When I first read this passage in mid-January, it led me to suspect prosecutors in the Hunter Biden case were hiding real problems with the provenance of their digital data.
In August 2019, IRS and FBI investigators obtained a search warrant for tax violations for the defendant’s Apple iCloud account. 2 In response to that warrant, in September 2019, Apple produced backups of data from various of the defendant’s electronic devices that he had backed up to his iCloud account. 3 Investigators also later came into possession of the defendant’s Apple MacBook Pro, which he had left at a computer store. A search warrant was also obtained for his laptop and the results of the search were largely duplicative of information investigators had already obtained from Apple. 4 Law enforcement also later obtained a search warrant to search the defendant’s electronic evidence for evidence of federal firearms violations and to seize such data. 5
2 District of Delaware Case No. 19-234M and a follow up search warrant, District of Delaware Case Number 20-165M.
3 The electronic evidence referenced in this section was produced to the defendant in discovery in advance of the deadline to file motions.
4 District of Delaware Case No. 19-309M.
5 District of Delaware Case No. 23-507M.
Not so Ken Dilanian.
He read the same passage over five weeks and abundant new disclosures later, and claimed that rather than raise questions, it instead amounted to confirmation that prosecutors had authenticated material from the laptop.
Material from the laptop became evidence in the criminal investigation of Hunter Biden, which ultimately resulted in a pair of indictments accusing him of tax and gun crimes. He has pleaded not guilty. A recent court filing by the lead prosecutor in the case, special counsel David Weiss, says investigators authenticated the laptop material — and the fact that a computer had been left in a store.
He also claimed that this laptop evidence could have resulted in a gun indictment, when — as I confirmed as I was trying to chase down my suspicions — prosecutors didn’t get a warrant to search the laptop for gun crimes until after the gun indictment. If they used the laptop to get that gun crime indictment, they probably conducted an unlawful search.
Because people are quoting Dilanian’s claims as if they accurately report what we know about the laptop, I’d like to trace all the reasons why Dilanian should never have made either claim.
Let’s start with the reasons that passage raised suspicions in the first place.
I was suspicious partly because of the way Derek Hines used a showy claim about cocaine residue to distract from the issue he was litigating — whether prosecutors only decided to charge gun crimes in response to GOP pressure. Worse still, Hines hid the most important detail about that cocaine residue discovery, the date a lab tested for it, which would reveal whether that showy claim instead hurt his argument. In NBC’s case, three reporters suggested the late discovery of cocaine residue showed that prosecutors had obtained new evidence that led to indictment (though to NBC’s credit, they at least didn’t make the coke-in-gun their headline). Subsequent filings have revealed that the lab test was October 2023, after the indictment, and so proof instead that prosecutors didn’t seek evidence until after they charged. The showy residue claim actually supports Hunter’s side of this argument, not Weiss’: it suggests prosecutors never took basic investigative steps to support gun charges until Jim Jordan demanded it.
I was also suspicious because Hines had engaged in so much obvious prevarication in the same filing. He played with the timeline to suggest that evidence available two years before the indictment — Hunter’s book — was newly obtained. He selectively cited documentation about what led up to the plea deal: ignoring proof that David Weiss was personally involved, on June 6, in crafting language that protected against further charges; offering no contest to Chris Clark’s claim that on June 19, Weiss’ First AUSA assured Clark there was no ongoing investigation. Hines lumped Hunter’s lie on a gun form in with far more serious straw purchases in order to claim there were aggravating circumstances that merited charging (a detail that still doesn’t address why Weiss reneged on the plea deal). Hines outright lied about how much David Weiss had ratcheted up the potential sentence with the new charges.
No one should have uncritically accepted the language in this passage, because so much of the filing was obviously deceptive.
I was suspicious, too, because Hines’ claim that evidence obtained from the laptop was “largely duplicative” admits that it was not entirely duplicative. His choice of language made it clear there were things on the laptop that were not in the iCloud.
And he did so in a paragraph that tried to obscure how the provenance of the laptop affects the provenance of his other evidence. Notably, the structure of the passage misrepresented the temporal progression — a temporal progression that anyone who had covered Gary Shapley’s testimony should know. The body of the paragraph suggested that investigators got a warrant for Apple and only then accessed the laptop. The body of the paragraph provided no hint about when prosecutors obtained a warrant to search already obtained materials for gun crimes. The footnotes tell a different story. Hines hid in footnote 2 a follow-up warrant for backups of individual devices with a docket number, dating to 2020, showing that that follow-up warrant post-dated FBI’s receipt of the laptop (again, which was already clear from Gary Shapley’s testimony), and therefore may be poisoned fruit of the laptop. More shockingly, Hines hid the 2023 date of the gun crimes warrant in footnote 5. Those footnotes are what led me to ask more questions and ultimately to liberate the warrants in question.
