Court File and Parties

Court: Ontario Court of Justice

Date: 2016-05-11

Court File No.: London 15-7105

Between:

Her Majesty the Queen

— AND —

Reginald Thompson

Before: Justice A. Thomas McKay

Heard on: March 8 and 9, 2016

Reasons for Judgment released on: May 11, 2016

Counsel:

• L. Tuttle, for the Crown
• M. Fordham, for the defendant Reginald Thompson

MCKAY J.:

INTRODUCTION

[1] This decision relates to a trial which was held in London on March 8 and 9, 2016. On April 22, 2016, the court released condensed oral reasons finding Mr. Thompson guilty of all charges. The Court indicated that it would subsequently release these written reasons.

[2] As a result of an investigation, members of LPS obtained and executed a search warrant related to Mr. Thompson's residence. A number of electronic devices were seized. Ultimately, police located a number of videos and images on a computer which was seized at the residence. It was agreed at the outset of trial that those images meet the definition of child pornography within the Criminal Code.

[3] Mr. Thompson was charged with the following offences under section 163.1 of the Criminal Code:

1. accessing child pornography during the period from August 1, 2014 to December 2, 2014;
2. making child pornography available on August 6, 2014;
3. possessing child pornography on August 6, 2014;
4. making child pornography available on August 11, 2014;
5. possessing child pornography on August 11, 2014.

[4] The Crown proceeded summarily on all counts. Mr. Thompson entered not guilty pleas on all counts.

EVIDENCE

Grant Fair

[5] Grant Fair has been a member of the London Police Service ("LPS") for approximately 27 years, and is currently assigned to the position of supervisor of the Child Exploitation Unit. He was assigned to the group of officers who executed the search warrant to Mr. Thompson's residence. Officers attended the residence and at 7:02 a.m. and were allowed entry to the residence by Mr. Thompson. Prior to their entry, Mr. Thompson was alone in the apartment.

[6] Officer Fair located an iMac desktop computer in the basement of the residence in what he described as the recreation room. He advised Detective Constable Johnson of that find. He then searched one of the two bedrooms of the residence, which were located upstairs. The bedroom which he searched was obviously a bedroom used by an adult. Located within it were documents, including Bell Internet records billed to that address under the business name MBRK Building Maintenance. The second bedroom appeared to obviously be used by a child. Officer Fair overheard Mr. Thompson inform Detective Constable Johnson that he lived alone, but that his daughter visited him every second weekend.

Andrew Mitchell

[7] Detective Constable Mitchell has been a member of the LPS for approximately 15 years. Since 2011, he has served in the Digital Forensics Unit. On December 2, 2014, he was part of the team of officers who executed the search warrant on Mr. Thompson's residence. He brought a digital camera and took the photographs of the scene. Mr. Thompson was the only occupant of the residence. The iMac desktop computer was in the basement recreation room on a circular table. That computer powered on, and the date and time display were accurate. There were several applications running on the computer, including Safari, email, and uTorrent, which is a downloading program. His understanding is that uTorrent is not a default application for Apple's operating system.

[8] The series of photographs taken by Detective Constable Mitchell were collectively filed as Exhibit 2. With respect to photograph number nine, it depicts the screen of the desktop computer with the uTorrent application open. It depicts an inactive download file. The file is inactive because the desktop computer at Mr. Thompson's residence could not locate another computer from which to download that file. The same inactive status would result if one started a download, and then stopped it. The name of the inactive file was "7yo daughter Pedo Mom- (Rare dad & Daughter PTHC Video"). In his experience, the letters PTHC stand for preteen hard-core. After viewing that on the computer screen, he notified Detective Constable Johnson.

[9] Photograph 11 of Exhibit 2 captured the Safari application tab running on the desktop computer. It shows that the last session on the web browser was the Kijiji site. Photograph 12 captures the email application which was open on the computer. Photograph 13 is a picture of a document recovered from the trash bin of the desktop computer. It pertains to an ad promoting the purchase of DVDs containing child pornography. Photograph 14 is the photo of a screenshot from the computer showing recently downloaded files. Photograph 15 is simply a photo of the back of the desktop computer showing a phone connected to that computer, along with a USB device connected to the back of the computer.

[10] Detective Constable Mitchell seized a number of items from the residence, including the iMac desktop computer. All seized property was handled in the usual fashion, bagged and sealed.

