Court File and Parties
Ontario Court of Justice
Date: 2018-11-20
Court File No.: Brampton 3111 998 17 703
Between:
Her Majesty the Queen
— and —
Dhanesh Ramlogan
Before: Justice A.R. Mackay
Heard on: May 28, 2018
Reasons for Judgment released on: 20 November 2018
Counsel
Shanna Ferrone — counsel for the Crown
Paula Locke — counsel for the defendant Dhanesh Ramlogan
Judgment
MACKAY J.:
Introduction
[1] This is a ruling on an application by the defence to exclude all evidence obtained pursuant to a search warrant executed on the defendant's home and personal computer. The defence argues that there were no reasonable grounds for the issuance of the search warrant and that the search was a violation of the defendant's right under s. 8 of the Canadian Charter of Rights and Freedoms (Charter).
[2] Mr. Ramlogan is charged with possession of child pornography contrary to s. 163.1(4) of the Criminal Code.
The Defence Position
[3] The defence argues that the warrant should not have been issued for three reasons:
There were typographical and careless errors in the Information to Obtain (ITO). Namely, an IP address [1] was incorrectly cited in one paragraph in the ITO, although correctly cited in the appendix and in another paragraph of the ITO. In addition, the ITO had another error with respect to the date the officer in charge, Cst. MacDonald, reviewed information provided by Bell pursuant to a production order.
Cst. MacDonald waited approximately two months after he received information from The Child Protection System (CPS) [2], the production order and his own investigation before making application for a search warrant. The dated information was stale and could not support reasonable and probable grounds that child pornography would still be located in the defendant's residence.
Cst. MacDonald was only able to corroborate that the IP address in question had one file which contained child pornography. He did not make sufficient effort to log into the defendant's computer and instead sought a search warrant.
The Crown's Position
[4] It is the Crown's position that the errors found in the search warrant were simply typographical errors which were corrected on amplification through the testimony of Cst. MacDonald. The errors in no way were made in bad faith and did not affect the validity of the warrant.
[5] With respect to the lack of nexus between the information in the ITO and the date of the search, the Crown submits that given the nature of the way child pornography is stored, forensic searches of computers are able to retrieve child pornography even when files have been deleted by the user. The delay of time between the information obtained in the investigation and the actual search would not therefore affect the officer's reasonable and probable grounds.
[6] With respect to the lack of corroboration, the Crown maintains that the officer did take steps to confirm the IP address in question had downloaded child pornography by doing the following. He looked at a file with a unique hash value downloaded by the IP address as discovered by the CPS program and was able to retrieve the same file from his media library. He then opened the file with the same hash value and confirmed it was child pornography by watching the video. Further corroboration was not required.
Summary of the ITO and Investigation
[7] Cst. MacDonald, the affiant to the ITO, was the only witness called on the voir dire. He has been assigned to the Internet Child Exploitation Unit (ICE Unit) since 2012. Previous to this assignment he was in the Technological Crimes Unit for five years.
[8] On September 26, 2016, Cst. MacDonald logged into the Child Protection System (CPS) and observed a GUID [3] was listed with 113 files of interest, and 109 files identified as suspected child pornography. There were multiple interactions with the files causing duplication. Attached to the GUID were 27 different IP addresses stretching back to 2012. These addresses were all geolocated back to Mississauga.
[9] All of the IP addresses were for distinct periods of time and were all for Bell Communications. Given Cst. MacDonald's experience he believed that this was consistent with one computer operating at one location. The changing of Bell IP addresses is quite common for Bell.
[10] Cst. MacDonald attempted to make a direct connection download from this IP address but was unsuccessful. This could have been the result of the user not being online at the same time as the officer or because the user had the file-sharing program turned off.
[11] On October 19, 2016, Cst. MacDonald logged into the CPS, however, he did not see any new activity since September 25, 2016. This GUID was on the peer-to-peer (P2P) [4] file sharing network a lot throughout 2012 and 2013 and showed a reduced usage in 2015 and 2016.
[12] The file sharing software used was eMule. This software gives the option of putting in a username during the installation process. This user put in the name "Kutulu1".
