Her Majesty the Queen v. Cusick
[Indexed as: R. v. Cusick]
Ontario Reports
Court of Appeal for Ontario
Juriansz, Watt and Harvison Young JJ.A.
June 24, 2019
146 O.R. (3d) 678 | 2019 ONCA 524
Case Summary
Charter of Rights and Freedoms — Search and seizure — Service providers statutorily required to report to National Center for Missing and Exploited Children ("NCMEC") when they have knowledge of child pornography on their systems — Ontario police obtaining search warrant for accused's residence primarily on basis of NCMEC report — Police not required to verify NCMEC information for accuracy — Affiant of information to obtain ("ITO") warrant not required to include in ITO "disclaimer" in NCMEC report that NCMEC does not investigate or confirm information provided to it and that report was not to be used as evidence of criminal wrongdoing — Disclaimer not material as it was designed to protect NCMEC from criminal liability — NCMEC information not stale despite fact that warrant was executed seven to eight months after child pornography was uploaded — NCMEC report reliable — ITO setting out sufficient basis for issuance of warrant.
The accused was charged with child pornography offences. The police obtained and executed a search warrant for his residence largely on the basis of information received through the National Center for Missing and Exploited Children ("NCMEC"). Service providers are statutorily required to report to the NCMEC "Cyber Tipline" when they have knowledge of child pornography on their systems. Microsoft informed NCMEC that child pornography was uploaded using two IP addresses that originated in Canada. After receiving the NCMEC report, the Ontario police obtained customer information for both IP addresses from the service provider pursuant to a law enforcement request. When they executed the search warrant at one of the residences (the "N. Street address"), they discovered that one of the persons living there was a young person with autism who had been involved with child pornography three years earlier. The young person admitted that he used the e-mail address reported by Microsoft but denied uploading the child pornography. They then executed the warrant for the accused's residence and ultimately found child pornography on his computer. None of the files matched the files contained in the NCMEC report. The trial judge found that the accused's rights under s. 8 of the Canadian Charter of Rights and Freedoms were violated when the police obtained identifying information from his service provider without a warrant, but would not have excluded the evidence of the child pornography if that had been the only s. 8 breach, as the police acted in accordance with what they reasonably believed the law to be at that time. She found that the issuing justice was misled as to the reliability of the information in the NCMEC report, that there was no reliable and credible evidence connecting the accused's IP address to any criminal activity, and that there was no basis on which the warrant could issue. She excluded the evidence and acquitted the accused. The summary conviction appeal judge allowed the Crown's appeal and entered a conviction. The accused appealed.
Held, the appeal should be dismissed.
The trial judge erred by finding that the police were required to check with Microsoft to verify the information in the NCMEC report for accuracy. A tip or information that comes from a source which is generally credible and reliable can provide some evidence which an issuing justice could rely on to issue a search warrant. The standard is reasonableness, not certainty. Information from a large corporation like Microsoft may be reasonably believed.
The trial judge also erred by substituting her own views on whether a search warrant should have been issued, rather than considering whether the issuing justice could have issued the search warrant with the amplification evidence.
The affiant of the information to obtain the search warrant was not required to include in the ITO the "disclaimer" in the NCMEC report that NCMEC does not investigate and cannot verify the accuracy of the information provided to NCMEC and that the report was not to be used as evidence of criminal wrongdoing. The disclaimer was not material as it was designed to protect NCMEC from criminal liability. The "criminal wrongdoing" referred to in the disclaimer is the criminal wrongdoing of NCMEC in possessing and distributing child pornography. The affiant made it clear that NCMEC acts as a "clearing house" of information. The disclaimer was immaterial to the reliability of the information in the NCMEC report.
The affiant testified that Microsoft uses computer software called PhotoDNA to identify child pornography and that in his experience PhotoDNA is reliable and not subject to human error. The trial judge erred by requiring verification as to the accuracy of the use of PhotoDNA when the only expert evidence was that it was developed by Microsoft and used by Microsoft and other service providers and there was no evidence to the contrary. In any event, the trial judge erred in considering the lack of verification as to the use of PhotoDNA to be material.
The information in the NCMEC report was not stale despite the fact that the warrant was executed seven or eight months after the child pornography was uploaded. In finding that the information was stale, the trial judge failed to pay sufficient deference to the affiant's ability to draw inferences and make deductions as a police officer and as an expert in online cloud storage and Internet investigations.
The trial judge erred in finding that the N. Street search undermined the grounds for the search of the accused's residence. After the N. Street search there was still evidence that child pornography had been uploaded from an IP address associated with the accused's residence using the e-mail address reported by Microsoft. Nothing the police learned during the N. Street search negated or even undermined that evidence.
The only violation of s. 8 of the Charter was the failure to use a search warrant to obtain the customer information. As the trial judge found, that violation alone was not serious and did not warrant excluding the evidence under s. 24(2) of the Charter.
Cases Referred To
Illinois v. Gates, 462 U.S. 213 (1983); R. v. Araujo, [2000] 2 S.C.R. 992, 2000 SCC 65; R. v. Caissey, [2008] 3 S.C.R. 451, 2008 SCC 65; R. v. Campbell, [2011] 2 S.C.R. 549, 2011 SCC 32; R. v. Debot, [1989] 2 S.C.R. 1140; R. v. Grant, [2009] 2 S.C.R. 353, 2009 SCC 32; R. v. Manders, [2007] O.J. No. 4757, 2007 ONCA 849; R. v. Morelli, [2010] 1 S.C.R. 253, 2010 SCC 8; R. v. Spencer, [2014] 2 S.C.R. 212, 2014 SCC 43
Statutes Referred To
Canadian Charter of Rights and Freedoms, ss. 8, 24(2)
Criminal Code, R.S.C. 1985, c. C-46, ss. 163.1(1), 487(1)
Victims of Child Abuse Act of 1990, 18 U.S.C., 2258(a)
Procedural History
APPEAL from the order of Ricchetti J., [2015] O.J. No. 5780, 2015 ONSC 6739 allowing an appeal from the acquittal entered on October 30, 2014 by Ready J. of the Ontario Court of Justice.
M. Halfyard and B. Vandebeek, for appellant.
Manasvin Goswami, for respondent.
The judgment of the court was delivered by
JURIANSZ J.A.:
A. Introduction
[1] This appeal concerns the validity of a search warrant issued primarily on the basis of information received by the Peel Regional Police ("Peel police") through the National Center for Missing and Exploited Children ("NCMEC"). NCMEC was established pursuant to American legislation and is funded by the United States Justice Department. Electronic service providers and providers of remote computing services are required to report to the NCMEC "CyberTipline" when they have knowledge of child pornography on their systems. NCMEC then forwards the "CyberTipline Report" to the appropriate law enforcement agency.
