James Comer’s Imaginary Whistleblower Friend, Gal Luft, Was Charged Last November for Lying in that March 2019 Meeting

/41 Comments/in , /by

I wrote last week that James Comer and Jim Jordan and Jason Smith have been immunizing misconduct and crime in an effort to gin up a conspiracy theory against Joe Biden and his family.

Last night, that effort was demonstrated in spectacular fashion. For months, Comer has been squealing about a secret informant he had who had proof that Joe Biden engaged in graft with CEFC. But then his imaginary whistleblower friend disappeared.

In recent weeks, Comer’s imaginary whistleblower friend was identified as Gal Luft. He disappeared because he skipped bail in Cyprus on an arrest warrant from the US.

Here’s how NYPost’s Hunter propagandist described it:

Gal Luft, the “missing” witness in the House Oversight Committee’s Biden family corruption investigation, has told The Post he is alive and living as a fugitive in an undisclosed location.

The former Israeli Defense Force colonel vanished from Cyprus last month while on bail awaiting extradition to the US on seven charges.

He denies the allegations, which include five charges relating to the Arms Export Control Act of conspiring to sell Chinese products to the United Arab Emirates, Kenya and Libya, as well as a violation of the Foreign Agents Registration Act, and of making a false statement.

Luft claims he was forced to skip bail because he is the victim of a political persecution by the US to protect Joe Biden and his son Hunter, and brother Jim.

A few days ago, Luft did a video, naming the prosecutors he met with at that meeting and daring DOJ to unseal his indictment. So they did. The November 1, 2022 indictment, by the same two prosecutors, charges Luft with a range of sanctions violations and serving as a Foreign Agent of China. The FARA violation alleges he insinuated someone who looks a lot like James Woolsey into the Trump Administration on the payroll of CEFC.

The date is important: He was charged before he started regaling dim-witted Chairmen about dirt on Hunter Biden. This prosecution can’t be about retaliation for the conspiracy theories he told Comer — the indictment precedes it all by months.

In any case, the indictment also lays out the false charges count against him.

He was charged with lying at that March 2019 meeting about his own ties to CEFC.

84. On or about March 29, 2019, in the Southern District of New York, Belgium, and elsewhere outside of the jurisdiction of any particular State or district of the United States, GAL LUFT, defendant, who is expected to be first brought to and arrested in the Southern District of New York, in a matter within the jurisdiction of the executive branch the Government of the United States, knowingly and willfully made a materially false, fictitious, and fraudulent statement and representation, to wit, LUFT falsely stated during an interview at the United States Embassy in Brussels, Belgium with federal law enforcement officers and prosecutors, in connection with an investigation being conducted in the Southern District of New York, that LUFT had tried to prevent CEFC China from doing an oil deal with Iran, that LUFT had been excluded from CEFC China meetings with Iranians, and that LUFT did not know of any CEFC China dealings with Iran while he was affiliated with the company–when in fact, including as described above in paragraphs Sixty-Six through Eighty, LUFT personally attended at least one meeting between CEFC China and Iranians and assisted in setting up additional such meetings for the purpose of arranging deals for Iranian oil, and also worked to find a buyer of Iranian oil while concealing its origin.

In other words, well before Luft told Comer anything, he had been charged for lying at the very meeting he’s now claiming he was retaliated for. Comer was duped.

Again.

Given the precedent of Eric Swalwell, who was removed from the House Intelligence Committee after having been cultivated by a Chinese agent, Comer should be stripped of his gavel and referred to the ethics committee.

Instead, Speaker McCarthy is going to let him continue to make a mockery of himself offering to immunize all range of grifters in hopes of finding dirt.

Nine Months of Surveillance Video: Trump’s Newfound Worries His Discovery Will Leak

/115 Comments/in , /by

As I alluded to here, hidden in Trump’s bid to push his trial out past the November 2024 election is a confession that the discovery he has gotten in the case is really damning — more damning than the documents seized last August.

In his filing, his attorneys say that the discovery is so sensitive, it is impossible to use contractors to help review the discovery.

[U]nlike most cases, all the discovery materials are sensitive and high-profile, the Defendants are unable to utilize contract or other third-party reviewers to the extent such resources would normally be available.

It’s hard to explain what a stunning claim this is, particularly given that Trump was perfectly happy to trust just such a third-party service in his Special Master bid before Judge Aileen Cannon last year, as evidenced by a series of filings last September and October.

Consistent with Judge Cannon’s order (ECF 125, at 3), the parties entered contracts with thirdparty vendors to scan, process, host, and provide a review platform for the Seized Materials.

Even though a key argument in Trump’s bid for that Special Master pertained to leaks, he nevertheless let a third party handle every unclassified document seized from Mar-a-Lago in August.

1 The Government is apparently not concerned with unauthorized leaks regarding the contents of the purported “classified records,” see, e.g., Devlin Barrett and Carol D. Leonnig, Material on foreign nation’s nuclear capabilities seized at Trump’s Mara-Lago, WASH. POST (Sept. 6, 2022), https://www.washingtonpost.com/nationalsecurity/2022/09/06/trump-nuclear-documents/, and would presumably be prepared to share all such records publicly in any future jury trial. However, the Government advances the untenable position in its Motion that the secure review by a Court appointed and supervised special master under controlled access conditions is somehow problematic and poses a risk to national security.

That’s not surprising: such vendors are involved in every legal case involving voluminous digital discovery. And their business model is so wrapped up in signing and upholding protective orders, they don’t leak.

Yet Trump’s lawyers imply they might here.

With that in mind, I want to look at what Trump says he has seen in discovery so far.

The Government anticipates producing discovery in stages due to the sheer volume of documents collected and because of procedural mechanisms necessary to protect against the unlawful production of classified information. The Government produced its “first production of unclassified discovery” on June 21, 2023. 1 That initial production was substantial and voluminous. Therein, the Government produced more than 428,300 records (in excess of 833,450 pages) consisting of approximately 122,650 emails (including attachments) and 305,670 documents gathered from over ninety (90) separate custodians. The initial production also included some 57 terabytes of compressed raw CCTV footage (so far there is approximately nine months of CCTV footage, but the final number is not yet certain).

In addition, “there will be additional productions of discovery” provided by the Government, as it continues to process “some devices and search warrant returns.” Notably, the Government has not produced all interview-related materials, including certain witness statements and associated memorialization of those statements. [my emphasis]

Some of this doesn’t look that burdensome, or surprising. Trump mentioned 90 separate custodians. Well, DOJ has a list of 84 witnesses with whom it doesn’t want Nauta and Trump to speak, so this is partly saying that witnesses who testified were asked for discovery. The likely additional custodians are going to be entities like Trump’s own corporation, NARA, and the Secret Service.

Some of those records will include texts. The list of Bates stamps released last year shows 21,792 pages of unclassified documents seized last August that Trump’s lawyers already got to review in detail. The government may be obliged to turn over copies of some or all of the 15 boxes returned in January 2021, too, since Trump’s sort through them is part of the indictment.

It’s a lot. But it wouldn’t be a lot if Trump were using a discovery vendor.

What I find more interesting are the “devices and search warrant returns” that Jack Smith’s team is still processing. There are phones or computers that the government has not yet finished searching. And there are witness statements that — whether for ongoing investigative reasons or other sensitivities — DOJ has yet to turn over. That’s interesting!

Then there are the nine months of surveillance footage. As I noted in this post, in response to the original June subpoena for five months of surveillance footage, Trump turned over just two months. It’d be easy to see how DOJ came to request surveillance footage through December of last year (because documents kept moving around), and it’s unclear whether this includes footage from Bedminster in addition to Mar-a-Lago.

Still, all that footage came from Trump’s own properties! He’s just getting what he already owns back.

DOJ obtained far, far more surveillance footage after that original batch focused just on a basement hallway. And it’ll show the much more mundane stuff of Trump’s corrupt flunkies wandering around his properties — and possibly who knows what foreign parties nosing through boxes in the gaudy bathroom to see what kind of documents Trump brought home. DOJ will undoubtedly point Trump to what they consider the highlights. But I can understand why Trump wouldn’t want that video in the hands of anyone he couldn’t trust implicitly, often for reasons entirely unrelated to the case at hand.

All that said, DOJ has had this information for months and months.

And contrary to what leaks to that favorite right wing outlet Devlin Barrett would have you believe, it hasn’t leaked. Trump says a vendor whose entire business model depends on keeping secrets can’t be entrusted with these secrets. But the FBI has been sitting on some of them for almost a year and they haven’t leaked.

Trump’s lawyers may just be bullshitting here because it is the surest route to get this case declared a complex matter, entitling them to expanded pretrial delays. But the claims about the sensitivity of the discovery they’re making to support that argument are fairly astonishing.

When “Lock Her Up!” becomes “Wait Till Later!”

/72 Comments/in , , /by

Last month, I did a post noting the legal significance of two paragraphs in Trump’s indictment, one quoting Trump’s promises to protect classified information during the 2016 election, and another quoting Trump’s rationale for (pretending to) strip John Brennan of clearance for using classified information for his own gain.

Here’s the paragraph quoting just some of the times Trump used a promise to protect classified information to beat Hillary Clinton.

