COURT FILE NO.: CR-21-42 DATE: 20230309 ONTARIO SUPERIOR COURT OF JUSTICE

BETWEEN:

HER MAJESTY THE QUEEN – and – KYLE HUGHES Defendant

Counsel: Cameron Peters for the Crown Joel Hechter for Mr. Hughes

HEARD: February 27, 2023

Reasons for JUDGMENT c. boswell j. (Orally)

The Nolo Contendere Procedure

[1] Mr. Hughes was charged, following a police investigation of his file-sharing activities on the BitTorrent peer-to-peer network, with two counts of possession of child pornography and one count of making child pornography available to others.

[2] The trial of the charges against Mr. Hughes was scheduled to commence on February 27, 2023. Prior to the trial date, the court was alerted to the fact that Mr. Hughes’ intention was to plead not guilty but otherwise not contest the Crown’s case against him.

[3] Mr. Hughes had sought, in a pre-trial application, to exclude all, or virtually all, of the core evidence relied upon by the Crown in the case against him. He argued that the evidence had been obtained unconstitutionally and must be excluded to protect the reputation of the administration of justice. I dismissed Mr. Hughes’ Charter application on January 6, 2023 for reasons reported as 2023 ONSC 109.

[4] Following the release of my ruling on the Charter application, Mr. Hughes decided that he would not contest the Crown’s case against him but would nevertheless plead not guilty so that he could maintain his right to appeal the Charter ruling.

[5] The process followed was the functional equivalent of a plea of nolo contendere (no contest), though that is a plea not formally recognized by our Criminal Code.

[6] Prior to the arraignment and pleas, and in accordance with the procedure discussed by the Court of Appeal in R. v. R.P., 2013 ONCA 53, the court conducted the functional equivalent of a plea inquiry with Mr. Hughes. He confirmed that he understood the process that was proposed by counsel. He was aware that he was all but giving up his right to a trial; understood that his counsel would not be challenging the evidence that the Crown adduced; appreciated the fact that it was anticipated by all interested parties that findings of guilt would be made against him on all outstanding counts; and understood that the next stage of the proceedings would likely involve sentencing submissions, where the Crown would be expected to seek a jail sentence.

[7] Mr. Hughes confirmed that his decision not to contest the Crown’s case was one made voluntarily, without the presence of threats or inducements of any nature.

[8] The Crown asked that Mr. Hughes be arraigned on only two of the three counts charged, namely count two (making child pornography available between July 18 and 20, 2019) and count three (possessing child pornography on September 5, 2019). He was so arraigned and entered pleas of not guilty to each count.

The Evidence

[9] The evidence adduced by the Crown was quite modest, as one might expect with this type of process. Counsel worked out a short synopsis of facts to be read into the record. Mr. Hughes was not prepared to formally admit the truth of the facts, so the synopsis did not enter the record as an agreed statement of fact. That said, he did not contest the facts either. His counsel agreed that the facts set out in the synopsis essentially reflected the evidence that the Crown could have and would have adduced through a number of witnesses had the charges been contested. Defence counsel confirmed that the court could rely on the evidence set out in the synopsis as though it had been offered as sworn testimony as part of the Crown’s case. The synopsis was read into the record and a copy was marked Exhibit “A” at trial.

[10] Defence counsel also agreed that the court could, in reaching its verdicts, rely on any of the evidence adduced during the hearing of the Charter application, or a records application that preceded it.

[11] Mr. Hughes, as I noted, is alleged to have been sharing child pornography on the BitTorrent network. The Child Exploitation Unit of the OPP uses proprietary software programs known as Torrential Downpour Receptor (“TDR”) and Torrential Downpour (“TD”) to investigate the proliferation of child sexual abuse material on the BitTorrent network. Those programs were used by law enforcement agencies to (1) identify Mr. Hughes’ IP address as associated with files known to contain child pornography; and, (2) connect to a device at Mr. Hughes’ IP address and download files containing child pornography between July 18 and 20, 2019.

[12] Mr. Hughes brought a disclosure application to obtain copies of the software, its source codes, operational manuals, training manuals and other information as a prelude to his Charter application. He alleged in the Charter application that the use of the software intruded on his reasonable expectation of privacy and thereby breached his s. 8 right to be free from unreasonable search and seizure.