[2] In this case, NCMEC forwarded CyberTipline Reports to the Canadian National Child Exploitation Coordination Centre, a division of the R.C.M.P., who sent it on to Peel police. That information led to the execution of a warrant at the appellant's residence. The subsequent forensic analysis of his computer and external drives revealed a number of digital videos and images alleged to be child pornography. The appellant was subsequently charged with possession of child pornography.
[3] The trial judge found that the warrant should not have been issued and that the appellant's s. 8 Canadian Charter of Rights and Freedoms rights were breached. She excluded the evidence under s. 24(2) and entered an acquittal. The Crown's appeal to the Superior Court was allowed and a conviction entered.
[4] While leave to appeal was granted at the outset of the appeal hearing, I would dismiss the appeal.
B. Overview of the Facts
[5] Microsoft provides cloud-based storage to registered users. In May 2012, Microsoft became aware that a user had uploaded 41 files containing some 2,000 images of child pornography between May 10 and May 19, 2012. As required by legislation, Microsoft sent NCMEC:
- the files containing child pornography;
- the date and time each file was uploaded;
- the user's screen name ("John E.");
- the user's e-mail address ("[information omitted]@hotmail.com"); and
- the two IP addresses of the computer or computers used to connect to the Internet and upload the files.
[6] NCMEC determined that the two IP addresses, 174.95.50.159 and 174.95.54.28, originated in Canada and forwarded the 41 CyberTipline reports to the R.C.M.P., in two groups. The R.C.M.P. received 21 CyberTipline reports in August 2012, and a further 20 CyberTipline reports in December 2012. I will refer to these collectively as "the NCMEC Report".
[7] The R.C.M.P. viewed the images and believed the majority of the images constituted child pornography under the Criminal Code, R.S.C. 1985, c. C-46, s. 163.1(1).
[8] The R.C.M.P. made a law enforcement request to Bell Canada to identify its customer accounts that had the IP addresses 174.95.54.28 on May 10, 2012 at 11:24 p.m. UTC, and 174.95.50.169 on May 19, 2012 at 11:46 p.m. UTC. Bell Canada provided its customer information. The first IP address was associated with the account of a resident of N. Drive, Mississauga. The second IP address was associated with the account of F. Cusick at [information omitted] Queen Street, Mississauga. The R.C.M.P. forwarded this information to Peel police.
[9] Peel police also viewed the files, formed the opinion that they constituted child pornography under the Criminal Code, and confirmed that the two IP addresses were in their jurisdiction. Peel police conducted surveillance at each of the two addresses and confirmed that each had a Wi-Fi network protected by security to prevent use by persons without the passwords. The investigating officer, Cst. MacDonald, prepared the ITO and applied for a warrant for each address. In the ITO, he asserted:
I have reasonable grounds to believe that one Microsoft account, [information omitted]@hotmail.com, has uploaded images of child pornography using two different internet connections at two locations in Mississauga. This application is for [information omitted] Queen St South, Basement Apartment, Mississauga, ON. I believe the seizure and analysis of the items listed in Appendix A will corroborate the information originating from Microsoft, determine what computer system(s) specifically had access to this Microsoft account and render evidence of the child pornography based offence named in appendix B.
[10] The justice of the peace (the "issuing justice") granted the warrants.
[11] Cst. MacDonald first executed the warrant at the N. address. One of the persons living there was a 17-year-old male with autism, who had been previously cautioned by the police for child pornography offences three years earlier. His mother said he suffered from sexuality issues and was getting help. The young person admitted he had used [information omitted]@hotmail.com, but denied uploading the child pornography. He also denied knowing the appellant and stated he had never been to the appellant's home.
[12] About two hours later, Cst. MacDonald executed the search warrant at the appellant's address. The appellant told him there "shouldn't" be any child pornography on his computer. He said he did not know John E. and denied any knowledge of [information omitted]@hotmail.com. He denied that any children had access to his computer. Cst. MacDonald performed a cursory examination of the appellant's computer, but found no evidence of the use of [information omitted]@hotmail.com, John E., or child pornography. Peel police nonetheless seized the appellant's computer equipment, and after a complete search, found 131 unique image files and 24 unique video files they believed constituted child pornography. None of these files matched the files contained in the NCMEC Report.
[13] The appellant brought a ss. 8 and 24(2) Charter application to challenge the warrant. He also brought an application to cross-examine Cst. MacDonald, to which the Crown consented.
C. Decisions Below
(1) Decision of the Trial Judge
[14] The R.C.M.P. obtained the identifying information about the appellant from Bell Canada without a warrant. As a result of R. v. Spencer, [2014] 2 S.C.R. 212, 2014 SCC 43, the Crown conceded that this breached s. 8. The amplification evidence did indicate, however, Spencer was not the law when Cst. MacDonald drafted the ITO. The trial judge indicated that if this had been the only s. 8 breach, she would not have excluded the evidence found at the appellant's home. However, she found the following additional deficiencies with the ITO, all of which could not be cured by amplification:
(1) Cst. MacDonald failed to verify the information in the NCMEC Report for accuracy;
(2) Cst. MacDonald failed to include a "disclaimer" in the ITO;
(3) Cst. MacDonald failed to confirm Microsoft's use of "PhotoDNA" software;
(4) There was a time discrepancy on the face of the NCMEC Report;
(5) The ITO was premised on indefinite and stale information; and
(6) The fruits of the N. search undermined the reasonable grounds to search the appellant's residence.
[15] I will review the trial judge's basis for making these findings later in these reasons.
[16] The trial judge allowed the appellant's application to exclude the evidence. She concluded that the issuing justice was misled as to the reliability of the information in the NCMEC Report. There was no reliable and credible evidence connecting the appellant's IP address to any criminal activity, and only the possibility of evidence being found at the appellant's residence. There was no basis on which the warrant could issue. Cst. MacDonald displayed careless behaviour and a careless attitude. At best, he exaggerated the existence of reasonable grounds to believe that evidence of the offence would be found at the appellant's residence at the time the warrant was executed.
(2) Decision of the Summary Conviction Appeal Judge
[17] The summary conviction appeal judge (the "SCAJ") concluded the trial judge erred in law and made palpable and overriding errors of fact.
[18] The trial judge first erred in law by reasoning "that, absent verification by the [Cst. MacDonald], the information in the NCMEC CyberTipline Report was not reliable evidence for the issuing [justice] to consider". The trial judge's second error of law was substituting her own views on whether a search warrant should have been issued, rather than considering whether the issuing justice could have issued the search warrant with the amplification evidence. As well, the trial judge made findings not supported by the evidence in concluding the information in the NCMEC Report was not credible and reliable, and there were no reasonable grounds to believe that evidence of the offence would continue to be found at the appellant's residence at the time the warrant was executed.