22. As a candidate for President of the United States, TRUMP made the following public statements, among others, about classified information:

a. On August 18, 2016, TRUMP stated, “In my administration I’m going to enforce all laws concerning the protection of classified information. No one will be above the law.”

b. On September 6, 2016, TRUMP stated, “We also need to fight this battle by collecting intelligence and then protecting, protecting our classified secrets. . . . We can’t have someone in the Oval Office who doesn’t understand the meaning of the word confidential or classified.”

c. On September 7, 2016, TRUMP stated, “[O]ne of the first things we must do is to enforce all classification rules and to enforce all laws relating to the handling of classified information.”

d. On September 19, 2016, TRUMP stated, “We also need the best protection of classified information.”

e. On November 3, 2016, TRUMP stated, “Service members here in North Carolina have risked their lives to acquire classified intelligence to protect our country.”

The two paragraphs played a certain role in proving that Trump understands the import of classified information. But they also, I argued, bundled a public integrity component up inside this Espionage Act trial.

That is, they laid out how Trump himself has argued that voters need to know whether you’re going to mishandle classified information before they cast their votes.

Those paragraphs may come in handy as DOJ attempts to respond to Trump’s opposition to the government’s proposed schedule for trial. Because he is now arguing that he’s too busy running for President to take time out to be tried for stealing classified records.

Note that Trump misrepresents what his filing attempts to do (and few journalists are calling him on it). The filing is titled, “Response in Opposition to the Government’s Motion for Continuance and Proposed Revised Scheduling Order” — that is, it claims to be responding only to the government’s pitch for a December trial. But the first paragraph admits that it is also asking Cannon to entirely withdraw her own orders setting trial in August.

The Defendants, President Donald J. Trump and Waltine Nauta, in the above captioned matter, respectfully request that this Court deny the Government’s proposed scheduling order, withdraw the current Order (ECF No. 28), and postpone initial consideration of any rescheduled trial date until after substantive motions have been presented and adjudicated. [my emphasis]

As we all hold our breath to see how Cannon will respond to this request, understand that Trump has pitched this (smartly, probably), as him against the government, but there’s a tiny chance Cannon will be miffed Trump is downplaying her own authority both here and (as I note below) on picking a jury.

There are many reasonable parts of this filing:

  • Trump argues this case should get complex case designation, leaving a longer time for pretrial proceedings (though he falsely claims the government is asking for an “expedited” trial)
  • Trump states that CIPA is going to take some time
  • Trump claims that this trial will present a number of matters of first impression — or at least matters of first impression for this Circuit (for example, Trump and Paul Manafort, have already lost on Special Counsel authority in DC, but not in the Eleventh Circuit)
  • Trump unsurprisingly calls all the classified designations as “purported,” which reserves the issue for trial
  • Trump describes that jury selection will be onerous (this is one issue on which Cannon has already issued a ruling)
  • While Trump is bullshitting that he’s being tried by his opponent, it is true that there should be as little secret evidence in this case as possible

Much of it is typical defense attorney argument about the need to adequately review the evidence before figuring out where to go next — though this filing pitches what is actually fairly modest discovery, if you ignore the CCTV footage, as a great burden.

The Government anticipates producing discovery in stages due to the sheer volume of documents collected and because of procedural mechanisms necessary to protect against the unlawful production of classified information. The Government produced its “first production of unclassified discovery” on June 21, 2023. 1 That initial production was substantial and voluminous. Therein, the Government produced more than 428,300 records (in excess of 833,450 pages) consisting of approximately 122,650 emails (including attachments) and 305,670 documents gathered from over ninety (90) separate custodians. The initial production also included some 57 terabytes of compressed raw CCTV footage (so far there is approximately nine months of CCTV footage, but the final number is not yet certain).

There’s a hilarious line where the same guy who consented to a discovery vendor to turn some of this very same evidence for a Special Master review before this very same judge less than a year ago now says the use of such vendors will be impossible given the “sensitive and high profile” nature of the case.

Since, unlike most cases, all the discovery materials are sensitive and high-profile, the Defendants are unable to utilize contract or other third-party reviewers to the extent such resources would normally be available.

And Trump pitches a one year investigation as a totally long time — without mentioning that he, with Judge Cannon’s help, caused three months of that duration by demanding a stay in the investigation, to say nothing of his months of obstruction before that.

The Government’s investigation into the matters at issue in the indictment has been ongoing for over a year.

There’s a funny progression where Trump first says his day job running for President doesn’t leave him time to be prosecuted for stealing documents the last time he was President, then admits that he has found time in his busy schedule for two other trials.

President Trump is running for President of the United States and is currently the likely Republican Party nominee. This undertaking requires a tremendous amount of time and energy, and that effort will continue until the election on November 5, 2024. Mr. Nauta’s job requires him to accompany President Trump during most campaign trips around the country. This schedule makes trial preparation with both of the Defendants challenging. Such preparation requires significant planning and time, making the current schedule untenable and counseling in favor of a continuance

[snip]

Finally, previously scheduled trials in other matters for both President Trump and defense counsel make it nearly impossible to prepare for this trial by December 2023. For example, President Trump and Mr. Blanche are preparing for a March 2024 criminal trial in New York Supreme Court; Mr. Kise and President Trump are preparing for a lengthy civil trial in New York Supreme Court commencing October 2, 2023;

[snip]

The pendency of these other proceedings and their collective impact on the ability of defense counsel to prepare effectively for trial also support granting a continuance pursuant to 18 U.S.C. § 3161(h)(7)(B)(ii) & (iv).

But, given that he got elected the last time by promising he would be more careful with classified information than his opponent, the most remarkable paragraph in the filing is this one, where Trump says there is no exigency to scheduling this trial (as opposed to his hush money or corporate fraud trials) before the election.

While the Government appears to favor an expedited (and therefore cursory) approach to this case, it cannot point to any exigency or urgency requiring a rapid adjudication. There is no ongoing threat to national security interests nor any concern regarding continued criminal activity

I suspect the paragraph is designed to elicit a response to the question, “is there any concern regarding continued criminal activity?” That is, I think it is an attempt to probe for what more the government continues to investigate.

And yes, the government may well respond to this by answering, “funny you should mention ongoing threats to national security because we’re still looking for all the things that disappeared up at Bedminster.”

But the underlying premise is even more remarkable, given how Trump’s got elected the last time.

Trump says that there is no exigency in telling the citizens and voters of the United States whether the last time he was President, all the promises he made to get elected were just bullshit, because in fact he used his position of power to steal the nation’s secrets and store them in his chandeliered bathroom.

There is a lot that is reasonable in this filing.

But at its core, it argues that a guy accused of using the access to the nation’s secrets he got by getting elected President on false promises the last time, should get a shot at accessing those secrets again, without first letting a jury decide whether he had abused his position of power the last time.

Trump promised voters in 2016 that he would protect classified secrets; it’s actually a key part of how he got elected. Now he says voters shouldn’t have a chance to find out whether he broke that promise before going to the polls again.

Update: This post originally suggested current Trump lawyer Todd Blanche was on Paul Manafort’s team when he tried to challenge Robert Mueller’s Special Counsel authority. That’s not the venue in which Blanche represented Manafort.

Update: Judge Cannon has reset the CIPA conference for Tuesday afternoon, as all parties had agreed would work.

Stanley Woodward Tests Judge Aileen Cannon’s Patience

/60 Comments/in , /by

Just days into Pro Hac Vice admittance before Judge Aileen Cannon, Walt Nauta’s lawyer, Stanley Woodward, is testing (as in, probing) her patience, to see how much she will play along with obvious attempts to stall this case.

He and the government have submitted dueling filings about whether the CIPA conference scheduled for Friday should be postponed to some uncertain time.

Before I get into what they say, remember that Woodward is being paid by Trump’s PAC, which is also under investigation for raising money promising one thing and then spending it on other things — such as paying for Woodward’s legal fees.

Remember, too, that after months of claiming that DOJ had screwed up by not immunizing Walt Nauta — a strategy that got his client charged in an Espionage Act indictment (in some legal circles, a sign of a legal strategy that has backfired, potentially catastrophically), Woodward then adopted a new strategy: belatedly accusing Jay Bratt of bullying him because Bratt tried to prevent him from setting his client up to be charged.

Finally, consider that we’ve already seen stories suggesting that Trump plans to stall this out past November 4, 2024, so he can pardon both of them.

The pace of hiring an attorney for Nauta has been slow — as has been the speed with which Trump is beefing up his own criminal defense team. Nauta continues to work for Trump’s organization and Trump’s political committee is financing his employee’s legal representation. Inside the former president’s orbit, top aides are prepping for a protracted and litigious fight with prosecutors that draws out the entire legal process through the 2024 general election that Trump hopes to win for a return to the White House.

“If you ask three different people in Trump world what’s going on, you’ll get five different answers,” said the source familiar with discussions. “But the reality is there’s no rush to do this. This seems to be their posture: ‘The case is probably going to happen after the election anyway [on Nov. 5, 2024]. So what’s the rush?’”

And before I present Woodward’s seven (!!!) excuses for not being able to make Friday’s hearing, consider that according to the government, Woodward hasn’t even submitted his SF-86 form required before he can get clearance.