When Dilanian quoted that passage as if it were reliable, he omitted the existence of those footnotes, as well as the reference to the belated warrant for gun crimes that explained why the laptop couldn’t have “resulted” in the gun indictment without a likely Fourth Amendment violation.
“In August 2019, IRS and FBI investigators obtained a search warrant for tax violations for the defendant [Hunter Biden]’s Apple iCloud account,” [omitted footnote 2] the filing said. “In response to that warrant, in September 2019, Apple produced backups of data from various of the defendant’s electronic devices that he had backed up to his iCloud account. [omitted footnote 3] Investigators also later came into possession of the defendant’s Apple MacBook Pro, which he had left at a computer store. A search warrant was also obtained for his laptop and the results of the search were largely duplicative of information investigators had already obtained from Apple.” [omitted footnote 4 and admission they did not originally get a warrant for gun crimes]
Even in January, that response filing should have led reporters to note that David Weiss didn’t even seek basic evidence needed to prove the gun case until after he charged it.
But much has happened since to raise further questions about the laptop, including:
- January 17: I write Weiss’ spox asking, “Can you correct me on the date of that warrant, please?” because I thought there was no way it was really December 2023. He declined to further comment, which made me suspect maybe it was really December 2023.
- January 22: I asked Judge Noreika to unseal the dockets. She did!
- January 30: Those dockets confirmed Weiss did not seek a warrant to search Hunter’s Apple data for evidence of gun crimes until 81 days after the indictment; the warrant return also discloses that the FBI was still searching Hunter’s Apple data on January 16 when Hines first publicly disclosed it and claimed that the laptop was largely duplicative of what was in the iCloud.
- January 30: Abbe Lowell announced he plans to file a motion to suppress.
- January 30: Prosecutors had not provided material from the laptop with Bates stamp or in e-discovery format; they also had not provided expert reports on the laptop known (from Shapley’s testimony, among other places) to exist.
- February 13: Almost 40 months after acknowledging that the FBI had never validated the laptop to check when files were added to it, they admitted that they still have no index of the laptop. They also claim they were seizing information relating to gun crimes under the plain view doctrine for four years.
- February 13: The FBI understands the laptop so poorly that they presented a picture of sawdust from Keith Ablow that probably should have been treated as privileged and claimed it was a picture Hunter took of his own cocaine. (There’s likely another picture that Hines misattributed, too.)
- February 20: The same day Hunter rejected Weiss’ demand for quick guilty pleas to felony charges, August 29, prosecutors told Abbe Lowell — still three months before they obtained a gun crime warrant for either Hunter’s iCloud or the laptop — they had “independent sources” for anything on the laptop.
- February 20: By describing that key texts sent between Hallie and Hunter Biden in October 2018 were not found in the iCloud content, prosecutors were actually describing that they did not have “independent sources” for their most probative evidence (or of the picture of a picture of a table saw and sawdust they want to claim is cocaine).
Let me make this easy for NBC, because they seem to misunderstand this.
Over 1,500 days after receiving the laptop, the FBI has not done the things it would need to do to validate the laptop. They don’t have an index of what they have and they don’t know how all the embedded back-ups relate to one another. Without that, they cannot make representations that the laptop was not tampered with. Indeed, they’re making laughably false claims about what they have found uniquely on the laptop, a testament that they don’t have the most basic understanding about the laptop.
Additionally, Hines’ description of the source for the texts between Hallie and Hunter Biden makes it highly likely they came from a device backup that was protected by a password when the FBI got the laptop. Accessing that content without a follow-up warrant — which they did before they got the 2020 warrants that may rely on it — may be a Fourth Amendment violation under Riley. And particularly given that Hunter had just lost two phones in the days before such texts would have been sent, it raises real questions about both their provenance and the compilation of the laptop itself.
Since Derek Hines made dubious claims on January 16 that the laptop was “largely duplicative” of material found in Hunter Biden’s iCloud, we’ve since learned one reason he was so squirrelly when he made that claim: his most important evidence for the gun crime doesn’t appear to be duplicated in Hunter’s iCloud. And unless the FBI conducted an unlawful search of Hunter’s digital evidence — or unless they indicted based on what they had seen in Murdoch publications — they did not learn that until months after they charged the President’s son. And they didn’t learn that because four years after obtaining the laptop, the FBI has still never taken basic steps to understand what is on it.
After I reviewed the passage Dilanian quoted, I realized that it is even more misleading than I had previously understood. The full passage is below, with annotations.
