In both a footnote of his reply motion for discovery …

1 The prosecution’s opposition briefs reveal some new evidentiary issues (e.g., seizing electronic evidence for the gun charges for the first time pursuant to a December 4, 2023 warrant; using a grand jury in California in connection with the tax case to elicit evidence for already-indicted gun charges in Delaware; seeking a search warrant in December 2023 to search for evidence in support of its charges three months after having charged; testing a leather pouch for cocaine residue in October 2023 that it had in its possession for five years; denying there was Probation’s approval for the diversion agreement) in addition to those raised in Mr. Biden’s motions to dismiss themselves (e.g., how a Delaware agreement for a diverted gun charge and two tax misdemeanors turned into multiple felonies in two jurisdictions following massive political pressure to do just that). Based on the prosecution’s admissions made only recently in its filings, Mr. Biden will expeditiously file a motion to suppress improperly gathered evidence. [my emphasis]

And two footnotes in his motion to compel …

3 The search warrant on December 4, 2023, which post-dates the firearm indictment by almost three months, is the first time in the course of this five-year investigation that DOJ obtained a warrant to search the alleged laptop (and iCloud account and backup data) for evidence of federal firearms violations. The prosecution then used that warrant to purportedly review and seize, for the first time, text messages, photos, and other evidence in support of its felony charges, several of which the prosecution cited in its pleadings on January 16, 2024. (See DE 68 at 8–9.) Moreover, that warrant contained testimony (in support of finding probable cause) about the firearm obtained from a witness in a grand jury empaneled in the Central District of California in November 2023 after this indictment had already been brought. Accordingly, the issue raised—as a result of the prosecution’s recent filings—is one to explore at the evidentiary hearing Mr. Biden requested (DE 64) and a motion to suppress which will be filed promptly.

[snip]

18 Citing District of Delaware Search Warrant No. 23-507M. Unlike the Office’s prior search warrants during the five-year investigation that were for tax, financial, or foreign-business related offenses, this warrant was specifically for offenses pertaining to 18 U.S.C. §§ 922, 924 (firearms offenses). See supra n.3, and a further motion to suppress concerning this December 4, 2023 search will be forthcoming. [my emphasis]

Hunter Biden attorney Abbe Lowell said he would soon be filing a motion to suppress “improperly gathered evidence.”

Part of this will likely be a challenge to the belated pretextual testing of the gun for cocaine residue without also testing for fingerprints and dating of the residue to the time period immediately after Hunter purchased a gun.

But in all three footnotes, he promises to challenge the December 4, 2023 warrant, which would implicate the original search warrant to Apple, the exploitation of the laptop, and follow-on searches for four devices backed up to his iCloud:

• iPhone X (Apple Backup 1)
• iPhone 6S (Apple Backup 3)
• iPad Pro (Apple Backup 4)
• iPhone XR (Apple Backup 11)

After over three years of controversy about the laptop attributed to Hunter Biden, this challenge may finally unpack the reliability of the device that has driven right wing frothers nuts ever since.

Game on!

There’s a variety of things that Lowell might rely on to challenge the use of the laptop — and possibly, the four backed up devices, as fruits of the laptop — some sound and some less so. They include:

• A complaint that David Weiss used testimony obtained from a Los Angeles grand jury focused on tax crimes to obtain the December 2023 warrant, which will almost certainly be dismissed as normal prosecutorial dickishness.
• If any of the devices entirely predate 2018, there should be no probable cause to search them for the 2018 charges. Based on emails available at BidenLaptopEmails dot com, Hunter Biden started using at least three different iPhone Xes in 2018 (but at least one of those was likely lost to hostile people). He had an iPhone 6S with the droidhunter account he used to access adult entertainment in early 2019, though the only known iPhone XR may have been tied to that account, rather than his Rosemont Seneca account (or there could be a later one). Otherwise, his iPhone 6S use appears to have significantly predated 2018. An iPad backed up to the laptop is an iPad Pro, which itself dates to 2016, and much of Hunter Biden’s known iPad Pro use was also in 2016 and earlier, which is the time frame investigators were most interested when they obtained those warrants.
• The fact that, per Gary Shapley’s notes, the FBI never validated when the files loaded onto the laptop were added to it in the first 10 months they used it (which also means they did not do so before obtaining four backup devices partly relying on it).
• John Paul Mac Isaac’s acknowledgment that when his father first went to the FBI, the FBI agent with whom he spoke advised, “you should get a lawyer [because] You may be in possession of something you don’t own.”
• JPMI’s description that the FBI was trying to boot up the laptop on December 9, 2019, before the FBI had the December 13, 2019 warrant.
• The fact that the Attorney General’s Chief of Staff texted the Attorney General that he was sending him a laptop the day after the FBI obtained the known December 13, 2019 warrant, suggesting the laptop may have been used for something else, like potential impeachment defense.
• Also per Shapley’s notes, that some of the means FBI used to determine the laptop was once associated with Hunter’s iCloud account — including call and email traffic with John Paul Mac Isaac and a cigar purchase made locally the day of the drop-off — could easily be spoofed by anyone in possession of the laptop.
• The fact that, for two and a half months by the time the FBI claimed to have validated that the laptop was Hunter Biden’s, they had had full access for Hunter’s iCloud (and almost certainly had access to Hunter Biden’s Rosemont Seneca Google account for at least that long), which would have given them full access to a bunch of metadata that very much should have raised concerns about who had control of Hunter’s devices at any given time.

