Accused over thumbnails: Inside one family’s digital nightmare

Article content

A knock at the door. A police search. A rose gold iPhone. Child pornography allegations. Shocking as the charges were against his son, a Woodstock father says the family ordeal that followed shattered his faith in the justice system. Brian Williams reports.

Article content

Article content

CHAPTER 1: THE SEARCH WARRANT

A knock at the Spina household’s front door started the family’s waking nightmare.

Article content

Andrea Spina answered, then rushed back to her husband, Mario, slowly getting out of bed.

Get dressed, she urged him.

Chaos and confusion began.

The morning of Jan. 19, 2022, was a stark contrast to what Mario calls the household’s “very simple, quiet family life.”

He said he heard “heavy boots” and “marching” from the people who’d entered the house.

“We have grandma in the house, who doesn’t speak any English, doesn’t have a clue what the heck is going on, the dog is freaking out and all this commotion,” Mario said.

He was shocked to discover six police officers equipped with firearms and a search warrant for the suburban home in northeast Woodstock, a city of about 48,000 in Southwestern Ontario’s auto belt.

“We had no clue why they were here,” Mario said.

Mario, Andrea, her mother, the couple’s daughter and their 19-year-old son, Kristian, lived in the bungalow at the time. Except for Kristian, who was at work, everyone was home when police showed up to search the place.

“We thought something happened to Kristian,” Andrea said.

The family was “sequestered in the living room” as Woodstock police officers searched the house, said Mario. Det. Mike Haegens gave them a copy of the search warrant and explained the investigation.

Article content

Haegens said the investigation involved a Snapchat account with a handle connected to Kristian. Snapchat is an app that allows users to send and receive videos and photos that automatically delete after being viewed for 10 seconds, longer if left unopened.

An old email address used by all family members was also connected to the investigation, and both the Snapchat handle and email address were linked to uploading and sharing child pornography, police told them.

“We never thought for a million years that there was anything, because that’s not who my son is,” Mario said. “We knew the moment they came through the house and they told us why they were here.”

Andrea was as shocked as her husband.

“When they said what they were looking for, I said to myself, ‘It’s got to be a mistake,’” she said. “We knew we raised a wonderful kid here, and I was sure it’s got to be a mistake.”

Mario confirmed to police that the email address in question was used by the family, but hadn’t been in a long while.

“I said, ‘Well, wait a minute. We haven’t used that (email address) in years and it’s full of junk,’” he said, adding it hadn’t been removed because it was the main email address linked to the family’s telecom provider.

Article content

Article content

The family told Haegens that Kristian was working a shift at Vuteq, an auto parts maker.  The detective left for the plant while the other officers searched.

As they waited in the living room during the search, his daughter told police that Kristian’s Snapchat account had been compromised months earlier, Mario said.

After Haegens and another officer arrived at Vuteq, Kristian joined them in a private office. Kristian said he had no idea why the police wanted to speak to him.

“The first thought that went through my head was something happened to my family,” Kristian said.

It was in that office at work that Kristian was told his Snapchat account had been flagged for uploaded child pornography.

“I was at a loss for words,” he said. “I know what’s on my phone, I know what I do on my phone and I know that this isn’t one of them.”

Believing he had nothing to hide, Kristian handed over his phone to Haegens, gave him the password and told the detective his Snapchat account had been hacked.

“That’s why I gave them (the phone), no hesitation,” Kristian said, adding he thought officers would realize his digital footprint would corroborate his innocence.

Article content

Woodstock police seized numerous phones from the Spina residence, including several old devices from Kristian’s room that he no longer used. A rose gold iPhone was among the items collected.

About two hours after the officers arrived, they left with some boxes of material seized from the home, Mario said.

That afternoon, Mario and Kristian went to the police station to retrieve some of the devices that police had searched and cleared to return to the family. Kristian spoke to police and again explained that his account had been hacked.

The Spinas didn’t know it but that day was only the beginning of what would become a year-long family struggle, one that an expert warns can happen to anyone with a phone and social media accounts.