Nauta’s second justification for a continuance is a claim that Mr. Woodward cannot “meaningfully” participate in a discussion about classified discovery or a CIPA discovery schedule at a Section 2 conference until obtaining a security clearance. Motion at 3. But he cites no case holding that a Section 2 conference is contingent on counsel having clearances, which is unsurprising since such a requirement would be inconsistent with Section 2’s language that “[a]t any time after the filing of the indictment or information, any party may move for a pretrial conference to consider matters relating to classified information that may arise in connection with the prosecution.” 18 U.S.C. App.3 § 2. Perhaps more to the point, as of this writing, Mr. Woodward has yet to complete his Form SF-86, which is necessary for him to receive both an interim clearance and final adjudication, despite having been put in contact with the Litigation Security Group on June 12, some three-and-a-half weeks ago.

With all that laid out, ready for Woodward’s seven complaints?

1) First, that DOJ charged his client in Trump country rather than in DC.

With little notice to Defendant Nauta, the operative indictment in this matter was returned in this District and only recently, on Wednesday, July 5, 2023, did Defendant Nauta retain local counsel, Sasha Dadan.

2) Then, that he opposed having a CIPA conference at all (a claim the government says is not true).

Although government counsel asked whether Mr. Nauta’s longtime counsel opposed such a hearing – we did – and provided an electronic courtesy copy of the same, the government did not request any dates when defense counsel would be unavailable for such a conference.

3) Then, that Nauta had delayed so long in hiring a Florida lawyer that poor Stan Woodward had no way to object on his own.

At that time, Mr. Nauta, through counsel was not receiving electronic notices through the Court’s CM/ECF filing system, the government did not advise counsel that the pretrial CIPA conference had been scheduled, and even when counsel did learn of the conference, Mr. Nauta had no ability to formally move the Court for relief based upon his counsel’s unavailability. Rather, it was not until Wednesday, July 5, 2023, that Mr. Nauta retained local counsel, Sasha Dadan, and Thursday, July 6, 2023, that Chief Magistrate Judge Torres entered an Order permitting Mr. Nauta, through counsel to file electronically with the Court.

4) Then, that Woodward has a trial for Freddie Klein this week (the government says it — this prosecution team — did not know that — it seems that Woodward is relying on prosecutors on a 1,000 defendant crime scene investigation to track Woodward’s other clients).

As the government has long been aware, Mr. Nauta’s longtime counsel, Mr. Woodward, is scheduled to begin a Bench Trial in the United States District Court for the District of Columbia on July 10, 2023.

5) Woodward then says that even though he’s not required to attend, Nauta should be able to demand that he attend.

Presumably, the government will argue that Mr. Woodward’s appearance is unnecessary. But see Flanagan v. United States, 465 U.S. 259, 268 (1984) (like the Sixth Amendment right to self-representation, the right to counsel of choice, “reflects constitutional protection of the defendant’s free choice independent of concern for the objective fairness of the proceeding”). And defense counsel is aware of the Court’s admonishment that, “[l]ocal counsel must be ready to adequately represent [Mr. Nauta] at any time.” Paperless Order (July 7, 2023).2 However, as the government notes in its application for the hearing, a pretrial CIPA conference permits the Court to, “consider matters related to classified information that may arise in connection with the prosecution.” Motion at 6 (June 23, 2023) (ECF No. 32) (quoting 18 U.S.C. App. III § 2).

6) Woodward doesn’t see the point of using CIPA in a case charging 31 of the most sensitive documents ever charged in an Espionage Act case.

To that end, the government only broadly describes the basis for its request for a pretrial CIPA conference: “to establish a discovery and motion schedule relating to any classified information.” Motion at 19 (June 23, 2023) (ECF No. 32). Yet, defense counsel cannot meaningfully opine on, “a discovery and motion schedule relating to any classified information,” before their provisional security clearances, let alone complete clearances, have been approved.

7) Even though his brand spanking new co-counsel (who mostly does family law kinds of things but also dog bites) is obligated under local rules to hit the ground running, she’s not ready to hit the ground running.

Nor is it feasible to expect Mr. Nauta’s local counsel to appear at a pretrial CIPA conference and to agree upon, “a discovery and motion schedule relating to any classified information,” barely a week after she has been retained by Mr. Nauta.

2 Mr. Nauta respects the Order of the Court and submits that it was not unreasonable for him to retain local counsel and thereafter request this Court accommodate the unavailability of his longtime counsel, Mr. Woodward insofar as Defense counsel would note that Local Rule 4 of the Rules Governing the Admission, Practice, Peer Review, and Discipline of Attorneys for the United States District Court of the Southern District of Florida, which pertains to the admission of out-of-state attorneys pro hac vice does not indicate that the sponsoring attorney be required to, “be ready to adequately represent the defendant at any time.”

Tune in in January, when Presidential candidate Donald Trump says he needs to delay his trial because he has primaries to run in. It won’t be his fault that the lawyer his PAC is paying invented frivolous cause for day, after all.

As I said, Woodward is testing Judge Cannon’s patience. And why wouldn’t he? If she conducts herself like she did last summer, he’ll be able to buy Trump all the time in the world.

The Blind Squirrel’s Nut: Chuck Grassley Unwittingly Debunks Bill Barr

/67 Comments/in , /by

Last month, Bill Barr got Federalist Faceplant Margot Cleveland to claim that Jamie Raskin was lying when he said that the lead from an informant claiming that Joe Biden had been bribed was assessed by Pittsburgh US Attorney Scott Brady and then shut down.

It’s not true. It wasn’t closed down,” William Barr told The Federalist on Tuesday in response to Democrat Rep. Jamie Raskin’s claim that the former attorney general and his “handpicked prosecutor” had ended an investigation into a confidential human source’s allegation that Joe Biden had agreed to a $5 million bribe. “On the contrary,” Barr stressed, “it was sent to Delaware for further investigation.”

Then James Comer relied on that to claim that Raskin was wrong when he said that it was shut down as an assessment.

Bill Barr to Margot Cleveland to James Comer: At each new level, this Matryoshka doll of disinformation gets less and less credible.

So incredible, in fact, that even Chuck Grassley debunked them.

Unwittingly.

Like the proverbial blind squirrel finding a nut.

You see, Chuck is outraged that the IRS agents conducting the investigation into Hunter Biden’s alleged tax crimes were not included in a meeting at which Pittsburgh FBI agents briefed the Delaware US Attorney’s office about the informant report. He has written Delaware US Attorney David Weiss a letter demanding an explanation of why.

The answer is clear from the timing of the briefing, which Senator Grassley reveals in his letter: October 23, 2020.

Based on information provided to my office from individuals aware of the meeting, on October 23, 2020, Justice Department and FBI Special Agents from the Pittsburgh Field Office briefed Assistant U.S. Attorney Lesley Wolf, one of your top prosecutors, and FBI Special Agents from the Baltimore Field Office with respect to the contents of the FBI-generated FD1023 alleging a criminal bribery scheme involving then-Vice President Biden and Hunter Biden; however, the meeting did not include any IRS agents. In addition, based on information provided to my office, potentially hundreds of Justice Department and FBI officials have had access to the FD-1023 at issue, which begs the question that I’ve been asking since the start of my oversight in this matter: what steps have the Justice Department and FBI taken to investigate the allegations?

This briefing was nine days after a NYPost story would have made clear that Rudy Giuliani had ties to the “Hunter Biden” “laptop” that the IRS agents had been relying on for investigative materials for the better part of a year.

It was one day after an October 22, 2020 meeting that the IRS agents did attend. As Gary Shapley confessed to the House Ways and Means Committee, the meeting was largely an effort to make sure that the government had used proper legal process before acquiring two devices that — it had only recently became clear — had become and may always have been part of a political hit job.

A Yes. So there are a couple significant parts of this. One was that, at this time, the laptop was a very big story, so we were just making sure that everything was being handled appropriately.

So we wanted to go through the timeline of what happened with the laptop and devices. I thought one of the most important first parts was that on November 6 of 2019, the FBI case agent, Josh Wilson, called up the computer shop owner, John Paul, and basically got the device numbers from him.

If Shapley’s notes are at all reliable, prosecutors at the meeting instead discovered that the FBI broke the most basic rules of forensics when exploiting the laptop purportedly owned by the former Vice President’s dissolute son, and in the process may have destroyed evidence about who was really behind it. I’m still not convinced his notes are reliable, but if they are, then the meeting should have raised all sorts of alarms within DOJ.

As I laid out here, Shapley has instead pitched the meeting as one that served the primary purpose of giving Whistleblower X opportunity to complain that the US Attorney’s office had prevented the IRS agents from being tainted by dodgy materials on the laptop. Whistleblower X did complain, mind you, but those complaints mostly raise questions about the extent to which he had already been accessing materials from the laptop that Rudy Giuliani had been tampering with, thereby tainting the investigation.

Shapley’s propaganda has worked, because that’s what our blind squirrel from Iowa focuses his letter on.

But as Shapley described in his prepared statement, even before that meeting he had written to AUSA Lesley Wolf complaining about how the laptop was being referred to in the news.

On October 19th, 2020, I emailed Assistant United States Attorney Wolf: “We
need to talk about the computer. It appears the FBI is making certain representations
about the device, and the only reason we know what is on the device is because of the
IRS CI affiant search warrant that allowed access to the documents. If Durham also
executed a search warrant on a device, we need to know so that my leadership is
informed. My management has to be looped into whatever the FBI is doing with the
laptop. It is IRS CI’s responsibility to know what is happening. Let me know when I can
be briefed on this issue.”