[19] The SCAJ found the NCMEC Report had the hallmarks of reliability and satisfied the standard of reasonableness for assessing information from a non-police, third-party source set out in R. v. Debot, [1989] 2 S.C.R. 1140. He concluded the issuing justice could have issued the warrant on the totality of the information.
[20] I agree with the careful analysis and detailed reasons the SCAJ provided for reaching these conclusions. A detailed review of his reasons would be needlessly repetitious of my own analysis, as I adopt much of his reasoning. It is convenient to refer to his reasons and conclusions in the course of my own discussion of the issues.
D. Analysis
(1) The NCMEC Report
[21] The SCAJ, before turning to the issues in this case, reviewed how CyberTipline Reports are generated and how they are provided to local police authorities. This is a useful starting point. A proper understanding of these reports is fundamental to gauging the strength of the initial information in the ITO.
[22] Microsoft Corporation is both an electronic service provider and Internet service provider. Microsoft made available to Microsoft users cloud-based storage on its servers. The cloud-based storage was called SkyDrive (and now is known as OneDrive). SkyDrive made it possible for users not to have files stored on their own computers, but stored in the "cloud" where they can access, view, transfer and retrieve them through an Internet connection. Persons with a Microsoft user account can access Microsoft servers through the Internet from any computer anywhere in the world to upload, store, transfer and download files, including image and video files.
[23] American legislation -- the Victims of Child Abuse Act of 1990, 18 U.S.C., 2258(a) -- requires electronic service providers and remote computing services that have actual knowledge of apparent violations of various child exploitation and child pornography criminal provisions to make a report to the NCMEC CyberTipline.
[24] The SCAJ set out the provisions of this legislation at some length at para. 13 of his reasons. Suffice it to say, the legislation requires the electronic service provider to include in the report available identifying information of the source of the upload, such as the IP address used, and copies of the apparent child pornography.
[25] Once NCMEC receives a report from an electronic service provider, it identifies the geographic location of the IP address and creates a written report. The written report is called a CyberTipline Report. The information received from the electronic service provider is set out in the first three pages of the CyberTipline Report, and NCMEC makes clear the electronic service provider is the source of the information. The information is set out under the heading:
The following information was submitted to NCMEC's CyberTipline. This information cannot be modified by [NCMEC] staff.
[26] The legislation requires NCMEC to send the CyberTipline Report to the appropriate local police authority. When the apparent child pornography is uploaded from outside the United States, the appropriate law enforcement agency includes designated foreign federal agencies. In Canada, the federal agency designated to receive CyberTipline Reports is the National Child Exploitation Coordination Centre in Ottawa, a division of the R.C.M.P. The R.C.M.P. reviews the CyberTipline Report and forwards it to the appropriate local law enforcement agency. In the present case, NCMEC determined the two IP addresses used were in Canada, and so forwarded the NCMEC Report to the R.C.M.P.
[27] The SCAJ noted that Cst. MacDonald described NCMEC as a "clearing house". NCMEC does not generate any information regarding the matter that was uploaded, when it was uploaded or the user who uploaded it. The SCAJ also noted the limited role played by NCMEC is described in the report itself:
NCMEC does not investigate and cannot verify the accuracy of the information reported to NCMEC. NCMEC forwards reports of child sexual exploitation to law enforcement for purposes of investigation and disposition.
LAW ENFORCEMENT OFFICIALS PLEASE BE ADVISED: This Report is being provided solely for informational purposes pursuant to NCMEC's congressional authorization and mission. Under no circumstances shall this Report be used as evidence of criminal wrongdoing Please treat all information contained in this report as law enforcement sensitive information and do not share any contents of this report with persons unrelated to the criminal investigation or any resulting criminal prosecution.
[28] The trial judge referred to these two statements in the NCMEC Report as the "disclaimer". I will have more to say about these two statements later when discussing what the trial judge made of them.
[29] Cst. MacDonald was qualified as an expert in the areas of "online cloud storage and internet investigations". He had previous experience with about 30 cases involving CyberTipline Reports. He testified that he has never come across a CyberTipline Report that had given him false information, and there was never an error in the reported IP address.
[30] Cst. MacDonald testified CyberTipline Reports are sent to law enforcement agencies all over the world. He said the vast majority of Internet child exploitation investigators base their work on CyberTipline Reports. He explained that local police forces have no way of knowing when child pornography is uploaded to a cloud server in a foreign country from a local computer connected to the Internet. CyberTipline Reports link the providers of cloud storage to local law enforcement. NCMEC makes possible a system of international cooperation designed to combat child exploitation and child pornography.
(2) The Trial Judge Erred by Requiring Verification for Accuracy
The Trial Judge's Reasons
[31] In the trial judge's initial statement of the law, she indicated the standard on review of a search warrant was one of "reasonable probability". In fact, she observed that the standard is "not an onerous one". She stated that the issuing justice "acts on reliable information verified for accuracy, in other words, credible, compelling, corroborated evidence". However, the standard she applied throughout her analysis was that the police themselves were required to verify the information for accuracy.
[32] The trial judge reasoned that "large corporations do make mistakes and Microsoft is no exception. The police officers need to check with Microsoft to verify the accuracy of any report that comes into their possession." She regarded Cst. MacDonald's reliance on the NCMEC Report without verifying for accuracy as "both careless and reckless".
The SCAJ's Conclusion
[33] The SCAJ concluded that "the trial judge erred in requiring verification for accuracy before the Microsoft information could be relied upon by the issuing [justice]". As the SCAJ observed, if verification for accuracy were required, "hearsay evidence would never be sufficient to support the issuance of a search warrant".
[34] I agree.
The Trial Judge's Errors
[35] As the SCAJ pointed out, "verified as to accuracy" is not consistent with how the standard is usually described in judicial authorities. The terms usually used are "credibly-based probability", "reasonable probability" or "reasonable belief". Section 487(1) of the Criminal Code authorizes a justice to issue a warrant if there are "reasonable grounds to believe".
[36] Certainly, it must be considered whether the information provided by a third-party source outside the police is compelling, from a credible source, and corroborated. However, that does not change the standard of "reasonable belief". The SCAJ pointed out that a tip or information that "comes from a source which is generally credible and reliable . . . can provide some evidence which an issuing justice could rely on to issue a search warrant". I agree. The standard is reasonableness, not certainty.
[37] Wilson J. made that clear in Debot, at p. 1168 S.C.R. She said that a consideration of whether information is compelling, from a credible source, and corroborated is not a separate test, but that the "totality of the circumstances" must meet the standard of reasonableness. She added that weaknesses in one area may, to some extent, be compensated by strengths in the other two.
