The Matt Bandy Story
A Nightmare Before Christmas
By Jonathan Bernstein
Author's Note: Your home computer could, as you're reading this, contain child pornography or other illegal material. It could have been placed there by criminals who have turned your computer into a "zombie" which they control at their whim. It could have gotten there via simple, innocent mistakes that millions of computer users make every day.
Worse, under many existing laws, you could go to prison for what is found on your computer, even if you didn't put it there.
This is not the Twilight Zone. This is the real deal. I'm a former Army counter-intelligence operative and investigative reporter. I have 25 years of experience in crisis management public relations. I know how to tell when a source is truthful, when a story has journalistic merit, and when a client is trying to do the right thing versus attempting any sort of cover-up.
The reason I know that our home computers are all at high risk is a kid named Matt Bandy. A kid accused of a horrible crime he didn't commit, and which he didn't have to tell you about at all. Let me tell you Matt's story.
The Nightmare Before Christmas
At 6 am on Thursday morning, December 16, 2004, Matt then age 16 was getting ready to go to school, as was his younger sister. His mom, Jeanne, was coming down the stairs when she saw shadowy figures coming up their walk, to the Bandy's front door, where they started pounding.
"This is the police, open up!"
After the officers showed their IDs to Jeanne through the window, she let them in.
"There were about ten police. They made me and my kids go outside where we huddled together, frightened. The police asked if we had any guns in the house and I said we didn't own any. They asked if there was anyone else in the house and I told them yes, my husband, Greg, who was asleep upstairs with earplugs in. They pulled Greg (an emergency room physician) out of bed at gunpoint."
Eventually, the police made it clear to The Bandys that they had a search warrant for their home. The lead detective from the Police Department said that child pornography had allegedly been uploaded to a specific Yahoo Group from an IP address (a unique identifying code) associated with The Bandys' computer. Yahoo apparently reports such events to the National Center for Missing and Exploited Children (NCMEC), which then passes the information on to law enforcement serving the region from which the images seem to originate. "Seem" being the operative word, as you'll come to understand later in this article.
Jeanne and Greg had no idea what the detective was talking about, but Matt ruefully admitted that he had participated in a Yahoo Group for the purpose of viewing Playboy-like adult images. He was asked what username he had employed and he provided that information, which was apparently similar to but not the same as the name the police said had been used to upload child porn. He adamantly denied ever viewing images that in any way could be construed as child pornography.
An officer from the local County Attorney's office set about conducting a preliminary examination of the computer in The Bandy's home. To their shock and dismay, he reported that he found a number of child porn images and traces of the email address used to upload the pics.
"We were speechless," said Jeanne. "That was when our nightmare began."
The Arizona Justice System
The Bandys immediately retained legal counsel, Ed Novak of Quarles & Brady.
For six months, The Bandys' computer sat in the evidence locker. In June 2005, the County forensic investigator spent one week reviewing the hard drive and the CDs taken from The Bandys' house. He confirmed that, in fact, there were child pornography images, one of which had been uploaded to Yahoo by someone with the username "mrbob1980hoopdu." This was not the name Matt used, which was joebean1988hoopdu (hoopdu was the name of an online game Matt and his friends liked to play). But there was still, mysteriously, evidence that "mrbob1980hoopdu" had sent the image from The Bandy's IP address. Additionally, it seemed that the illegal activity had coincided, roughly, with the times Matt had been active on Yahoo as joebean1988hoopdu. And, one or more images were also found on a CD-ROM. Circumstantially, things didn't look good for Matt. No one had yet figured out how the images got onto the hard drive or a CD-ROM.
In April 2005, there was an evidentiary hearing at which defense counsel Novak challenged the validity of the search warrant. Although the validity was upheld, Novak told the Bandys that the lead detective had admitted, on the stand, that the investigators could not tell who was on the computer at the time the pictures were uploaded. Based on that encounter, the attorney hoped the case would go away, and The Bandys breathed a sigh of relief and went back to what they believed would be a normal life, just waiting for the legal loose ends to be cleaned up. But the prosecutor still thought he had a case.
The dreaded day didn't come until November 9, 2005, when The Bandys received a certified letter from County authorities indicting Matt Bandy on nine counts of class 2 felonies i.e., possession of nine child pornography images. A Class 2 felony is just one level below murder, and Matt Bandy suddenly had to come to terms the possibility of 10 years in prison for each count on which he was convicted, with a judge having no discretion whatsoever in sentencing. A 16-year-old kid who did nothing more than look at Playboy-like images, facing the rest of his life behind bars, doing hard time as a sex offender.