[13] When Cst. MacDonald could not make a connection to the user's computer, he decided to check the hash value of a file found by the CPS on September 24, 2016 with this GUID and IP address with a file having the same hash value in his media library. He then watched the video to form his own belief as to whether the image met the Criminal Code definition of child pornography or not. The file was a 13 minute video of a girl, approximately 10 to 12 years old, and was clearly child pornography.
Typographical Errors
[14] During the voir dire Cst. MacDonald corrected the following typographical errors in the ITO to obtain the production order:
Looked at the CPS records pertaining to the most IP address 70.49.32.13 and learned the following: … [5]
There were two errors contained within this paragraph, one he omitted the word "recent" and two he recorded the wrong IP address. The paragraph should have stated:
Looked at the CPS records pertaining to the most recent IP address 70.31.79.48 …
[15] The production order was signed by a justice on October 20, 2016. The order was then sent to Bell. Cst. MacDonald received an email back from Bell on November 13, 2016 with an attachment setting out the name, address and email of the customer for the IP address in question. The same document containing the correct IP address was attached to the production order.
[16] Appendix C of the ITO for the search warrant, is identical to the ITO to obtain the production order from Bell up until paragraph 6, page 11. The same error(s) referred to in the ITO for the production order are repeated.
[17] In paragraph 6, page 11, Cst. MacDonald incorrectly inserted the wrong date: "On the 10th of October, 2017, I reviewed the return from Bell Communication and learned the following…" He went on to set out the details of the account holder. However, the actual date he reviewed the information sent from Bell was January 10, 2017. The warrant to search was signed on January 16, 2017.
Errors in an ITO
[18] The courts have recognized that latitude is to be given to police officers in drafting ITOs. They are not expected to draft ITOs with the same precision that counsel might be held to when drafting legal documents. ITOs are often done without the assistance of legal advice and under time constraints: R. v. Sanchez, [1994] O.J. No. 2260 at para. 20. In R. v. Nguyen, 2011 ONCA 465 Justice Blair stated at para. 57:
However, the review is not an exercise in examining the conduct of the police with a fine-toothed comb, fastening on their minor errors or acts or omissions, and embellishing those flaws to the point where it is the police conduct that is on trial rather than the sufficiency of the evidence in support of the application.
[19] A reviewing court may consider additional evidence at a Garofoli hearing to correct errors in the ITO. Amplification evidence can be used to correct "good faith error" by the affiant but it cannot be used to cure deliberate attempts to mislead the authorizing justice. The evidence must be evidence that was available to police at the time the ITO was sworn and not information they subsequently obtained: R. v. Boussoulas, 2014 ONSC 5542 at para. 13, R. v. Araujo, 2000 SCC 65, [2000] 2 S.C.R. 992 at paras. 57-58; R. v. Morelli, 2010 SCC 8, [2010] 1 S.C.R. 253 (S.C.C.) at paras. 41-43; R. v. Ebanks, 2009 ONCA 851, at para. 28; R. v. Farrugia, 2012 ONCJ 830, at paras. 26-29; R. v. Sadikov, 2014 ONCA 72, at paras. 85-86.
[20] Inaccuracies in the ITO, on their own, are not a sufficient basis on which to set aside the warrant. Minor errors can be corrected when the police had reasonable and probable grounds and made the errors in good faith: Araujo, para. 59. The existence of fraud, non-disclosure, misleading evidence, and new evidence are all relevant but are neither a prerequisite to, nor dispositive of, the review: Garofoli, [1990] 2 S.C.R. 1421 (S.C.C.) at p. 1452; Ebanks, at para. 20; and Sadikov, para. 87.
[21] During examination-in-chief Cst. MacDonald referred to the source documents that he used to draft the ITO. Screenshots of the CPS were introduced along with an Excel spreadsheet from the search of the GUID with the various IP addresses used by it. In addition, the information from Bell which provided the name, address, phone number and email for the most recent IP address for the GUID in question was introduced into evidence, Exhibit F. It was clear that Cst. MacDonald obtained the most recent IP address attached to the GUID in question from the CPS search. Further when he sought the production order from Bell, he used the same IP address and he attached the document he received from Bell to the ITO.