In August 2019, IRS and FBI investigators obtained a search warrant for tax violations for the defendant’s Apple iCloud account. 2 In response to that warrant, in September 2019, Apple produced backups of data from various of the defendant’s electronic devices that he had backed up to his iCloud account. [this obscures what happened: Apple sent the full content of Hunter’s iCloud account, including the backups, but DOJ obtained new warrants — possibly relying on the laptop — to obtain those backups in 2020] 3 Investigators also later came into possession [this “came into possession” will look comical after we see a motion to suppress, not least because by the time FBI obtained it, they had already told John Paul Mac Isaac’s father he may have had it illegally] of the defendant’s Apple MacBook Pro, which he had left at a computer store. [as I’ve shown, the only proof that Hunter left the laptop would be easily faked by anyone in possession of the laptop — and when they checked Hunter’s iCloud data, they should have realized there were too many devices associated with it for all to be legitimately his] A search warrant was also obtained for his laptop and the results of the search were largely [as subsequent filings made clear, Weiss’ most important evidence was not duplicated in Hunter’s iCloud] duplicative of information investigators had already obtained from Apple. 4 Law enforcement also later [by “later,” Hines means, they didn’t get a warrant until 81 days after indicting and were still searching the digital data] obtained a search warrant to search the defendant’s electronic evidence for evidence of federal firearms violations and to seize such data. 5
2 District of Delaware Case No. 19-234M [August 29, 2019: Original iCloud warrant; warrant return] and a follow up search warrant, District of Delaware Case Number 20-165M. [July 10, 2020 iCloud warrant; warrant return]
3 The electronic evidence referenced in this section was produced to the defendant in discovery in advance of the deadline to file motions.
4 District of Delaware Case No. 19-309M. [December 13, 2019: Original laptop warrant; warrant return]
5 District of Delaware Case No. 23-507M. [December 4, 2023: post-indictment warrant; warrant. return (less attachments) attachments AB]
The searches revealed incriminating evidence, including evidence of the defendant’s addiction to controlled substances and his possession of the firearm, such as:
– Prior to October 12, 2018 (the date of the gun purchase), the defendant took photos of crack cocaine and drug paraphernalia on his phone. [as proof of this, Hines presented a single photo of someone weighing cocaine without proof Hunter took it (though he probably did)]
– Also prior to his gun purchase, the defendant routinely sent messages about purchasing drugs. [as shown in the table below, Hines provides three examples, one of which was conducted on an “unknown” phone, the most recent of which was in July 2018]
– On October 13, 2018, and October 14, 2018 (the day after and two days after he purchased the firearm), the defendant messaged his girlfriend about meeting a drug dealer and smoking crack. For example, on October 13, 2018, the defendant messaged her and stated, “. . . I’m now off MD Av behind blue rocks stadium waiting for a dealer named Mookie.” The next day, the defendant messaged her and stated, “I was sleeping on a car smoking crack on 4th street and Rodney.” [this is from content that Hines seems to concede only exists on the laptop and was sent during a period when Hunter was still replacing lost phones]
– On October 23, 2018 (the day his then-girlfriend discarded his firearm), the defendant messaged his girlfriend and asked, “Did you take that from me [girlfriend]?” Later that evening, after his interactions with law enforcement, he messaged her about the “[t]he fucking FBI” and asked her, “so what’s my fault here [girlfriend] that you speak of. Owning a gun that’s in a locked car hidden on another property? You say I invade your privacy. What more can I do than come back to you to try again. And you do this???? Who in their right mind would trust you would help me get sober.” In response, the girlfriend stated “I’m sorry, I just want you safe. That was not safe. And it was open unlocked and windows down and the kids search your car. You have lost your mind hunter. I’m sorry I handled it poorly today but you are in huge denial about yourself and about that reality that I just want you safe. You run away like a child and blame me for your shit . . .” [this is still content that may only be available on the laptop and therefore unreliable or inadmissible]
– After the firearm was taken from him and recovered by police, the defendant continued to send messages to various people about his use of drugs, including telling his girlfriend that he is an “addict” on November 8, 2018, and on November 21, 2018, telling Person 1, “. . . I’m a fucking better man than any man you know whether I’m smoking crack or not.” He also continued to send messages about purchasing drugs. He sent a message to his girlfriend on November 29, 2018, stating, in relevant part, “I DONT BLAME MY ADDICTION ON YOU . . .” and another message to Person 2 on December 18, 2018, acknowledging that he is “an addict.” On December 28, 2018, hemessaged Person 2 stating, “I’ll fuxking [sic] get sober when I want to get fucking sober.” [this content does exist in Hunter’s iCloud, but several things make it suspect: he was texting on at least one other device at the time — though that’s a device that appears to only be available on the laptop — and (as I describe here) this particular device may be one that has suspect provenance going back to 2016]
– During November and December 2018, the defendant took multiple photographs of videos apparent cocaine, crack cocaine, and drug paraphernalia. [Hines presented three photos to back this claim: a timer in a picture of a presumed sex worker, a picture Keith Ablow took of a picture of sawdust, and a picture that may have come from Hallie — to the extent that it represented drug use — could not be tied to Hunter as opposed to Hallie and was very dated in any case] These episodes of persistent drug usage, documented by the defendant, in the immediate time frame before, during, and after his possession of the gun were evidence that he lied during the background check and unlawfully possessed the gun in October 2018.