“Unfortunately, the reality” for social media users – “in this case (users of) Snapchat, specifically” – is that they could “inadvertently” find themselves susceptible to similar circumstance, said Jason Conley, a digital forensic expert who examined Kristian’s case. Security measures, such as two-factor authentication, are useful ways social media users can protect themselves from hackers and cyber criminals, he added.

Article content

The account of what happened to the Spinas is based on interviews with family members, a court ruling, expert reports and a summary by the Law Enforcement Complaints Agency (LECA), an independent civilian oversight agency of the Ontario Ministry of the Attorney General.

For the Spinas, there would be financial setbacks, health scares, uncertainty and a draining emotional toll.

Over 2022, and into the next year, Kristian found himself feeling like he had to prove his innocence, and his son’s predicament drove Mario to pursue changes to a justice system he believes lacks reliable procedures to protect the  innocent.

“The forensic expert at the Woodstock police didn’t know what he didn’t know, and the Crown attorney was relying on the investigative efforts of the police,” Mario said. “Is it negligence or is it ignorance? At the end of the day, what the heck is the difference to the accused?”

CHAPTER 2: THE ARREST

The year before, on July 17, 2021, Kristian received an email from Snapchat to the email address the family had essentially stopped checking. The email from Snapchat advised him his account had been accessed by an unknown device in Hamilton that he didn’t own.

Article content

On Aug. 5, 2021, Kristian was locked out of the account, a timeframe Conley noted was in close proximity to when the alleged child pornography was uploaded on his account.

Kristian tried logging into the account, but realized the password had been changed by another party, he said.

“I made a new (account),” Kristian said. “I did what every guy my age would do and just made a new one.”

Kristian said he set up his new account with a two-factor authentication key for extra security, after losing access to the old Snapchat account.

But, Snapchat wasn’t the only account of Kristian’s that had been hacked, he discovered.

On Jan. 5, 2022, Kristian received an email from Instagram. He was notified that his account on the social media platform had been accessed suspiciously from a location in Vancouver and the account’s email address was changed from his to receivecash731@gmail.com. Kristian was in Woodstock at the time, far from the west coast.

When illegal videos are uploaded to Snapchat and the company becomes aware of the content, it will report the videos to to the National Center for Missing and Exploited Children (NCMEC), an organization funded mainly by the U.S. Department of Justice that works with law enforcement and others to fight child sexual exploitation.

Article content

“The sexual exploitation of any young person is horrific, illegal and against our policies. If we are made aware of any content sexually exploiting minors – whether through our proactive detection technology or confidential in-app reporting tools – we remove it, we lock the violating account and we report it to authorities,” a Snapchat spokesperson wrote in an email.

The American group forwarded the information to its Canadian counterpart, the National Child Exploitation Crime Centre (NCECC), because the IP address was found to be in Canada. The RCMP tracked the account and email to an IP address in Woodstock belonging to the Spinas, and forwarded the tip to Woodstock police.

Woodstock police received the RCMP tip on Oct. 12, 2021, according to the LECA report. Woodstock police Chief Rod Wilkinson confirmed by email the tip was received in October 2021. The investigation would take months, with police having to obtain judicial approval for documents to pinpoint the location of the IP address that led to a home address in Woodstock, resulting in more sign-offs for search warrants, his statement added.

Article content

With a warrant to search devices from the Spina home, mining the phones for depictions of child pornography fell to Woodstock’s digital examiner, a civilian employee, Special Const. Robert Gower. Over several days, Gower worked to locate child porn on the confiscated devices. He found thumbnail images on Kristian’s former phone – the rose gold iPhone – that had been left in a bedroom drawer.

Gower’s search of the iPhone revealed eight still images, some reproduced multiple times, for a total of about 50 thumbnails, meeting the police definition of child porn.

The thumbnails — small images of pictures or videos — found on the phone matched the video connected to Kristian’s account that was first flagged by Snapchat and passed along to Woodstock police.

On Feb. 3, 2022, Mario contacted police for an update on the search of Kristian’s phones, wondering when he could pick them up.

It wasn’t that simple.

Haegens responded that Kristian needed to contact him.

Around 9:30 a.m., Kristian phoned Woodstock police. He was told his phone contained images of child pornography and that charges would be laid.

