Release: Hunter Biden emails (3.6 GB)
DDoSecrets identifies signs of altered or implanted emails in the dataset distributed by Trump allies. We are mirroring the data with significant warnings
We are releasing approximately 128,500 emails allegedly from a Hunter Biden laptop. The emails are primarily dated between 2009 and 2019. There are some anomalies with the dates and the number of emails, in addition to concerns about the chain of custody. There are considerable issues with this dataset including signs of tampering, as well as misconceptions about its contents. See our article for the most up-to-date description of the issues we have encountered.
More than one altered or implanted emails was detected in a version of the dataset distributed by Trump allies and former staffers. The known possibly tampered emails were created between August 31, 2020 and September 2, 2020. The existence of other possibly tampered emails cannot be ruled out. See: Timeline.
We present the dataset now in full context to counteract possible deceptions by persons with an agenda who are currently distributing the dataset without the relevant context or warnings.
Contents
Origins of the Laptop
The laptop was allegedly left with a legally blind man at a computer repair shop, along with other laptops. Though the computer store clerk, John Paul Mac Isaac, is unable to identify the person who left the laptops, the paperwork allegedly identified Hunter Biden. The laptops were never picked up by the owner, and eventually considered abandoned property. John Paul Mac Isaac began reviewing the files on the abandoned machines.
Hunter Biden has neither confirmed nor denied the authenticity of the laptops. DDoSecrets has detected some irregularities and modifications of the dataset as presented, which warrant further investigation. We have made the decision to release the data with the analysis and warnings detailed below.
Source issues and discrepancies
As reported by The Daily Beast, John Paul Mac Isaac has contradicted himself repeatedly (see here for audio). CBS also noted he contradicted himself in his interview with them, and invoked debunked conspiracy theories like Seth Rich. He has declined to clarify his relationship with Giuliani, indicating to The Daily Beast that he doesn't want to discuss "details that transpired between December 9th and the beginning of September."
Notably, Mac Isaac has also warned about false claims others have made about the contents of the laptops.
Involvement of Trump, Giuliani, Bannon and other Trump staffers
Rudy Giuliani, former-President Trump's lawyer, received a copy of some of the data sometime in 2019 or 2020. According to a defamation court filing, in August 2020 Mac Isaac contacted Rudy Giuliani's lawyer, Mr. Costello, and provided him with the data. Mac Isaac's court filing in the defamation suit states that he never communicated with Giuliani, a statement which he seemed to contradict in media interviews.
In an attempt to swing the 2020 election with an October Surprise, Steve Bannon and Rudy Giuliani provided some of this data to the New York Post.
According to multiple sources, then-President Trump had been aware of the effort to publish data from the laptop. According to Giuliani, in addition to briefing Trump, he alerted Senators Ron Johnson (R-Wisconsin) and Jim Jordan (R-Ohio). Giuliani believed Rep. Devin Nunes (R-California) also received the data.
The cache of ~128.5k emails was first circulated online by Garrett Ziegler, a former associate director in Trump advisor Peter Navarro's Office of Trade and Manufacturing Policy. Garrett Ziegler also distributes an alleged copy of Ashley Biden's stolen diary and pushes false QAnon talking points such as COVID-19 being a "plandemic", or that new variants of COVID-19 are financial schemes. COVID-19 is a deadly virus, and not a planned pandemic.
Timeline
March 28, 2018: The original 'Macintosh HD' drive was created.
March 17, 2019: Cutoff point of the data allegedly from the laptops. The latest date supposed to be present in the files.
April 12, 2019: Laptops allegedly dropped off for repair.
Late-May, 2019: Alleged Hunter Biden emails are offered to people in Ukraine.
Mid-September, 2019: A second person in Ukraine is approached about alleged Hunter Biden emails. There is reportedly a plan to sell the data to allies of President Trump.
September 28, 2019: The date of creation for some of the PDF files used in the Oct. 14, 2020 New York Post story.
October 8, 2019: Mac Isaac's father meets with the FBI. The FBI advise Mac Isaac Sr. to get a lawyer and clarify the legal ownership of the laptop and his rights to it. Mac Isaac and his father interpret this instruction as a brush-off.
