An Innocent Man is Framed for Child Porn by a PC Virus

How many other innocent men are sitting in prisons with their lives destroyed because of a computer virus?
 
How many other families have had their lives destroyed and their life savings wiped out because a family member was wrongly accused of knowingly possessing child pornography?

This website is inspired by the events surrounding the conviction of an innocent man, Nathaniel Ethan Solon, for possession and receipt of child pornography.  Nathaniel is known as "Ned" to his friends and family so that is the name we use on this website.

Throughout this entire case, Ned's family has held out hope that justice would be served and Ned's conviction would be overturned, but after exhausting every legal avenue, and being astonished time and time again with the courts' interpretation of the evidence, maybe it's time to question whether this family is delusional. The majority of people with a family member in prison think that person is innocent, so perhaps delusion and denial would not be beyond the realm of possibility in this case.

There are really only two choices—either we're delusional, or in this case, the justice system has truly failed.  Of course, we feel it is the latter, but then again, isn't that the kind of thinking you would expect from delusional people?  For this family, it is difficult to accept that any reasonable person could assess the facts in this case and come away believing Ned is guilty beyond a reasonable doubt.
 
These are the facts and circumstances in this case.  We'll let you be the judge.

• On the evening of September 20, 2006, Ned was home alone trying to download some computer games using LimeWire.  The games he attempted to download contained Trojans that direct evidence shows were introduced to his computer through the games he attempted to download.  (United States v. Solon, District of Wyoming, Case 2:07-CR-00032-CAB, Trial Transcript, Vol. V, 11/07/08, pp. 44, 100).
   
• Despite the government's claim to the contrary, the direct evidence from Ned's computer clearly proves that the anti-virus software installed on his computer was not working properly in that it was not running continuously as it is designed to do (Id., pp. 95, 116-118).  Furthermore, the direct evidence establishes that the anti-virus program was most likely not running at all the evening of September 20, 2006, which is when he used LimeWire in an attempt to download computer games that unfortunately contained Trojans (Id., pp. 122-123).
   
• The version of LimeWire installed on Ned's computer was an older version that has an opening in the software that allows people to get into your computer, which results in the computer being vulnerable to attack (Id., p. 24).  In addition, the settings in the LimeWire properties file on his computer showed a "forced" port and a "forced" IP address, both of which were peculiar and have yet to be explained, but look suspicious in light of the fact his computer was being attacked (Id., Vol. III, 11/05/08, pp. 183-184, and Vol. V, 11/07/08, pp. 21-24).
    
• On June 23, 2006, prior to the search and seizure of Ned's computer on September 21, 2006, law enforcement observed his computer offering to share child pornography (Id., Vol. II, 11/04/08, pp. 18-35).  Direct evidence from the computer's anti-virus program shows virus activity occurring on June 22 and 23, 2006 (Id., Vol. V, 11/07/08, p. 96).
     
• From the end of June until the end of July 2006, direct evidence shows that there was no virus activity occurring on Ned's computer during that time (Id.).  During this time when there was no virus activity on that computer, law enforcement did not observe Ned's computer offering to share child pornography.
     
• On July 29 and 30, 2006 virus activity once again occurred on Ned's computer (Id.), and on August 4, 2006 the anti-virus program found and deleted a Zlob Trojan (Id., p. 95).
      
• Virus activity started up again on Ned's computer on August 7, 2006 and continued through August 11, 2006 (Id., p. 96).  On August 7, 2006, the anti-virus program detected another Zlob Trojan, but there is no indication from the anti-virus program that that particular Trojan had been deleted (Id.).  During this time of virus activity, law enforcement once again observed Ned's computer offering to share child pornography, specifically on August 9, 10 and 11, 2006 (Id., Vol. II, 11/04/08, pp. 46-50).
    
