WARNING
The court hearing this matter directs that the following notice be attached to the file:
A non-publication and non-broadcast order in this proceeding has been issued under subsection 486.4(3) of the Criminal Code. This subsection and subsection 486.6(1) of the Criminal Code, which is concerned with the consequence of failure to comply with an order made under subsection 486.4(3), read as follows:
486.4(3) CHILD PORNOGRAPHY — (1) In proceedings in respect of an offence under section 163.1, a judge or justice shall make an order directing that any information that could identify a witness who is under the age of eighteen years, or any person who is the subject of a representation, written material or a recording that constitutes child pornography within the meaning of that section, shall not be published in any document or broadcast or transmitted in any way.
486.6 OFFENCE — (1) Every person who fails to comply with an order made under subsection 486.4(1), (2) or (3) or 486.5(1) or (2) is guilty of an offence punishable on summary conviction.
Court Information
Date: July 9, 2019
Ontario Court of Justice
Between:
Her Majesty the Queen
— and —
Jeremy Tsang
Before: The Honourable Justice Susan Chapman
Heard on: January 9; 10; 17 and 22 and March 25, 2019
Judgment Rendered: June 10, 2019
Reasons for Judgment Released: July 9, 2019
Counsel:
B. Cohen for the Crown
M. Bojanowska and A. Sewrattan for the accused Jeremy Tsang
Introduction
[1] Mr. Jeremy Tsang stands charged on a four (4) count information with possession, accessing and making available child pornography on or about May 29, 2017, contrary to sections 163.1(4.1), 163.1(4), 163.1(3) of the Criminal Code respectively, and possessing child pornography on November 16, 2017. The Toronto police received an alert generated by the Skype application, indicating that a user had transmitted imagery of known child pornography to another user on or about May 28, 2017. The police followed up with an investigation that resulted in the November 16, 2017 search of the residence associated with the Internet Protocol (IP) address of the Skype transmission of May 28. During the search, Mr. Tsang was found in a bedroom in the basement with a Microsoft tablet open and active on his lap. At the time of the search child pornography and an open Skype application were found on that device and it, along with some other electronic devices found at the residence, were seized and the accused arrested that same day.
[2] During a subsequent and more thorough forensic analysis of two of the seized devices, the tablet and a hard drive, numerous images and videos containing child pornography were found. Further, other information associated with the devices and the accounts on those devices, including the Skype application, were analyzed by police and the results were relied upon by the Crown as circumstantial evidence of Mr. Tsang's guilt.
[3] At the outset of the trial certain admissions were made including: the time/date of the events alleged to have occurred on the electronic devices; that the objects seized were seized and from where they purport to have been seized; the continuity of the exhibits; that the software programs (LACE and Axiom) used by the Child Exploitation Unit in this case have produced accurate reports as to the content of the computers; the accuracy of the purported Skype conversations associated with the open account on the tablet, and; that the images identified by the police as child pornography are in fact child pornography.
[4] Therefore, the main issue for me to decide is whether or not the Crown has proven beyond a reasonable doubt that it was the accused who was accessing, possessing and making available child pornography on the particular dates as set out in the information. This involves a detailed review of the forensic analysis done on the devices seized and the information found on them as well as a consideration of the totality of the circumstances. The defence filed an alibi notice prior to trial and called evidence at trial in support of this defence. Accordingly, as part of its burden of proof, the Crown must disprove the alibi beyond a reasonable doubt.
The Crown's Case
The Skype Alert
[5] Det. Earle Davies from the Toronto Police Sex Crimes unit testified that he was involved in securing a search warrant for the home of Mr. Tsang's parents at 93 Abbeywood Trail in Toronto. It was sought pursuant to an alert from Microsoft Skype as to the uploading of child pornography imagery associated with an IP address at the residence. Six separate reports were sent through the National Centre for Missing and Exploited Children (controlled by the RCMP) and received by Toronto police in June of 2016 in relation to the transmission said to have taken place on the May date. The reports contained information pertaining to the social media platform Skype, the date and the time the suspicious material was uploaded, and a copy of the images.
[6] The Skype alert directed the Toronto police service to a particular IP address and a subsequent production order connected that IP address to 93 Abbeywood Trail. The Rogers account holder associated with the IP address was identified as Shirley L-F Yuen and searches revealed three known parties associated with the account phone numbers. The open source information through Facebook (FB) led the officer to identify three FB accounts associated with these same phone numbers: one was associated with the accused's mother Shirley Tsang, another was associated with Jenkin Tee and one was associated with the phone number 647 880 0140 and Jeremy Tsang. On the FB account of "Jeremy Tsang" there were pictures and updates from July of that same year. In the information section of the page the person associated with the account indicates that they live in Toronto and are employed as a pixel layer for Double Happiness Projects, Jeremy Does Art Prints and an artist under the name T-Sang.
