The Delaware District Courthouse has unsealed much of what Judge Maryellen Noreika ordered unsealed last week. The major piece still outstanding are the Attachments for the most recent warrant describing the crimes they’re investigating and the things they’re permitted to seize, which is actually one of the most important things I was seeking to have unsealed.
The story the warrants generally tell is that investigators obtained Hunter Biden’s entire iCloud account on September 25, 2019, literally the same day it became clear Donald Trump had demanded an investigation into Hunter Biden. Then they got the laptop. The laptop led them to discover four device backups of interest. In summer 2020, they obtained warrants specific to those devices to access data already in hand.
And then, years later, 81 days after charging Hunter Biden for gun crimes, they obtained a warrant to search all that same digital evidence for evidence of gun crimes.
They really are claiming they didn’t think to search all the data they had for evidence of gun crimes until after they had the indictment in hand, 81 days after they indicted the President’s son. That is, at least for the moment, they are claiming that they never bothered to check for gun crime evidence in Hunter Biden’s texts until after they charged him.
And they made that admission in a filing arguing, “oh sure, we’ve been planning on charging these gun crimes for years.”
This late disclosure will undoubtedly raise a lot of questions about whether any of this data was presented to the grand jury (particularly given that Abbe Lowell would only have had notice of this warrant not long before we got it); if it was, it’d strongly suggest that investigators unlawfully searched Hunter’s data for gun crimes. Though thus far, that’s the most likely way any of this becomes illegal under the very generous precedents for criminal investigators.
Before I look more closely at what the individual warrants show, remember that these are not the only warrants. We know from this filter document Joseph Ziegler shared, for example, that investigators also searched this same data for FARA crimes — so there are almost certainly a parallel sent of warrants for those crimes. There are known warrants, such as for the Google account tied to Hunter’s Rosemont Seneca email, for other content that would have been less interesting for the gun crimes. There’s some epic funkiness with the treatment of the laptop.
But this is the story David Weiss has decided he can bring to a jury: that investigators obtained two parallel sets of Apple data, and very belatedly, literally after they indicted, decided to search it for alleged gun crimes that were committed before they obtained the first warrant.
August 29, 2019: Original iCloud warrant; warrant return
The first warrant unsealed obtained all the content for Hunter’s iCloud account. It permitted the search for evidence pertaining to the three tax crimes charged in Los Angeles: 26 USC 7201, 26 USC 7203, and 26 USC 7206(1) (though the probable cause statement could not have covered those charges for 2018, the primary tax year charged, as those alleged crimes had not been committed yet).
It asked for the entire content of the iCloud account, from January 2014 through the present; I originally questioned how they could show probable cause to obtain information from 2018 and 2019, as no tax crimes could have been committed yet in those years, but realize that so long as Hunter hadn’t paid his earlier tax years, the willful failure to pay continued.
The warrant did not mention Burisma by name, though Burisma might be covered under permission to search for evidence about business operations. The warrant did not mention the sex workers on which this entire investigation was predicated, but those would be covered under “personal expenditures.”
The warrant only asked for content related to one of the several email addresses Hunter used with Apple, RHBDC at iCloud, though probably got everything in response under Apple’s normal response to legal process. That could become pertinent later.
Here’s how Derek Hines described it in his response filing that first identified these warrants:
In August 2019, IRS and FBI investigators obtained a search warrant for tax violations for the defendant’s Apple iCloud account. 2 In response to that warrant, in September 2019, Apple produced backups of data from various of the defendant’s electronic devices that he had backed up to his iCloud account.
2 District of Delaware Case No. 19-234M
There are three things of interest in Hines’ description. He emphasizes that both the FBI and IRS were on this warrant, which might be an attempt to cover later plain view expansions of this investigation. He suggests, inaccurately, that the warrant focused on backups from Hunter’s phone, which is likely because he only wants to introduce texts at trial, not emails.
Most interestingly, Hines notes that the warrant was served in August but the data was returned in September.
The warrant shows that before investigators filed for a warrant in August 2019, they twice preserved Hunter’s data, on April 11, 2019 (which is the day Joseph Ziegler submitted his tax package to DOJ Tax for approval to open a grand jury investigation), and July 11, 2019.
The docket itself shows that Magistrate Judge Sherry Fallon issued a Magistrate’s order on September 12 (which remains sealed). That suggests that Apple may have challenged this warrant, delaying the return of the content until after that.
We may learn more about the content of this order in motions in the Los Angeles case (though once it was issued, investigators would be working under a Good Faith exception). As the July 2020 warrant reveals, Apple turned over the content on September 25, 2019 — the very day the White House would release the Perfect Phone Call revealing that Trump had been demanding an investigation into Hunter Biden personally.
On August 24, 2020, investigators sought a renewal of the original order sealing the docket. At least from what got unsealed, that’s the only actual renewal of sealing orders investigators ever got.
December 13, 2019: Original laptop warrant; warrant return
The second warrant obtained authorized the search of the laptop turned over from John Paul Mac Isaac. Here’s how Hines explained it:
Investigators also later came into possession of the defendant’s Apple MacBook Pro, which he had left at a computer store. A search warrant was also obtained for his laptop and the results of the search were largely duplicative of information investigators had already obtained from Apple. 4
4 District of Delaware Case No. 19-309M
It was actually served by the FBI agent who served the subpoena on JPMI on the CART guy.
Mike Waski may know details of how — according to JPMI — the laptop came to be accessed four days before this warrant. Or he could be “computer guy” who didn’t bother to validate the content of the laptop for over 10 months.