Shapley appears to have been concerned, in the weeks before the Presidential election, that people believed the laptop was being investigated by the FBI as an information operation targeting Joe Biden, when in his view, it remained the cornerstone of his investigation into Hunter Biden.

But if DOJ was not already investigating both topics by October 23, 2020 — both Hunter Biden’s tax crimes and a potential information operation targeting Joe Biden — if it has not spent years doing so, then the FBI has become even more captured than I already suspected.

Indeed, if the FBI hasn’t already significantly substantiated that Hunter Biden was hacked in early 2019, then I may renounce my citizenship. I know FBI’s cyber agents can be incompetent, but they can’t be that incompetent, can they?

Can they?

Chuck Grassley may not realize it because he is very old and he is staffed by a bunch of partisan cranks. But he’s basically complaining that DOJ might have learned their lesson after the Steele dossier — the lesson that Chuck Grassley spent years demanding they learn! — and decided, upon the revelation that a key piece of evidence they had been relying on for months had ties to a political hit job, they should figure out precisely what tie that key piece of evidence had to the political hit job.

Chuck Grassley may also not realize that the political cranks who staff him got him to sign a letter effectively complaining that the FBI thought it worthwhile to figure out if the information operation Russian spies had been bragging about for over a year at that point had actually succeeded. Chuck is bitching that the FBI decided to protect a presidential candidate.

Chuck Grassley also likely doesn’t realize his staffers got him to sign a letter bitching that David Weiss attempted to maintain the integrity of the tax investigation even while DOJ assessed whether they had been caught in another information operation. That’s why you don’t include the IRS agents in a meeting where Pittsburgh FBI agents explain to Delaware lawyers how sketchy was the information Rudy Giuliani was collecting from known Russian agents in Ukraine. If you include them, you risk blowing the otherwise meritorious tax investigation.

And Chuck Grassley definitely doesn’t realize that he has debunked Bill Barr.

You see, Bill Barr, who is a very adept liar, was sort of telling the truth to Faceplant Margot that the FD-1023 was referred to DE USAO for further investigation. It surely was. But Pittsburgh FBI agents shared it on October 23, 2020, because the US Attorney’s office was frantically trying to figure out whether the entire tax investigation had been blown, or only parts of it. The US Attorney’s office was undoubtedly trying to understand what kind of other garbage Rudy had produced that got shared with the FBI, in addition to any role he had with the “laptop” that had been used in the tax investigation.

Even Gary Shapley admitted that in the wake of the NYPost story, the Delaware US Attorney’s office did some quick CYA to figure out whether they had been using a tainted information operation for the better part of a year (they had!). The October 23 briefing would have had substantially the same purpose as the October 22 one: to figure out how tainted the investigation was.

And Bill Barr instead got even stupider people to believe that that an attempt to triage the damage done by Rudy’s political hit job amounts to an investigation for bribery.

Gary Shapley and Hunter Biden’s Colleague Named “Z”

/16 Comments/in , /by

There was a detail in Abbe Lowell’s letter to House Ways and Means Chair Jason Smith complaining about the way Smith platformed purported whistleblowers to launch an attack on Joe Biden that deserves more attention: Lowell claimed that Gary Shapley misrepresented the identity of the person with whom Hunter Biden had a WhatsApp exchange in 2017.

This is the WhatsApp exchange that Smith mocked up to look like texts themselves. The mocked up texts went wildly viral based on Smith’s unsubstantiated claim that Joe Biden was in the room with Hunter during his deal-making.

Lowell described that fake mock-up this way.

The agent only described one message, but you took that purported text and disseminated images of it on June 22 and June 24 in two Twitter postings.

The screen-grab images you posted are not real and contain myriad of issues: both include a photo of Mr. Biden not from 2017 but from the White House Easter Eggroll in April 2022 (long after the purported message was sent); both images portray the message in a blue bubble, when WhatsApp messages are in green; one image super-imposed the Chinese flag for the contact ID, when surely that was not how a text or contact was kept; and one purports to be a screenshot with the “. . .” of someone composing a text (as in Apple’s iMessage) when that does not happen on WhatsApp.

I explained why Smith had to attempt to recreate WhatsApp messages in this post: Shapley himself shared summaries of the purported WhatsApp messages, rather than the WhatsApp messages themselves or the forensic report from Apple whence (Shapley claimed) the IRS obtained them.

Not only did Shapley admit to the Committee they were summaries, but Shapley isn’t even sure who did the summary.

Q Could you tell us about this document, what is it, and how was it obtained —

A Sure. So there was an electronic search warrant for iCloud backup, and these messages were in that backup and provided —

Q Okay.

A — from a third party, from iCloud.

Q Okay. Who was it provided to?

A The — the investigative team from —

Q Okay. A It would go through all the same processes of — since it’s electronic, it would go to one of the computer analysis folks, and then they would put it in a readable format, and then it would go through filter review.

Q Okay. And these aren’t WhatsApp messages, these are summaries of WhatsApp messages, correct?

A Yeah, that’s correct. Because it was something about the readability of the actual piece, right? It was easier to summarize in a spreadsheet.

Q Okay. And who did the summary? Who prepared this document?

A It was either the computer analysis guy or [redacted, probably Whistleblower X], one or the other [my emphasis]

Even on their face, they’re not reliable summaries. In this text, for example, someone interjects their opinion, “believed to be Zhao” right into the middle of a purported quotation, without marking that opinion as such.

Given that the summary presents at least this direct quote with additional information, we can’t be sure whether other quotes — particularly references to Zhao — are accurate.

Compare Shapley’s summaries with what reliable law enforcement summaries of WhatsApp chats saved to iCloud and obtained from Apple look like (this was an exhibit in the Vladimir Klyushin trial and would have been obtained in the same timeframe).

Not only does this directly quote all the messages, but it includes exact time and the accounts used, details that should drive any law enforcement investigation.

The summary matters, a lot. That’s because Lowell claims that Shapley — or whoever did these summaries — misidentified the Hunter Biden interlocutor whose last name begins with Z.

In one excerpt that has now gotten a great deal of media attention, Mr. Biden is alleged to have been sitting next to his father on July 30, 2017, when he allegedly sent a WhatsApp message, urging the completion of some business transaction. See Shapley Tr. at 14. The inference is that the referenced message was being sent to an official of CEFC (China Energy) to forward a false narrative about the Bidens’ involvement in that company. The facts, which some media has now reported, are that President Biden and our client were not together that day, the company being referenced was not CEFC but Harvest Financial Group (with a person who also had the initial “Z”), and that no transaction actually occurred. More important, your own actions call into question the authenticity of that communication and your subsequent use of it. In short, the images you circulated online are complete fakes. Many media articles confirm that data purported to have come from Mr. Biden’s devices has been altered or manipulated. You, or someone else, did that again. All of the misstatements about this communication and your use of a false text are good examples of how providing one-sided, untested, and slanted information leads to improper conclusions. [my emphasis]

This is a remarkable claim, because — if true — it suggests the IRS was investigating Hunter Biden based on wildly incorrect assumptions about the identity of his interlocutors.

Abbe Lowell claims that the IRS agents who investigated his client for five years — the son of the President!!! — didn’t know to whom he was talking! I’ve heard a lot of outlandish claims from defense attorneys (though Lowell is far more credible than the grifters who defend a lot of January 6 defendants), But this is an utterly inflammatory claim.

Had Shapley used responsible summaries, rather than the unprofessional script he did use, it might be possible to figure out who is right, here, because then we could compare the actual number or email account used.

Or maybe not.

There’s another possible way to explain why IRS agents wouldn’t even know the identity of the person with whom Hunter Biden was discussing business deals.

One of the things that happened during January 2019 when Hunter Biden’s droidhunter88 account had taken over his iCloud account is that his contacts list was “restored.”

In the publicly released emails, there’s no indication of when the request was made, or restored from what. But it happened around the same time as “Hunter Biden” requested a full iCloud download, including his contacts list.

That iCloud download is almost certainly what became much of the content on what is now known as the “Hunter Biden” “laptop” — a laptop the IRS was using (after booting it up in a new laptop, if you can believe Shapley’s notes) for evidence in this investigation.

There are at least three possibilities here:

  • Shapley is right and Abbe Lowell is wrong
  • Whoever wrote these unprofessional summaries just guessed — wrongly — who Hunter’s interlocutor was
  • The iCloud contacts list that the IRS was using when these summaries were made had been altered

We don’t have enough data to know. But given what even Hunter Biden’s persecutors have released, we can’t rule out the last one — that the IRS was using a doctored contacts list to investigate Joe Biden’s son.

The Laptop Everyone Knows as Hunter Biden’s Appears to Have Been Deleted Starting February 15, 2019

/111 Comments/in , , , /by

I’ve been wading through Hunter Biden data all weekend. There’s some evidence that the descriptions of the “Hunter Biden” “laptop” based on the drive Rudy Giuliani has peddled do not match the description of what should be on such devices given what the FBI and IRS saw.

Before I explain that, though, I want to talk about how the life of Hunter Biden’s iCloud account differs from what is portrayed in this analysis paid for by Washington Examiner.

As that report describes, Hunter Biden activated a MacBook Pro on October 21, 2018, then set it up with Hunter’s iCloud on October 22. Hunter then used the MacBook as his primary device until March 17, 2019, a month before it waltzed into John Paul Mac Isaac’s computer repair shop to start a second act as the biggest political hit job ever.