On December 2, 2005, Matt Bandy entered a not-guilty plea, but was required to wear an electronic monitoring band around his ankle from that point on.
The Defense Goes on the Offense
It was then that first Ed Novak, and later I, started to help The Bandys present exculpatory evidence that they believe the investigators had not seen or not recognized as evidence.
In February 2006, at Novak's urging, Matt voluntarily underwent both a polygraph examination (which he passed with flying colors) and psychological assessment (which indicated he was not the "type" to commit such a crime).
The legal process continued and in March 2006 the prosecution relayed the first plea offer: 5-15 years in prison, registration as a sex offender, sexual probation for life. It was immediately rejected, of course. The next plea offer allegedly took into consideration the first psych assessment, but merely reduced the prison time to one year, with the other terms the same.
"We turned the plea down, knowing Matt was innocent and expecting to have a chance to prove it,." said Jeanne Bandy.
At the end of May, after a legal battle to obtain an imaged copy of the hard drive for forensic examination, forensic examiner Tami Loehrs got the imaged drive, resulting in her startling report in September, in which she concluded that:
- There were more than 200 viruses on the hard drive
- The anti-virus software had been disabled
- There was no firewall
- A number of the viruses would allow a criminal to remotely control the computer
- There was no way to tell who was using the computer at any given time, since there was only one user name for login
- One of the viruses even renamed hundreds of files, making it very difficult to track activity
- There were a number of suspicious "executable" (program) files that started running during the time period when the child pornography images were allegedly transmitted
However, it was apparently not standard police procedure to look for viruses in such cases; the assumption made by police departments in many states, the Bandys learned, is that possession of contraband images on your hard drive is almost certain proof that you put them there. Government and industry reports to the contrary, such as those we have available on our Articles & Links of Interest page, have apparently not made their way into the hands of those responsible for law enforcement forensic examination.
Going to the Court of Public Opinion
In August 2006, Ed Novak called me. Ed and I had previously worked together on a number of crisis management situations. He said that the family wanted to "go public," but he was concerned that (a) they would get a lot of negative publicity because of the nature of the allegations and (b) they might irritate the prosecution and Judge, compromising the ongoing attempt to get the charges thrown out or, at least, a better plea offer. Ed wanted to stay clear of my work to avoid any ethical issues while the case was pending, but could answer my questions about the case.
I asked Ed the same question I had asked numerous criminal defense lawyers in the past, "Could this kid pass a polygraph exam?" I've had other defense counsel say "no" and refuse to allow their clients to take a test for fear of incriminating them. Ed Novak, to my surprise, said "He's already passed one and a psychological evaluation."
Then I fired a series of questions at Ed:
"Would Matt Bandy be willing to voluntarily undergo another polygraph exam, this time by an examiner whose name would be very impressive to a national audience?"
"Would Dr. and Mrs. Bandy be willing to undergo polygraph exams by the same expert, even though they are under no obligation to do so, simply to rule them out as suspects in the minds of the court of public opinion?"
"Would Matt Bandy be willing to undergo a second psych eval to verify the results of the first one, and would his parents be willing to go through one each again, to rule them out as suspects as far as the general public is concerned?"
Those questions led to my first meeting with The Bandys, in early September 2006, who answered those questions, without hesitation, "Yes, yes, and yes!"
In October 2006 all three Bandys went through and passed with flying colors a polygraph examination by renowned examiner Dr. David Raskin, addressing whether they had ever seen or downloaded child pornography images.
Matt Bandy and his parents said "no" to each of these questions from Dr. Raskin:
- Did you ever use your computer to download or upload a sexually explicit photograph of a minor?
- Did you ever view a sexually explicit photograph of a minor on your computer?
- Did you ever record sexually explicit photographs of a minor on a disc?
- Did you know before the police came to your home on December 16, 2004 that there were sexually explicit photos of minors on your computer?
They also went through psychosexual assessment the first for Greg and Jeanne, the second for Matt by Dr. Judith Becker, a University of Arizona psychologist with impeccable credentials in this field. She concluded, "It is my clinical opinion that Matthew Bandy does not meet the DSM-IV TR Diagnosis of Paraphilia." A paraphilia is defined as "recurrent, intense sexually arousing fantasies, sexual urges, or behaviors generally involving 1) non-human objects; 2) suffering or humiliation of one's self or one's partner, or 3) children or other non-consenting persons that occur over a period of at least six months." Her summary conclusions about Greg and Jeanne Bandy were the same. Read Bandy Polygraph Exams & Psych Evaluations for more information.