Article content

“A digital forensic examination was conducted and, as a result, a device contained materials that met the Criminal Code definition of child pornography,” Wilkinson’s email to The Free Press stated.

“When they said they found thumbnails on the old phone, and they support that there was something that went through the account and that they’re pressing charges, that was a bomb,” Mario said.

“We thought there’s an explanation for this,” he said. “We just don’t know how a hacker or somebody took over an account which was able to put those images on my son’s device.”

Kristian was in disbelief.

“In my head, I’m like, ‘This makes absolutely zero sense at all,’” he said. “I don’t have a clue how it happened, what happened, because I’ve never seen any of this stuff.”

Arrangements were made for Mario to turn in his son the following day to face three charges related to child pornography.

Before then, the 19-year-old’s only brush with the law had been a speeding ticket.

The family consulted a lawyer.

“The advice we were getting from our lawyer we had at that time, a local criminal attorney . . . was don’t tell the police anything, because they’ll use it against you,” Mario said. “The police right now are not your friends.”

Article content

Mario and Andrea drove Kristian to the police station the next morning. It was hard for them to watch their son face a new struggle.

At age eight, Kristian was diagnosed with Hodgkin lymphoma, a type of cancer that affects the lymphatic system.

Two weeks after the diagnosis, Kristian walked out of the hospital without hair because of chemotherapy treatment.

He made a full recovery after six months.

“When that cancer bomb goes off, everyone comes to help you — they come from everywhere. The doctors, the oncologists, the therapists, the counsellors, your family, your friends, your neighbors. You come home, your snow’s shoveled, your grass is cut — all that stuff,” Mario said.

This struggle felt much different.

“This is a young man who has had battles to deal with earlier on in life, through his cancer,” said Mario. “So, imagine him going into this police station with all these police officers looking at him.

“Two or three officers came out into the vestibule area to greet Kristian and myself, and the detective was there, and then the door opened up to go into the belly of the station. It felt like a walk of shame for my son, and he didn’t do this.”

Article content

His son was booked and held for a bail hearing. Mario left.

“I got back in the car, and I was in shock with tears,” Mario said. “My wife was waiting for me in the car and we were terrified. We didn’t know what to do.”

Andrea recalled the heartbreak of dropping her son off at the police station.

“It was horrible to leave him behind, and not knowing exactly what he’s going to go through,” she said. “You see these things in the movies, but I never in a million years thought it was going to happen to our son.”

Watching his son appear on a courtroom video feed later that day was surreal, Mario said. Some other people appearing by video wore jailhouse jumpsuits, making the surreal a stark reality.

“It was gut-wrenching,” he said.

Kristian was released later that afternoon. He faced three charges: One each of distributing, possessing and accessing child pornography.

“There’s no parenting courses on what to do in case your son’s arrested for something he didn’t do,” Mario said.

Before Mario could tell family members of his son’s plight, Woodstock police named Kristian and the charges against him in a news release.

Article content

Now, Kristian had to deal with a second court: public opinion.

Mario said he feared people would jump to conclusions when they read about the charges and saw Kristian’s name. “(People assume) when they see this example, the charges and a name associated with it, the police must have quite a lot of evidence here.”

CHAPTER 3: THE HEALTH SCARE

Only Mario, his mother-in-law and Kristian were home the morning of March 26, 2022, about a month and a half after his arrest.

Mario’s mother-in-law told Mario that Kristian had a headache and was feverish, but she’d check on him periodically.

A little while later, Mario said he heard her “screaming like that wild scream, something’s really wrong.”

Mario had watched his son battle cancer. He’d watched Kristian’s final year of high school – his graduation, classes, socializing – stolen by the Covid-19 pandemic. Most recently, he’d watched him be charged with crimes he was certain Kristian hadn’t committed.

He said that morning he watched his son dying.

“I fly out of the kitchen, and my son’s on the bed violently convulsing, foaming at the mouth,” Mario lamented. “He went grey, his lips were blue, he was dying.”

Article content

Kristian had never had a seizure before that morning.

Panicking, Mario called 911 and managed to flip Kristian on his side.

An ambulance took Kristian to the hospital, and a shaken Mario got a ride there from a neighbour. Mario was unsure if his son was alive.