• Direct evidence reveals that the same Trojan that appeared on August 4th and August 7th, also appeared on August 9th, 2006, which was an indication that these Trojans were resident on the system, that they were continuing to try to work themselves, and that the anti-virus program was sometimes seeing them and sometimes not (Id., Vol. V, 11/07/08, p. 116).
   
• Then from August 11th until September 10, 2006, which is when a virus warning appeared, there was no virus activity occurring on Ned's computer (Id., p. 43).  During this time when there was no virus activity on his computer, law enforcement did not observe Ned's computer offering to share child pornography.
   
• Again on September 17, 2006,  more virus warnings show up (Id.).  At some point from September 18th to the 21st, the anti-virus program on Ned's computer turned off.  On the evening of September 20th, child pornography downloaded to that computer.  At 5:44 a.m., the morning of the seizure, September 21, 2006, the anti-virus program turned on again.  It turned off again at 2:17 p.m., which was most likely at some point during the seizure (Id., pp. 122, 123).
   
• The government's report from the anti-virus program installed on Ned's computer indicated that it would shut itself off and start up again on numerous occasions when the virus activity was happening (Id., p. 95).  The anti-virus program continually starting and stopping is indicative of something attacking the virus protection program (Id., pp. 116-118).
   
• The government's expert, Agent Huff, testified that on the day of the search, he found nothing in Ned's house suggesting an interest in child pornography (Id., Vol. IV, 11/06/08, p. 9).  In addition to the hard drive, three VHS tapes and a Sony Video 8 tape were seized.  None of these tapes had anything to do with child pornography (Id., Vol. II, 11/04/08, pp. 74-75).  Furthermore, other than what was located in the unallocated space of Ned's hard drive, there was no child pornography found saved on his computer or copied to CDs or DVDs.
   
• Agent Huff further testified that there was no indication that Ned or anyone else viewed the images that were on his computer (Id., Vol. III, 11/05/08, p. 112; Id., Vol. IV, 11/06/08, pp. 14, 55, 57).  He testified that he found no email communication regarding child pornography, and no indication that Ned was participating in chat rooms related to child pornography (Id., Vol. III, 11/05/08, p. 165).
   
• The defense forensic computer expert, Ms. Loehrs, did a thorough examination of Ned's computer, including locating search terms that had been used to browse the internet and search terms that had been used in LimeWire, and she too found nothing related to child pornography or nothing out of the ordinary (Id., Vol. V, 11/07/08, p.10). 

A Trojan often acts as a backdoor, which allows a hacker to have unauthorized access to the affected computer.  In the summer of 2006, Trojans were being introduced to Ned's computer through the games he was attempting to download using LimeWire.  These Trojans were periodically attacking his computer. 
 
Also in the summer of 2006, law enforcement observed Ned's computer offering to share child pornography, specifically on June 23rd, and then again on August 9th through August 11th, which happened to be at the exact same times that Trojans were attacking his computer.  Trojans were again attacking his computer at the time of the seizure, and during the time of that attack, child pornography once again appeared on his computer.
 
When Trojans were not attacking Ned's computer, there was no observation of his computer offering to share child pornography.  During the summer of 2006, the times when there was no virus activity on his computer were substantial.  From the end of June until the end of July, a one-month period, there was no virus activity, and during that time, law enforcement did not observe Ned's computer offering to share child pornography.  From August 11th until September 10th, again a one-month period, there was no virus activity, and again during that timeframe, law enforcement did not observe his computer sharing child pornography.
 
The reasonable inferences that can be drawn from these facts are that every time Ned attempted to download computer games, he was instead getting Trojans which were attacking his computer and causing child pornography to be downloaded.  A reasonable jurist could reasonably infer that if Ned were knowingly receiving and possessing child pornography, then law enforcement would have observed that activity during the long periods of time when there wasn't any virus activity on his computer.  The fact that law enforcement only observed Ned's computer offering to share child pornography at the exact same times that Trojans were attacking his computer reasonably infers a connection between the Trojans and the child pornography. 
 