[13] The disclosure sought involved a mix of first and third party records. The disclosure application was complex and proceeded in two stages. During the course of the application, I heard extensive evidence about the BitTorrent network generally, about the software in issue and about the police investigation into Mr. Hughes’ IP address.

[14] I released two rulings on the disclosure application, reported as 2022 ONSC 2164 and 2022 ONSC 5209. Each of those rulings contains a detailed description of how the BitTorrent network operates. It is unnecessary that I repeat all of those details here, though I will touch upon them momentarily.

[15] Once the disclosure application was complete, I heard Mr. Hughes’ Charter application. Blended with the Charter application was a challenge to the validity of a warrant the OPP obtained to search Mr. Hughes’ residence in Beeton, Ontario. During the course of that hearing, I heard evidence from Detective Constable Erin Neller, who was the lead investigator into Mr. Hughes’ IP address and his activities on the BitTorrent network. She provided a concise account of her investigation into Mr. Hughes’ IP address using the TD software.

[16] In the course of my ruling on the Charter application, I again extensively detailed the way in which the BitTorrent network works and how the police make use of the software tools at their disposal to conduct investigations of activity on that network. It is unnecessary to repeat that detailed examination of the BitTorrent network. However, to understand the investigation into the charged offences, it is necessary to understand at least some basic information about how the network functions.

Overview of the Offences

[17] The BitTorrent network is a peer-to-peer (“P2P”) network operating over the Internet. Its structure allows users across the network to communicate directly with one another, without the need of a central server, for the purpose of sharing data files. Access to the network is free. One need only download a client program file compatible with the network in order to operate on it. There are a number of client programs available for free download on the Internet. One such program is called μTorrent.

[18] Program files on the BitTorrent network, including μTorrent, almost invariably lack internal search engines. Instead, a user has to actively search the internet for a “torrent” file associated with the data file the user is ultimately looking for. For instance, if a user is seeking a copy of the movie, Star Wars, he or she must begin with a search for a torrent file associated with that movie. A torrent file is a small data file that contains instructions that enable a BitTorrent client program to locate and download the data that makes up the file being sought (the “payload file”).

[19] When a user locates and loads a torrent file into their client program, the client program searches the BitTorrent network for users that have, and are willing to share, the payload file. They are aided in their search by indices utilized by the network to match those seeking files with those willing to share them.

[20] Client programs, like μTorrent, have default file folders into which payload files are saved as they are downloaded. Those default folders are shared file folders. Any payload file in a shared file folder is available for other users on the BitTorrent network to access.

[21] The way that data files on the BitTorrent network are structured allows them to be broken down into pieces and shared in pieces. That ability in turn allows users to obtain pieces of a given payload file from multiple users. In that way, download speed increases. When a user successfully downloads a piece of a payload file to his or her shared folder, that piece immediately becomes available for other users to download. In other words, the user may immediately become simultaneously an uploader and downloader of the payload file.

[22] TDR is a program that searches the BitTorrent network for users expressing an interest in files known to contain child pornography. By “expressing an interest” I mean users that are actively searching for known child pornography or users that are actively sharing files known to contain child pornography.

[23] TDR and TD operate through a central server maintained by a U.S. task force known as the Internet Crimes Against Children task force (“ICAC”). When TDR locates a user expressing an interest in known child pornography files, it identifies the user’s IP address and it reports that address, along with information about the file in issue, to the ICAC server. The server then geolocates the IP address and pushes the details of that address and of the files in issue to TD software being operated by a law enforcement agent in the jurisdiction where the IP address is located.

[24] DC Neller is a licensed user of TD software. In the summer of 2019, she ran her TD program file around the clock, seven days per week. The software requires very little human involvement.

[25] On July 18, 2019, TDR software being operated by an unknown law enforcement agent somewhere in the world, identified IP address 99.232.162.41 as expressing an interest in two files known by law enforcement to contain child pornography. The ICAC server geolocated the IP address to New Tecumseth, Ontario and pushed information about it - and the files of interest associated to it - to DC Neller’s TD client program.

[26] DC Neller’s TD client program subsequently connected to a device operating at IP address 99.232.162.41 between 10:02 p.m. on July 18, 2019 and 10:02 p.m. on July 19, 2019. During that time, her TD software downloaded some 57 files from the device. The device was determined by TD to be operating μTorrent v. 3.5.5 software.