“I just couldn’t believe where we were going, and why we’re going there, after what happened only weeks prior,” Mario recalled.

At the hospital Mario found Andrea, who worked at the health centre as a porter. They made their way to the emergency wing and found their son “hooked up” to monitoring equipment in the intensive care unit.

Kristian was later taken to University Hospital in London, where a doctor discovered Kristian had arteriovenous malformation. That’s a tangle of blood vessels that irregularly connects arteries and veins, which can cause bleeding in the brain, stroke or brain damage. Kristian had surgery a year later to correct the condition.

Kristian spent a week in the hospital after the seizure.

Mario wonders whether the stress his son was under triggered the health scare.

Kristian doesn’t believe that was the main trigger for his seizure, but “I think it played a huge part.”

Article content

He made a full recovery and attended Fanshawe College in the fall of 2022, trying to put the weight of the charges against him to the back of his mind.

“When I was in school, I started off well, and then as time went on the stress was just putting weight on my shoulders that I couldn’t do any more,” he said. “So, I had to drop out of college first year and the stress was just insane.”

And Kristian still had the worry of the charges against him.

CHAPTER 4: THE DEFENCE

The family was certain Kristian was innocent, but Mario said speaking with lawyers made him anxious.

It didn’t help that one lawyer, who had experience with child pornography cases, told him that in most cases the accused who claimed their equipment had been hacked had committed the crime.

“Right away, whatever evidence that you have that has given you comfort, and you think ‘OK, this is going to help explain things,’ is taken away from you,” Mario said.

He knew he needed legal muscle to help his son, Mario said, but that doesn’t come cheap. The least expensive lawyer he found cost $350 an hour. Still, there was no expense he and his wife would forego to clear Kristian’s name.

Article content

“Basically, what you have to have is a war fund,” Mario said. “You can’t just make a race to the bank and you’ll get a loan – you got to have money, liquid money.”

The Spinas sold a rental property they owned, which was part of their retirement fund. Getting good legal help was that important, Mario said.

“It’s an absolute lifesaver. You will have your day in court, and in court, the system works: Innocent until proven guilty. But you have got to get there, and you have to get there with the right people in your corner and they don’t come cheap.”

Emails from Snapchat indicated Kristian’s account had been accessed by someone else. His Instagram account had also been compromised. Although the Crown had to prove his guilt, it felt more like Kristian had to prove it wasn’t him who’d uploaded and shared the video flagged by Snapchat, and it wasn’t him who was responsible for the thumbnails found by police on his old phone, Mario said.

Looking outside Woodstock for a lawyer, the Spinas hired Michelle Biddulph from the Toronto law firm Greenspan Humphrey Weinstein.

Kristian’s defence team enlisted Conley, the digital forensic examiner, who was working then for Envista Forensics, to examine how it was possible for another person to access Kristian’s Snapchat account, and how the images could wind up on the rose gold iPhone without his knowledge.

Article content

Conley’s report broke down how that could happen. His probe also uncovered apparent evidence of Kristian’s innocence and raised questions about the police investigation.

Article content

Because Kristian had not clicked on and seen the video containing child pornography on his phone, the rose gold iPhone he had stopped using, the thumbnails created on the phone were not erased, Conley told The Free Press.

Any other digital forensic examiner could have replicated the process and concluded it “adds up,” he said.

Without Snapchat co-operation and software engineers to confirm “exactly how it went down,” it’s not 100 per cent possible to know if that’s how the thumbnails ended up on Kristian’s phone, he said. Still, there’s an overwhelmingly strong possibility the synchronization led to the images on the rose gold iPhone, he said.

Conley did more than just show how the images could end up on the phone: He also uncovered evidence that appears to substantiate that Kristian wasn’t aware of the video or the thumbnails.

Conley went through Kristian’s search history and concluded there were no searches or content related to child pornography, which are commonly present when someone is deliberately searching for such illicit images or videos.

“(The police) looked at all the devices from the home, including Kristian’s current phone, and found nothing,” Conley said. “That’s a huge red flag.”

Article content

Conley said another concern to him was what appeared to be police reluctance to investigate a notification from Snapchat indicating Kristian’s account had been accessed from an IP address in Hamilton in July. At the time, Kristian was in Woodstock, his father said.