I knew that, despite the recalcitrance of the prosecution, you the court of public opinion would find all that evidence pretty darn convincing. Reasonable doubt, indeed!
So how did the crime actually happen?
I already knew that certain Trojan Horse viruses, like those Tami Loehrs reported being present on The Bandys' computer, were capable of giving a criminal remote access to and complete control over -- a computer without the user knowing it.
Now, if you're a child porn collector, would you rather store your illegal collection on your own computer, or on someone else's? Heck, if you're committing ANY crime where you want to access illegal information or images and/or hide electronic evidence, wouldn't you use some innocent and unknowing person's computer if you could do so?
It became the highest priority of the Crisis Management Team I quickly assembled to find proof of this theory, and proof we found. You only have to read the expert interviews and authoritative articles from respected publications that you'll find elsewhere on this website to know we're right. Including one in which a UK court threw out a case when they found out how many viruses had been on the accused's computer but not before his life was ruined. I could have filled an entire website with more expert sources, and I'm hopeful that many of them will speak out after visiting this site or seeing news coverage.
As our experts discuss, it's already common practice for computer hackers to use viruses and other techniques to take control over huge groups, or "farms," of computers, and sell access to the "farm" for use in spamming and "phishing" and denial-of-service attacks. If remote computer access can be sold for those purposes, it can be sold for any purpose again, as our experts testify.
Computers controlled this way are called "Zombies" and our "Are You in Danger, Too?" article is a must-read, because your family could be next. And once you can control a "Zombie," you can do anything with it that the user could do, to include burning images on a CD-ROM if there's one sitting in the drive. And if you were going to commit further crimes on the computer, like uploading images, wouldn't you do so in way that made it look like one of the innocent resident users was doing it, picking a similar username, accessing sites right after they do? I reached that conclusion before Tami Loehrs' report came out and her report obviously supports the conclusion. All of this information was relayed to the prosecution in October and early November 2006.
The Prosecution Gets More Moderate
We believe the lack of evidence along with all the new information about viruses and zombie computers played a major role in the prosecution moderating its stance and offering Matt a plea deal of three class 6 undesignated offenses, or as they were later described at Matt's sentencing hearing (boldface and italics mine):
Each is a class 6 undesignated offense, each committed on or about September through October 2004). These are non-dangerous, non-repetitive offenses under the criminal code. (Translation: these are neither felonies nor misdemeanors until the end of probation, at which time the judge decides how to designate them. The likelihood, if Matt obeys the terms of probation, is designation as misdemeanors).
To avoid even an outside chance of conviction by a jury which would not necessarily understand the "geek talk," Matt copped that plea, "solicitation to commit furnishing harmful or obscene material to minors." Matt was willing to admit he had taken a Playboy magazine to school and shown it to three friends. This "offense" has probably been committed by 95 percent of the teenaged boys not only in Arizona, but all over the United States and in any country with access to adult pornography. In one of the many ironies of this case, a little research unearthed the fact that the US Supreme Court would likely consider Playboy a form of artistic expression and not pornography. Ed Novak commented that "this may be the only time an American teenage boy has ever been charged with a felony for showing adult pornography to his friends."
Here's some of what the Bandys were advised by defense counsel Novak, as he summarized in an email to me:
- Every jury trial has risks. Perhaps the most significant is the jury pool in the County. We find more older people, uneducated and undereducated, more unemployed and government workers in the jury box. Minorities are underrepresented. The understanding of computers by jurors is generally less than that of better educated professional or even, office workers.
- The penalties for conviction are draconian. Matt faced 90 years in prison if convicted. The judge would have no discretion. Our Supreme Court recently found a 200 year sentence was not cruel and unusual. The governor cannot pardon and commutation provisions are limited.
- The jury would see the images and, like photos of any other crime scene, it is hard to get some jurors to focus on reasonable doubt once those images have been displayed.
- The polygraph tests are not admissible. Matt admitted to viewing adult pornography on the computer. Inferences might be drawn from such activity by the jury.