There are problems with that story. A longer table of the devices that logged into Hunter Biden’s iCloud includes devices that appear to have been accessing core Hunter Biden content.

That same table doesn’t show any access after November 15, 2018, with the last access being the device Roberts MacBook Pro that would end up in a Delaware repair shop, but showing up six days earlier than it should. There’s a phone that should but does not show up in those devices, too.

The report doesn’t discuss the import of the shifts between these emails.

RHB used several emails for business and personal use including:
○ [email protected] [sic]
○ [email protected] ([email protected])
○ [email protected]
○ [email protected]
○ [email protected]

One email missing from this list is a Gmail account under which a bunch of passwords were stored. That’ll become important later.

The most important email is the Gmail account (misspelled above), [email protected], which Hunter Biden used to contact sex workers, probably including the Russian escort service that the IRS used to predicate the IRS investigation. That email account got added to his iCloud account at the same time as his iCloud contents were requested, and then again before the MacBook stopped being used. Those changes often happened in conjunction with changes to the phone number.

For now, though, I just want to map out the major events with Hunter’s iCloud accounts from September 1, 2018 (perhaps the months before the IRS would open an investigation into him because he was frequenting a Russian escort service) until the final email as found on the laptop itself. There’s a bunch more — one after another credit card gets rejected, and he keeps moving his Wells Fargo card over to pay for his Apple account; the iCloud account shows Hunter reauthorizing use of biometrics to get into his Wells Fargo account in this period.

In January 2019, the Gmail account Hunter Biden used to contact sex workers (probably including the Russian escort service he had been using) effectively took over his iCloud account and asked for a complete copy of his iCloud account. Then, the next month, all the data on the Hunter Biden laptop was deleted.

Update: I’ve taken the reference to the HB RediPhone out altogether–it’s clear that’s a branded iPhone–and replaced it with a better explanation of the other devices.

Update: I see that he does have D[r]oidhunter88, but doesn’t discuss the import of it.

Update: I’ve added a few things that happened while Hunter’s account was pwned. Importantly, as part of this process an app called “Hunter” was given full access to his droidhunter88 gmail account. There are also a few emails that seem to be a test process.

Update: Added the missing Gmail account.

Hunter Biden’s iCloud

9/1/18: An account recovery request for your Apple ID ([email protected]) was made from the web near Los Angeles, CA on August 31, 2018 at 9:36:07 PM PDT. The contact phone number provided was [Hunter Biden’s].

9/1/18: The following changes to your Apple ID, [email protected] were made on September 1, 2018 at 10:29:36 AM PDT: Password

9/1/18: Your Apple ID ([email protected]) was used to sign in to iCloud on a MacBook Pro 13″.
Date and Time: September 1, 2018, 10:34 AM PDT

9/1/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser.
Date and Time: September 1, 2018, 10:42 AM PDT

9/2/18: Your Apple ID, [email protected], was just used to download Hide2Vault from the Mac App Store on a computer or device that has not previously been used.

9/2/18: Welcome to your new MacBook Pro with Touch Bar.

9/11/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser.

9/11/18: The password for your Apple ID ([email protected]) has been successfully reset.

9/11/18: Robert’s iPad is being erased. The erase of Robert’s iPad started at 2:56 PM PDT on August 5, 2018.

This is one of several times in several weeks that Hunter loses his iPhone, but while it’s lost, someone also pings his MacBook.

9/16/18: A sound was played on iPhone. A sound was played on iPhone at 8:25 PM PDT on September 15, 2018. (Repeats 25 times in 5 minutes)

9/16/18: A sound was played on Robert’s MacBook Pro at 8:30 PM PDT on September 15, 2018. (Repeats 2 times)

9/16/18: A sound was played on iPhone at 8:31 PM PDT on September 15, 2018. (Repeats 7 times)

9/16/18: iPhone was found near Santa Monica Mountains National Recreation Area 23287 Palm Canyon Ln Malibu, CA 90265 United States at 11:32 PM PDT.

9/16/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser.

9/19/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser.

9/20/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone 8 Plus.

This is the second time he loses his phone. What follows is basically a chase of Hunter Biden’s iPhone across LA. It’s not clear it is ever recovered — but it is over two weeks before a new iPhone logs into his account.

9/27/18: Lost Mode enabled on Robert Hunter’s iPhone. This device was put into Lost Mode at 7:20 PM PDT on September 27, 2018.

9/27/18: Robert Hunter’s iPhone was found near [address redacted] Lynwood, CA 90262 United States at 7:20 PM PDT.

9/27/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone 8 Plus.

9/27/18: A sound was played on Robert Hunter’s iPhone at 7:20 PM PDT on September 27, 2018.

9/27/18: A sound was played on Robert Hunter’s iPhone at 7:20 PM PDT on September 27, 2018.

9/27/18: Robert Hunter’s iPhone was found near [address redacted] Lynwood, CA 90262 United States at 7:20 PM PDT.

9/28/18: Robert Hunter’s iPhone was found near [different address redacted] Lynwood, CA 90262 United States at 4:24 PM PDT.

9/28/18: Robert Hunter’s iPhone was found near [third address redacted] Lynwood, CA 90262 United States at 5:27 PM PDT.

9/28/18: Robert Hunter’s iPhone was found near [fourth address redacted] Los Angeles, CA 90036 United States at 6:22 PM PDT.

9/28/18: Robert Hunter’s iPhone was found near [fifth address redacted] Los Angeles, CA 90069 United States at 6:38 PM PDT.

10/13/18: Bobby Hernandez to [email protected]: You left your phone. How do I get it to you?

10/14/18: The password for your Apple ID ([email protected]) has been successfully reset.

By date, this login is the HB rediPhone, but Apple recognized it as an iPhone X.

10/14/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone X. Date and Time: October 14, 2018, 11:24 AM PDT

10/17/18: The password for your Apple ID ([email protected]) has been successfully reset.

10/17/18: The following information for your Apple ID (r•••••@rspdc.com) was updated on October 17, 2018. Trusted Phone Number Added – Phone number ending in 73

10/17/18: New sign-in to your linked account [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

Per the Gus Dimitrelos report, the following activity reflects the creation of a new MacBook account called Robert’s MacBook Pro — the laptop that would end up in Mac Isaac’s shop. But there doesn’t appear to be an alert for a new device like there is the for the iPhone 8 Plus the following day.

10/21/18: Your Apple ID ([email protected]) was used to sign in to iCloud on a MacBook Pro 13″. Date and Time: October 21, 2018, 5:50 AM PDT

10/21/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: October 21, 2018, 9:06 AM PDT

10/22/18: The following changes to your Apple ID, [email protected] were made on October 22, 2018 at 7:47:30 PM EDT: Phone number(s)

10/23/18: Your Apple ID, [email protected], was just used to download Quora from the App Store on a computer or device that has not previously been used.

10/23/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone 8 Plus. Date and Time: October 23, 2018, 4:10 PM PDT

10/23/18: New sign-in to your linked account [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

Several spyware apps get purchased in this period.

10/29/18: Your mSpy credentials to your control panel: Username/Login: [email protected]

11/2/18: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone XS.

11/16/18: You recently added [email protected] as a new alternate email address for your Apple ID.

11/21/18: You’ve purchased the following subscription with a 1‑month free trial: Subscription Tile Premium

11/22/18: Your Apple ID, [email protected], was just used to download KAYAK Flights, Hotels & Cars from the iTunes Store on a computer or device that has not previously been used.

12/28/18: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: December 28, 2018, 7:06 AM PST

1/3/19: Keith Ablow (then Hunter’s therapist) says Hunter’s email is screwed up

1/6/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: January 6, 2019, 1:51 AM PST

1/12/19: Your Recent Mac Cleanup Pro Order [ADV181229-7742-90963]

1/14/19: The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 10:28:31 PM EST: Phone number(s)

1/14/19: The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 10:31:15 PM EST: Password

1/14/19 The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 10:52:13 PM EST: Billing and/or Shipping Information

1/14/19: The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 10:53:40 PM EST: Phone number(s)

1/14/19: The following changes to your Apple ID, [email protected] were made on January 13, 2019 at 11:12:45 PM EST: Billing Information

1/16/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: January 16, 2019, 1:59 PM PST

While Hunter is in Ketamine treatment at Keith Ablow’s, a service called “Hunter” gets access to the droidhunter88 gmail account

1/16/19: Here’s my first tip for you!

1/16/19: Hi Robinson, Hunter now has access to your Google Account [email protected].

Hunter can:
View your email messages and settings
Manage drafts and send emails
Send email on your behalf

A bunch of things happen in this four day period: first, someone accessed droidhunter88 from a new iPhone. Someone changed the phone number for the Hunter Biden iCloud. Then, droidhunter88 was given access to the iCloud account. Then the iCloud account ordered all of Hunter’s iCloud contents. Then the password for the account was reset.

1/17/19: New device signed in to [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

1/17/19: I am here to help you find the emails you need!

Giovanni here from Hunter.

I wanted to quickly check if I can help you getting started with Hunter.

There are plenty of functionalities included with your free plan that will allow you to find, verify and enrich a set of data in bulk: these are all explained in our video guides.

However, if you already have a precise task to perform, reply to this email so I can better assist you!