“I went through these old emails after this happened and realized, ‘Holy crap, Snapchat actually is reaching out to us to tell us that, hey, somebody logged into our account from an IP address in another city, in Hamilton, and that was highly suspect,’” Conley said.

Although the Snapchat account and IP address connected to the alleged video’s upload were associated with Kristian, Conley’s report stated it was “questionable” whether Kristian had “exclusive control” over the iPhone.

Using his skills, Conley determined that Kristian’s phone was in very close proximity to a recorded WiFi source — a router that logs network traffic and activity — named “Canadian Tire” on Aug. 5, 2021, at 12:34 p.m., about the time the alleged video was uploaded to the iPhone. That cast further doubt for Conley on the charges against Kristian, he wrote in his report.

Article content

“Whilst he may have been in physical possession of this device, there is evidence that suggests that Mr. Spina was the victim of credential theft (on at least two social media platforms) and he was not exclusively in control of his Snapchat account,” Conley wrote.

“A second user of this account could easily have sent or received this video without Mr. Spina’s knowledge, and the video could have been synchronized to Mr. Spina’s phone as a result,” he added.

The report gave the family some solace. If the police weren’t examining clues supporting Kristian’s innocence, perhaps they’d take a closer look after examining Conley’s report.

“We just got even more confident because, obviously, at the start, I knew I didn’t do anything,” Kristian said.

Mario said he was “re-energized” by Conley’s findings.

“Here’s a true professional, a true digital forensic examiner who completely showed us that this thing is completely full of holes,” Mario said.

But the report seemed to have no impact when provided to the police, Conley said. He said he worried that figuring out how the thumbnails came to be on Kristian’s phone wasn’t as great a concern to the police as the actual presence of the images on the phone.

Article content

“My terrible gut feeling in the situation is they just didn’t care, they just ran with it and they just refused to backpedal,” he said, adding: “But they had the opportunity to back up, and they didn’t.”

It’s not clear whether the police investigated the findings in Conley’s report. Asked that in his email correspondence with The Free Press, the police chief didn’t answer the question.

A Snapchat spokesperson said the company can’t “comment on specific incidents or investigations,” but that Snapchat has a team that reviews and responds to “law enforcement requests for data related to their investigations.”

Two weeks before an October 2022 pre-trial hearing, Conley’s report was submitted to the Crown, Mario said. He said he believes the report wasn’t examined seriously by law enforcement or the Crown, and that it should have had a greater bearing on the case.

“The worst part was (police) read my report and proceeded anyway,” Conley said. “That was the biggest indicator that something’s very, very, very off” with how Kristian’s case was investigated.

CHAPTER 5: THE TRIAL

Article content

Mario and Kristian thought the case against their son would have been resolved long beforehand.

Before Kristian had a seizure and dropped out of college.

Before Mario and Andrea liquidated their rental property, using the proceeds to pay for their son’s criminal defence despite their unwavering faith in his innocence.

By Jan. 26, 2023, the first day of the trial, the Crown had dropped the child pornography distribution charge, but Kristian still faced two other child porn charges.

At age 20, Kristian was staring at a potential jail sentence, a minimum of six months to one year, and a lifelong sex offender status attached to his name if found guilty of accessing and possessing child pornography.

“I was feeling confident. Obviously, I was a little nervous my first time going into a courtroom (because) if anything goes bad, then I’m gone, basically,” Kristian said about the first day of the trial. “I kept my confidence and my family was behind me. The best team (was) in my corner.”

Both Haegens, the lead detective, and Gower, the special constable, testified on the first day.

Article content

Gower became the subject of a voir dire hearing, a kind of trial within a trial. The hearings are held to help a judge determine legal issues such as the admissibility of evidence, or whether witnesses can be fair or impartial or whether they’re qualified to give expert testimony.

Justice M. Edward Graham presented his voir dire analysis to both the Crown and defence by document. The Free Press obtained a copy of the analysis from Mario, who acquired it from Kristian’s defence lawyer.

Although Gower had “extensive expertise in extracting data from devices,” Graham wrote in his analysis that Gower “does not have sufficient training or expertise to further analyze and interpret that data.”