[38] The trial judge in this case lost sight of the reasonableness standard. Information from a large corporation may be reasonably believed, even if it is known that the corporation makes mistakes on occasion. In this case, Cst. MacDonald testified that in his experience with some 30 cases, Microsoft had never made a mistake in the information it reported to NCMEC and that was subsequently passed on to the police.
[39] I agree with the observation of the SCAJ, at para. 87, that
The trial judge's sole focus was on "verification of accuracy", in other words, "corroboration". While referring to Debot, the trial judge erred in failing to consider all the circumstances, including whether the information was compelling, credible, to what extent was it corroborated and, if so, whether considering the totality of the evidence, it was sufficient to meet the standard of reasonableness.
[40] I conclude that the trial judge erred in law by applying an incorrect standard to the ITO.
[41] This error alone required the SCAJ to assess, without deference to the trial judge, whether there was a basis on which the warrant could have issued.
(3) The Trial Judge Failed to Consider Whether the Issuing Justice Could Have Authorized the Warrant
[42] I agree with the SCAJ that the trial judge's analysis reflects her own view as to whether the warrant should have been issued. It was an error in law to fail to determine whether the issuing justice could have authorized the warrant.
[43] The trial judge set out the governing principles correctly. A warrant, once issued, is presumed to be valid. The role of the reviewing judge is to determine whether there is at least some evidence upon which the issuing justice could have issued the warrant. The party challenging the warrant bears the burden of demonstrating its invalidity. The reviewing judge is not to engage in a fresh assessment of the grounds for the warrant or substitute their views for those of the issuing justice. The task of the reviewing judge is limited to assessing whether on the whole of the record before the issuing justice, as amplified on review, there is "at least some evidence that might reasonably be believed on the basis of which the authorization could have issued": R. v. Araujo, [2000] 2 S.C.R. 992, 2000 SCC 65, at para. 51 (emphasis in original).
[44] Having stated these principles, the trial judge expressed specific concerns she had with the ITO and concluded the warrant should not have been issued. For the following reasons I conclude, as did the SCAJ, that the trial judge's concerns are unsupported by the evidence and that the issuing justice, on the totality of the evidence, could have authorized the warrant. In fact, as I discuss below, the issuing justice could have taken a different view of each of the deficiencies found by the trial judge.
(i) The "Disclaimer"
The Trial Judge's Reasons
[45] CyberTipline Reports contain two statements, preprinted in the template used for its reports, which Cst. MacDonald did not include in the ITO. As indicated above, the "disclaimer" consists of a sentence plucked out of the paragraph in the header of the first page, and the complete paragraph in the footer of every page of the CyberTipline Report.
[46] The trial judge found that the failure to include the "disclaimer" in the ITO would have misled the issuing justice. An application for a search warrant is an ex parte proceeding and the application must "make full and frank disclosure of material facts": Araujo, at para. 46 (emphasis in original).
[47] Cst. MacDonald agreed the "disclaimer" should have been included in the ITO to ensure disclosure was full, fair and frank, but testified he did not consider the statements material. The ITO did state that NCMEC acts as a "clearing house" of information, which is the import of the statement in the header. He offered his opinion that the footer was included to protect NCMEC itself from criminal responsibility.
[48] The trial judge rejected the notion the "disclaimer" attempted to protect NCMEC from criminal responsibility. The trial judge pointed out that Cst. MacDonald never confirmed with NCMEC what the "disclaimer" meant. The trial judge found that on a common sense reading of the "disclaimer", it was "a warning to whoever comes into possession of this report, that it is in essence a tip" (emphasis added). The trial judge found by not including the "disclaimer" in the ITO, "the [issuing justice] was misled in respect of the reliability of the information he was acting upon" (emphasis added).
The SCAJ's Conclusion
[49] The SCAJ concluded that the trial judge made a palpable and overriding error in finding that the failure to include the "disclaimer" misled the issuing justice. He explained, "when properly considered, the [d]isclaimer was not material and had no effect on the reliability on the material facts necessary for the issuing justice to determine whether reasonable and probable grounds existed to issue the search warrant".
[50] I agree.
The Trial Judge's Errors
[51] The first statement reflects what Cst. MacDonald included in the ITO and repeated in his testimony: namely, NCMEC acts as a "clearing house" of information. This is made clear by considering the statement in context.
[52] The header begins by reciting NCMEC's establishment in 1984, and states pursuant to its mission and congressional authorization, NCMEC operates the CyberTipline "to assist law enforcement in identifying victims of child pornography and child sexual exploitation". It states that NCMEC "works with the law enforcement" and Electronic Service Providers "to reduce the distribution of child sexual exploitation images and videos over the Internet". Then, the header states what the trial judge described as the first part of the "disclaimer": "NCMEC does not investigate and cannot verify the accuracy of the information reported to NCMEC. NCMEC forwards reports of child sexual exploitation to law enforcement for purposes of investigation and disposition."
[53] The second statement appears as the footer of every page of the report. The footer should be read keeping in mind the content and transmittal of a CyberTipline Report. NCMEC comes into actual possession of child pornography when it receives copies from the electronic service provider. After it comes into actual possession of child pornography, NCMEC then engages in the distribution of child pornography when it sends out its reports. Cst. MacDonald provided his expert opinion that NCMEC includes the second statement to attempt to preclude the use of its CyberTipline Reports as evidence of criminal wrongdoing by itself.
[54] A reading of the footer, keeping in mind that the CyberTipline Report is evidence that NCMEC has possessed and transmitted apparent child pornography, supports Cst. MacDonald's expert opinion. The first sentence of the footer says the CyberTipline Report is provided only for informational purposes and reminds the recipient of NCMEC's statutory authorization and mission. The second sentence states that the CyberTipline Report should not be used to establish criminal liability. The only criminal liability conceivable is for the possession and distribution of child pornography. Understanding the second sentence to mean the CyberTipline Report should not be used as evidence of criminal wrongdoing by the user who uploaded the child pornography, as the appellant urges, is inconsistent with the last sentence and the header of the CyberTipline Report. The last sentence makes clear the CyberTipline Report is intended to be used in "criminal investigation" and "any resulting criminal prosecution". In fact, in the last sentence, NCMEC uses the voice of a partner in the criminal process.
[55] The only sensible interpretation of the whole footer is that NCMEC plays a role in the criminal process pursuant to congressional authorization, and NCMEC should not itself be seen to breach the criminal law though it possesses and transmits child pornography. The cautious inclusion of the statement as a footer of every page of the CyberTipline Report supports this reading.