1/17/19: n (from [email protected])

1/18/19: Long email to tabloid journalist sent under rosemontseneca email (this is sent first to Keith Ablow and then George Mesires, the latter of whom responds); this would have shown how the email account worked

1/19/19: The following information for your Apple ID (r•••••@rspdc.com) was updated on January 19, 2019. Trusted Phone Number Removed – Phone number ending in 13

1/20/19: The following changes to your Apple ID, [email protected] were made on January 20, 2019 at 5:24:54 PM EST: Phone number(s)

1/20/19: The following changes to your Apple ID, [email protected] were made on January 20, 2019 at 5:31:21 PM EST: Apple ID
Email address(es)

1/20/19: The following changes to your Apple ID, [email protected] were made on January 20, 2019 at 5:31:21 PM EST: Apple ID Email address(es)

1/20/19: A request for a copy of the data associated with the Apple ID [email protected] was made on January 20, 2019 at 5:40:26 PM EST

1/21/19: The password for your Apple ID ([email protected]) has been successfully reset.

1/21/19: The following changes to your Apple ID, [email protected] were made on January 21, 2019 at 8:28:05 AM EST: Name — changed from Robert Hunter to Robert Biden

1/21/19: You recently added [email protected] as the notification email address for your Apple ID

1/21/19: The following changes to your Apple ID, [email protected] were made on January 21, 2019 at 8:31:02 AM EST:
Rescue email address

1/22/19: The following information for your Apple ID (r•••••@icloud.com) was updated on January 22, 2019. Trusted Phone Number Removed – Phone number ending in 96

1/22/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: January 22, 2019, 4:21 AM PST

1/22/19: The following changes to your Apple ID, [email protected] were made on January 22, 2019 at 10:05:20 AM EST:
Email address(es)

1/22/19: The following changes to your Apple ID, [email protected] were made on January 22, 2019 at 10:05:29 AM EST:
Email address(es)

1/22/19: The following changes to your Apple ID, [email protected] were made on January 22, 2019 at 10:05:34 AM EST:
Email address(es)

1/24/19: You recently added [email protected] as a new alternate email address for your Apple ID.

I think that after ordering all Hunter’s data, the account is reset to what it had been from the start. But Droidhunter88, not [email protected], gets the iCloud backup.

1/24/19: Your contacts have been restored successfully on January 24, 2019, 1:17 PM PST.

1/25/19: The data you requested on January 20, 2019 at 5:40:26 PM EST is ready to download. [Sent to both Droidhunter88 and [email protected]]

1/27/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: January 27, 2019, 7:41 AM PST

Several photo editing apps are purchased in this period (and one CAD app).

1/27/19: You’ve purchased the following subscription with a 1‑month free trial: Subscription Polarr Photo Editor Yearly

2/6/19: The following changes to your Apple ID, [email protected] were made on February 5, 2019 at 11:39:09 PM EST: Phone number(s)

2/9/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: February 9, 2019, 9:52 AM PST

2/9/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: February 9, 2019, 5:08 PM PST

Hunter connected to your Google Account
Hi Robinson,

2/9/19: Hunter now has access to your Google Account [email protected].

2/9/19: test To:[email protected]

2/9/19: jkFrom:”Robinson Hunter” [email protected]:[email protected]

2/9/19: The following information for your Apple ID (r•••••@icloud.com) was updated on February 10, 2019. Trusted Phone Number Added – Phone number ending in 96

2/9/19: You recently added [email protected] as the notification email address for your Apple ID.

2/9/19: You recently added [email protected] as the notification email address for your Apple ID

2/9/19: The following changes to your Apple ID, [email protected] were made on February 9, 2019 at 8:33:57 PM EST: Rescue email address

2/9/19: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone 6s. Date and Time: February 9, 2019, 6:11 PM PST

2/10/19: Your Apple ID, [email protected], was just used to download Call recorder for iphone from the iTunes Store on a computer or device that has not previously been used.

2/15/19: Hi Robinson, Did you know? Hunter doesn’t have only one Chrome extension! We recently built a simple email tracker for Gmail.

This is where the data on the MacBook that would end up in Mac Isaac’s shop started getting deleted.

2/15/19: Robert’s MacBook is being erased. The erase of Robert’s MacBook started at 4:18 PM PST on February 15, 2019.

2/15/19: Robert’s MacBook Pro has been locked. This Mac was locked at 8:36 PM PST on February 15, 2019.

2/19/19: Noiseless MacPhun LLC

2/20/19: where the fuck are youi? from DroidHunter88 to dpagano:

this is hunter
i dont have your #

call me please

The droidhunter88 account bought a new iPhone — but, after telling Apple they would recycle the old one, instead kept it. That would effectively be another device associated with Hunter Biden. Given some of the other apps involved, this may have served as a way to get Hunter Biden’s calls (eg, from Mac Isaac). Unlike the new devices that show up in 2018, this one was paid for. 

2/21/19: New device signed in to [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

2/21/19: Hi Robinson, Welcome to Google on your new Apple iPhone (tied to droidhunter88)

2/28/19: Your items are ready for pickup.Order Number: W776795632Ordered on: February 28, 2019

2/28/19: Your trade-in has been initiated. Thanks for using Apple GiveBack.

3/1/19: Your Apple ID ([email protected]) was used to sign in to iCloud on an iPhone XR. Date and Time: March 1, 2019, 8:52 AM PST

3/5/19: Recently you reported an issue with Polarr Photo Editor, Polarr Photo Editor Yearly using iTunes Report a Problem

3/7/19: Your Apple ID, [email protected], was just used to download Lovense [sic] Remote from the App Store on a computer or device that has not previously been used.

3/9/19: New sign-in to your linked account [email protected] Your Google Account was just signed in to from a new Apple iPhone device.

3/9/19: Promise Me, Dad: A Year of Hope, Hardship, and Purpose (Unabridged)

3/13/19: Your Apple ID ([email protected]) was used to sign in to iCloud via a web browser. Date and Time: March 13, 2019, 5:43 PM PDT

3/16/19: The following changes to your Apple ID, [email protected] were made on March 16, 2019 at 11:59:16 PM EDT:Email address(es)

Droidhunter88 is added back to Hunter’s iCloud contact again.

3/17/19: You recently added [email protected] as a new alternate email address for your Apple ID.

3/17/19: The following changes to your Apple ID, [email protected] were made on March 17, 2019 at 12:02:06 AM EDT: Email address(es)

3/17/19: We haven’t received your device.

Rudy’s Even Worse Week

/29 Comments/in , /by

Back in May, I wrote a post called, “Rudy’s very bad week.”

It described:

  • He had lost his lawyer for a PA suit against him
  • Judge Beryl Howell was forcing him to cooperate in the Ruby Freeman lawsuit against him
  • Rudy claiming he faced no legal risk from Jack Smith
  • He was being sued by a former associate Noelle Dunphy who claimed to have two years of his email

He had a worse week this week.

That’s true, in significant part, because yesterday the DC Board on Professional Responsibility recommended he be disbarred in DC. the committee basically said he made false claims based on no evidence to disrupt the peaceful transfer of power.

The documentary evidence that Respondent did produce is fundamentally vague, speculative, or facially incredible. We have reviewed it and have examined with particularity the materials cited by Respondent in his posthearing filings. Respondent’s PFF 36-37. Although the materials identify a handful of isolated election irregularities, they completely fail to demonstrate that the observational boundaries or Notice and Cure procedures facilitated any meaningful fraud or misconduct that could have possibly affected the outcome of the presidential election.

[snip]

Mr. Giuliani’s argument that he did not have time fully to investigate his case before filing it is singularly unimpressive. He sought to upend the presidential election but never had evidence to support that effort. Surely Rule 3.1 required more.

[snip]

Mr. Giuliani brought a case that had no factual support. It caused an astonishing waste of the resources of the District Court, the Third Circuit, and multiple defendants in a compressed time frame.

[snip]

We cannot blind ourselves to the broader context in which Mr. Giuliani’s misconduct took place. It was calculated to undermine the basic premise of our democratic form of government: that elections are determined by the voters. The Pennsylvania claims were carefully calibrated to blend into a nationwide cascade of litigation intended to overturn the presidential election. FF 9. Since John Adams established the precedent in 1800, no president – until 2020 – refused to accept defeat and step away from that office. And no lawyer – until 2020 – used frivolous claims of election fraud to impede the peaceful transition of presidential power and disenfranchise hundreds of thousands of voters.

[snip]

His frivolous claims impacted not only the court and parties involved but threatened irreparable harm to the entire nation.

Even before that, though, Rudy was taking steps to settle a lawsuit for his conduct after he gave up filing frivolous lawsuits based on no evidence — the attacks he made on Ruby Freeman and her daughter.

On Thursday, Rudy’s attorney Joe Silbey reached out to Freeman’s lawyers and, less than a day later, they asked for time to come to some settlement.

On July 6, 2023, counsel for Defendant Giuliani approached counsel for Plaintiffs to discuss a potential negotiated resolution of issues that would resolve large portions of this litigation and otherwise give rise to Plaintiffs’ anticipated request for sanctions. Throughout July 6 and July 7—and into the evening on July 7, counsel for both parties have worked diligently to negotiate a resolution and believe they are close.

Silbey’s approach for a settlement came one day after Freeman’s lawyers asked for $89,172.50 in legal fees for all the stalling that Rudy has already done.