The Search of the Residence
[7] The house at 93 Abbeywood Trail is a two story home with a finished basement. It belongs to the parents of the accused and there was some controversy in the evidence as to how often the accused stayed there with them. During the course of the search of the home on November 16, 2017 Officer Jodoin found the accused lying on his back on a bed in a bedroom in the basement with a Microsoft tablet open and active on his lap/belly with the screen facing towards him. It appeared to Officer Jodoin that the accused had fallen asleep while watching a movie on the tablet and that he had been startled awake by the officer's presence. In cross-examination Officer Jodoin maintained that the accused was lying on the bed and not standing when he found him.
[8] Officer Jodoin took the laptop out of the grip of the accused's hands and placed it on the bed and instructed the accused to get out of the bed. The accused was wearing a shirt and underwear and no pants. He was allowed to dress right away and was then brought upstairs. He was fully compliant. The laptop was left on the bed. Officer Jodoin noticed that there was a professionally produced movie playing on it. Officer Jodoin also observed that next to the bed that the accused was found sleeping on there was a nightstand and a number of personal effects. On the nightstand was a cell phone (later identified as belonging to the accused) and an expired Canadian passport in the name of the accused, among other things.
[9] Officers Firth and MacInnis took pictures during the execution of the search warrant. Some of those pictures show the contents of the bedroom in the basement where the accused was found. Some of the pictures taken by another officer show various credit cards and pieces of identification in the name of the accused that were found on or near the bed side table in basement bedroom. The hard drive that was seized and Mr. Tsang's nexus cellphone were also found on or near the bed side table, the latter was charging.
[10] Officer Jodoin alerted the forensic officer to the search warrant team, D.C. Jeff Kidd, that there was an active laptop on the bed in the basement and thereafter officer Kidd seized it and analyzed it. It was found to contain child pornography and Mr. Tsang was arrested for possessing it and taken from his parent's home to the police station. He got more clothes from the basement bedroom before going to the police station.
[11] Detective Constable Kidd testified that he has been with the Toronto Police Service for 22 years and for the last ten years has worked in sex crimes. He attended at the search of the residence as the computer forensic examiner to assist the other officers in the seizure of electronic devices. He also conducted the subsequent examination of the 5 electronic devices seized during the search. Not long after entering the residence he was directed to the downstairs were the accused had been located with a "live" laptop, i.e. one that is turned on ad actively doing something. He photographed the laptop sitting on the bed. It is a Microsoft Surface laptop with a removable keyboard and therefore better described as a tablet. It was not plugged in or attached to a charger.
[12] Because the tablet was open and active the officer was able to access its contents by merely swiping the screen. It opened up to what is referred to as a sort of "walk-in" page, as depicted in slide 5 of Exhibit 1 D (the Powerpoint). He then was able to slide up the screen revealing what is depicted in slide 6 of Exhibit 1 D. There was a video running in the background and the officer recognized it as the TV series "NCIS". When he minimized the movie it minimized to an application called Plex, which is a media sorter that allows a user to play movies as depicted in slide 7 of the Powerpoint. The officer then brought up the tab view in Windows 10, as depicted in slide 8, and that gave him an overview of all of the currently opened windows in the Windows environment. The officer then took pictures of the individual windows that were open on the screen including the Skype application. Skype was open but not logged in. It would require the user to sign in with a username and password in order to send and receive messages through the open Skype application as shown in the photograph that is slide 9. As the officer was photographing the screen of the tablet a warning popped up indicating that the Skype application had just been updated, showing that the application was not dormant but instead was being regularly updated as part of the update process for Windows 10.
[13] D.C. Kidd then went to the next tab, the Windows File Explorer tab, which is how most people would see the file stored on their computer. He photographed it as it would appear to any user that would have opened it, as depicted at slide 11. The tab was open and child pornography readily apparent. The officer arrived at this tab within minutes of being directed to the device by officer Jodoin and within seconds of examining it. As shown in slide 11, there were 6 applications open in the Windows File Explorer when it was found. That the applications are open is clear from the blue marking underneath the icons along the bottom of the page. The officer could readily cycle through the tabs which were layered one behind the other.
[14] Next Officer Kidd went to the downloads folder and the next folder was "YNG BOY 22" as depicted in slide 12. The file path to this folder is depicted in slide 13. It is a very simple and direct file path to this folder which contained the thumbnail of a number of videos that could be played with VLC. The thumbnail depictions of the videos clearly show that they include obvious child pornography. The names of the files also suggest that they contain child pornography as shown on slide 13.