[11] In cross-examination, he confirmed that his search was focused on the basement area of the residence. He described uTorrent as an application which allows users to download a torrent of files.

Angela Johnson

[12] Detective Constable Johnson is a member of LPS, and for the past 4 ½ years has been assigned to the Internet Child Exploitation Unit. She was the investigating officer for this case. She testified that typically, 99% of her time is spent investigating Internet child exploitation. One of the methods employed is the use of investigative bit torrent software designed for police services. The software provides a means to make a one-to-one or peer-to-peer connection to another computer. The software is set up to search IP addresses in the London area for users who are sharing child pornography. IP addresses are assigned a physical address. U-Torrent is software which allows a user to download portions of files from multiple users.

[13] On August 6, 2014, she was running her bit torrent software in her office. She connected to a device at IP address 70.31.139.24. At 8:27 p.m., she completed downloading a file which had been made available by that IP address. The filename was O(YAMAD) PTHC K7.MPG. The letters PTHC are a common search term for preteen hard-core. The file which she downloaded was a video file of a prepubescent female, naked, playing with her vagina, and inserting a dildo in her vagina with the assistance of a male, and playing with the male's genitals. From her observations, the female child appeared to be approximately 10 years of age. The software which she utilizes automatically saved the file to a subfolder related to this investigation. The software which she employs does not share the file, but she later provided access to Jason Eddy, who is a digital forensics examiner with LPS.

[14] On August 11, 2014, she was again utilizing the same software in her office. Her computer once again connected to a device at IP address 70.31.139.24. Between 9:01 and 9:22 p.m., her computer downloaded a partial file entitled 3yoMPEG. The file met the definition of child pornography. She testified that at times, the computer which she is downloading from terminates the download to her computer because the computer sharing the file senses that her computer is not file sharing. Between 9:26 p.m. and 9:50 p.m., her computer downloaded a complete file entitled babyJ RCA3. Mpeg from the same IP address. That file also met the definition of child pornography and depicted a prepubescent female approximately 5 years of age, who was naked, and engaging in oral sex and sexual intercourse. Again, her computer saved those files to the subfolder related to this investigation, and she later shared access to the files with Jason Eddy.

[15] IP address assignments frequently change. She investigated with the IP service provider to determine the subscriber information related to that IP address on the relevant dates and times. After obtaining a Production Order, she obtained the subscriber information from the IP service provider. She used that information to obtain a search warrant. She spoke with the St. Thomas police department, and they provided her with information related to Mr. Thompson and the business which he operated. On December 2, 2014, she was part of the team of officers who executed the search warrant at Mr. Thompson's residence, which was apartment two at 44 Elizabeth Street in St. Thomas. The entrance to the apartment was labeled as unit 2, and the entrance door led directly into Mr. Thompson's apartment. Mr. Thompson allowed the entry and she went into the kitchen with Mr. Thompson to discuss who lived in the apartment, and what Internet service was available there. Mr. Thompson advised her that he lived there by himself and that his daughter visited him every second weekend. She observed photos of a child in the apartment who appeared to be approximately 10 years of age. Mr. Thompson indicated that he did not share Internet access with other units in the building.

[16] Other officers advised her that they had found child pornography on the desktop computer. At 7:12 a.m., she arrested Mr. Thompson and provided him with his right to counsel and caution. He indicated that he wished to speak with a lawyer. He was turned over to Constable Bogart of the St. Thomas Police. At 8:11 a.m., the search of the residence was complete, and she returned to LPS headquarters. She had further contact with Mr. Thompson, and charged him with additional offences under section 163.1 of the Criminal Code.

[17] Within LPS headquarters, Detective Constable Johnson has a joint office which she shares with Jason Eddy. That office is locked and secured. She provided Jason Eddy with all of the information regarding the execution of the search warrant and the earlier computer downloads. Detective Constable Eddy had access to the devices seized in Mr. Thompson's residence. Normal practice is that Jason Eddy puts all of the images into a specialized software program named C4 All, which performs a sorting function.

[18] On March 10, 2015, she received the results of Jason Eddy's sorting program. There were 28 videos which met the definition of child pornography. Twenty-seven of the videos had been recovered in spite of the fact that the user had deleted the files. Three of the videos were portions of the videos that she had downloaded from IP address 70.31.139.24. She explained that when a user deletes a video, and police subsequently retrieve the image, they only recover certain frames of the video. In addition, 24 images that she viewed met the definition of child pornography. There were another 403,300 images which had not been categorized or reviewed by her. She does not always view every image as part of every investigation. It depends upon the circumstances. Also located on the computer, and shown in photograph 13 was a two page document purportedly from a business named "Porn-Brokers", which is apparently an ad promoting the purchase of child pornography DVD's. She spoke with Jason Eddy regarding his analysis, and as a result, laid additional charges against Mr. Thompson.