The same day as Freeman asked for sanctions, they also filed a motion to compel Bernie Kerik’s cooperation. They included a revised privilege log that — while they still argue it is noncompliant with legal standards — nevertheless points to a whole slew of interesting communications in Kerik’s possession. For example, there’s a January 4, 2021 briefing for members of the Senate on which Steve Bannon was CCed (note, Katherine Freiss used both protonmail and hushmail to conduct her coup plotting; I’m leaving these emails unredacted to show the stealth with which these people were trying to steal an election).

There’s a FISA proposal from Mark Finchem.

There is what appears to be a request that Mark Meadows clear them into the White House for the December 18 meeting that doesn’t even get Meadows’ first name right.

There’s an email showing MI fraudster Matthew DePerno receiving Peter Navarro’s report even before Trump sent it out, right along with the rest of Rudy’s team (and other emails show that Victoria Toensing was closely involved in the MI shenanigans).

And the emails give a better sense of what Sidney Powell and Mike Flynn were up to.

Almost none of this would be privileged, because Rudy was no longer pursuing litigation after the PA lawsuit.

All this comes amid more reporting on Rudy’s recent 8 hour interview with Jack Smith’s team, which itself follows voluntary interviews with (at least) Mike Roman and Boris Epshteyn.

During Rudy’s last really really bad week, he had the fantastic belief he wasn’t in any legal trouble.

He may finally understand how ridiculous that is.

Update: I hadn’t been tracking the Dunphy suit, but Rudy narrowly missed being assessed attorney fees there, too, this week.

 

Walt Nauta and the Single Box

/148 Comments/in , , /by

The section of the less redacted search warrant affidavit showing when Walt Nauta moved boxes in and out of the storage room differs from the timeline shown in the indictment in one key way.

The search warrant affidavit used to demonstrate probable cause doesn’t describe how, on May 22 of last year, the former valet spent over half an hour in the storage room, and then left carrying a single box.

53. On May 22, 2022, NAUTA entered the Storage Room at 3:47 p.m. and left approximately 34 minutes later, carrying one of TRUMP’s boxes.

There are several possible explanations why that description may not be in the search warrant affidavit.

Perhaps investigators didn’t think it important — though that would be hard to believe, given that the affidavit observes something that the indictment does not as explicitly: that all this box moving happened in the same period when Nauta disavowed any knowledge of box movement.

On May 30, 2022, four days after WITNESS 5’s interview with the FBI during which the location of boxes was a significant subject of questioning, WITNESS 5 is observed exiting the ANTEROOM doorway with approximately fifty Bankers boxes, consistent with the description of the FPOTUS BOXES. [my emphasis]

Perhaps investigators simply didn’t see Nauta and the single box on May 22. But note that the surveillance video was motion activated, so any movement on May 22 should show up just like all the other movement did, and in close proximity to his movements captured two days later.

[T]he FBI determined that the drive contained video footage from four cameras in the basement hallway of the PREMISES in which the door to the STORAGE ROOM is located. The footage on the drive begins on April 23, 2022, and ends on June 24, 2022. The recording feature of the cameras appears to be motion activated, so that footage is only captured when motion is detected within each camera’s field of view.

Or perhaps this movement, Nauta spending half an hour in the storage room then leaving with a single box, is one of the surveillance footage gaps that investigators spent much of a year trying to fill and explain.

The different treatment of this one box is more interesting given other details of the timeline.

For example, Nauta retrieved that single box just two days before the original deadline for the subpoena, May 24.

The return date of the subpoena was May 24, 2022.

Nauta retrieved that box the day before Trump met with Corcoran and another attorney who hasn’t been IDed yet, but who may be Boris Epshteyn. At the meeting, a day after presumably getting a box that didn’t show up in the search warrant affidavit, Trump whined that, “I don’t want anybody looking through my boxes!”

54. On May 23, 2022, TRUMP met with Trump Attorney 1 and Trump Attorney 2 at The Mar-a-Lago Club to discuss the response to the May 11 Subpoena. Trump Attorney 1 and Trump Attorney 2 told TRUMP that they needed to search for documents that would be responsive to the subpoena and provide a certification that there had been compliance with the subpoena. TRUMP, in sum and substance, made the following statements, among others, as memorialized by Trump Attorney 1:

a. I don’t want anybody looking, I don’t want anybody looking through my boxes, I really don’t, I don’t want you looking through my boxes.

b. Well what if we, what happens if we just don’t respond at all or don’t play ball with them?

c. Wouldn’t it be better if we just told them we don’t have anything here?

d. Well look isn’t it better if there are no documents?

Amidst all that whining, Trump agreed to let Corcoran search for documents, but only after a ten day delay. And then Trump delayed his departure to Bedminster so he would be at Mar-a-Lago to sort boxes and to see the scheme through.

56. On May 23, TRUMP also confirmed his understanding with Trump Attorney 1 that Trump Attorney 1 would return to The Mar-a-Lago Club on June 2 to search for any documents with classification markings to produce in response to the May 11 Subpoena. Trump Attorney 1 made it clear to TRUMP that Trump Attorney 1 would conduct the search for responsive documents by looking through TRUMP’s boxes that had been transported from the White House and remained in storage at The Mar-a-Lago Club. TRUMP indicated that he wanted to be at The Mar-a-Lago Club when Trump Attorney 1 returned to review his boxes on June 2, and that TRUMP would change his summer travel plans to do so. TRUMP told Trump Attorney 2 that Trump Attorney 2 did not need to be present for the review of boxes.

57. After meeting with Trump Attorney 1 and Trump Attorney 2 on May 23, TRUMP delayed his departure from The Mar-a-Lago Club to The Bedminster Club for the summer so that he would be present at The Mar-a-Lago Club on June 2, when Trump Attorney 1 returned to review the boxes.

Something that doesn’t show up in the indictment but does in the affidavit is that Corcoran then pushed for an extension on the subpoena deadline.

On May 25, 2022, while negotiating for an extension of the subpoena, FPOTUS COUNSEL 1 sent two letters to DOJ COUNSEL. In the second such letter, which is attached as Exhibit 1, FPOTUS COUNSEL 1 asked DOJ to consider a few “principles,” which include FPOTUS COUNSEL 1’s claim that a President has absolute authority to declassify documents. In this letter, FPOTUS COUNSEL 1 requested, among other things, that “DOJ provide this letter to any judicial officer who is asked to rule on any motion pertaining to this investigation, or on any application made in connection with any investigative request concerning this investigation.”

Just one of the two letters Corcoran sent that day has been released — the one falsely claiming Trump had returned documents in good faith earlier that year, though Corcoran may not have known that was false. Nauta would repeat a version of that claim the next day, on May 26, in his FBI interview, though unlike Corcoran, he is credibly accused of knowing well that was a lie.

All the other movement of boxes, then, occurs during that subpoena extension (and this might be another reason why the May 22 movement is not included on the affidavit — perhaps investigators focused on what happened during the subpoena extension). Nauta empties the storage closet of 64 more boxes, moving all these boxes in the same week when, in an FBI interview, he allegedly denied knowing anything about an earlier scheme to sort through boxes.

On May 24, 2022, WITNESS 5 is observed exiting the ANTEROOM doorway with three boxes.

On May 30, 2022, four days after WITNESS 5’s interview with the FBI during which the location of boxes was a significant subject of questioning, WITNESS 5 is observed exiting the ANTEROOM doorway with approximately fifty Bankers boxes, consistent with the description of the FPOTUS BOXES. FBI did not observe this quantity of boxes being returned to the STORAGE ROOM through the ANTEROOM entrance in its review of the footage.

The next day, on June 1, 2022, WITNESS 5 is observed carrying eleven brown cardboard boxes out the ANTEROOM entrance. One box did not have a lid on it and appeared to contain papers.

And then, after Nauta told a female Trump that Trump wanted to pick from all those boxes, Nauta loaded up several of the boxes withheld from Corcoran’s search onto Trump’s plane to take to Bedminster, never to be seen again.

72. Earlier [on June 3], NAUTA and others loaded several of TRUMP’s boxes along with other items on aircraft that flew TRUMP and his family north for the summer.

So it may or may not be a significant detail, but the day before Trump orchestrates this scheme to keep 35 boxes shielded from Corcoran’s search, Nauta spent half an hour in the storage room retrieving a single box.

Some weeks after this scheme, on June 21, the day before DOJ asked Trump Organization for surveillance footage, per the discovery letter, Nauta appeared before a grand jury, his second (and only other) interview with investigators.

A bunch of reports last year, such as this one from Devlin Barrett that likely confuses Nauta with Molly Michael, described that Nauta changed his testimony in what would be this grand jury appearance, admitting that Trump ordered him to move boxes.

When FBI agents first interviewed Nauta, he denied any role in moving boxes or sensitive documents, the people familiar with the situation said in interviews before Nauta’s name became public. But as investigators gathered more evidence, they questioned him a second time and he told a starkly different story — that Trump instructed him to move the boxes, these people said.

But those reports came at a time when DOJ was still trying to get more testimony from Nauta.

Prosecutors have indicated they are skeptical of an initial account Mr. Nauta gave investigators about moving documents stored at Mar-a-Lago and are using the specter of charges against him for misleading investigators to persuade him to sit again for questioning, according to two people briefed on the matter.

So, particularly given that a grand jury appearance would have been in — and so would be charged — in DC, it’s not really clear whether Nauta did correct his story before the grand jury. If he didn’t, Jack Smith could prosecute Nauta individually on a perjury charge that might go to trial within months, not the year the Espionage Act trial is expected to take.