[56] The Crown submits that the trial judge had no basis to reject Cst. MacDonald's expert opinion of what the statement meant, as there was no contrary evidence. Certainly, Cst. MacDonald's expert opinion was deserving of appropriate weight. This was a technical area and the reading of the NCMEC Report involved some technical expertise. It is sufficient to observe that Cst. MacDonald's testimony on the point "might reasonably be believed" and could have been accepted by the issuing justice: R. v. Caissey, [2007] A.J. No. 1342, 2007 ABCA 380, 227 C.C.C. (3d) 322, at para. 23, affd [2008] 3 S.C.R. 451, 2008 SCC 65. Accepting Cst. MacDonald's opinion, the issuing justice could have regarded the two statements as immaterial to the reliability of the information in the NCMEC Report.
[57] Even if the trial judge's understanding that the two statements are a "disclaimer" was correct, the "disclaimer" was still immaterial to the reliability of the information in the NCMEC Report. The pertinent information in the NCMEC Report originated with Microsoft and was simply passed on by NCMEC. The information that the files were uploaded, the times at which they were uploaded, the IP addresses from which they were uploaded, the username and e-mail address of the Microsoft account that uploaded the files, and the copies of the files themselves were all provided by Microsoft, not NCMEC. The only thing NCMEC did was to identify the geographic location of the IP addresses provided by Microsoft. That the IP addresses were located in Mississauga was confirmed by the R.C.M.P. and by Peel police as well. The R.C.M.P. and Peel police also reviewed copies of the files and formed the view they contained child pornography. The rest of the information was as reliable as such information from Microsoft should be considered. The two statements from NCMEC comprising the "disclaimer" do not transform information that is otherwise considered reliable into unreliable information.
[58] The failure to include the two statements in the ITO could not have misled the issuing justice as to the sufficiency of grounds contained in the ITO. The SCAJ correctly concluded the trial judge erred by finding that it did.
(ii) PhotoDNA
The Trial Judge's Reasons
[59] Cst. MacDonald testified that he saw no need for the police to verify the information in the NCMEC Report, because the information originated with Microsoft. He testified Microsoft was a large organization that used computer software called PhotoDNA to identify child pornography. In Cst. MacDonald's experience, PhotoDNA was reliable and not subject to human error.
[60] The trial judge rejected this explanation, criticizing Cst. MacDonald for not confirming with Microsoft that it had used PhotoDNA.
The SCAJ's Conclusion
[61] The SCAJ concluded "the trial judge erred by requiring verification as to accuracy of the use of PhotoDNA when the only expert evidence was that this was developed by Microsoft, used by Microsoft and other [electronic service providers] and there was no evidence to the contrary, expert or otherwise". He also concluded that in any event, "the trial judge erred in considering the lack of verification as to the use of PhotoDNA to be a 'material'".
[62] I agree with these conclusions.
The Trial Judge's Errors
[63] The trial judge's criticism of Cst. MacDonald for not verifying with Microsoft that it had used PhotoDNA to identify the alleged child pornography was unwarranted.
[64] It seems the trial judge took the view that the information provided by Microsoft would have had greater reliability if it were computer-generated and not subject to human fallacy. This may be a legitimate view, but the trial judge lost sight of the fact that whatever method it used, Microsoft did identify files containing potential child pornography. Both the R.C.M.P. and Peel police confirmed the files attached to the NCMEC Report contained child pornography as defined by the Criminal Code. As the SCAJ put it:
. . . any issue regarding the use or reliability of the PhotoDNA program (or any other image identification program) to identify apparent child pornography being uploaded to the cloud was not relevant or material to whether the search warrant could have issued.
[65] It is worth noting that the ITO did not even mention PhotoDNA. An issuing justice could have issued the warrant whether PhotoDNA had or had not been used.
[66] In any event, the trial judge had no basis to reject the unequivocal opinion of Cst. MacDonald that PhotoDNA had been used. Cst. MacDonald was an expert in online cloud storage and Internet investigations, who had been trained on the use of PhotoDNA and had previous experience with it. He testified that when he saw output like that contained in the NCMEC Report, "I know it to be PhotoDNA" (emphasis added). He added, "[i]f I'm receiving something from Microsoft coming to NCMEC in that file format or in that format to say here is a picture, here is the IP address and the time and day, specifically, here is the user account it's -- it's PhotoDNA" (emphasis added). He also said when he reviewed the NCMEC report, "I knew the system in which it came from." There was no evidence that cast any doubt about the opinion of Cst. MacDonald. The issuing justice could have accepted Cst. MacDonald's testimony and proceeded on the basis that PhotoDNA was used.
(iii) The Time Discrepancy
The Trial Judge's Reasons
[67] The trial judge found a time discrepancy on the face of the NCMEC Report. This finding provided considerable support for her view that the Microsoft information in the NCMEC Report should not be considered reliable without verification.
[68] The NCMEC Report indicates the time when each file was uploaded to SkyDrive, and the time when the Microsoft incident report was generated about the file being uploaded. The discrepancy is that the incident reports are indicated to have been generated before the files were uploaded to SkyDrive. For example, report #1432170 shows an upload time of 23:46 GMT and an incident time of 16:46 GMT, a difference of seven hours. Obviously, Microsoft could not have started generating a report about a file being uploaded seven hours before the file was actually uploaded.
[68] On his first day of testimony, Cst. MacDonald was unable to explain this time discrepancy. On his second day of testimony, Cst. MacDonald proffered a table showing the upload times and the incident times from all 41 entries in the NCMEC Report. In each case, the incident time was precisely seven hours before the upload time. Cst. MacDonald knew that Microsoft's law enforcement team that generated these kinds of reports was located in the State of Washington, and the NCMEC Report, in identifying Microsoft as the Internet service provider, provided a street address for Microsoft Corporation in Redmond, Washington. Cst. MacDonald offered his opinion that the incident dates were indicated in local time at Microsoft headquarters, i.e., Pacific Time, whereas the upload times were indicated in Greenwich Mean Time. He testified that there is precisely a seven-hour difference between Pacific Time and Greenwich Mean Time, and suggested the NCMEC Report should have indicated the incident times as PDT, not GMT.
[70] The trial judge considered this to be unreliable amplification evidence because it had not been "verified or confirmed with Microsoft". The trial judge said Cst. MacDonald conceded that the NCMEC Report did not state where it was prepared, and his "new theory" was "based upon his personal theory and his assumptions". He should have confirmed with Microsoft that his explanation was sound.
[71] The trial judge concluded Microsoft made a mistake. The NCMEC Report had a clear contradiction in it. It was the basis for the warrant, and it showed the Microsoft incident reports were generated hours before the appellant was associated with the identified IP address.
