Full Report
How much could a single underscore in a username really matter? Just ask Brandon Klayme, who served 18 months in prison before realizing how authorities arrested, charged, and convicted the wrong man.
Analysis Summary
# Incident Report: Case of Incorrect Attribution (Brandon Klayme)
## Executive Summary
A clerical error involving a single character in a username led to the wrongful arrest and conviction of Brandon Klayme. Law enforcement requested records for the wrong "Kik" messaging account, resulting in an innocent man serving 18 months in prison for crimes committed by another individual. The conviction was overturned in 2026 after the typo was discovered during the appeal process.
## Incident Details
- **Discovery Date:** July 2026 (During appeal process)
- **Incident Date:** 2018 (Original crime); 2020 (Arrest); 2024 (Sentencing)
- **Affected Organization:** Nova Scotia Judiciary / Law Enforcement Agencies
- **Sector:** Public Sector / Law Enforcement
- **Geography:** Madison, Wisconsin (USA) and Halifax, Nova Scotia (Canada)
## Timeline of Events
### Initial Access
- **Date/Time:** 2018
- **Vector:** External platform investigation (Kik)
- **Details:** Police investigated a user "fus__ro_dah" (two underscores) for child-luring.
### Lateral Movement
- **N/A:** This was a failure of attribution rather than a network intrusion. The investigation "moved" from the perpetrator to an innocent party via a subpoena typo.
### Data Exfiltration/Impact
- **N/A:** No data was stolen from a network; however, the impact involved the total compromise of an individual's liberty and reputation.
### Detection & Response
- **2020:** Canadian police arrested Brandon Klayme based on the incorrect records.
- **2023-2024:** Klayme was convicted and sentenced to 18 months; he served the full term.
- **July 2026:** While preparing an appeal, the discrepancy between "fus__ro_dah" (perpetrator) and "fus_ro_dah" (Klayme) was discovered.
- **July 28, 2026:** Nova Scotia Court of Appeal overturned the conviction, declaring Klayme factually innocent.
## Attack Methodology
*Note: In this incident, the "attacker" was the actual criminal who evaded detection, while the "failure" was systemic.*
- **Initial Access:** Use of social messaging platform (Kik) for illicit activities.
- **Defense Evasion:** The perpetrator's choice of a common gaming-themed username ("Skyrim" reference) likely contributed to the clerical confusion.
- **Discovery:** Police misidentified the target account during the reconnaissance/subpoena phase.
- **Impact:** Wrongful imprisonment and permanent reputational damage to an innocent citizen.
## Impact Assessment
- **Financial:** Legal fees for several years of trials and appeals; loss of income during 18 months of incarceration.
- **Data Breach:** Exposure of Klayme's private personal information to the legal system and public record.
- **Operational:** Failure of the judicial "verification" process.
- **Reputational:** Klayme was publicly labeled a sex offender; local news and Crime Stoppers published his name and charges.
## Indicators of Compromise
- **Behavioral indicators:** Lack of incriminating evidence on the suspect's physical and digital devices (initially ignored by authorities).
- **String Discrepancy:** `fus__ro_dah` (Actual) vs `fus_ro_dah` (Target).
## Response Actions
- **Containment:** None (Klayme served his full sentence).
- **Eradication:** The Nova Scotia Court of Appeal vacated all charges.
- **Recovery:** Public exoneration and declaration of factual innocence.
## Lessons Learned
- **The "Single Point of Failure" in Attribution:** Law enforcement relied entirely on a username match without cross-verifying the specific metadata of the account before proceeding to arrest.
- **Confirmation Bias:** Authorities proceeded with a conviction despite reports that no incriminating evidence was found on Klayme’s actual devices.
- **Standardization of Characters:** Underscores and special characters are high-risk areas for human error in manual data entry.
## Recommendations
- **Mandatory Peer Review:** Require a secondary "technical witness" to verify the exact spelling of handles/usernames in legal warrants and subpoenas.
- **Comparison Validation:** Implement automated checks to compare the username requested in a warrant against the username associated with the IP/subscriber data returned by service providers.
- **Evidence-Based Prosecution:** Re-evaluate cases where digital forensic evidence on a suspect’s device does not match the activity alleged from the service provider's records.