Gower also candidly advised he didn’t have training on Snapchat – the platform from which the child pornography video was sent, and from which the thumbnails were produced – or other social media applications, Graham wrote.

It wasn’t just Gower’s inexperience with Snapchat that was of concern to the judge, but also his lack of expertise with the device on which the thumbnails were found.

Article content

“He also does not have any formal training on the Apple iOS operating system,” Graham wrote. “In my view he is not qualified to provide opinion evidence even in a general sense of the strengths and weaknesses of that system.”

The judge noted other reasons suggesting the special constable wasn’t suited to provide evidence for expert testimony.

Gower’s “role is to take a device, extract the information and provide the results to the investigator,” Graham wrote.

However, Gower wrote an email on Aug. 19, 2022, to the police investigations team under the heading “Spina Case,” that said: “Not that it is for us to un-prove, but here is an article from today the Spina lawyers might use in an attempt to prove the phone was hacked.”

Graham wrote that Gower acknowledged the article identified a flaw in iOS devices, and though the information led him to check Kristian’s device for malware and trojans, he took no further steps, giving Graham the concern that biases could “inadvertently creep into his analysis.”

“I am not satisfied that he is qualified to provide more detailed analysis or interpretation of the data,” Graham wrote.

Article content

Graham concluded that Gower has a “solid foundation to build upon,” but would need to take more courses in “this rapidly evolving area” to provide expert testimony.

On the third day of the trial, Graham distributed a copy of the voir dire decision to the Crown and the defence to review.

A key component in the case against Kristian was Gower’s expert testimony, which the judge found he was not qualified to provide.

The Crown acknowledged Gower was “short of passing the threshold on the ability to draw inferences from the extracted data,” according to the trial transcript.

“I’m not calling any further evidence, given your honour’s decision in this case, and I’m going to invite an acquittal on the accessing and possession charge,” Jonathan Melo, the Crown counsel, said.

The charges were dismissed.

It took much longer than the Spinas had envisioned, but Kristian’s plight was over, the trial had concluded and he could return to being a 20-year-old.

“(My parents) never gave up. I never gave up. As a family we pushed together and we succeeded,” Kristian said.

“Knowing that he can start his life again, because it had been put on hold for such a long time — it was a huge relief,” Andrea said.

Article content

Two months after the charges were dismissed, Kristian had successful brain surgery to repair the arteriovenous malformation that doctors found when he was in hospital for the seizure. The procedure diminishes the probability of a brain aneurysm, a burst artery in the brain that can be deadly

With the court case in the past, Kristian, now 22, has returned to Fanshawe College, studying to become an electrician.

“I feel like I’m back to my myself,” he said.

His son has been made whole but the system remains broken, said Mario, who believes there were shortcomings in how his son’s case was handled and investigated.

“I’m not saying the police officer on the street isn’t doing their job,” he said, but “I don’t have faith in (the system).”

CHAPTER 6: A FATHER’S MISSION

Mario has many questions.

If Conley’s investigation could find sufficient evidence supporting Kristian’s innocence, why did it appear to Mario that police hadn’t similarly questioned whether his account had been hacked?

The Free Press asked Wilkinson in its email correspondence whether the investigating officers had looked into whether Kristian’s account had been hacked as an explanation for child pornography uploaded to his Snapchat account. He confirmed that was investigated, but did not say whether police had contacted Snapchat. A digital forensic examination had revealed “a device contained materials that met the Criminal Code definition of child pornography” and gave police “reasonable and probable grounds to proceed to lay charges,” the chief wrote in an earlier email.

Didn’t Woodstock police have access to similar investigative tools as Conley to explore doubts in the case, and, if they didn’t, why not look to another agency with proper resources?

The chief replied that the force has the tools and training for such investigations.

What if the Spinas were completely without means? What if they didn’t own a rental property they could sell to hire a defence lawyer?

Where would Kristian be under less fortunate circumstances?

“They always say money can’t buy happiness, but if we didn’t have money, I wouldn’t be here now,” Kristian said.

Mario set set out to change the system – a system in which he contends detectives ignored clues of innocence, resulting in what he believes was a negligent investigation of his son.