[15] At this point in his preliminary examination of the tablet, Officer Kidd informed Officer Davies that he had located child pornography and an active Skype account. As he continued his on scene investigation into the device Officer Kidd saw that on the left hand side of the Windows Explorer tab there were folders containing child pornography pinned to the quick access folder as depicted in slide 15. Officer Kidd then live imaged the surface of the tablet, i.e. created a forensic copy of the device, and then triaged the computer itself. The live image is referred to as a logical copy of the device in that it copies the files that the user would normally have access to, including some deleted files, but not necessarily the encrypted data. The live image captures approximately 95 percent of what is stored on the hard drive of the device.
[16] Officer Kidd continued to triage the tablet on scene having regard to what was contained in Appendix A to the search warrant. The user account signed into the tablet was named "T-SANG" and the password for this account was not enabled. The device was bitlocker encrypted. During the search of the device Officer Kidd very quickly found 38 hash matches. Hash matches are essentially digital fingerprints of images that can be compared to a police database of known child pornography from previous investigations. In this case, the officer found 38 "hits" for images found on the device right away.
[17] Officer Kidd then examined the Skype application that was open on the tablet. Though the application was not currently logged into, the officer was able to examine the login for the computer itself which shows that the Skype application was version 7.35 and had just been recently automatically updated. The sign in page, as depicted in the photograph of the screen that is slide 17, shows the information associated with the currently signed on account includes a profile picture, and the Administrator of the account is listed as T – SANG, with an email address Jeremy@t-sang.com.
[18] The Rogers modem was located in the master bedroom of the house and the serial number associated with it is depicted in slide 20. The serial number of the modem was a match to the one listed in Appendix A to the search warrant. Next, in order to capture the IP address, it was necessary for the officer to plug his own forensic laptop into the network at the address, which then shows the Internet Protocol address that links the house to Rogers and then out to the world wide web. The IP address captured was different than the one contained in the appendix to the search warrant. A possible explanation for this is the passage of time between the alert in May and the search in November. It is not uncommon that the IP address could change during this period of time, for example when the network was down perhaps due to a power outage or the unplugging of the modem at some point.
[19] In cross-examination Detective Constable Kidd testified that at the time of his initial seizure of the tablet, an innocent video was playing in full screen and accordingly the downloads folder was not immediately visible on screen. It took action, namely swiping the screen (or alternatively using the keyboard) to bring up the "virtual window" which in turn immediately brings up the six open windows as depicted in slide 8.
[20] Officer Kidd agreed in cross-examination that though he is not aware of an email application that automatically downloads attachments that are clicked on/opened: "I can't see why that wouldn't be possible as long as that setting would be available." D. C. Kidd also agreed that anyone can create a Skype account as long as they have an email and phone number and abide by the rules. Further, a person can provide false names and identifiers including fictitious email accounts. In other child pornography investigations he has seen the word "boi" as online slang for boy.
The Forensic Analysis of the Devices
[21] During the search of the home, five electronic devices were seized and two were forensically examined back at the police lab: 1. a Microsoft tablet and 2. A silver Western external hard drive.
[22] The first program used by police to search the devices is known as LACE and it is essentially an image categorization program that can analyze both images and videos found on electronic devices. Once the LACE program has identified certain images, Officer Davies was responsible for putting the images located on the device into three separate categories: 1. child pornography; 2. images of investigative interest, for example those showing child nudity/age difficult images or pictures of the accused, and 3. everything else. Exhibit 1 filed at trial is an external hard drive that has various folders on it including: 1A – the category 1 LACE identified images; 1B – the category 1 LACE identified videos; 1C – the category 2 LACE identified images; 1D – a Powerpoint presentation prepared by Det. Kidd that includes some photographs of the devices when seized, and; 1E – the Skype cache.
[23] On the two devices, the examiner found a total of 620 files containing category 1 child pornography. That number includes deleted, unallocated and readily accessible files. Of those 620 images, the LACE software program found 355 images that the average user would see just by going on to the computer and browsing. Of those 355 images, 310 were unique. Of the 355 images (which includes duplicates) the officer did a manual search and found that approximately 28 images were part of the Skype cache and therefore not in plain sight to the ordinary user. That then leaves 327 images of child pornography in plain sight.
[24] The total number of videos containing child pornography on the two devices (i.e. the tablet and the external hard drive) is 597 and that number includes recovered and non-recovered videos as well as some duplicate files. Out of 597 videos 414 were readily accessible to the ordinary user. Of those 414 videos, 374 were unique. Officer Kidd testified that in his ten years of doing child pornography investigations he has never run across a case where child pornography ended up on a computer without having been placed there by user action.