[19] In cross-examination, she indicated that in order for the bit torrent program on her computer to connect to a file in another computer, that file must be saved in the other computer. Accordingly, when she connected to the device at IP address 70.31.139.24 on August 6 and August 11, those files were saved on that computer. In order for that computer to have saved those files, the user must first download and install a copy of the uTorrent software. The user must then have typed in searches to locate those files, and then chosen those files to download from another computer. She agreed that peer-to-peer networking is common and that uTorrent is a program which facilitates that. She agreed that uTorrent can be used to download copyrighted material. Her evidence was that by simply streaming a file to watch it, one does not save the file to one's computer after the file has been watched.

Jason Eddy

[20] Detective Constable Eddy is a member of LPS. After a voir dire, on consent, he was qualified as an expert in the forensic analysis of computers and other digital devices and the interpretation of such analysis, with specific expertise in the identification of child pornography, and the source and electronic history of child pornography images and videos located during such analysis. He undertook an analysis of the items seized from Mr. Thompson's residence. On December 2, 2014, he met with Detective Constable's Johnson and Mitchell when they returned from executing the search warrant at Mr. Thompson's residence. He assisted them in previewing the exhibits which were seized. Of particular interest was the iMac desktop computer. Detective Constable Eddy used forensic software in order to connect to the iMac desktop in a write protected fashion. He found that the iMac desktop had virtual machines - operating systems inside the Mac operating system. There were a total of five systems installed and configured on the desktop. Each operating system created an entire separate computer environment within the Apple operating system of the desktop. Such an arrangement can be used to obscure or hide the contents of the computer.

[21] Detective Constable Eddy found evidence on the Windows 7 operating system that child pornography had been played on that system. However, most of the child pornography was contained within the Mac operating system. The computer user had pirated versions of software such as Tuxera and TFS and used it to create the separate virtual environments within the desktop computer. Such an arrangement indicates an advanced computer user. Relatively few computer users know of the existence of these virtual environments, and fewer still can successfully install virtual environments.

[22] Detective Constable Eddy prepared what he referred to as the Blacklight report, which analyzed the contents of the desktop computer. It was filed as an exhibit. Page 4 of the report provides basic information regarding the iMac computer system. In terms of users, it was set up with a guest user, along with the administrator. There was another user name, mattsullivan, but that user was deleted from the system on November 5, 2013. Page 5 of the report details recent applications which had been opened on the computer. "Private Tunnel" is one application which had been recently used. It is software which can change one's IP address in order to ensure online privacy. "DivX Player" was another application which had been recently used. It is a free software video player. "VLC" was another recently used application, and is also a free software video player. Neither of those two applications is included with a standard Mac operating system, and must be specifically downloaded. Mac's have a built-in software video player, but it does not support all video formats, so a user attempting to play videos in different formats would have to download other software video players. Another application in the recent applications summary was uTorrent.

[23] Files which had been recently opened on the computer were listed on pages six and seven of the report. They included video files with titles such as "Young video models-Daphne 9y#5". Pages 8-10 of the report listed in various torrent files found on the computer. The torrent files had various names, which included references to pedophilia and individuals having sexual intercourse with children of various ages ranging from six years of age to 13 years of age. In order for the uTorrent files to be present on that computer, the user had to have searched and located the file on the Internet and then chosen to download it and save it to the computer. These files were downloaded into the uTorrent program rather than the Mac downloads file. The torrent file is actually just a text file which contains instructions to the uTorrent software to go to a particular computer on the Internet and download a copy of the file. Detective Constable Eddy located 13 torrent files on the computer. There were two groups; one group downloaded October 5, 2014, and another group downloaded November 1, 2014.

[24] Detective Constable Eddy indicated that in his experience, there were two types of file downloaders. Collectors tend to keep the videos which they download stored in folders on their computer. Deleters tend to view the videos, and then delete them after viewing. The forensic software which he employs locates, in the unallocated space on the computer, portions of or at times entire files which have been deleted. On this computer, he found a software program entitled Tune Up My Mac. That program can be used to "wipe clean" the unallocated space on the hard drive.

