The Kinds of Laptop Documents the Hunter Biden Investigation Used

Back in July, while I was mocking the latest Devlin Barrett transcription of right wing spin about the Hunter Biden laptop, I contested his claim that the laptop had had little role in the investigation of Hunter Biden.

WaPo had ignored the bank records on which this investigation was predicated and built. And while bank records were surely more important to the tax investigation than anything on the laptop, the laptop would have been key to influence peddling allegations against the President’s son, both by the FBI and journalists (and now by Dick Pic sniffers in Congress, who keep using documents from a hard drive of the laptop the provenance of which they refuse to share publicly with Democrats).

[T]he IRS agents’ testimony (taken in conjunction with the report that the Washington Examiner was ethical enough to release), shows that the IRS didn’t obtain what is probably Hunter Biden’s rhb iCloud account — from which the cited, contested WhatsApp messages were probably obtained a second time — until August 2020, after it got some of the same material on the laptop. That potential taint may be why someone told Barrett to downplay the import of the laptop.

While the laptop may not have played a key role in substantiating a tax case against Hunter Biden, it may well have tainted the evidence in the case. It may well be part of the reason why Hunter Biden is getting to plead to misdemeanor rather than felony tax charges — because as even Whistleblower X explained that he had been told, there are emails that raised concerns about whether this could be charged at all, suggesting this case couldn’t withstand discovery.

Since then, Joseph Ziegler has proven that I was right (well, not about Hunter getting to plead to misdemeanor tax charges; we were all wrong about that).

But if anything, I underestimated how much the government used the laptop.

For example, Ziegler shared the filter term document for the laptop, with a creation date of February 7, 2020, focused exclusively on the tax investigation. While the filter term document for Hunter’s Google account was dated December 16, 2019, some documents that Ziegler says were obtained from Google warrants have creation dates of May 4, 2020 or August 12, 2020. These dates may reflect when the investigators obtained the filtered and scoped materials from the filter team; we know the team was working on a warrant for Blue Star Strategies in August 2020; that would have been central to a Burisma-related FARA investigation.

The FARA-related filter term document for the laptop Ziegler shared may not have been originally shared with him at all; the copy he shared has the same creation date, January 26, 2021, as the date he asked for all the filter documents (perhaps not coincidentally, just days after Joe Biden was inaugurated).

More interesting still, Ziegler provided part of an Excel spreadsheet that he described this way:

[A] relevant document timeline which was utilized throughout the investigation (Over 2,100 line items). This would have included emails and attachments recovered from the multiple electronic search warrants, calendar entries and open source (public) records. In this document, specifically in the “Description” column, the case investigators would summarize the relevant information found in the documents. The source of the document was included in the “Type Misc” column (For example, if the document came an electronic search warrant served on Google). The “related to” and “type of Doc” columns were utilized by the investigators to further sort the overall timeline. Pursuant to the Congressional Committees request, I have filtered this timeline for all relevant documents related to Burisma, U.S. and Foreign Government officials (Including former Government Officials). In addition, I have also provided the emails and attachments for some of the referenced documents in this Exhibit (Exhibits 302 through 313). [my emphasis]

This is it, folks: What Ziegler claims are all the (unclassified, at least) documents pertaining to Burisma.

This fragment of the spreadsheet is a good way to assess how the team spun particular records. It also shows their documentation of the open source records they claimed to rely on, for things including, “Archer reportedly meets with VPOTUS Biden,” “VPOTUS allegedly withholds $1B to Ukraine,” and “VPOTUS Biden allegedly pressures Ukrainian Poroshenko to fire Prosecutor Shokin (tied to $1 billion U.S. loan guarantees).” It was not very rigorous and in the descriptions of Biden’s role in pressuring Ukraine reflects clear bias.

I’ve never seen a criminal investigator willfully torch internal aspects of his own investigation like this, but I’m grateful for the insight on the investigation. Thanks Joe Ziegler!

Perhaps the most interesting part of this timeline, though, is that as of the time when Ziegler secured a copy for himself, it reflected that of the 150 or so items in this spreadsheet (remember, just a fragment of a much larger one), 14 are sourced to the laptop. The spreadsheet may be outdated; there’s no mention of a Dropbox warrant that investigators definitely got, nor of any warrants targeting Devon Archer or Vadym Pozharskyi that investigators seemed to at least be contemplating in August 2020.