The Skype Account
[25] The Axiom program was also run on the tablet, which shows the overall picture of the device, such as activity and files, including information relating to the Skype investigation that was the primary focus of the search. The Axiom program revealed that the current version of the Skype application found on the tablet was installed on May 17, 2017 as depicted in slide 22, and that it is being continually updated showing that it is running properly. Through the information extracted by the Axiom program it is possible to discern that there were three unique user accounts associated with the Skype application as depicted in slide 23:
(1) Skype Name: live.Jeremy_3120 Full Name: Jeremy Tsang Email: jeremy@t-sang.com
That email account would have been provided at the time this account was originally created by the user Jeremy T-sang, in September of 2014. There is also a mobile number associated with the account: 647-880-0140.
(2) Skype Name: live: dadsboiboi Full Name: Lil Johnny Email: dadsboiboi@yahoo.com
That profile account was created in August 14 of 2017.
(3) Skype Name: johnnyboytoy6 Full Name: yng boytoy Email: George.lyon9802@gmail.com
An account created on May 30, 2013 and the one referred to in Appendix A. Further information associated with this account is: gender male and country C – which appears to be CA cut off.
[26] There is a fourth entry in the Skype application and it is associated with the same Skype and Full Name of the first account but does not include the mobile phone number, suggesting that the phone number was removed and the user account was thereby slightly changed.
[27] An analysis of the account information revealed that the first Skype account to be created was the johnnyboytoy6 account which was active for four years and then was shut down and a new account then created in August of 2017. The shutdown of the account is in the time frame of the Skype alert – created by Skype as part of its automatic process of closing, freezing or suspending accounts immediately upon finding possible child pornography – generated on May 28, 2017. The officer then determined that this same user account utilized the IP address referred to in Appendix A of the search warrant, that is the IP address from the Skype alert. In other words, the johnnyboytoy6 user accessed the Skype application on May 28, 2017 starting at 9:04 p.m., logging in and probably having generalized chat and then Skype intercepts the transmission of the offending files later on that evening, around 10:00 p.m. and eventually alerts local police. Then there is no IP address associated with this jonnyboytoy6 account after May 28 which is indicative of the account being shut down at around that time. Then in August of 2017 there is a new live account using the same Skype application and the same device but now accessing the new IP address and that is the dadsboiboi account.
[28] The next thing Officer Kidd did was take 6 images of child abuse identified by Skype as having been transmitted on May 28 and compared them, including the dates and times that Skype showed they were uploaded, against the information stored on the tablet so as to ensure that the images were indeed sent by that device. He found that they were and this is demonstrated in slides 25 through 30 of the PowerPoint. For example, the image of child pornography identified by Skype as having been transmitted at 10:26 p.m. on May 28 was found on the device itself along with corresponding information. That information includes the fact that there was a Skype chat between the users "tony baloney 7" and "johnyboytoy6" (with a display name of "yngboytoy") on that date and that the image was transmitted from the Microsoft tablet seized by police and from the IP address then associated with the residence of the accused's parents. Further, the image had been retrieved from a subfolder of the documents folder under the user account name of T-sang and then transmitted through the Skype application and made available to the other user account. The same can be said for the five other images identified by Skype in its alert. All six of those images were captured by Skype. All six of those images were stored on the T-sang user account and transmitted to the Skype application that intercepted them while they were being sent to tonybaloney7. All six images were being transmitted in a period of approximately 30 minutes, between 10 and 10:30 on May 28, 2017.
[29] There were also chats between the users associated with the transmitted images of child abuse. Copies of those digital conversations were filed as exhibits at trial and reviewed during the evidence of Officer Kidd. One of the ongoing Skype chats took place between the user "tonybaloney7" (herein "Tony") and the user"johnyboytoy6" (herein "Johnny") over the course of a couple of months. It starts with a system generated message indicating that Johnny is trying to add Tony as a contact on March 29, 2017. Tony subsequently provides Johnny with various links and thereafter there are various attempts to communicate with one user or the other being off line. When they connect they discuss a shared sexual interest in children. As well, Johnny tells Tony that he lives in Toronto and on May 28 he tells him that "I cycled 95 kilometers today". Johnny sends six images of child pornography to Tony over the course of approximately ½ hour on May 28, 2017. Again, one of the images Johnny sent to Tony was an original image taken from user T-Sang's pictures folder stored on the tablet.
[30] The Crown filed as exhibits 4 through 10 other chat conversations associated with the same Skype account. They did so not because the charges relate to the events of those particular dates but because they are capable of providing some circumstantial evidence as to the user or users involved in accessing the tablet and its folders and the Skype account in particular. In an ongoing chat with a user named "virginboycollector" (Daddy Kevin) that took place between May 1 and May 16, 2017, the user Johnny sent him some images of children. Virginboy tells Johnny that he is going to a conference in Halifax and Johnny assures him that "theres a lot of pervs there" and offers to find him a Halifax "hook up".