“My job as a responsible father, as a responsible citizen . . . is to make sure this doesn’t happen to anybody else who is innocent.”

The investigative shortcomings he alleges in his son’s case need to be resolved for future investigations, Mario said. He said he doesn’t want similar circumstances to cost someone else – especially someone who can’t afford it – as much as his family has paid in trauma, stress and money to defend their innocence.

Asked through email about Mario’s allegation the investigation against his son was negligent, Haegans replied that “I am unable to comment.”

Gower did not respond to a similar email seeking comment about the allegation and declined to answer questions when contacted by phone.

Wilkinson, the police chief, responded by noting that a provincial oversight agency dealt with Mario’s complaint about a negligent investigation and found that it was “unsubstantiated.”

A lawyer Mario spoke to following the trial suggested hiring a forensic investigation firm to help him if he sought damages for what he believes was flawed work by police, he said.

Mario ultimately decided not to pursue civil litigation, citing the extensive cost and that the family didn’t “stand that much to gain.” Still, he said he believes a report he ended up commissioning as a result of the lawyer’s advice is important.

“We just don’t want this to happen again,” Mario said.

Mario hired a private security and investigations firm, Investigative Solutions Network Inc., to examine the Woodstock police investigation of his son.

The investigation was conducted by Bill McGarry, the company’s director of cyber operations who doubles as both a manager and a primary investigator. A former Toronto police officer, with nearly 33 years of policing under his belt, McGarry retired as a detective sergeant and had extensive experience in the force’s child exploitation unit. He also was a trainer in a provincial strategy to help fight child exploitation on the internet, according to information McGarry gave to Mario.

McGarry’s report on his investigation concluded that Woodstock police appeared to take “a very basic approach to the investigation, accepting all information as valid without conducting an inquiry into the information received.” He found the police actions leading up to and including Kristian’s arrest appropriate, but his report cited limitations in the investigation’s scope including:

• Although police were able to extract the data from the rose gold iPhone, officers handling the data had no training to interpret or articulate data as it relates to Snapchat.
• Police should have used a forensic examiner familiar with investigating devices for offences related to child pornography, who would have made various queries such as checking search engine history related to child pornography. Snapchat operates in such a way that several copies and references to files are stored in various folders of the application and is “done in the background without the user’s knowledge and is necessary for the functionality of the application,” McGarry wrote.
• The files located on Kristian’s rose gold iPhone were “deep within the Snapchat application database that are inaccessible to the phone user,” McGarry wrote.
• “I concur with the opinion of Jason Conley, in that the files would only be accessible ‘via expensive software’ used by a person that requires extensive training and experience to use. In my opinion, an ordinary user of an iPhone would not know how to nor be able to access these images given their location on the device,” he concluded.
• Police failed to search for a potential alibi, such as correspondence between Snapchat and Kristian indicating the account had been compromised. “Reasonable and probable grounds” to support a charge of possession would have “evaporated and ceased to exist” had investigators examined further factors such as the Spinas’ compromised IP address.

McGarry noted that while it didn’t affect the case, Woodstock police didn’t reach out to preserve the Snapchat account and information attached to it, which he said was “the very first investigative step” that should have been done. 

Conley had said that without Snapchat’s co-operation and software engineers’ input, it wasn’t possible to definitively determine how the thumbnails wound up on Kristian’s phone.

Shouldn’t the company that had reported child pornography to law enforcement be involved in the investigation?

It’s unclear whether police contacted Snapchat. When The Free Press asked Wilkinson if that happened, his email statement didn’t indicate whether or not police had been in touch with the company.

A Snapchat spokesperson, in an email to The Free Press, said the company doesn’t comment on specific incidents – only that it has a team that works to review and respond to law enforcement requests about its data.

McGarry also wrote that while Woodstock police had grounds to arrest Kristian, the Crown would have “likely directed” police not to arrest him if it had more information then, such as the location of the files deep within the phone, because “there would be no reasonable prospect of a conviction.”

If Woodstock police didn’t have a forensic investigating officer with extensive training to interpret data from social media platforms or an iOS device, why, Mario wondered, wouldn’t investigators summon a police force with experience?