The SCAJ's Conclusion
[72] The SCAJ accepted that the "apparent timing inconsistency was an issue to be addressed". However, in his view, while the discrepancy may have lessened the connection to the appellant's home and computer equipment, the discrepancy did not eliminate it. The trial judge had no basis for rejecting Cst. MacDonald's explanation of the discrepancy, and engaged in a parsing of the facts. The SCAJ concluded "even with this 7 hour 0 minute time discrepancy, the issuing [justice] continued to have sufficient credible and reliable evidence that he could have issued the search warrant".
[73] I agree.
The Trial Judge's Errors
[74] Before turning to whether the trial judge had any basis for rejecting Cst. MacDonald's explanation of the discrepancy, I first explain why the time discrepancy did not eliminate the sufficiency of the grounds. Even if the time discrepancy remained unexplained, the SCAJ noted the following evidence remained intact:
(a) the file was uploaded by [information omitted]@Hotmail.com;
(b) the file contained images which were apparent child pornography;
(c) the IP addresses remained 174.95.50.159 and 174.95.54.28;
(d) the IP addresses continued to be connected to the N. address and Mr. Cusick's home; and
(e) the IP address associated with the uploading of the apparent child pornography, was within a short time, 7 hours 0 minutes, of the time in the NCMEC Report.
[75] I expand on the SCAJ's observation in subparagraph (e). Cst. MacDonald testified about the nature of dynamic IP addresses. IP addresses can and do change, but that does not mean they will change every time a computer user connects to the Internet. Cst. MacDonald said:
Bell [Canada] records when they gave you that IP address and gives it to you for certain amount of time. Then after -- sometimes with Bell [Canada] it could be three weeks, it could be three days, it could be -- the most I've seen is about two months with Bell [Canada] for them to allow you to keep an IP address, then you change it in for another one.
[76] For example, consideration of Exhibit 3, the "Combined table of all the NCMEC report time discrepancies", and the NCMEC Report, makes it apparent that IP address 174.95.50.159 was associated with the appellant's address both for the uploads on May 14 and May 19, 2012. A reasonable inference is that the appellant's IP address did not change between May 14 and May 19. The time discrepancy of seven hours did not eliminate the value of the NCMEC Report, which had to be weighed in the context of all the information.
[77] I add another observation. The times at which the files were uploaded were pertinent to the grounds, but the times at which Microsoft generated its incident reports were not. Cst. MacDonald was steadfast in his testimony, even on the first day, that the upload times in the NCMEC reports were accurate. His testimony about the uploading times was based on his training and experience. He testified that the GMT upload times and the IP addresses were bound together in the computer logs. So, while the times of the incident reports may have been puzzling, all the evidence in the record was that the upload times were those indicated in the NCMEC Report. It was only the upload times that were pertinent to the sufficiency of the grounds.
[78] Nevertheless, the trial judge never engaged Cst. MacDonald's explanation of the time discrepancy on its merits, but simply refused to accept it because he had not verified it with Microsoft. Cst. MacDonald's explanation of the time discrepancy was compelling and uncontradicted. The trial judge did not consider whether an issuing justice could have reasonably believed the explanation.
(iv) Staleness
The Trial Judge's Reasons
[79] The NCMEC Report indicated that the files containing the child pornography were uploaded to SkyDrive between May 10 and May 19, 2012. The search warrant was executed on January 23, 2013.
[80] Cst. MacDonald was extensively cross-examined about the "chances" the search would obtain relevant evidence after the passage of more than seven to eight months. He was forthright that he could not say what the chances were and that answering the question would require him to speculate.
[81] Cst. MacDonald said he had no grounds to believe the actual image files would be at either address. He did not know how they had been uploaded, including whether they were uploaded from a hard drive or a thumb drive, though he had reason to believe a thumb drive was involved. He explained that he would be looking for what he called "artifacts", which he described as electronic footprints left behind by the use of a computer. There are different kinds of artifacts that may be found in different locations on a computer. The type of artifacts and their location depends in part on the type of computer and its operating system. How long these artifacts remain depends on many factors such as the hard drive size, user activity, the type of artifact and so forth. Some artifacts might be currently used and saved in the current operating system. Cst. MacDonald indicated he was primarily interested in any activity of [information omitted]@hotmail.com. He said that until he executed the search warrant, he did not know what technologies were used and for what specific artifacts he should even look.
[82] The cross-examination culminated with counsel putting to Cst. MacDonald that, at the time he prepared the application for the search warrant, he did not know what the chances were that he was going to find artifacts on the appellant's computer. Cst. MacDonald agreed, saying he would have to speculate on user activity, hard drive size and other factors that he would not know before the search.
[83] The trial judge found it was speculative that artifacts would be found at the time of the search, as some seven to eight months had elapsed from the time of the uploading to the execution of the warrant.
[84] The trial judge summarized the import of Cst. MacDonald's cross-examination by saying "[a]t the time of drafting, he had no idea of any of this, of the usage, of the systems, etc. Nor, he had no idea as to the chances the artifacts on the computer would be there seven to eight months later. He couldn't say, he said if he tried it was speculation." The trial judge concluded that speculation was well below the standard for reasonable and probable grounds to believe that evidence would be found at the address searched.
The SCAJ's Conclusion
[85] Despite Cst. MacDonald's lack of detailed knowledge as to what would or could be found on the appellant's computer equipment, and the delay of seven to eight months, the SCAJ concluded there were sufficient grounds on which the warrant could have been issued. The SCAJ found the trial judge had not paid sufficient deference to Cst. MacDonald's "ability to draw inferences and make deductions as a police officer and as an expert in online cloud storage and internet investigations". He was satisfied "that the trial judge erred in equating the lack of knowledge of the precise manner of uploading/computer use and the inability to state the 'chances' that electronic artifacts or use of the user account would be found".
[86] I agree.
The Trial Judge's Errors
[87] As a matter of context, it is worth noting that the police investigation did not contribute to the delay. Cst. MacDonald testified that it takes NCMEC between 90 days to six months to transfer the files received from the electronic service providers to the designated foreign federal agencies. In this case, NCMEC completed transferring files to the R.C.M.P. in December 2012. After the investigative steps described above, Peel police applied for the warrant on January 21, 2013 and executed the warrant on January 23, 2013. This is not a case in which the lack of police diligence allowed evidence to grow stale.