Still, whenever Ziegler saved a copy of this spreadsheet, almost 10% of the sources came from the laptop.

This table pulls together the documents Ziegler provided and lists those sourced to the laptop.

They seem to have sourced two kinds of things consistently to the laptop: calendar notices (items 2, 5, and 12, and possibly 7 and 13) and emails with attachments (items 6, 9, 10, and — I think — 11). That’s curious because both should be available — with far better provenance — with a Google warrant. Indeed, attached Burisma documents are one of the things of most suspect provenance on the public versions of the laptop.

But remember that these emails wouldn’t have been Hunter’s personal Google account; most of his personal email, with the exception of a Google account he used for sex-related accounts, was one or another iCloud address. These were Rosemont Seneca emails hosted by Google. Depending on how RS set that up, it may have complicated getting the emails, and so made sourcing certain things to the laptop easier. Note that Ziegler describes the “Schwerin” sourced documents as also a warrant, which would be similar.

That leaves the following seven emails sourced to the laptop rather than a more reliable warrant.

• 1: May 7, 2014 email from Archer to Vadym’s Gmail ccing Hunter’s Rosemont Seneca email regarding plans for a trip to Kazakhstan (possibly the one where, Lev Parnas alleges, the first Hunter laptop was compromised) that references a meeting with the Kazakh Prime Minister
• 3: April 8, 2015 email from Serbian diplomat Vuk Jeremić’s NGO email to Hunter’s iCloud email discussing a backchannel with “the bear” likely relating to Iranian talks
• 4: May 29, 2015 email from Jeremić’s Gmail to Hunter’s iCloud, ccing Archer, clearly asking Hunter if he had asked his father (whom he referred to as the big guy) about something
• 7: October 23, 2015 email from Rosemont Seneca’s Joan Mayer to both Hunter and Schwerin noting Sally Painter meeting with Vadym and Hunter; this should have been included in Google warrants, but may have been set up as a pre-set meeting notice
• 8: October 30, 2015 email from Schwerin to Hunter forwarding an email from Sally Painter at Blue Star Strategies, linking a story about about Serhiy Kurchenko; it should have been available in warrants targeting all three though perhaps the way it was forwarded had it treated as an attachment?
• 13: February 23, 2016 email from Rosemont Seneca’s Joan Mayer to both Hunter and Schwerin at their Rosemont Seneca emails regarding meeting with Frank Mermoud about Burisma; this should have been included in Google warrants, but may have been formally a pre-set meeting notice
• 14: August 14, 2016 email from Jeremić’s gmail to Rosemont Seneca emails, asking Hunter to lobby for him to become UN Secretary General, in response to which Hunter explained, “as I have also said many times I won’t engage in I advocati ng on your behalf with my father or anyone else in the USG;” this is their last email in the public set, though Jeremic definitely tried to stay in touch via DM and WhatsApp after that; it should have come up in the Hunter and Schwerin warrants

There are two emails on this list — the two 2015 Jeremić ones — that wouldn’t hit a Google warrant at all (though depending on the dates of the iCloud backups the government obtained, should be in those). But the other Jeremić emails on this list that would be in Google as well.

So it may, instead, be a scope issue: that the filter team (and which agency provided the filter team over time varied) excluded Jeremić entirely from the Google batches, but included him in the laptop batches (plus, we can’t guess the date of that filtering process, so it could reflect later developments in the investigation). Most of these emails would fit under the suggested relevancy terms by dint of including Archer, but the one about the “bear” doesn’t appear to.

Which is to say one thing investigators may be getting from the laptop are documents that would be excluded from other filters.

And that’s just the Burisma (which spanned both the tax and FARA investigations) and FARA focused documents. Ziegler has not shared his list of tax documents, so there could — likely are, given Ziegler’s obsession with the sex workers Hunter slept with — be quite a lot of laptop documents from there.

As Lesley Wolf reportedly described on October 22, 2020, almost all emails were available in two sources anyway. But if someone packaged up this laptop, as I suspect, then it would mean the government got a collection of documents tailored to make a particular kind of impression that they wouldn’t have gotten without a lot more investigation.

That is, depending on what was done with the laptop before it got to the FBI, it may not be a matter of doctored records, but it could amount to packaging up a criminal investigation in a box, just what Rudy was looking for when the laptop walked into John Paul Mac Isaac’s shop.