[31] In an ongoing chat with user "lilithsboy (Jason)" that being on March 29, 2017 Johnny describes himself as "5'6", 135. 22 here". He says that he does art for a living – "sculptural and conceptual things". In a chat with user "ruiben40 (ruiben nebiur)" Johnny asks "u play with bois a lot?" (emphasis added). In a chat with user "srg874 (srg874)" Johnny describes himself as 19 years old. In a chat with user "sendmeanim (tom)" Johnny sends him an image that is taken out of user T-sang's new documents folder, as can be seen from a review of the Skype media cache that is exhibit 1E.
The Defence Case
Overview
[32] Three witnesses testified for the defence: the accused, his mother and his Aunt. All three testified that they were continuously together during the evening of May 28, 2017, between the hours of approximately 6:00 to 11:10 pm and that therefore it could not have been the accused that was uploading child pornography from the tablet in his parent's residence as alleged in three counts of the information. Important context to the alibi defence is the Crown's admission that the child pornography was being uploaded at approximately 10:21 to 10:26 pm that evening and from the surface pro laptop that was at the Abbeywood Trail address at the time. In other words, Jeremy Tsang had to be at that residence on that date and at that time in order to be the one uploading child pornography as alleged in three counts in the information.
[33] If I accept the accused's denials and/or the alibi evidence I must acquit. If I do not accept those denials or the alibi evidence, but that evidence raises a reasonable doubt, I must acquit. Of course, even if I reject the defence evidence I need to determine whether the Crown has proven its case beyond a reasonable doubt, including disproving the alibi.
The Evidence
Jeremy Tsang's Testimony
[34] Jeremy Tsang testified at trial that he is 29 years old and has no criminal record. He attended the Nova Scotia College of Art and Design (NSCAD) University in Halifax where he obtained a degree in fine arts in 2011. He owns a print shop and art gallery where he works with other artists. The gallery is on Sterling Road in the west end of the city which is approximately 40 km away from his parent's home on Abbeywood Trail. He estimated that it was approximately a 35 minute drive to his parent's home when there is no traffic and up to a 1.5 hours when there is. He works long hours in the gallery. It is open from 9 am to 7 pm most days and he estimated that he generally works 16 to 18 hours a day. He also works with various art related organizations and is the local rep for the Toronto chapter of the NSCAD alumni association. He lives in the studio gallery but goes to his parent's home perhaps one or two times a week and sometimes stays over. He has a bedroom in his parent's house but it's upstairs and not downstairs in the basement.
No Knowledge of Child Pornography on the Devices
[35] Jeremy Tsang testified and denied any knowledge whatsoever of the child pornography found on the two electronic devices seized from his parent's home. The accused testified that the surface pro tablet was given to him as a gift by his uncle from the U.S. in November or December of 2014. He soon determined that it was not powerful enough to use for work so he has another computer he uses at work and he leaves the tablet at his parent's home for everyone in the extended family to access for their own purposes. In particular, he testified that his father, mother, brother, uncle (who stays with his parents routinely), his cousins, another aunt and uncle, and his god parents all have the password to the tablet and are free to use it. These people also have keys to his parent's home. He testified in chief that he only uses the tablet to watch movies when he comes home.
[36] Mr. Tsang testified that he and his father took the tablet in for repairs in November of 2016 because someone cracked the screen. It couldn't be fixed at that time so the tablet was replaced with a refurbished one and the files were transferred by the shop to the new tablet without any difficulties or concerns. The receipt for this transaction was filed in evidence as exhibit 12 and it lists the customer contact information as "Jeremy Tsang" with an email of jeremy@t-sang.com and a phone number of 647 880-0140.
[37] Mr. Tsang testified that he has never seen any child pornography on the tablet and was shocked to learn of its existence at the time of the execution of the search warrant. He agreed that he makes use of the device from time to time and that some of his own folders and documents may be found on the laptop, including in the downloads file that contains the child pornography in question. However, he testified and denied that he was the one that put a copy of the photo of his driver's license in the downloads folder on the tablet. He suggested that it might have ended up there when the old tablet got synced with the new one back in November of 2016 or that it might have been automatically downloaded to the computer from an email attachment, but could not say for sure. He didn't know how it got there. Nor did he upload the photographs of himself to the downloads folder and didn't know how they ended up there. He denied ever accessing Skype much less transmitting child pornography via the application. He denied setting up the Skype account Johnny or any of the other accounts associated with the application. He denied owning the hard drive that was found to contain child pornography.