[88] Further, there is something more fundamental than staleness at issue here. Even if he had been cross-examined shortly after the files were uploaded to Skydrive, Cst. MacDonald would have been unable to state the "chances" that artifacts would be found during the search. Given his lack of knowledge about the computer devices from which the files were uploaded and their technical characteristics, he would not have able to quantify for the court the "chances" that any particular artifacts would be found. He would not have been able to say anything more definitive than what he explained in the ITO:
When these devices operate on the internet, electronic artifacts are left behind. These artifacts can be used to corroborate the information sent from Microsoft. With the information at hand, it is unclear it is one person using the account [information omitted]@hotmail.com or two individuals. Further, if it is in fact one individual it is not clear if the suspect is travelling between the dwelling houses with a computer system and using the Internet service at each house, or is using the computer system(s) that are already present at the residences. Police wish to seize all computer system capable of operating on the Internet in order to identify, collect and preserve any images on the computer, as well as the electronic artifacts to afford evidence of possession of child pornography. The further analysis of the computer system(s) will clarify . . . what computer(s) have access to this Microsoft account.
[89] The fundamental point is that the assessment of reasonable grounds does not depend on mathematical notions of probability. Cst. MacDonald's inability to express the "chances", i.e. the odds, of finding artifacts on the appellant's computer does not mean that he lacked reasonable grounds. The standard is whether the authorizing justice of the peace, considering the evidence as a whole on a common sense, practical and non-technical basis, and drawing reasonable inferences therefrom, could have reasonably believed that there was evidence to be found at the place to be searched. The standard to be met is determined qualitatively by applying reason to the evidence, not quantitatively by attempting to apply notions based on the probability branch of mathematics. As Deschamps J. said in R. v. Morelli, [2010] 1 S.C.R. 253, 2010 SCC 8, at para. 129, "[d]etermining whether evidence gives rise to a 'credibly-based probability' does not involve parsing the facts or assessing them mathematically" (emphasis added). She approved of the "non-technical, common sense approach" taken by Rehnquist J. in Illinois v. Gates, 462 U.S. 213 (1983).
[90] It is essential, as this court said in R. v. Campbell, [2010] O.J. No. 3767, 2010 ONCA 588, 261 C.C.C. (3d) 1, at para. 54, affd [2011] 2 S.C.R. 549, 2011 SCC 32, "that the grounds for believing there is evidence in the place to be searched are based on the operation of reason and not on mere suspicion". In determining whether there was a breach of the accused's constitutional right, the test is "whether there was reliable evidence in the sworn information before the justice that might reasonably be believed on the basis of which the justice could have granted the warrant": R. v. Manders, [2007] O.J. No. 4757, 2007 ONCA 849, at para. 11.
[91] The starting point of the assessment of Cst. MacDonald's testimony about artifacts is his expertise in cloud computing and Internet investigations. He had much education, certification and experience in electronic evidence collection and the forensic examination of computers. It is significant that throughout his testimony, he steadfastly maintained he had reasonable grounds for searching for artifacts. His opinion in a highly technical field had to be carefully considered and was deserving of weight.
[92] During his prolonged cross-examination about the chances of finding artifacts, Cst. MacDonald conceded that the chances he would find evidence of the actual uploading of the child pornography on the appellant's physical computer were "most likely pretty low". He did clarify that he had grounds to believe the images were on a thumb drive or other external media. He reminded counsel of what the ITO he had indicated. The ITO indicated:
Other devices capable of storing electronic data may contain images of child pornography. Due to the type of files uploaded, there is reason to believe that the suspect used an external storage device, that at some point was plugged into a Windows operating system and later a Macintosh/Linux operating system, or vice versa. Police wish to seize all devices capable of storing electronic data to have it analysed for evidence of child pornography images.
The suspect uploaded some hidden files to the SkyDrive. This includes thumbnail image database (thumbs.db) for a Windows based operating system and a Desktop Services Store (DS_ Store) for a Macintosh or Linux Operating System. The fact that both these files were loaded by the same user at almost the same time tells me these two files existed in the same folder.
In my experience, these files usually co-exist in one folder on a thumb drive, external hard drive, or other types of external media that can be plugged into a computer running the Windows operating system and a Macintosh/Linux operating system.
[93] In response to other questions, Cst. MacDonald testified that he would be speculating as to the chances of finding artifacts. Specifically, he testified that he would not know the chances of finding artifacts until he knew "the technologies". To estimate the chances of finding artifacts would necessarily require speculation on "user activity", which varies depending on a number of factors unknown prior to the execution of the search warrant. He testified that it would be speculation as to what exact technologies -- whether an iPad, computer or other device -- were used, based only on the time, date and IP address provided by NCMEC.
[94] Cst. MacDonald was clear that the artifacts he would be looking for were not limited to those created when the child pornography files were uploaded to SkyDrive. He gave two examples.
[95] First, he indicated that artifacts would be created if the child pornography was viewed after it had been uploaded. He said, "[a]s soon as you look at [the child pornography] you are going to create a cache and all that kind of different stuff on your computer. There is still lots of evidence." The issuing justice could have reasonably inferred that the files were uploaded for retention and later viewing. As Cst. MacDonald explained, later viewing of the files any time after their upload would create artifacts. This would be so even if the computer used to view the files was not the same one that had been used to upload the child pornography earlier.
[96] Second, Cst. MacDonald indicated he was primarily interested in artifacts left by [information omitted]@Hotmail.com. Such an artifact need not be connected to the upload of the pornographic files some seven to eight months earlier. Any login into that SkyDrive account would create artifacts, and, in fact, use of [information omitted]@hotmail.com at any time whatsoever, for any purpose whatsoever, would create artifacts that could connect the computer to the child pornography. Again, such artifacts would be highly relevant, even if the computer was not the same one that had been used to upload the child pornography months earlier. The issuing justice could reasonably infer the person who uploaded the child pornography would use their e-mail account to access SkyDrive for other purposes as well.
[97] While Cst. MacDonald was forthright that quantifying the chances of finding artifacts would be speculative, he could not be dissuaded from his view there were reasonable grounds to search the computer. The issuing justice could have accepted Cst. MacDonald's expert opinion, evident in the following exchange:
Q. Okay. So when you're talking about the artifacts because you -- I mean you're saying you had grounds to believe that there should be artifacts that have some evidentiary value on computers, right?
A. Yes, there is.
[98] As I understand it, Cst. MacDonald's testimony was not that the prospect of finding artifacts was speculative, but that quantifying the chances of finding artifacts would require him to speculate. The trial judge erred by concluding that the fact Cst. MacDonald could not express the odds of finding artifacts some seven to eight months later meant he was engaging in speculation and lacked reasonable grounds that artifacts would be found. She failed to recognize the assessment of reasonable grounds is qualitative. All the circumstances have to be considered, the passage of time being only one.
[99] Considering all the circumstances, the issuing justice could have accorded the passage of time less weight, and attached greater weight to the expert opinion of Cst. MacDonald, in this highly technical field in which common sense intuitions about the lapse of time are less helpful.