October 10, 2019: Another date of creation for some of the PDF files used in the Oct. 14, 2020 New York Post story.
December 9, 2019: When asked about meeting Giuliani, Mac Isaac indicated he didn't want to talk about the time between "December 9th and the beginning of September."
December 18, 2019: The first Donald Trump impeachment hearings begin. According to Giuliani, Mac Isaac gave the laptops' data to Mr. Costello around this time.
December 19, 2019: Mac Isaac surrenders the laptops to the FBI.
February 5, 2020: Impeachment hearings end.
August, 2020: According to a court filing, Mac Isaac contacted Mr. Costello, Rudy Giuliani's lawyer.
August 31, 2020: In the dataset, on this date two blank email replies are created on the topic of a recommendation letter, replying to an email from 2014. The email and file metadata indicate these documents are created on August 31, 2020.
September, 2020: When Costello tells Snopes that he received the contents of the hard drive.
Early September: When asked about meeting Giuliani, Mac Isaac indicated he didn't want to talk about the time between "December 9th and the beginning of September."
September 1, 2020: Two draft emails are created and added to the cache as a reply to an email from 2014. The email and file metadata both indicate they are created on September 1, 2020.
September 1, 2020: New folders are created on their copy of the laptop drive, according to the Washington Post.
September 2, 2020: Another date when folders are created on their copy of the laptop drive, according to the Washington Post.
September 2, 2020: A variation of a Burisma email from 2016 is created and added to the cache. A phone number in the footer of the email is redacted and replaced with "Sent from my iPad". The email and file metadata both indicate it was created on September 2, 2020.
October, 2020: Giuliani and Bannon reportedly give New York Post the data.
October 2020: Someone from a West Coast location may have accessed the copy of the drive that the Washington Post later analyzed. Three more directories are added on this date.
November 3, 2020: Two blank emails are created and inserted with no recipient, subject or body.
December, 2020: The latest date on the emails found by cyber-forensics firm Maryman & Associates, who provide an analysis to the Daily Mail.
Allegations of State Sponsorship
Dozens of former intelligence officials have written that the Hunter Biden laptop affair "has all the classic earmarks of a Russian information operation." Then-Director of National Intelligence (DNI) John Ratcliffe contradicted this allegation of state sponsorship. The matter is under FBI investigation.
During this time period, Giuliani has met with and worked with Andrii Derkach, who the Treasury Department considers "an active Russian agent" and who was alleged by the DNI to be using leaks to undermine the candidacy of Joe Biden. Giuliani estimated the odds that he'd worked with a Russian spy "no better than 50/50".
Email count discrepancy
An early analysis by Maryman and Greenfield on behalf of the Daily Mail identified 154,000 emails. According to the Daily Mail, this cache contains 128,775 emails . The cache contains that many files, however several of the files are not emails, and are instead contacts or appointments in .emlx or .eml format. In a more recent Daily Mail article, they refer to the original cache they shared with Maryman & Associates as containing 142,838 emails.
Attempts at verification
Approximately 22,000 emails from a similar cache* have been verified using DKIM or ARC. This Washington Post analysis notes files and directories were created after the date the laptop would have allegedly left Hunter Biden's custody. Several of these dates coincide with dates where emails have been inserted into the cache.
It's unknown if the intent was to highlight these for research use, or if it was part of a failed attempt to edit and implant emails. It is possible they were deliberately sloppy attempts, and that more sophisticated attempts to modify the contents of the dataset remain.
Reports on the analysis by Maryman & Associates offers surface verification of the data while raising significant questions. DDoSecrets will update our article with research links that shed more light on these issues.
Questions for future research include:
How would the pair of laptops dropped off in April 2019 include emails up to December 2020?
Why does the Daily Mail have two different counts of the number of emails they analyzed?
Further, diligent attempts at verification are imperative for any reporting on the substance of the emails and any other associated materials.
*While the Washington Post described the email cache as having a similar amounts of documents, they listed its size as 4.3 gigabytes. We have mirrored the 3.6 gigabyte cache as published by Garrett Ziegler. The cause of this dataset size discrepancy is not known.