[27] TD Neller reviewed a number of the downloaded files on August 1, 2019. She confirmed that they contained child pornography. They are part of a commonly shared group of files, known to DC Neller, which include the name “Adry” in their titles.

[28] Two of the files downloaded by TD from the device at IP address 99.232.162.41 are described as follows:

(a) The first is titled, “AdryPlayWithDelyandDad(1).jpg”. It is a colour image of two prepubescent females lying naked on a bed. One is holding a sex toy to the vagina of the other. The females are estimated to be between 10 and 12 years of age. I will refer to this file as “Adry1”;

(b) The second is titled, “Adry HC007.MTS.jpg”. It is a collage of 20 thumbnails of still images. The images depict a prepubescent female engaged in illicit sexual acts with an adult male including oral sex and vaginal intercourse. The female is estimated to be between 8 and 10 years of age. I will refer to this file as “Adry2”.

[29] Through further investigation, DC Neller determined that the target IP address was registered to Athena Hughes, who lived at 20 McGinty Court in Beeton, Ontario. Beeton is a part of New Tecumseth. Ms. Hughes lived at that address with her husband and two adult sons, one of whom is the defendant.

[30] DC Neller obtained a warrant to search 20 McGinty Court. The warrant was executed on September 5, 2019. During the search, the police seized four items from Mr. Hughes’ bedroom:

• an LG smartphone;
• a Samsung smartphone;
• a Cooler Master desktop computer; and,
• a Gateway laptop.

[31] While at the scene, forensic analysts located images of child pornography on the LG phone and the Gateway laptop. The desktop was observed to contain a file in the downloaded files folder titled “Adry”. The desktop was also found to have μTorrent v. 3.5.5 installed.

[32] Subsequent forensic examination of the desktop and laptop computers revealed some 1,619 unique images of child pornography. The LG phone was found to contain 91 unique images of child pornography. The majority of the images depicted prepubescent female children engaged in explicit sexual activity with adults. The balance of the images were of prepubescent females whose sexual organs were the dominant characteristic of the image. The majority of the children in the images on the computers were female. Less than 5% were toddlers, with the balance estimated to be between toddler and age 10. The majority of the children in the images on the LG phone were female and ranged in age from 6 to 12.

[33] Twenty-two unique videos containing child pornography were located on the two computers. Roughly half of the videos were of prepubescent females engaged in explicit sexual activity with adult males or other female children. The balance were of prepubescent females whose sexual organs were the dominant characteristic of the video. The majority of females in the videos ranged from age 8 to 14.

The Essential Elements

Possession of Child Pornography

[34] I will address the possession count first. At count 3, Mr. Hughes is charged with possessing child pornography on September 5, 2019.

[35] Section 163.1(4) of the Criminal Code makes possession of child pornography a criminal offence.

[36] Child pornography is defined in s. 163.1(1) of the Code which provides, in part, as follows:

163.1 (1) In this section, child pornography means

(a) a photographic, film, video or other visual representation, whether or not it was made by electronic or mechanical means,

(i) that shows a person who is or is depicted as being under the age of eighteen years and is engaged in or is depicted as engaged in explicit sexual activity, or

(ii) the dominant characteristic of which is the depiction, for a sexual purpose, of a sexual organ or the anal region of a person under the age of eighteen years.

[37] Knowledge and control are the essential elements of possession.

[38] Knowledge is established when the Crown proves, to the reasonable doubt standard, that Mr. Hughes was aware that he had physical custody of the images and videos in question and that he was aware of what the content of those images and videos was. See R. v. Morelli, 2010 SCC 8 at para. 16. Though it must be shown that Mr. Hughes had knowledge of the contents of the videos and images in question, there is no requirement that he actually knew the content constituted child pornography. See R. v. Chalk (2007), 2007 ONCA 815, 52 C.R. (6th) 371 (C.A.) at para. 18.

[39] The knowledge element must co-exist with an act of control: Morelli, para. 16. Control means having power or authority over the item, whether exercised or not: Chalk, para. 19.

[40] In this case, the evidence regarding knowledge and control is all circumstantial.