Whether or not he cleaned up his testimony, on June 21, Nauta appeared before the grand jury.

Having locked that testimony in, on June 22 prosecutors asked Trump Organization — probably Alan Garten, from whom discovery has been deficient in past investigations — for surveillance footage.

DOJ COUNSEL has advised me that on or about June 22, 2022, counsel for the Trump Organization, a group of business entities associated with FPOTUS, confirmed that the Trump Organization maintains security cameras in the vicinity of the STORAGE ROOM and that on June 24, 2022, counsel for the Trump Organization agreed to accept service of a grand jury subpoena for footage from those cameras.

Shortly after that, per reporting on some of the last grand jury testimony banked in DC before DOJ took steps to charge the Espionage charges in Florida, Nauta called Chief of Operations for Trump Organization, Matthew Calamari Sr.

To resolve the issue about the gaps in the surveillance footage, the special counsel last week subpoenaed Matthew Calamari Sr, the Trump Organization’s security chief who became its chief operating officer, and his son Matthew Calamari Jr, the director of corporate security.

Both Calamaris testified to the federal grand jury in Washington on Thursday, and were questioned in part on a text message that Trump’s valet, Walt Nauta, had sent them around the time that the justice department last year asked for the surveillance footage, one of the people said.

The text message is understood to involve Nauta asking Matthew Calamari Sr to call him back about the justice department’s request, one of the people said – initially a point of confusion for the justice department, which appears to have thought the text was to Calamari Jr.

Then, less than two weeks later, on July 6, Trump Organization provided DOJ with surveillance footage showing Nauta moving a great many boxes out of the storage room, and moving fewer than half of them back in before Evan Corcoran searched them. That’s pretty damning stuff! It provided some of the most compelling evidence in the affidavit justifying a search on the former President’s beach resort.

DOJ only got two months of footage, not the five they had asked for (which would have covered the tail end of the earlier sort of boxes). That’s unsurprising: even normal businesses only retain such footage for a limited period of time.

But in addition to obtaining fewer months than they had requested, the footage Trump Org turned over reportedly had other gaps, gaps that have not yet been charged or even mentioned, at least in unsealed form, in any official DOJ filing.

What’s unclear is whether that May 22 footage, showing that Nauta spent half an hour in the storage closet only to come out with a single box, was originally one of those surveillance gaps or not.

The Technical Oddities of the FBI’s Exploitation of Hunter Biden’s Laptop

/71 Comments/in , /by

I wrote about the memorialization of an October 22, 2020 meeting about the Hunter Biden laptop that Gary Shapley did here.

Shapley is using it to wind up the frothy right, which as is true of all things Hunter Biden, has worked like a charm.

He has used it not only to make false claims that the FBI has validated the laptop and all its contents, but also to claim that Whistleblower X was being denied access to some of the materials on the laptop. As I noted, by his own description, Whistleblower X saw contents from the laptop, as released by Rudy Giuliani, at some point in the investigation, even though investigators had been instructed not to view publicly available materials out of taint concerns.

But the meeting wasn’t held 8 days after the Rudy laptop had been made public so Whistleblower X could air his complaints. It was held as CYA, to make sure DOJ documented the chain of custody that had just been rendered suspect by the disclosure that a source the FBI had basically trusted had turned the laptop into an election season hit job.

Authentication

The frothy right is either lying or ignorant when they claim this report authenticates the laptop and all contents. Indeed, the report makes it clear that, over a year after first learning of the laptop, the FBI still hadn’t validated every file on it.

But it did do some authentication, some of which could have been faked. That includes:

  • Financial records showing Hunter Biden made a purchase in a cigar shop on the “same day” (could easily be faked, particularly since anyone with his laptop had images of his credit cards)
  • “Other intelligence” showing he was in the area
  • Phone records showing at least two calls “around this time” (but may not reflect later calls Mac Isaac claimed to have made)
  • Device number registered to Hunter Biden’s iCloud account
  • October 2020: Discussion of tracking data creation dates on laptop

Forensic Process

From the description of the memo, the hard drive was easy to access. It was imaged within days of receipt and sent to the regional forensics lab in Philadelphia. Even there, though, by March there were concerns about the quality and completeness of what got imaged from the hard drive.

For some reason, however, to access the laptop, the FBI obtained a new PowerBook and installed the hard drove from the Hunter Biden laptop in the new laptop, which “the computer guy” in the meeting said “returned [the laptop] to original.” It took three months to get this image.

Furthermore, there were problems with exporting the results. Even in October 2020, the team were joking that anyone else who wanted to access the laptop would need to buy their own laptop and review the discovery on that.

Here’s what the memo said about this:

FBI determined in order to do a full forensic review a replacement laptop had to be purchased so the hard drive could be installed, booted and imaged.

[snip]

Josh Wilson stated that (while laughing) so whoever [people wanting to review the laptop] are they are going to have to buy a laptop to put the hard drive so they can read it.

As noted, at that point in October 2020, the FBI had not checked the laptop for any alterations made while in Mac Isaac’s custody. Of particular concern given what I’ve heard about the hard drive is whether the computer access email updates during the period it was at the shop (not least because in that period, Burisma was hacked). Shapley said nothing about any validation that happened after this point.

  • Replacement laptop purchased, hard drive installed, booted, imaged
  • CART images external hard drive
  • 12/19/19: Regional Computer Forensics Lab receives image of har drive
  • 3/6/20: FBI receives image of laptop
  • 3/10/20: RCFL receives laptop image
  • 3/31/20: email about quality and completeness of imaged/recovered from hard drive (not shared with agents)
  • No list of when files created

Legal Treatment

Before the government took the laptop, they checked with Apple (what might be a subscriber report) to make sure the laptop in question was registered to Hunter Biden’s iCloud account. The FBI did two telephone and one in person interview with Mac Isaac (curiously, Shapley refers to his as John Paul rather than Mac Isaac). They then served a subpoena on Mac Isaac to take custody. The Office of Enforcement Operations approved the warrant. The IRS then used a Title 26 (tax) search warrant, with search protocols, to access the content.

There are two references to LTFC, which I suspect is the filter team.

  • Order to Apple to verify computer
  • Two telephone and one in-person interviews of Mac Isaac
  • Subpoena for laptop (12/9/19, but not recorded in doc)
  • 12/12/19 OEO approval for search warrant
  • 12/13/19 T26 Search Warrant approved with filter protocol
  • Some grand jury process relating to iPad backup
  • LTFC [?] emails 1/23/20 about data imaging
  • 4/10/20: thumb drive (from laptop?) to LTFC

Discovery History

As noted, the hard drive was easy to access; the laptop was not.

The forensic team first started describing the contents of the hard drive 24 days after obtaining the search warrant (with Christmas in between), and first obtained messages from the hard drive in February.

The investigators didn’t get content from the laptop until April, and it was deduped from the hard drive (though there seems to have been stuff on the laptop that was not on the hard drive).

Whistleblower X kept complaining about not getting a Cellebrite report on the devices. It’s unclear whether that pertained to some of the forensics challenges.

Shapley mentioned that there had been an error when the FBI tried to upload the laptop to USAfx, a discovery platform. That’s weird because USAfx is really finicky. Problems uploading it would be unsurprising. Problems uploading it that remained an issue in October, six months later, would be.

  • After 1/6/20: Emails about “body parts, file names”
  • 1/15/20: Email with file extensions
  • 1/27/20: DE1 and DE2 provide file extensions, provided on USB drive
  • 2/27/20 DE3 All messages from hard drive provided on USB drive (includes iPad and MacBook messages, not iPhone messages)
  • After 2/27/20: iPhone messages decrypted with password obtained from business card
  • 4/7/20: DE4 first evidence from laptop (de-duped from hard drive)
  • 4/17/20: Uploaded files to USAfx, receive error (many file types)
  • 4/20/20: Zip file with PDF and HTML files of cell phone records, and redacted Cellebrite file

Investigative treatment

The most interesting aspect of the investigative treatment of the laptop is that a filter team withheld information from the Mac Isaac 302 from investigators. I wonder whether he told them what he has said publicly–that he has no idea whether Hunter Biden really was the one who showed up in his shop.

  • 10/16/19: Richard McKissack calls the FBI Albuquerque
  • 10/17/19: Baltimore Field Office receives lead from FBI Albuquerque
  • 11/3/19: Unnamed person reaches out to McKissack for contact information for Mac Isaac
  • 11/6/19: Josh Wilson calls Mac Isaac
  • 11/7/19: FBI interviews Mac Isaac, 302 not shared with prosecution team
  • 11/21/19: Follow-up phone call to clarify Mac Isaac claims about timing of abandonment
  • 12/3/19: Whistleblower X starts drafting search warrant
  • 12/9/19: Took property of laptop, external hard drive, and receipt (redacted information about subpoena)
  • 12/12/19: OEO approved search warrant for laptop and hard drive
  • 12/13/19: Whistleblower X obtains T26 Search Warrant
  • 1/6/20: Forensic analysis begins
  • 2/10/20: Filter review completed, scope review begins

Update: Added link to DDOSecrets report.

Links

Original NYPost story

WaPo analysis of drive

Washington Examiner-paid analysis of drive

DDOSsecrets Report

Hunter Biden countersuit