Those are just some of the potential bases for a Fourth Amendment challenge to using the laptop as evidence. There may be more.

It’s the last bullet that I want to focus on here. Shapley’s notes show that on November 6, 2019 — over a month after obtaining Hunter’s full iCloud account on September 25, 2019 — Josh Wilson used the serial number provided by JPMI and “determined that device was registered to [Hunter Biden] via apple ID account/iCloud account.”

It is absolutely the case that at 8:50AM Delaware time on October 21, 2018 — nine days after Hunter bought a gun and two days before he no longer possessed it — the laptop that would eventually end up at the FBI logged into Hunter’s iCloud account, though unlike some devices before and after, there’s no public confirmation of a tie to Apple directly, such as Apple welcoming him to a new computer or a receipt.

But there’s something unusual about what came next.

Normally, when Hunter Biden started using one of the new devices that can be clearly tied to his account, he would log into iCloud, then shortly thereafter log into one or another of his two Google accounts, Rosemont Seneca and/or droidhunter. As a result, Google would send security alerts to both the Gmail account and a whichever of the iCloud emails were set as backup.

For example, after Hunter bought a new laptop (possibly the laptop found at Keith Ablow’s in March 2019) on August 31, 2018, he signed into his iCloud account the next day, then, also on September 1, signed into his droidhunter Gmail account, then into his Rosemont Seneca account on September 2.

Someone signed into one of his new replacement iPhones, ordered through Asurion, on October 14 and then, on October 17, signed into his Rosemont Seneca Gmail account.

Someone signed into a new iPhone 8 Plus on October 23, 2018 — possibly the other replacement phone from Asurion — and then signed into his Rosemont Seneca Gmail account that same day.

Things are a bit fuzzier with some phones replaced through Apple the next spring, after his life was packed up on a laptop for delivery to John Paul Mac Isaac.

On February 21, 2019, he got a new iPhone, associated with his droidhunter account, and signed in on his droidhunter Gmail right away.

On March 1, 2019, he got a new iPhone XR — possibly the one obtained with the 2020 warrant. Then bought an adult themed App on March 7, then signed into his droidhunter email on March 9.

There are an astounding number of other devices used to log into one or another account associated with Hunter Biden’s digital life. But for recognizable device replacements, the pattern generally holds: Sign into Apple, then sign into Google.

But based on what is available on the public emails, after someone logged into Hunter’s iCloud account with a new laptop on October 21, 2018, it was weeks before a new Mac device logged into his Gmail accounts, starting with a November 16 attempt to log into Rosemont Seneca that was rejected by Google, followed by a reset of the droidhunter account and a login into that on November 20, followed by a login into Rosemont Seneca on November 24. Not only did those attempts come in the midst of a bunch of attempts to get into Hunter Biden’s Twitter account from a Mac. But on November 27, someone appears to have gotten into his iCloud account from Troutdale, OR.

New Mac devices also accessed Hunter’s Rosemont Seneca account on February 9 and February 20, 2019.

As I’ve already described, a great deal of Hunter Biden’s “normal” activity on his devices in this period looked like he was hacking himself. For example, on at least 36 occasions in 2017 and 2018, Wells Fargo shut down Hunter’s online access because of activity that looked, to it, like a hack. Many if not most of that was probably, instead, just Hunter Biden doing erratic things. In other cases, it’s impossible without more data to show whether a particular access or expenditure was Hunter himself, someone who had acquired one of his devices, or someone more malicious.

But there is a pattern, and the laptop ultimately shared with the FBI, he deviated from that pattern.

Certainly, David Weiss might argue that the FBI just hadn’t looked at Hunter Biden’s digital fingerprints that closely when they got a warrant on December 13, 2019.

But they’ve had five years to look at it in the interim period, and might have a harder time arguing that this pattern was normal.

Update: Just catching up to the Delaware docket (JPMI’s suit and Hunter’s countersuit). Judge Robert Robinson will hold hearings in everyone’s motions on February 22.

Update: Abbe Lowell has amended his lawsuit against the IRS, tweaking it to make statements that lawyers for Joseph Ziegler and Gary Shapley made. He told Mark Scarsi had had some motion regarding the disgruntled agents, so I expect this filing will be cited in that motion.