[25] On December 2, 2014, he examined the digital devices seized from Mr. Thompson's residence. The only item of interest was the Mac desktop computer. One of the parallel operating systems was a Windows based file system. A Mac computer will not write files to such a system without a third-party software program. This Mac had a pirated version of such a program. Again, this is an indication of a sophisticated computer user.

[26] Detective Constable Eddy outlined his forensic report. A default operating system installation on any computer does not have parallel operating systems, nor does it include programs such as Tune Up my Mac, uTorrent, DivX Player or VLC. On the computer, he located a software program named Hotspot Shield. It is a downloadable software program which disguises your IP address from the rest of the world. As indicated, the uTorrent software program was also present on the computer. It is free software which is downloaded from the Internet. The user must search for it, download it and install it. It is a well-known software program among people who know about torrent sharing programs. He estimates that 15 to 20% of all computer users could use uTorrent. The use of uTorrent to obtain child pornography promotes anonymity because of the peer-to-peer file-sharing method. Detective Constable Eddy also located the document from the business "Porn-Brokers" in the computer's trash bin folder.

[27] Child pornography videos and pictures were found on the computer hard drive in the deleted space. Child pornography named torrent files, which had not been deleted, were found in the uTorrent application, showing that the user had used uTorrent to launch those files. The Safari web browser was being used to visit a torrent website and search for child pornography named files, which produced results for the three files Detective Constable Johnson was able to download from IP address 70.31.139.24 on August 6 and 11th. Artifacts from the IP address 70.31.139.24 were found on the computer showing that it connected to the Internet using that IP address, the same IP address observed by Detective Constable Johnson during her on-line investigation. The DivX Player-played movies report shows that that program was used to view child pornography files. The Quicklook Thumbnail Cache shows child pornography files, including the three files which were downloaded by Detective Constable Johnson during her on-line investigation, were played on the computer.

[28] By following the search and web history found on the computer, Detective Constable Eddy was able to replicate the sequence of events to download the child pornography files. There were thousands of references to child pornography files on the computer including Google searches for child pornography and other websites searches for child pornography files and torrents. Those references were detailed in the section of the forensic report entitled child pornography search hits. There were similarities in Internet search uses of legitimate Internet sites on the computer, and on the Galaxy S4 telephone which was seized. Both devices appeared to be used by Mr. Thompson as email accounts were configured on both devices. Family and personal pictures on each device related to Mr. Thompson.

[29] In cross-examination, Detective Constable Eddy agreed that it is easy to locate and download uTorrent software, and that it can be used to download copyrighted material such as movies. He maintained that it did not matter when the additional software programs were installed on the desktop computer. The computer was configured with Mr. Thompson's name and picture on all accounts before the pornography material was obtained and played on the computer.

[30] The defence chose not to call evidence.

POSITIONS OF THE PARTIES

The Crown

[31] The Crown takes the position that there is no serious issue with respect to what was found on the computer. There was a significant amount of material which meets the definition of child pornography. The issue is whether the Crown has proven beyond a reasonable doubt that Mr. Thompson was in possession of the child pornography. In order to establish possession, the Crown must prove knowledge and control. The Crown has proven that Mr. Thompson was the primary computer user. That is established by various documents and images on the computer. The Crown has proven that the IP address for the computer was the same on both August 6 and August 11, dates that Detective Constable Johnson downloaded files meeting the definition of child pornography from that IP address.

[32] The evidence of Detective Constable Eddy is overwhelming in terms of establishing that child pornography was accessed through the uTorrent program. The file names confirm that the various videos are child pornography and in order for them to end up on the computer, a user had to take steps to search, locate download and share those files. The computer screen shows that the files are being shared. To suggest that somehow files were accidentally downloaded lacks any rational basis. The computer is set up by a sophisticated computer user; Mr. Thompson. The expert report shows that DivX Player was installed in February 2014, that the computer user was browsing child pornography in February 2014. The resumes related to Mr. Thompson found on the computer predate February 2014. Hotspot Shield is a software program which conceals one's IP address from the rest of the world. Mr. Thompson received emails addressed to him from the Hotspot Shield software vendor.