[41] When the Crown’s case is based wholly or substantially on circumstantial evidence, a finding of guilt may only be reached where the trier of fact is satisfied beyond a reasonable doubt that guilt is the only reasonable inference to be drawn from the evidence as a whole. See R. v. Villaroman, 2016 SCC 33, [2016] 1 S.C.R. 1000, at para. 20.

[42] It is important to keep in mind that circumstantial evidence is not to be assessed on a piecemeal basis. It is the evidence, assessed as a whole, that must meet the reasonable doubt standard. See R. v. Lights, 2020 ONCA 128, at para. 37. See also R. v. Johnson, 2023 ONCA 120 at para. 7.

[43] When assessing whether guilt is the only reasonable inference to be drawn from the circumstantial evidence in the case, the trier of fact must consider other plausible theories and reasonable possibilities inconsistent with guilt so long as they are grounded in logic and experience as opposed to fevered imaginings or speculation. That said, inferences consistent with innocence need not arise from proven facts. Rather, they may arise from a lack of evidence. See Villaroman, at para. 35.

[44] While Crown counsel must negate reasonable possibilities inconsistent with guilt, he need not negate every possible conjecture, no matter how irrational or fanciful, which might be consistent with an accused’s innocence. See Lights, at para. 38. The “only reasonable inference” standard does not demand that guilt is the only possible or conceivable inference. See R. v. Vernelus, 2022 SCC 53.

[45] In the circumstances here, I am satisfied that the only reasonable inference available on a consideration of the evidence as a whole is that Mr. Hughes had knowledge and control of at least some, if not all, of the images and videos of child pornography found on his desktop computer, his laptop and his LG phone. In other words, I am satisfied beyond a reasonable doubt that, on September 5, 2019, Mr. Hughes had knowledge and control of child pornography on his devices based on the following facts and circumstances:

(a) There is no dispute here that the devices seized from Mr. Hughes’ room were his devices. It is not disputed that he possessed those devices and that he had control of each and every one of them;

(b) Three of the four devices had files containing child pornography stored on them. In my view, the fact that files containing child pornography were found on multiple devices possessed and controlled by Mr. Hughes strongly supports an inference that he did not accidentally acquire the files and that, instead, they were accumulated intentionally;

(c) There were a significant number of files containing child pornography on the three devices. It would have taken a significant amount of effort to amass a collection that large. Moreover, it strikes me as extremely unlikely that a person would have over 1,700 images of child pornography and over 22 videos of child pornography on his devices without being aware that they were there;

(d) The BitTorrent network is, regrettably, a platform on which child pornography files are frequently disseminated. I am satisfied that one way in which Mr. Hughes acquired images and/or videos containing child pornography was on the BitTorrent network. As I explained, acquiring files on the BitTorrent network requires a concerted effort by the user to seek out and obtain a torrent file for the payload file sought. This requisite effort tends to reduce the likelihood that child pornography is accidentally downloaded without a user’s knowledge; and,

(e) Mr. Hughes’ devices were found to contain copies of the files downloaded by DC Neller’s TD client program between July 18-19, 2019, including Adry1 and Adry2. Moreover, Mr. Hughes’ desktop computer had an installed copy of μTorrent v. 3.5.5, which is the program file that DC Neller’s copy of TD connected to at the IP address registered to Mr. Hughes’ mother. I conclude, without hesitation, that it was Mr. Hughes’ desktop computer that DC Neller’s TD client program connected to on July 18, 2019. I further infer, without hesitation, that Mr. Hughes had copies of Adry1 and Adry2 in the shared file folder of his μTorrent client program between July 18 and 19, 2019. Finally, I infer that he had those files in that shared folder because he had actively sought them out on the BitTorrent network.

[46] It is always possible, of course, that somehow 1,700 images of child pornography got onto Mr. Hughes’ devices without him knowing about it. But on the evidentiary record before the court, the notion that Mr. Hughes’ somehow unknowingly came into possession of such a substantial inventory of child pornography is entirely speculative and fanciful.

[47] I am, in the result, satisfied beyond a reasonable doubt that the only rational inference available on the evidence before the court is that Mr. Hughes knew he possessed child pornography and he had control of it, on his various devices.

[48] A finding of guilt is therefore entered on count 3.