In addition, the night before the search when Trojans were attacking Ned's computer and his anti-virus program was not running, 46 files with names consistent with child pornography were downloaded to that computer.  At 5:44 a.m. the day of the search, the anti-virus program started up again.  By that afternoon when the computer was seized, there were only seven files that contained child pornography left in unallocated space.  In addition, none of the files that law enforcement observed in June or August were on Ned's computer. 
 
In light of that evidence, a reasonable jurist must ask why the rest of those 46 files were not found in unallocated space.  There was no evidence that a disk cleaner was or had been on his computer, and no evidence that Ned had used a disk cleaner to erase those files from unallocated space.  From these facts, a reasonable jurist could infer that once that anti-virus program was running again, it would work to remove the damage caused by Trojan activity and was near the end of its process at the time the computer was seized.
 
Reasonable inferences from the facts constitute circumstantial evidence, and the circumstantial evidence in this case is that Trojans were responsible for child pornography on Ned's computer.  This circumstantial evidence is made exponentially stronger when it is coupled with the fact that absolutely no other evidence exists that links Ned to child pornography.
 
The government has inferred that because Ned was home alone using LimeWire, he not only knew child pornography was on his computer, but he actually downloaded it.  However, in making that inference, it appears the rest of the facts and circumstances in this case have been ignored. 

The events of Ned's legal case began on September 21, 2006 when law enforcement searched Ned's home for child pornography.  After an exhaustive search of both his home and his computer, nothing was found.
 
Law enforcement then removed the hard drive from Ned's computer and took it back to their lab for forensic testing.  Only after several days of examination were they able to find trace evidence of child pornography.
 
As far as Ned knew, there wasn't any child pornography on his computer so he wasn't worried.  Eventually he went and bought another hard drive for the computer and life continued on for him.
 
It was a complete surprise to Ned and his family when on January 20, 2007 he was arrested and charged with "knowingly" possessing a hard drive containing digital images of child pornography.
 
A trial commenced November 3, 2008 and on November 10th the jury reached a verdict of "guilty."  On January 21, 2009 Ned was sentenced to 72 months in federal prison.
  
On February 5, 2009, Ned filed a Notice of Appeal, and on February 17, 2010, the Tenth Circuit Court of Appeals in Denver rendered its decision to affirm the conviction of Ned Solon for Receipt and Possession of Child Pornography.  A review of the full court was requested, but denied on April 7, 2010.
 
On June 17, 2010 a Petition for Writ of Certiorari was filed with the U.S. Supreme Court, but on October 4, 2010, it was denied.

On September 7, 2011 a Motion to Vacate, Set Aside, or Correct a Sentence By a Person in Federal Custody (Motion Under 28 U.S.C. § 2255) was filed.  On May 24, 2013 a judgment was issued denying not only that motion, but also denying a Certificate of Appealability (COA).

Ned filed another Notice of Appeal on June 21, 2013, and his Opening Brief and Application for a Certificate of Appealability (COA) was filed September 3, 2013.  On December 3, 2013, the Tenth Circuit denied the COA and dismissed the appeal.  A Petition for Panel Rehearing was filed on February 14, 2014, and on February 19, 2014, that petition was denied. 

Unfortunately for all of us, the mentality in this country is, "if it is on your computer, then you must be guilty."  As this family has learned the hard way -- that is not always the case.

We have posted numerous articles on this subject and will continue to post articles as we find them.  Those can be found on the Newspaper Article link.  For those people who aren't in this situation, but who use peer-to-peer networking programs, or have children who use peer-to-peer networking programs, it is our hope that this website will be a wake-up call for them to uninstall those programs immediately, and protect their computers with effective anti-virus software.

Unfortunately, we don't have many words of encouragement for others who do happen to find themselves in this type of nightmare.  About the only thing we can do at this point is use this website to educate potential jurors and provide the Transcripts and Court Documents from Ned's case in the hope that these documents may help others be prepared for the nasty battle ahead.

---