Jeanne, in her email, went on to explain:
"We felt, faced with these circumstances and upon the advice of our lawyer we did the only thing available to save our son accept a plea. We are not for one instance accepting that Matt was guilty. He was innocent, but the system is broken. So we could not win this case in a court of law, but we knew in our hearts that this was wrong, and something had to be done. We were fortunate enough to be able to hire our own lawyer, pay for a psych evaluation, polygraph test and forensic testing. Now we can talk about this case publicly. We do not have to put our family at risk, but we feel compelled to stand up for those that may not be able to do so on their own.
"We adamantly agree that child pornography is horrific, and there needs to be laws to protect children, but we can not allow innocent people (children) to go to jail and be labeled a sex offender when their only crime was to own a computer. So we are taking a big risk and going public. Hopefully we will make a difference. People need to be educated on how dangerous computers are becoming, and something needs to be done to keep our children safe with a tool that has become as essential to their lives as a car was to us.
"Finally, we need to enact responsible and reasonable laws that account for the many devious ways the Internet and computers can be used to harm innocent people."
Matt, ultimately, was the one who had to decide, and with the support of his family he decided not only to "gut it out" through any probation period, but also to speak out publicly against this injustice.
"If I can help save even one other teenager, one other family, from going through the same experience, then it's worth it to me to go public," Matt said.
The End And a Beginning
On November 22, 2006, the day before Thanksgiving, Matt Bandy stood before the judge in County Superior Court and pleaded guilty to the three undesignated 6 offenses.
Matt Bandy was sentenced to 18 months probation, initially with horrendous "sex offender" terms attached, because it was the only way the prosecution would agree to the far-lesser plea, and even though the plea itself had nothing to do with the original charges. Those terms quickly resulted in Matt being treated very harshly by a probation officer and literally afraid to leave the house for fear he would somehow violate the order, which precluded any contact with children. He couldn't go to the grocery store, a movie theater or even to church except under certain very stringent and embarrassing conditions (e.g., he was told that his pastor would have to know not merely what he pled guilty to, but what he was indicted for!). Ed Novak immediately instituted legal steps to try to get those terms removed.
On December 5 and 6, 2006, a crew from ABC News' 20/20 arrived to film a segment on the Bandys (which aired January 12, 2007). On December 6 not five minutes after ABC's chief legal correspondent, Jim Avila, had interviewed Matt a pre-Christmas miracle occurred. I went to The Bandy's dining room to check my computer email (ironically, poaching on a neighbor's wi-fi signal) and found an urgent transmission from Ed Novak with a court order attached that removed the sex offender terms from Matt's probation.
The scene in the Bandy's dining room was tumultuous and joyous, with Matt, 20/20's producers, Jim Avila and just-arrived Bandy relatives all trying to see the computer screen while hugging and crying with joy all of it being filmed by two 20/20 cameramen!
The revised probation terms mean, essentially, that Matt, has to behave himself which is what he thought he was doing before all of this began -- and be accountable to a probation officer, which should result, ultimately, in the "undesignated" charge becoming a misdemeanor. The ankle bracelet is off. He can live an almost-normal life except, of course, that the indictment is permanently on the record and his family's life has been turned into hell, and trashed financially, over a two-year period.
Which brings us full-circle to how I started this article:
Your home computer could, as you're reading this, contain child pornography or other illegal material. It could have been placed there by criminals who have turned your computer into a "zombie" which they control at their whim. It could have gotten there via simple, innocent mistakes that millions of computer users make every day.
Worse, under many existing laws, you could go to prison for what is found on your computer, even if you didn't put it there.
Remember, this case isn't just about child pornography, but about the potential for criminals to engage in a wide array of criminal activity using your computer, and then leave you holding the electronic bag.
What can you do? Read our How You Can Help Protect Yourself and Your Children section for some useful tips on safe surfing. Read the articles about zombie computers on our Articles & Links of Interest page. Know the dangers. When you see injustice being done in the name of the law, speak up. Write to your legislators to get them to change laws that can victimize the innocent. Demand that the big companies that make computer operating systems do a better job of plugging security holes. Demand that Internet service providers and online businesses like Yahoo more effectively protect children online.
Matt told me, the evening before the 20/20 filming began, "Even if it's probably too late to help me, I believe there are other people who have been victimized the same way I was, people who may not have had the support I had to fight the system. There could be innocent people sitting in prison because they couldn't afford a proper defense. I want that to change."
It may only be a dream, now, but maybe -- with your help -- that dream could come true
Law enforcement doesn’t always have the resources to understand how computers can be exploited.
Paul Davis, CISSP-certified IT Security strategist