A poorly written underscore sent an innocent man to prison for 18 months: the digital error that no one detected

The case It began in 2018 in Wisconsin, United States, when the mother of a 12-year-old girl found an inappropriate image on her phone and notified the police. A forensic analysis recovered 125 messages exchanged on Kik with an adult who used the name “fus__ro_dah”, with two underscores after “fus”.

By asking Kik for that account data, one researcher wrote “fus_ro_dah”, with a single underscore. The platform responded to the query received, which corresponded to another account. That account belonged to Klayme, a young man who lived in the Canadian province of Nova Scotia.

From there, each link seemed to confirm the previous one. The email associated with the user pointed to an IP address in Canada. Google provided records linked to that connection and the provider Bell Aliant linked the IP to Klayme’s address. The Halifax police raided the house, seized phones and computers, and arrested him in 2020.

The problem was in the first piece of information. No conversations with the minor, no intimate images or traces that linked him to the investigated exchange appeared on Klayme’s devices. Nor could it be proven that he had used Kik during the months in which the events occurred. Even so, he was found guilty in 2023, received the sentence the following year and served it in full.

The mistake only appeared when preparing the appeal. The Nova Scotia Court of Appeal overturned the convictions and was definitive: Klayme was “factually innocent” and “should never have been charged, much less convicted.” ” id=”element-body-7″>Two analysts discussing online data in front of laptop

“Fus ro dah” is an expression known among players of The Elder Scrolls V: Skyrim. In the video game it is a shout that allows opponents to be thrown into the air. The popularity of the phrase explains why two different users could choose almost identical variants, separated only by an underscore.

The investigation by the Dane County Sheriff’s Department began with the minor’s phone. There were the conversations and a precise reference to the user “fus__ro_dah”. To identify who was behind it, the police sent a warrant to Kik, but transcribed the identifier with one less character.

Kik searched for “fus_ro_dah” and returned the information of the owner of that account. The platform processed the name provided by the police. The failureIt was in the transcript. From that moment on, the investigation stopped following the author of the messages and began gathering data on Klayme.

The sequence had an appearance of solidity. The user sent an email, the email, to Google records, the records, to a Canadian IP address and the IP, to the address reported by the Internet provider. Each step was compatible with the previous one because they all developed the identity obtained from the incorrect account.

The Halifax police executed the raid on February 5, 2020. He found that Klayme had a Kik account, an expected fact because he had precisely been identified through his username. The analysis of his teams, however, did not find the conversation investigated, the images exchanged or contacts with the girl.

Despite this absence, Klayme was accused of attracting a minor under 14 years of age by electronic means, providing her with sexually explicit material and possessing sexual abuse material childish. The court considered that direct and circumstantial evidence allowed him to be identified as “Jay”, the man who was speaking to the minor.

During the trial, Klayme maintained that he had not sent those messages. His defense raised the possibility that his email had been hacked, an explanation that also did not describe what happened. No one reviewed the most basic premise: the name of the account requested from Kik did not match the name on the girl’s phone. Klayme was convicted and spent 18 months in prison. After leaving, he was still under the conditions of parole while trying to reverse the ruling.

The difference appeared in the final stages of preparation of the appeal. Klayme described it as “a subtle mistake that changed the course of my life”: the order had requested the data of “fus_ro_dah”, although the user investigated was “fus__ro_dah”. The prosecutor’s office reviewed the file and accepted that the appeal should be successful. The query with the correct identifier would have led to another individual, named Jay, whose IP address appeared to be located in California, according to the Court.

The discovery made it possible to formally recognize the innocence of a man who had already served the totality of the penalty. The court annulled the three convictions, vacated the sentence and parole and entered acquittal verdicts. Official records show that a motion to add new evidence to the record was filed during the appeal.

The ruling also left an open question. The information needed to detect the difference between the two accounts was alreadyavailable during the trial. However, the Court noted that there is no confirmed explanation as to how it went unnoticed for so many years. An IP address, an email, or a response from a platform can be technically correct data and, at the same time, lead to a false conclusion when the initial identifier is poorly copied. The accumulation of records can reinforce that error of origin.

Computer forensics standards emphasize preserving evidence, maintaining the chain of custody, validating procedures and ensuring that results are accurate and repeatable. They also require analyzing the data within its context. In this case, the lack of incriminating material on Klayme’s equipment was not enough to stop a hypothesis built around the wrong account.

The omitted symbol was small and visually easy to miss. Its consequences were enormous. It transformed a user unrelated to the case into a suspect, accused and convicted, while the investigation moved away from the man it was really looking for. The acquittal corrected the record, but came after Klayme lost 18 months of freedom.