In their (absolutely atrocious) coverage of these warrants, NYPost claimed to have seen an earlier warrant.
A third search warrant was obtained Dec. 13, 2019, to examine the now-first son’s infamous Apple MacBook Pro laptop and a hard drive — the same one containing a copy of Biden’s laptop that computer store owner John Paul Mac Isaac made to give to Rudy Giuliani’s lawyer Robert Costello, an earlier warrant reviewed by The Post shows.
Given that the rest of Priscilla DeGregory’s story betrays not the remotest inkling of understanding of what she’s looking at, McGregory may be thinking of the December 9 subpoena to JPMI, but I suspect Abbe Lowell may learn if there’s an earlier one when he points out that according to JPMI, the FBI accessed the content of this laptop before the December 13 warrant, possibly in a way that is forensically unsound.
Attachment B in this warrant is similar to the one in the first warrant. It has this boilerplate paragraph, which would cover the government if they sent Bill Barr a copy on December 14.
But, largely because of the difference between cloud data and devices, it has different language pertaining to attribution.
The iCloud warrant describes it this way:
Hunter is undoubtedly the email account owner. But there is very good reason to believe that between January 1, 2014 and August 29, 2019, Hunter was not the only user. Indeed, this scope of time would cover the compromise that Lev Parnas says happened when Hunter was in Kazakhstan.
Among other things, this language should put the government on the hook for aberrations in Hunter’s iCloud access in advance of treating the laptop uncritically.
Now compare that with the attribution language used on the laptop warrant.
Most expansively, this device was only owned starting in October 2018 (when Hunter no longer owned it and whether he ever owned the hard drive remain very much contested), and I’ve got questions about whether others used it. And JPMI undoubtedly “used” both devices.
Bookmark that detail.
July 10, 2020 iCloud warrant; warrant return
The permission to search for passwords as evidence of “user attribution” could become mildly important given the third warrant which (as I’ve already noted), Derek Hines simply mentions as an afterthought.
a follow up search warrant, District of Delaware Case Number 20-165M.
In July 2020, investigators used this warrant to access content already in their possession tied to four specific devices. The warrant describes clearly that this is the content they received from Apple on September 25, 2019 (again, the same day the Perfect Phone Call transcript revealed that Trump was demanding investigations just like this one). And the warrant clearly shows that the data was stored at the FBI office in Wilmington.
I’ll return to the devices later. With these devices, as with all of Hunter’s iCloud content and devices from the period of his addiction, investigators would need to prove that content on the devices was put there while they were still in Hunter’s possession and that he was the one who backed up the phones.
But what Derek Hines is not telling Judge Maryellen Noreika is that the reason investigators came to have an interest in these four devices is because they accessed the content of those four devices from the laptop.
They got a warrant to access the same content from the Apple production. But they don’t claim to have obtained a warrant to access the same content on the laptop, and we know thanks to Gary Shapley that they only accessed one of these devices using a password they found on the laptop (again, that particular factoid is what sent me down this rabbit hole in the first place).
I’ll come back to the question of whether that’s a problem or not.
December 4, 2023: Post-indictment warrant; warrant return (less attachments) Attachments AB
Finally, there’s the December 4, 2023 warrant, the reason I asked to get these unsealed in the first place.
Law enforcement also later obtained a search warrant to search the defendant’s electronic evidence for evidence of federal firearms violations and to seize such data. 5
5 District of Delaware Case No. 23-507M.
When Derek Hines described this warrant, he tried to hide that by “later” he meant, “81 days after obtaining the indictment,” and — from the submission of the signed return dated yesterday, it appears that Special Agent Boyd Pritchard was still searching this content when the dockets were unsealed yesterday.
As noted above, the Delaware Clerk has not yet complied with Judge Noreika’s order with regards to this warrant. I’m going to see if I can’t get them to do so and if I succeed I’ll add some update. But for now, I can’t compare search protocols with those earlier warrants or see what crimes of which Pritchard said he was search for evidence. [Update: They have now provided the Attachments]
The Attachments basically just trace through the three earlier warrants (iCloud; laptop; backups — though they are not in order), then authorize searching the content for evidence of the gun crimes charged 81 days earlier.
Effectively, three days after a meet-and-confer phone call with Abbe Lowell following up on all the discovery requests David Weiss was blowing off, including these two bullets, they obtained a warrant to access his texts — they claim, for the very first time.
The user attribution could have some interesting repercussions, not least because it’s not clear these devices were “used” by Hunter when the content was added to them.
Of some interest, in the response, Hines didn’t mention the call from Joe Biden telling Hunter to get help reported by the Daily Mail. Since investigators seem to have so little appreciation for what happened with Hunter’s devices before and after the FBI obtained this warrant, they may not understand there’s evidence in the public record that won’t exist on the laptop, which therefore they would not have gotten a warrant to access.
In a different world, the serial discovery of what a mess Hunter’s digital mess was might have led law enforcement officers to start investigating whether there was a reason it was such a mess.
Not these guys. They just decided to take the assist criminals gave them to investigate Joe Biden’s son.
And with regards to the Apple content (it’s likely investigators got Hunter’s Rosemont Seneca account first, which shows even more evidence of deliberate compromise), they first received it on the same day the White House revealed that Trump had extorted Volodymy Zelenskyy for just such an investigation.
Updated with the AB Attachments from the most recent warrant.
Update: Corrected my reference to Matt/Mike.
Update: Corrected Pritchard’s first name now too. [Sigh!]