[22] Cst. MacDonald could not explain how he made the error with the wrong IP address in one of the paragraphs of the ITO for both the production order and the search warrant but he did refer to the fact that during this time period he had written several ITOs to search for child pornography. He recognized the first two digits to be 70 and assumed it was correct. It is clear that there was no attempt made by Cst. MacDonald to mislead the justice. Rather the error was an inadvertent one.
[23] With respect to the incorrect date in the ITO, this was also an inadvertent typographical error. Cst. MacDonald went back and looked at his notes on January 10th, 2017 and confirmed this is when he looked at the information provided by Bell and not October 10, 2017. It is clear that the steps the officer took to lead him to the defendant's address were laid out for the reviewing justice albeit with an incorrect date.
[24] Based on the foregoing analysis I find that the typographical and inadvertent errors found in the ITO were not made in bad faith and do not establish a sufficient basis to set aside the warrant. I find that it is appropriate in this case to allow the amplification evidence to correct these minor errors.
Currency of Information Relied upon to Obtain an ITO
[25] In this particular case the grounds were no longer current by the time the warrant was issued. Two months had passed before Cst. MacDonald acted on the information he received from Bell Canada. Depending on the length of the delay and the nature of the object(s) to be searched for, stale information can diminish an officer's reasonable and probable grounds: R. v. Turcotte (1987), 39 C.C.C. (3d) 193 (Sask. C.A.) at p. 206; R. v. Campbell, [2005] O.J. No. 2369, para. 45.
[26] Cst. MacDonald initially investigated the matter for three weeks commencing on September 26, 2016. The results of the production order came in on November 3, 2016 but the officer did not look at this information from Bell until January 10, 2017. On reviewing the subscriber information, he noted the IP address was assigned to "E. Ramlogan". An address was provided.
[27] Cst. MacDonald stated he did not review the information from Bell because he was away for all of November 2016 and then had other cases he was working on. In addition, from early December 2016 and throughout the holidays, Cst. MacDonald's Unit had a number of people away and as a result they were not doing any search warrants during this time.
Analysis
[28] In most cases the grounds an officer forms to obtain a search warrant should be current otherwise reasonable grounds becomes mere suspicion. Ms. Locke provided case law where the courts have found that reasonable and probable grounds to search was not made out where the information relied upon was dated. However, the cases can be distinguished in that the object of the search was for physical evidence, such as drugs or guns. These items are easily concealed and moved: In R. v. Adansi, 2008 ONCJ 144, police had waited two months to obtain a search warrant after receiving information that a gun would be at the residence in question. Clark J. found that it was no longer reasonable to say that a gun would still be at the defendant's home, as it would be equally consistent to find that a suspect had since divested himself of it: Adansi, para. 70.
[29] In R. v. Chen, 2007 ONCJ 177, the defendant was charged with violations of the Income Tax Act. In the ITO police relied on information that was over two years old. The Court acknowledged that in determining whether reasonable grounds existed to search a location, the currency or freshness of the evidence is important. An Information to Obtain a search warrant must contain information that is recent enough to satisfy the issuing justice that it is probable that the things sought will still be at the location and not that it is merely a possibility: Chen, page 8. Justice Trotter ultimately found that it was unreasonable for the issuing justice to conclude that it was probable that the documents sought would be at the defendant's home or her place of business and held that the seizures amounted to a violation of s. 8.
[30] In R. v. Colby, [1999] S.J. No. 915, a drug investigation had taken place over several years. Police received information during this time that the defendant was involved in an ongoing marihuana grow operation yet they did not act on it for close to two months. The Court found that there was no basis on which the Justice of the Peace could determine that a warrant should issue.
[31] Turning to the ITO before me, the affiant set out grounds for believing that forensic investigators would be able to retrieve evidence of child pornography even if the files were deleted. He stated that "the computer systems store information on the computers for some time". Had this been the only paragraph to inform how the officers would retrieve evidence of past accessing and possession of child pornography, I would have found that the officer did not have reasonable grounds. However, in the ITO Cst. MacDonald laid out in more detail how a forensic analysis can result in the retrieval of previously deleted or hidden images. [6] This included the ability to find the specific GUID in question linked to the downloading of over a 100 images of child pornography as discovered by CPS. In addition, a forensic search can locate a file specific to eMule that contains all of the files downloaded with eMule, even if the files have been deleted.