[38] Mr. Tsang testified that some of the personal information contained in some of the Skype chats does not accurately match up with him. For example, in the Skype chat that is exhibit 5 the user Johnny describes himself as 5'6", 135 pounds and 22 years of age whereas at the time of that chat Mr. Tsang testified he was 5'4", 150 pounds and 27 years old. Further, Johnny tells the other user in this same chat that he makes art and specifically sculptural and conceptual things but Mr. Tsang testified that during that time period he was not making art, though he had in the past, and was not doing sculptural work. As to whether he was doing conceptual art, Mr. Tsang testified that in today's art world most work is considered conceptual art. As for the chat that is filed as exhibit 4, Mr. Tsang agreed that he went to university in Halifax but did not agree that he knew any young perverts in Halifax to set anyone up with. Further, lots of people know that he attended school in Halifax.
[39] During his evidence in chief Mr. Tsang was asked questions concerning the Skype chat that was filed as exhibit 5 in evidence. It was during the course of this Skype chat that child pornography was transmitted by Johnny to Tony between 10 and 10:30 p.m. on May 28 as alleged in the information. In that Skype chat Johnny states "I cycled for 95 km today". Mr. Tsang denied that he was Johnny and/or that he wrote that. However, he did testify that he cycled around 98 km that day. He testified that lots of people would have known that he was training for various rides as he had engaged in fundraising efforts.
[40] In cross-examination some of the documents found in the downloads folder of the tablet were reviewed with Mr. Tsang. One of those documents is a photo of an invitation to "The Drake Henderson Brewing Block Party" and in relation to it Mr. Tsang testified that the Drake is across the street from his studio and that he "presumes" it is a restaurant, but that he was unfamiliar with this document. He later testified that it was a restaurant and he had gone there in the past.
[41] Mr. Tsang admitted in cross-examination that he may well have taken some of the pictures found in that downloads file. Some of the pictures are of him. But he testified that he had no idea how they ended up there. He didn't think that these particular images had been emailed to him, but he wasn't sure. He possibly took the photo of his driver's license but again did not know how they ended up in the downloads folder. As for the picture of him holding his driver's license he could not recall who took it, though guessed that he took it, and again does not know how it ended up in the downloads folder. As for the invoice from the electrical company found in the downloads folder, Mr. Tsang testified that it related to his business but did not know how it ended up in the downloads folder. He wasn't sure if he saved it there or not.
[42] As for the bike ride maps found in the folder, Mr. Tsang testified in cross-examination that he is not familiar with Ride with GPS and did not generate those documents, though he agreed that he is an avid bicyclist that trains with a group every weekend. He testified that he does not have a GPS device but that it is possible the document in the downloads folder mapping out a ride from Kipling to Appleby might be a ride that he did, and perhaps someone emailed him the map. He can't say for sure. As for the fifteen other similar bike ride related documents in the folder, Mr. Tsang could not say how they got there. In the Skype chat that is the subject of the allegations, the author of the texts from the user Johnny tells the other user that he has cycled 95 km that very day. The accused admitted that there was a map in the downloads file on the laptop – the very same file that some of the child pornography was found in – and that map shows the route for a 97.7 km bike ride at "Warden – Mussleman's Lake". The accused agreed that he did that bike ride on May 28 but testified that it was 97.7 km and not 95 km as stated by the author of the message. He points out that the map was uploaded after the time of the ride and not beforehand.
The Events of May 28, 2017
[43] Mr. Tsang testified that on May 28, after doing his bike ride, he was with his aunt and mother for 6 hours, starting at 6:00 pm, working on installing the air conditioning unit at his gallery. His mother and aunt left at 11:00 pm but he stayed to continue working, slept for a while at the studio and then went to his parents' home at around 8 to 9 a.m. on the morning of the 29th. He and his parents left for Kingston at around 10:00 a.m. on the morning of the 29th and his brother's convocation was in Kingston the next day.
[44] Mr. Tsang testified that on the evening in question he was with his mother and his aunt installing two portable air conditioning units in his studio on Sterling Avenue. He purchased the units on May 19 and then bought some further related parts on May 23 and 25 as evidenced by a copy of the receipts tendered as exhibits at trial. It was approximately 5 or 6:00 p.m. that his mom and aunt arrived and the installation of the air conditioning started on May 28. He described the steps taken to install the air conditioning and some of the problems they were experiencing in doing so. His mother and aunt came to the studio in one car and remained with him there until approximately 11:00 p.m. Most of that time they were working on the installation or having a bite to eat at the studio. He stayed longer than his mother and his aunt but was not sure what time he left the studio and drove to his parent's home that night/early morning. He specifically remembers that day because he did a long bike ride that morning as he was training for an upcoming fundraiser and the next morning went with his parents to Kingston for his brother's graduation from Queens University. Documentation showing check in for the hotel, meals and the timing of the convocation in Kingston were all filed in evidence and show that these events took place starting on the evening of May 29 when they arrived in Kingston and checked into the hotel.