The Free Press asked whether Woodstock police had contacted outside forces, such as the OPP or another source experienced with iOS devices and social media applications, but Wilkinson didn’t indicate whether or not that had been done. In his email correspondence, the chief said his force “continually” develops officers’ skills and qualifications to adapt to “rapidly changing technology involved in such complex investigations.”

McGarry called “the reliance of an unqualified digital forensic examiner” with inadequate training “to investigate iOS devices nor social media applications such as Snapchat” one of the “biggest missteps taken” by Woodstock police.

Mario turned everywhere he could to talk to people about what he believes was a misguided police investigation marred by tunnel vision and negligence, and filed a complaint with the LECA, the provincial policing oversight body. The agency “ensures all public complaints against the police are dealt with in a manner that is transparent, effective and fair,” according to its website, and its report has been used as a source in this story.

Mario’s complaint alleged a “negligent investigation, which caused the family stress, trauma, and financial loss,” according to the LECA report.

The LECA investigator who reviewed the case found insufficient evidence to support Mario’s concerns that “discreditable misconduct or neglect of duty” had occurred, his report stated.

Wilkinson, the police chief, reiterated the LECA’s findings that Mario’s complaint was “unsubstantiated,” noting the decision was relayed to the Spinas in May 2023.

A person who files a complaint to the LECA “has the right to request a review” within 30 days of a decision, Wilkinson noted, adding Mario made no such request and the file was closed.

Unsatisfied, Mario said he spoke to Ernie Hardeman, the Woodstock-area MPP, who recommended he go before Woodstock’s police service board that oversees the city police.

“The police board is there for the public,” Mario said. “They’re the conduit between the sentiment of the public and the ears of the police.”

Mario contacted the board with the intention to share information with it, including McGarry’s report, hoping to prevent what happened to Kristian “from ever happening to another innocent person.”

A date was scheduled for April 15. But a week before Mario was to speak is when “everything stopped,” he said.

He said he was told the board wanted to see in advance, in writing, what he planned to present and that his appearance would be in a closed session of the board.

“Basically, they want to screen (and) read everything in (McGarry’s) report in full. They want to read my delegation speech in full,” Mario said.

Ken Whiteford, who chairs the board, said one of its procedures is to “see some kind of written statement” as to what someone appearing before it will discuss.

“It seemed to us that he was going to be addressing individual members of the police service in some way, shape or form as to their participation in the legal matter, and we want to be assured that wasn’t going to be in public,” he said.

Whiteford said sometimes the board can provide guidance to the police chief, but it doesn’t get “into the day-to-day, nitty-gritty of how police conducted a particular case.”

Mario had wanted a public audience with the board but, given its stipulations, which left him believing “nothing would leave that room,” he decided against appearing before it.

“It’s in a closed room and nothing can be shared. That doesn’t leave me a real good, comforting feeling,” he said. “If they don’t trust me to go into an open part of the police board meeting, am I supposed to trust them?”

Under Ontario’s law that governs policing, complaints about a police board can be filed to an oversight office called the Inspectorate of Policing.

Mario filed a complaint in April 2024 with the inspectorate, whose response he got in August.

It was a punch in the gut he’d prepared for, but the disappointment still hurt. The inspectorate agreed with the police board.

“I thought it would come to this, but I’m at a loss for words just the same,” Mario said.

Mario said he’s not after an apology from the police, but would like them to publicly note that all charges against Kristian were dismissed, something McGarry’s report noted was the “only way to clear his name.”

“They are the ones who printed his name on grains of evidence that they didn’t understand, using a forensics expert who wasn’t qualified, who’d never done that before on a cellphone,” Mario said. “They published my son’s name (in the first place), they could publish my son’s name now saying he has nothing to do with this.”

Mario said he asked about appealing the inspectorate’s ruling, but found out its decision is final and can’t be overturned.

Even still, the issue isn’t dead for Mario.

“I’m not the kind of guy that just goes away that easy,” he said. “Hopefully, this story is going to have some type of an impact to allow this to be heard . . .”

bwilliams@postmedia.com

@BrianWatLFPress

The Local Journalism Initiative is funded by the Government of Canada

Article content