[32] Once Cst. MacDonald recommenced his investigation he was able to confirm sometime after January 10, 2017 and before January 16, 2017 that Mr. Ramlogan, according to the MTO records, still resided at the same address provide by Bell back on September 24, 2016. The September date represents the last time that CPS linked his IP address to downloading child pornography. Cst. MacDonald was able to look at a file downloaded on this date with this GUID and confirm the video was in fact child pornography.
[33] It was not prudent to leave the investigation in abeyance for two months prior to drafting the ITO. As was stated by Justice George in R. v. Porter, [2016] O.J. No. 4654, para. 58, while there is "no bright line or fixed date", there is a point when the information cannot be used to form reasonable and probable grounds. In Porter, the police let the investigation into the possession of child pornography go dormant for almost a year before they continued some investigation and then took another four or five months to obtain a warrant. However, the Court found the warrant was properly issued.
[34] In this case, Cst. MacDonald was away from the Unit a month after he had begun investigating this matter. In addition, the holiday season of December left his Unit short-staffed. While the delay in applying for the warrant was not ideal, given the information provided in the ITO about the retrieval of deleted files on computers, I find that the justice did have credible and reliable information to believe that a computer at the said address would contain evidence of possession of child pornography.
Lack of Corroboration
[35] Cst MacDonald was never able to make a direct connection with the IP address in question. Meaning he was not online at the same time as the user, or the user had the file-sharing turned off. However, Cst. MacDonald wrote in the ITO that information coming from CPS is highly reliable and that it contains the hash values of known digital files that are associated with child pornography. CPS is currently in use by law enforcement agencies around the world.
[36] Cst. MacDonald believed he only needed to confirm that the content found in those suspected child pornography files met the Canadian definition of child pornography. Based on his working knowledge of CPS as a highly reliable tool in detecting child pornography he did not believe it was necessary to continue to try to upload more files from the IP address in question. While it would have been more prudent to continue to try to connect with the defendant's computer, I cannot find that there was a complete lack of corroboration of the information received from CPS and Bell Canada. Once the officer recommenced his investigation, he checked the defendant's social media and confirmed the defendant's pictures matched the picture from the MTO records. He noted Mr. Ramlogan used the name "Kutulu3" as his twitter handle. "Kutulu" was also provided as a username when the sharing software file was downloaded and when the GUID was created.
The Standard of Review of Information to Obtain a Search Warrant
[37] In R v. Morelli, at para. 105, Justice Fish underlined the serious invasion of one's privacy that occurs when an individual home or personal computer is searched:
As I mentioned at the outset, it is difficult to imagine a more intrusive invasion of privacy than the search of one's home and personal computer. Computers often contain our most intimate correspondence. They contain the details of our financial, medical, and personal situations. They even reveal our specific interests, likes, and propensities, recording in the browsing history and cache files the information we seek out and read, watch, or listen to on the Internet.
[38] Prior authorization to search one's home must be sought absent exigent circumstances and that prior authorization must be able to withstand Charter scrutiny. [7]
[39] The search warrant in this case was issued pursuant to s. 487 of the Criminal Code. Essentially the section codifies the common law, it requires that a justice be satisfied by information provided under oath, that there are reasonable grounds to believe that there exists, in the place to be searched, evidence that an offence has been committed.
[40] In order to establish reasonable grounds for a search, the appropriate standard is one of "reasonable probability", rather than proof beyond a "reasonable doubt" or a "prima facie case": R. v. Debot, [1989] 2 S.C.R. 1140 (S.C.C.), at p. 1166, Morelli para. 127.
[41] A search warrant authorization is presumptively valid: R. v. Sadikov, 2014 ONCA 72; R. v. Araujo, 2000 SCC 65, [2000] 2 S.C.R. 992 (S.C.C.); and R. v. Garofoli.