[45] When asked in cross-examination when he first approached his mother about her recollection as to what happened on May 28-29, 2017, Mr. Tsang testified that he could not remember. It was not until after meeting his lawyer in the Fall of 2018 that he told his Aunt that his lawyer wanted to speak to her. In re-examination he denied ever speaking to his mother or Aunt about the details of his alibi.
The Events of November 16, 2017
[46] As for the day of the execution of the search warrant at his parent's home, Mr. Tsang testified that it was in the early morning hours (approximately 6:00 a.m.) of November 16, 2017 that he went to his parent's home and quietly walked downstairs to the bedroom in the basement, rather than his own bedroom upstairs, so as to not wake up his parents. He also testified that he attended at his parent's home that night/early morning because his mother had asked him over for dinner and he wanted to make his mother happy.
[47] When he arrived at around 6:00 a.m. everyone was asleep and he had soup in the kitchen and found the tablet on the table. The movie NCIS was already open on the display screen and paused, so he decided to take the device downstairs with him so that he could use it as white noise so that he could fall asleep. He also testified that it was very late and he was very tired. He denied manipulating the screen at all in any meaningful way and denies seeing the child pornography that was open in the downloads file underneath the movie. He fell asleep with the movie still playing and it was not long after that that he was awoken by the police entry into the home. According to Mr. Tsang, and contrary to the evidence of Officer Jodoin, he was standing when he was first confronted by an officer. He denied that he was lying on the bed or that he had the tablet on his lap.
[48] In cross-examination Mr. Tsang confirmed his evidence that he stopped using the tablet for work purposes because it was too slow and unsuitable and so he left it at home. Thereafter he used it only to watch movies and to surf the internet. He may also have used the Word program on it, but it was not his "go to" computer at home as there were many computers at his parent's home. Mr. Tsang testified that the Plex movie application account came from a friend but agreed he had to set up an account in order to use it on the computers in his home. The morning of his arrest he was watching a movie on the tablet that someone else must have started before him. He has no idea who opened the Skype application on the tablet. Though he testified that he was not often at his parent's home he agreed that it was his primary residence for the purposes of his voting card, health cards, bank cards, etc.
[49] Mr. Tsang testified that he was sleeping in the basement on the day the search warrant was executed because he had come home in the early morning hours and didn't want to wake anyone up by going to his actual bedroom which was upstairs. He also testified that the reason he was home that night was because his mother had asked him to come for dinner, though of course he arrived much too late for that. He found the tablet in the kitchen where he had some soup before going to bed at around 6:00 am. The tablet was playing a movie and he took it downstairs with him to use as white noise to help him sleep.
[50] In cross-examination Mr. Tsang maintained that the tablet was not on his lap but was instead on a tray on the side of the bed. He agreed that while watching the movie, if he had minimized it, the downloads folder would be visible to him. He also agreed that the contents of that downloads folder contained some child pornography and some files personally related to him. When asked in cross-examination what use he would make of the Word program, Mr. Tsang testified that he could not remember. He agreed he used the tablet for webmail to access work related emails through the browser. He agreed that he did use Skype for work but maintained that he did not use the Skype application on the tablet. In particular, he testified that the Skype account on the tablet that was in his name, using his email, was not his account. He had no idea how the application ended up on the tablet and had nothing to do with it being updated approximately 48 hours prior to his arrest as indicated in slide 22 of the PowerPoint. He agreed that he set up the computer account on the tablet in the name "t-sang" and using the same email account as was used to set up the Skype account on that same tablet. He testified that other people know his user name and passwords.
[51] When the pictures of the basement bedroom were put to Mr. Tsang in cross-examination he denied that the clothes in the closet were his. He testified that they could belong to anyone that slept there "because we switched around bedrooms numerous times in the house." He suggested that the clothes might belong to one of his cousins that stayed at the house at some point between 2013 and 2015. He eventually agreed that some of the clothes in that closet might be his.
[52] As for the two hard drives, found on the bedside table next to him and right next to his cell phone that he was charging, the accused testified that he has no knowledge of who they belong to or what is stored on them. His wallet was on the table next to them, though clearly the cards and identification in that particular wallet were not in active use as evidenced by the documentation filed by the defence as exhibits: 19 A - C, 20 A - C and 21. Mr. Tsang testified that he had no idea how his old wallet or other expired identification got there. That room is accessible to a number of people.
The Testimony of Mr. Tsang's Mother
[53] Shirley Yuen testified that she is the 59 year old mother of the accused. She testified that on May 28, 2017 she and her sister Phyllis went to her son Jeremy's studio to help him install air conditioning. They went there at about 6:00 p.m. and stayed until approximately 11:00 p.m. The accused was with them this whole time. They worked on trying to install the units for approximately 5 hours. Then she drove her sister home, got home herself around midnight and the family went to Kingston the next day for her other son's convocation. When asked in cross-examination, she testified that she was not sure whether or husband or anyone else was at home that evening. When she returned home at around midnight only her husband was there and he was sleeping.