(v) The Reliability of the NCMEC Report
[100] Given the trial judge's several errors, it was the SCAJ's task to determine if the warrant could have issued.
[101] The SCAJ correctly observed that the information in a CyberTipline Report has hallmarks of reliability. The Microsoft username, e-mail account, files uploaded, times of upload and IP address of the computer that uploaded the files all come from Microsoft, not from NCMEC. Microsoft's reports to NCMEC, and the CyberTipline Reports sent to police agencies, are mandated by statute. Microsoft is a large multinational corporation which took the initiative to co-develop PhotoDNA to combat child exploitation and comply with its statutory obligation. Microsoft has no interest in what the information transmitted to NCMEC consists of, as long as it complies with the relevant legislation. PhotoDNA is not subject to "human judgment", but is generated electronically by a computer program, as an "automatic response" by Microsoft to their program determining that images are apparent child pornography.
[102] In addition, the SCAJ correctly concluded that the totality of the circumstances met the Debot standard of reasonableness for assessing information from a non-police, third-party source.
[103] The SCAJ found the information from Microsoft was compelling that an offence was committed. The files contained in the reports were examined by the local police, and it was their belief that many of the files constituted child pornography under the Criminal Code. The information about the file names and times they were uploaded, along with the username, e-mail address and IP addresses used to upload the files, was detailed and specific.
[104] The SCAJ found the information from Microsoft was adequately corroborated. Corroboration of every aspect of information from a third-party source outside the police is not necessary. The three Debot factors -- compelling, credible and corroborated -- are not considered separately. Rather, "the 'totality of the circumstances' must meet the standard of reasonableness. Weaknesses in one area may, to some extent, be compensated by strengths in the other two": Debot, at p. 1168 S.C.R. Meaning, the quality of the information and the reliability of the source can compensate for weakness in corroboration.
[105] The information at issue was not susceptible to independent corroboration. The police could only have asked Microsoft to provide the contents of the NCMEC Report directly to them. The SCAJ observed this "would simply be a repetitive exercise" and that "[t]here is no further investigative technique which can be used by the police to corroborate the offence by the user without a search warrant." The information's hearsay character did not exclude it from the issuing justice's consideration.
(4) The Trial Judge Erred in Finding the N. Search Undermined the Grounds for the Search of the Appellant's Residence
The Trial Judge's Reasons
[106] The trial judge accepted the appellant's argument that the police lost reasonable grounds to search the appellant's residence after the search of the N. address. As indicated above, on executing the first warrant, the police learned that a young person with autism at the N. address used [information omitted]@hotmail.com. His mother advised he had involvement with child pornography three years earlier. The young person denied responsibility for uploading the child pornography identified by NCMEC. Cst. MacDonald's subjective belief was the young person was involved in the uploading of the child pornography.
[107] The trial judge noted that when the police arrived at the appellant's residence, the appellant denied any knowledge of John E. and [information omitted]@hotmail.com. The appellant's mother said no kids came over to use the appellant's computer or brought their own computers to the house. The appellant told the police they would not find child pornography on his computer, perhaps just an image of child nudity without sexual features. The police used a device to go onto the appellant's computer and found no connection to [information omitted]@hotmail.com and no images of the child pornography identified by the NCMEC Report.
[108] The trial judge emphasized that Cst. MacDonald agreed in cross-examination he had no grounds to believe the appellant had anything to do with the uploading of child pornography associated with [information omitted]@hotmail.com. All the evidence Cst. MacDonald had at that point pointed to no connection between the two houses or the two suspects. Thus, she concluded that Cst. MacDonald lacked reasonable grounds to seize the appellant's computer and external drives, saying "it would not be objectively reasonable that there would be evidence of the uploading activity on the accused's computer and storage discs at the time."
The SCAJ's Conclusion
[109] The SCAJ concluded the trial judge erred in finding that the police no longer had reasonable grounds after the N. search and the appellant's denials. He identified several errors in the trial judge's reasoning.
[110] I agree with the SCAJ's analysis.
The Trial Judge's Errors
[111] First, as the SCAJ pointed out, as a matter of law the validity of the search warrant does not depend on tying the appellant to the offence. The search warrant could have issued if there were reasonable grounds for discovering evidence of the offence at the appellant's residence, even if the appellant was not the offender.
[112] Second, the trial judge only considered if it was objectively reasonable to believe evidence of the uploading activity would be found. As explained above, artifacts of the use of [information omitted]@hotmail.com at any time and for any purpose would be relevant evidence.
[113] Third, as Cst. MacDonald pointed out, after the N. search there was still evidence that child pornography had been uploaded to SkyDrive from an IP address associated with the appellant's home using [information omitted]@hotmail.com e-mail address. Nothing the police learned at the search of the N. address negated or even undermined that evidence. That evidence alone provided a reasonable basis to believe the appellant home's Internet connection had been used to upload child pornography. A search of the appellant's computer and storage devices was necessary to investigate this connection.
[114] Fourth, the trial judge engaged in hindsight reasoning when she observed that the child pornography eventually found on the appellant's computer was "totally unrelated to the NCMEC report". It is true that the unique images and video files the police found at the appellant's residence did not match those in the NCMEC Report. But, the fact that the evidence found was not the evidence searched for is irrelevant. The SCAJ correctly stated:
A reviewing judge does not consider what was found as a result of the execution of the search warrant but only whether there were reasonable and probable grounds that the issuing justice of the peace could have issued the search warrant at the time the ITO was issued. A reviewing judge should not consider whether or not evidence was found pursuant to the execution of the search warrant to determine whether the issuing justice could have issued the search warrant.
[115] The trial judge did not consider whether the issuing justice could have viewed matters differently. The issuing justice could have accorded less weight to the appellant's denials to the police that child pornography would be found on his computer and that he had no connection to the young person at the N. address. The issuing justice could have attached greater weight to the evidence that child pornography was uploaded from the appellant's home's Internet connection, and resultantly issued the warrant.
(5) Section 24(2)
[116] The SCAJ found that the Spencer breach was the only s. 8 breach. In view of the fact that Spencer was released after this search warrant had been issued and executed, the police conduct fell on the lower end of the spectrum. Considering this together with the other two factors in R. v. Grant, [2009] 2 S.C.R. 353, 2009 SCC 32, the SCAJ reasoned that an order excluding the evidence should not be granted. In my view, he was correct to do so.
E. Conclusion
[117] The SCAJ correctly concluded that the appellant's s. 8 rights had not been infringed except for the Spencer breach. He properly declined to exclude the evidence under s. 24(2). I would dismiss the appeal.
Appeal dismissed.
End of Document
