June 5, 2024 / by emptywheel

 

Special Agent Erika Jensen Did Not Look, and Did Not Find, Evidence of Tampering with the Laptop

The frothy right has gone nuts today because they took a quote out of context and believed it meant that the FBI had validated the content of the laptop.

That quote they’re using was actually a response to a colloquy between Abbe Lowell and FBI Agent Erika Jensen — who is a summary agent, and who testified she’s not a cybersecurity expert — in which she said she had not done anything to validate the laptop.

It’s not her job to validate laptops.

So she didn’t try to validate it. And having not tried, she did not find evidence of tampering.

As I noted here, it remains the case that this laptop came into evidence relying on less evidence than Lesley Wolf cited to in October 2020, just the serial number proving it had been associated with Hunter Biden’s iCloud account and an email sent to that publicly listed email.

Here’s the exchange between Lowell and Jensen.

Q. You have no reason to believe the time the FBI acquired the data from Apple, or what you just described, they changed any part of it, right?

A. Forensic examiners?

Q. Yes, the FBI, they didn’t change anything that you know of, did they?

A. No, I have a small basis of my understanding of how they work, I know they do a lot — they create images files of what would be considered the original data, so it doesn’t change the original data, but beyond that, I’m providing what I know.

Q. And the material that came into evidence that you discussed with Mr. Hines yesterday, as far as you know is the way the FBI obtained it?

A. Yes.

Q. And you indicated what you know about what they did with it, but you have no reason to believe the material that you just described yesterday, and I asked you about today, had been changed, altered, it was authentic as you understood it?

A. What I can speak to is when we obtain the data.

Q. Yes?

A. It was authentic from that point forward.

Q. And then when you provided it to us in discovery, discovery meaning you provided material to the defense, that’s the way it was sent, in the same way that you retrieved it?

A. My understanding is you received copies both of our extraction reports and of the full forensic images of the original data.

Q. I think you said, I don’t know that you identified, that as to the device, the laptop, it came into the possession of the government in December of 2019?

A. Yes.

Q. You understand that from the invoice that you showed about a repair shop that it was brought, according to the owner, in April of that year?

A. Yes. The invoice is dated in April.

Q. So can you tell what happened between the time the invoice indicates that device was brought to the shop and when the FBI acquired it six months later?

A. No.

Q. You are aware from your investigation that the person who claims to have gotten it in April indicates he made copies —

MR. HINES: Objection.

MR. LOWELL: I’ll withdraw the question.

THE COURT: Sustained.

BY MR. LOWELL: Q. Will you put up government Exhibit 40? So this is an invoice you identified yesterday, and I referred to, dated the 17th; right?

A. Yes.

Q. And you indicated that that’s one of the things you obtained from the data that was recovered and that was extracted and that you had reviewed?

A. Yes.

Q. And the date of this is the 17th; right?

A. The date of the e-mail is the 17th.

Q. But you know from your investigation that the person who sent this indicates that he got this device five days before?

A. I know from the investigation that yes, it was reported that it was April 12th.

Q. Do you have any notion of what happened in that device between April he 12th, where your investigation indicates that’s when the person acquired it, and April 17th when he sent the invoice?

A. I have some knowledge, but it’s through somebody else’s statements.

Q. So no firsthand knowledge?

A. No firsthand knowledge.

Q. Now, the last point on this. If the person acquired it in April, and the FBI says it acquired that in December, six months later, did your investigation indicate whether what was put on that machine in April was the way it was originally done by Hunter before then?

A. I’m sorry, ask that one more time.

Q. I didn’t say that right. Benchmarks. April 2019, the person says “I got the device.” Right?

A. Yes.

Q. December of 2019, the FBI acquires it?

A. Yes.

Q. What I’m asking is, did you do an analysis to determine whether on the date that this person says he got it, the data he got was in the format, content, or in any way what had originally been put there by Mr. Biden?

A. You’re asking if on the 12th the person that received it?

Q. I’m asking whatever that person got on the 12th, was the way it was originally put, do you know? Did you do an analysis? Did you find out whether any of the files had been tampered with, added to, or subtracted?

A. I did not. Right, I did not. [my emphasis]

Derek Hines then responded by getting Jensen to testify that, having not checked, she did not find whether any files had been added or tampered with.

BY MR. HINES: Q. Agent Jensen, picking up where Mr. Lowell left off, yesterday you introduced Government Exhibit 16, the laptop; correct?

A. Yes.

Q. And Mr. Lowell was asking you some questions there about whether you knew anything about tampering or something like that, for all his questions just now?

A. Yes.

Q. Have you seen any evidence whatsoever from the data you reviewed from this laptop to suggest that there was tampering?

A. No.

Q. Does the serial number on the laptop, as you discussed in your testimony yesterday, match the serial number registered with Mr. Biden’s iCloud account?

A. Yes. [my emphasis]

The exchange is useless for the purpose people want to use it.

A summary witness who is not a cybersecurity expert, who “I have a small basis of my understanding of how they work,” who was specifically directed what to look at and what not, did not “do an analysis [to] find out whether any of the files had been tampered with, added to, or subtracted?”

And having not looked, she had not, “seen any evidence whatsoever from the data you reviewed from this laptop to suggest that there was tampering.”

She didn’t look for tampering before the FBI got the laptop, and having not looked, didn’t find any tampering.

Update: Okay, this is crazypants. Remember that Jensen did less validation that Lesley Wolf did in 2020. She cited only the emailed invoice from John Paul Mac Isaac sent to Hunter Biden’s iCloud email, which is something JPMI could have sent without ever speaking to Hunter.

The invoice, as released, has no metadata.

Q. So when you looked through the materials that you just reviewed — just described, do you recall that, for example, you see an entry to an Airbnb? Did you see e-mails which reflected the rental of an Airbnb, or a rental house in that period of time, did you look at that?

A. I did not review e-mails, but beyond that —

[snip]

Q. Agent, I’m going to do better starting right now. To be clear, if — you didn’t see any e-mails?

A. I did not review e-mails, beyond the few that we discussed yesterday.

Q. Okay. I’m sorry. So you did review — where did those e-mails come from?

A. So the e-mails that I — from The View, came from the Cloud. There were e-mails from the Cloud. I did not review the entire set of e-mails.

Q. So meaning you were looking for e-mails from the Cloud that said The View?

A. No. I didn’t review the full set that would have been provided to investigators after the forensic analysis.

Q. So you got from somebody else the e-mails that 102, which you identified yesterday?

A. Yes.

That emailed invoice would have been utterly useless to validate the laptop without metadata, without reviewing his emails generally.

Copyright © 2024 emptywheel. All rights reserved.
Originally Posted @ https://www.emptywheel.net/2024/06/05/the-laptop-discussion/