[42] In deciding whether or not there are reasonable and probable grounds for issuing a search warrant, the reviewing court must be satisfied that it was reasonable for the issuing justice to believe that the evidence will be on the premises at the time of the search not that there is merely suspicion that evidence may still exist. See R. v. Campbell, [2005] O.J. No. 2369, at paras. 41 to 46.
[43] The central issue I must decide is whether the issuing justice had sufficient evidence before him as a basis to issue the warrant. I am not entitled to conduct a de novo review of the evidentiary basis for the other. The question is not whether the reviewing court would itself have issued the warrant, rather, I must assess whether the record that was before the issuing justice, as amplified on review, could have supported the issuance of the warrant: R. v. Garofoli at 161, R. v. Araujo, at para. 54.
[44] As stated by Justice Fish in R. v. Morelli at para. 40:
In reviewing the sufficiency of a warrant application, however, "the test is whether there was reliable evidence that might reasonably be believed on the basis of which the authorization could have issued". The question is not whether the reviewing court would itself have issued the warrant, but whether there was sufficient credible and reliable evidence to permit a justice of the peace to find reasonable and probable grounds to believe that an offence had been committed and that evidence of that offence would be found at the specified time and place.
[45] Ms. Locke argued that the errors in the ITO and the failure to act promptly on relevant information reveals a pattern of carelessness. She also argued that the officer did not do enough to corroborate the information he received from the CPS. For the foregoing reasons, I do not find that there was lack of good faith in this case. However, a pattern of carelessness and indifference to acting promptly on information received about potential offenders, could tip the scales in favour of excluding evidence. Police officers should not be lulled into a false belief that they can take a lackadaisical approach in the investigation of child pornography cases, simply because there is a general view that deleted files can often be retrieved. In Morelli, the Court noted that the greater the lapse of time after a hard drive has been formatted, the more likely it will be impossible to recover the former contents even with forensic tools. [8]
[46] It is not in the public interest to let child pornography investigations sit dormant without good reason. Individuals who commit these crimes should be brought to justice and, where possible, be rehabilitated as soon as possible.
[47] In conclusion, while the ITO was not without some errors and not drafted in a timely manner, the issuance of the warrant in this case was not the result of a violation of s. 8 of the Charter. The justice could properly have issued the search warrant as there was sufficient information that could have permitted the justice to conclude that there were reasonable grounds justifying the issuance of the warrant.
Section 24(2)
[48] I will briefly address s. 24(2) of the Charter in the event that I have erred in concluding that Mr. Ramlogan's s. 8 Charter rights were not violated.
Seriousness of the State-Infringing Conduct
[49] The police searched the defendant's residence under the authority of a presumptively valid warrant: R. v. Collins (1987), 33 C.C.C. (3d) 1 (S.C.C.) at page 14.
[50] Although there were minor inaccuracies in the ITO, I conclude that the police acted in good faith in obtaining a search warrant for Mr. Ramlogan's home. As Justice Rosenberg stated in R. v. Rocha, 2012 ONCA 707 at paras. 28-29:
Applying for and obtaining a search warrant from an independent judicial officer is the antithesis of wilful disregard of Charter rights. The search warrant process is an important means of preventing unjustified searches before they happen. Unless, the applicant for exclusion of evidence can show that the warrant was obtained through use of false or deliberately misleading information, or the drafting of the ITO in some way subverted the warrant process, the obtaining of the warrant generally, as I explain below, tells in favour of admitting the evidence….
The approach rather should be to look at the ITO and consider first if it is misleading in any way. If so, the court should then consider where it lies on the continuum from the intentional use of false and misleading information at one end to mere inadvertence at the other end. Fish J. made this point in R. v. Morelli, 2010 SCC 8, [2010] 1 S.C.R. 253 (S.C.C.), at paras. 99-103.
[51] I have concluded the typographical errors in the ITO were not misleading in any way and that there was no intention to use false information. While the investigation was left dormant for two months, this was in large part due to a lack of staffing issue around the holidays in December. Cst. MacDonald could have done more to corroborate the fact that the defendant possessed child pornography but he has worked with the CPS for some time and had confidence in its reliability. This branch of the test favours admission of the evidence.