The Defence

[33] The defence takes the position that count number two specified that the offence took place in London. The evidence shows that Mr. Thompson's computer was in St. Thomas. Therefore, there should be an acquittal on that count. In addition, the defence takes the position that prompt deleting of a file can be evidence of the lack of intent to possess and share that file. Therefore, if one promptly deletes a file after downloading it, one never possessed it, one simply accessed it. The defence also takes the position that the Crown has not proven that Mr. Thompson was the computer user who downloaded the relevant material. There is some indication on the computer that Mr. Thompson was not the original owner of the computer.

APPLICABLE LEGAL PRINCIPLES

[34] The term child pornography is defined in section 163.1 of the Criminal Code. It is an offence to print, publish or to possess, for the purpose of publication, child photography. It is an offence to make available child pornography, or to possess it for the purpose of transmitting, distributing or making it available. It is an offence to simply possess child pornography, or to access it.

[35] The applicable definition for possession is set out in section 4(3) of the Criminal Code. Possession requires knowledge and a degree of control. The knowledge must include knowledge of the criminal character of the items in issue. In order to establish possession and control of a digital file, it is necessary for the Crown to satisfy the mens rea requirement by showing that the file was knowingly stored and retained through the cache. There is no requirement that the accused take a positive step to make child pornography available in order to be guilty of that offence. The possessor of child pornography who uses a file-sharing program and passively acquiesces in the program making the material available or who is willfully blind to that has committed the offence of making child pornography available. R. v. Spencer, [2014] 2 S.C.R. 212.

ANALYSIS

[36] It was agreed at the outset of the trial that the material in question met the Criminal Code definition of child pornography.

[37] It is possible that guest users may have accessed the computer at some point. However, the only logical inference to be drawn from the evidence is that Mr. Thompson is the computer user who has administrative rights. Similarly, the only logical inference which can be drawn from the evidence is that Mr. Thompson is a sophisticated computer user, who created parallel operating systems and downloaded various software, including software which can be used to hide one's IP address, and software which can be used to wipe clean the unallocated space in the hard drive. He was the primary user, if not the exclusive user of the computer.

[38] It is obvious that the computer, including the uTorrent file sharing program, was used to locate, access and download child pornography files. The fact that uTorrent is a file-sharing program which makes those files available to others would have been obvious to the computer user. Child pornography material was viewed on more than one operating system within the computer. Knowledge of the objectionable images can be inferred through evidence related to issues such as ownership, level of usage of the computer in question, the level of computer literacy of the accused, whether the file names for the images were descriptive, the organization of the files and other relevant indicators. Where the file names of the objectionable images strongly suggest child pornography content, an inference of knowledge will be strong.

[39] The only logical inference which can be drawn from the evidence is that Mr. Thompson was the user who knowingly searched for, located and downloaded child pornography images. Accordingly, the Crown has proven beyond a reasonable doubt that he accessed child pornography. Child pornography images were available to other computer users through the uTorrent program on both August 6 and August 11. Mr. Thompson at the very least acquiesced to that material being available to other computer users on August 6 and 11th. Given his knowledge of computers and the obvious indications of the uTorrent program that files are being shared, Mr. Thompson had to have known that his participation in the sharing program would permit others to access his files. Accordingly, the Crown has proven the charges of making child pornography available on those dates.

[40] The child pornography files were at some point saved on Mr. Thompson's computer. Given the fact that they were recovered from unallocated space, I note that they were subsequently deleted at some point. I reject the defence argument that because the files at some point were deleted, Mr. Thompson did not intend to possess them. He sought them out, downloaded them and at least temporarily saved them. The Crown has also proven the charges of possession of child pornography on August 6 and 11th.

[41] I find no merit to the argument of the defence that Thompson is entitled to acquittals because the Crown has not proven that the offence occurred in the location referred to in the Information, given that the Information specifies that an offence took place in the City of London when, in fact, Mr. Thompson's computer was a short distance away in the City of St. Thomas. I refer to section 601 of the Criminal Code, and note that the defence did not raise any objection to the Information prior to entering a plea. The Court has the power to amend the Information as necessary where it appears that it is in any way defective in substance. An amendment in this situation would not mislead or prejudice the defence in this case or cause any injustice. Section 601(4.1) specifically provides that "a variance between the indictment or a count therein and the evidence taken is not material with respect to… b) the place where the subject matter of the proceedings is alleged to have arisen, if it is proved that it arose within the territorial jurisdiction of the court".

CONCLUSIONS

[42] There will be findings of guilt with respect to all charges.

Released: May 11, 2016

Signed: Justice A. Thomas McKay