Making Available

[49] Mr. Hughes is charged at count 2 with making child pornography available between July 18 and 20, 2019.

[50] Section 163.1(3) of the Criminal Code creates the offence of making child pornography available. To establish Mr. Hughes’ guilt for this offence, the Crown must prove beyond a reasonable doubt that:

(i) Mr. Hughes made child pornographic material available to others by some means; and,

(ii) Mr. Hughes intended to make child pornography available to others.

[51] I am satisfied beyond a reasonable doubt that Mr. Hughes made files containing child pornography available to others through a μTorrent v. 3.5.5 client program operating on the BitTorrent network between July 18 and 20, 2019. That is the time period during which DC Neller’s Torrential Downpour software downloaded, amongst others, the Adry1 and Adry2 files from Mr. Hughes’ μTorrent program operating on the BitTorrent network.

[52] The files downloaded by DC Neller were linked to an IP address assigned by Rogers Communications to Mr. Hughes’ mother. He lived with her in Beeton. A device seized from Mr. Hughes’ bedroom contained copies of the files downloaded by DC Neller as well as an installed copy of μTorrent v. 3.5.5.

[53] The only reasonable inference available on a consideration of the whole of the circumstantial evidence is that Mr. Hughes had the Adry1 and Adry2 files in the shared folder of his μTorrent v. 3.5.5 program file and that he thereby made them available to other users of the BitTorrent network between July 18 and 20, 2019.

[54] All of this is to say that the actus reus of the offence of making child pornography available is relatively easily made out.

[55] The mens rea issue is only marginally more difficult.

[56] In R. v. Spencer, 2014 SCC 43 at para. 83, Cromwell J. confirmed that the fault element of s. 163.1(3) requires proof that the accused person had knowledge that the pornographic material in issue was being made available. It does not require, however that the accused person must “knowingly, by some positive act, facilitate the availability of the material.”

[57] Where a P2P file-sharing program is involved in making child pornography available, it is enough that the accused is demonstrated, to the reasonable doubt standard, to have actual knowledge that the file sharing program makes files available to others. Or, in the alternative, that the accused is shown to have been wilfully blind to the fact that the file sharing program makes files available to others.

[58] I am satisfied, in the circumstances of this case, that Mr. Hughes had actual knowledge that the file sharing program, μTorrent v. 3.5.5, makes files available to others. I find that such a conclusion is the only reasonable inference available in the circumstances, in light of the following factors:

(a) Mr. Hughes, as I have noted, had amassed a substantial collection of child pornography, in both image and video formats. I am unable to say how he acquired all of his digital images and videos, but I have no hesitation in inferring that he must be well familiar with the ways in which child pornography is shared over the Internet;

(b) On the occasion in issue, Mr. Hughes made child pornography available over the BitTorrent network. The BitTorrent network is a file sharing network. That is its sole purpose – the sharing of files amongst users. Though he may not have understood the specific architecture of the network, Mr. Hughes must have understood that its raison d’etre is the sharing of files;

(c) On the occasion in issue, Mr. Hughes made use of the μTorrent v. 3.5.5 client program. That program, as I noted, does not have a built-in search engine. Users are required to take steps to actively locate torrent files that relate to files of interest to them. Once located, the torrent file has to be loaded into the μTorrent program to initiate a search. All of this supports the inference that users of the μTorrent program must have at least some basic familiarity with the program’s functionality in order to successfully use it. I infer that Mr. Hughes had at least a basic understanding of how μTorrent v. 3.5.5 shared files on the network; and,

(d) The μTorrent program actively displays search results, including files that are being downloaded, the sources of the downloads and the progress of the downloads. It similarly displays files that are being uploaded. With even a basic understanding of the functionality of the program, the user – in this case Mr. Hughes – would be aware of the downloading and uploading functions of the software.

[59] I am, in the result, satisfied beyond a reasonable doubt that Mr. Hughes knew that his installed μTorrent program made files available to others. The Crown has therefore established, to the reasonable doubt standard, that Mr. Hughes is guilty of making child pornography available to others during the period July 18-20, 2019, contrary to s. 163.1(3) of the Criminal Code.

[60] A conviction will accordingly be entered on count 2.

C. Boswell J. Released: March 9, 2023