Man Cleared of Child Porn Charges After Hiring Computer Forensics Expert


Printer-friendly version Email this CRN article

Here's a lesson for computer neophytes -- when you get accused of having child porn on your computer, subsequently get fired, lose your friends and family and face prosecution -- hire a computer forensic expert to clear your name -- assuming you're innocent of course.

That's what Michael Fiola, a former employee of the Commonwealth of Massachusetts did after getting fired for having child porn on his laptop. After a cursory examination, state investigators did in fact find child porn, which Fiola swore he didn't download and wouldn't even know how.

With charges that he downloaded images of child pornography onto his notebook filed against him, the 53-year-old Fiola became a pariah in his community, was shunned by friends and family and watched his wife develop a stress-related illness.

Fiola finally hired forensic computer expert Tami Loehrs of Tuscon, Ariz. to get to the bottom of the nightmare.
The trouble began after Fiola, an investigator for the Department of Industrial Accidents, was issued a new laptop by the DIA in Nov. 2006 after his originally-issued laptop was stolen.

The replacement was a Dell laptop computer equipped with a Dell broadband wireless card and Internet access through Verizon wireless, according to Loehrs' forensic report. The laptop was configured earlier that day.

But by March 2007, an investigator red flagged the computer after reviewing a Verizon wireless bill, noticing abnormally high data activity on Fiola's laptop -- usage was four-and-a-half times greater than any of the other investigators. Several days later, Fiola's laptop was taken and reviewed by investigators who found Website files and images of child pornography in the temporary Internet files folder. Subsequently, Fiola was fired and faced prosecution by the state.

In her examination, Loehrs noted that on certain dates, porn appeared "in the temporary Internet files with no apparent origin or user interaction preceding the pornographic activity. There were no Web site addresses typed into the browser, no searches conducted, no other pages accessed that led to the pornography appearing on the laptop. There are no Symantec logs for this date."

Loehrs said that although Symantec Corporate Edition was previously installed with the computer name BOLLE04 on September 20, 2006, it was reinstalled under the profile for "michaelf."

In addition, "Microsoft's Systems Management server had previously been installed on September 20, 2006 with the computer name BOLLE04 and it appears that the new computer name BOLIN17 was not changed in the SMS software. According to the registry settings, the Windows Firewall was turned off."

The evidence showed that when Fiola used the laptop for the first time on November 20, 2006, he created several shortcuts to work related files such as mileage sheets, accessed several work-related Web sites, including Massachusetts Municipal Association and added these Web sites to his Internet favorites.
Then on November 27, the first evidence of pornographic activity appeared on the computer.

"With no preceding activity by Fiola, a file titled smp[1].htm appears in the temporary Internet files folder," Loehrs wrote in her report. "The forensics software identifies this file type as unknown and the file is not viewable. However, the underlying HTML code includes several URLs in addition to several other unusual files. Because there was no user activity that prompted these files to appear such as an Internet search, access to other Web sites, checking e-mail or downloading files, this suspicious activity is indicative of a virus and/or Trojan that was likely resident on the Laptop when Fiola received," stated Loehrs.

Viruses and Trojans that were found on the laptop included Downloader, a Trojan that is a Windows Metafile image file; DriveCleaner, a rogue application distributed through aggressive pop ups; Feebs Family, malicious JavaScript that is usually embedded in a malicious Web site; and Trojan.ByteVerify.

But Loehrs said that "it is unknown what viruses and Trojans infected the computer during those four and a half months that were not recorded by Symantec or that did not leave a trace in the file system."

In conclusion of her report, Loehrs exonerated Fiola.

"In general, the pornography found in the temporary Internet files folder does not represent activity conducted by a user, specifically Michael Fiola," said Loehrs. "It is evident from reviewing the Symantec logs that the virus protection software was either not configured correctly or was not functioning properly. Log files for November and December are missing and entries for November are incomplete. Once they have been allowed to execute their code, they erase evidence of their tracks making it impossible to assess the damage. While it is impossible to say how badly the laptop was infected while it was in the possession of Michael Fiola, I can say with 100 percent certainty that the laptop was compromised by numerous viruses and Trojans and may have been hacked by outside sources."

According to her assistant, forensic analyst John Hansen, Fiola's computer was initially examined for "a grand total of three hours" by the DIA's IT department and never checked by forensic investigators. By contrast, Hansen said that he and Loehr examined the computer for over a month. Hansen also said that "no one was bothering to check" logs to see if the laptop was experiencing problems.

After Loehr's report was completed, charges were dropped aginst Fiola. "The overall forensics of the laptop suggest that it had been compromised by a virus," said Jake Wark, spokesman for Suffolk District Attorney Daniel Conley, according to the Boston Herald.

As for Fiola, he moved to Rhode Island and now works for another company. The DIA doesn't want him back and told the Boston Herald that it "stands by its decision" in terminating him. The Herald also quotes Fiola saying that he plans on suing the DIA for "destroying our lives."

"Imagine this scenario: your employer gives you a ticking time bomb full of child porn and then you get fired and then you get prosecuted as some kind of freak," Fiola's attorney Timothy Bradl, told the Herald. "Anybody who has a work laptop, this could happen to," he said.

Printer-friendly version Email this CRN article