Impact of the Breach on the Charter-protected Interests of the Accused
[52] The search of Mr. Ramlogan's home had a significant impact on his Charter-protected interests. In referring to the search of one's home and computer, Justice Fish commented: "It is therefore difficult to conceive a s. 8 breach with a greater impact on the Charter-protected privacy interests …" (Morelli, para. 107). This branch of the test favours exclusion.
Society's Interest in Adjudication on the Merits
[53] The images discovered through forensic analysis after the defendant's computer was seized are reliable and are the crux of the Crown's case. Society's interest in adjudication of these charges on their merits would be seriously undercut by excluding the evidence. This branch of the test favours admission of the evidence.
Balancing
[54] Despite the significance of the negative impact on the defendant's privacy interests caused by police intrusion into Mr. Ramlogan's home and personal computer, I conclude that the exclusion of the reliable and crucial evidence in circumstances in which the police conduct is not tainted by impropriety or inattention to constitutional standards, would have a negative effect on the repute of the administration of justice. If Mr. Ramlogan's s. 8 rights had been violated, I would still conclude that the images of child pornography found on his computer are admissible evidence pursuant to s. 24(2) of the Charter.
Conclusion
[55] In conclusion, I find that the issuance of the warrant was not the result of a violation of s. 8 of the Charter. The justice could properly have issued the search warrant as there was sufficient information that could have permitted the justice to conclude that there were reasonable grounds to believe that evidence of possessing child pornography would be found in the defendant's home on his computer.
Released: 20 November 2018
Signed: Justice A.R. Mackay
Footnotes
[1] IP ADDRESS: An IP address or internet protocol address is a unique address that devices use in order to identify and communicate with each other on a computer network utilizing the internet protocol standard (IP). It can be thought of as an equivalent of a street address or a phone number for a computer or other network device on the internet. An IP address can uniquely identify a specific computer or other network device on a network. Depending on the internet service provider, a user may keep the same IP address for months or have several IP addresses in a day. One customer cannot have two IP addresses at a time. It is usually for a home address. When you pay for internet service you get an IP address. Internet Service Providers typically keep logs of IP assignments for a limited time period. Police have used these logs to identify an address and potential user associated to suspected criminal activity observed on line at a particular moment in time. (ITO – Definitions)
[2] The Child Protection System (CPS): A suite of programs used by law enforcement which allows the investigators to identify offenders using peer-to-peer networks to distribute child pornography. It is currently in use by law enforcement agencies around the world and is known as a reliable tool. CPS maintains an ever-growing database, which contains the hash values of known digital files that are associated to child porn. (ITO – Definitions)
[3] GUID and PEER TO PEER (P2P): In order to use a particular P2P file-sharing network, a user first obtains a P2P client, a software program. For the most part the P2P client can be publically downloaded from the internet. Once the P2P client is downloaded the local computer will generate a globally unique identifier (GUID). This electronic serial number is used on the Peer to Peer network to uniquely differentiate that particular installation of the software from any other software running on the network. (ITO – Definitions)
[4] Peer-to-Peer (P2P): File sharing is a method of communication available to internet users through the use of particular software programs. P2P file sharing programs allow groups of computers using the same file sharing network to transfer digital files from one computer to another while connected to the internet. P2P is a common mechanism by which child pornography is acquired and distributed. When a file is shared on the internet, a hash value is computed for each file being shared. This uniquely identifies the file on the network. The hash value is an alphanumeric number that represents the actual data of the file, regardless of the file name. The client software will share the hash value with other users on the P2P network. A user will search for files of other P2P users by a search term, and the software will attempt to download pieces of a desired file from multiple locations. (ITO – Definitions)
[5] ITO page 10, paragraph 2 (e).
[6] ITO at page 14, para. iii.
[7] Under the Charter, before a search can be conducted, the police must provide "reasonable and probable grounds, established upon oath, to believe that an offence has been committed and that there is evidence to be found at the place of the search" (Canada (Director of Investigation & Research, Combines Investigation Branch) v. Southam Inc., [1984] 2 S.C.R. 145 (S.C.C.), at p. 168). These distinct and cumulative requirements together form part of the "minimum standard consistent with s. 8 of the Charter for authorizing search and seizure" (p. 168).
[8] Morelli, at para. 68.