[54] She testified that the Surface Pro tablet is kept at her home and used by lots of different extended family members. It was password protected and everyone knew the password. She could not recall what the password was. She has used the tablet occasionally to watch movies and had never seen anything inappropriate on it. She could not put a number on how often she used the tablet. It was suggested to her in cross-examination that she never really used the tablet as she has her own computer at home. She disagreed. She testified that the bedroom in the basement was used primarily for storage. She testified that she did not know who owned the hard drives found by police in that bedroom or how they got there.
[55] Ms. Yuen testified that her son was cycling for fundraising on the morning of May 28. She also testified that she knows that they arrived at his studio at around 6 because he had told her not to arrive before then because he was cycling. She originally testified that they left the studio at around 12:00 but later clarified in her evidence that they left earlier and arrived home at around this time. She testified that her son woke her up the next morning when he banged the front door.
The Aunt's Testimony
[56] Mr. Tsang's Aunt Phyllis testified that she is a 55 year old woman with no criminal record and a responsible job. She is the accused's mother's youngest sister. They live close together and her family is over at the accused's family home at least two or three times a week. She testified that when they visit her sister's family on Abbeyroad Trail she sometimes uses the surface pro tablet to watch movies on Netflicks or Plex and even on occasion to surf the internet. She could not currently recall the password but testified that everyone in the family knew it and used that device.
[57] She testified that she recalls the events of May 28, 2017. That was a Sunday and she and her sister went to Jeremy's studio/office to help him install two portable air conditioning units that he had bought. She testified that it was close to 6:00 p.m. when they arrived at the studio at 163 Sterling Avenue and that they remained there with Jeremy the whole evening until she and her sister left at around 11:10/11:15 p.m. Her sister drove her home, which took about 40 minutes and she worked the next morning at 9:45 am. She described in some detail the difficulties the three of them had trying to install the air conditioning. The job was not complete when they left that evening and Jeremy said that he would stick around and keep working on the project after they left. She understood that her sister and the accused would be going to her other nephew's graduation at Queens "was on the Tuesday" and her sister mentioned having to get ready to go on the Monday. It was her understanding that earlier in the day her nephew would be cycling in preparation for a trip to Montreal.
[58] In cross-examination she agreed that she did not have any particular knowledge of air conditioning installation but stated that she often helps out her nephew at his office and that was why she was asked to assist on this particular evening. She knew about the charges her nephew was facing because she was present in the house during his arrest in November. The witness maintained steadfastly in cross-examination that from the time or the arrest onwards she never discussed the allegations or the events of May 28, 2017 with either her sister or her nephew – even though they are extremely close and spend several days a week together on average. When asked in cross-examination how many times she had accessed the surface pro laptop she testified that it was more than 10 but simply could not recall whether it was possibly more than 20 times. She couldn't recall the password. She said this was due to the passage of time.
Positions of the Parties
The Crown
[59] The Crown argues that this is a case of an accused being caught "red handed" in possession of child pornography. The open and running surface pro laptop found on the accused's person contains a very organized and extensive collection of child pornography in the downloads file that was open on the computer, right underneath the movie that the accused admitted he was watching during the early morning hours of November 16, 2017. When the police entered the house they found the accused on the bed in the basement bedroom with the laptop open and on his lap/chest. The movie was on the screen but if one were to close or minimize the movie the images of obvious child pornography were clearly visible in the downloads file, comingled with documents clearly belonging to the accused, including pictures of him and his identification.
[60] The Crown argues that if Mr. Tsang had knowledge of the child pornography in the downloads file then that presents strong circumstantial evidence as to his knowledge of the contents of the hard drives and the fact that they too belong to him and not some other mysterious person. A number of the articles in the basement bedroom are associated with the accused. The Crown also points to the contents of the Skype chats and the profile information associated with the various devices and applications, as further circumstantial evidence of guilt: R. v. Johannson, [2018] S.J. No. 827 (Sask QB); R. v. Villaroman, 2016 SCC 33, [2016] 1 S.C.R. 1000. The Crown argues that the totality of the evidence points to the accused as the one who was accessing and distributing child pornography through the Skype application on the tablet on May 28, 2017.
The Defence
[61] The defence argue that I should accept the accused's strong denials of guilt and the alibi evidence and that at a minimum that evidence should raise a doubt concerning the issue of the accused's knowledge. The defence argue that all three defence witnesses have no criminal records and are people of good standing the community. They provide a clear alibi for the accused concerning the events of May 28, 2017 and therefore demonstrate that it was someone other than the accused that was uploading child pornography on that date from his computer at his parent's home.
[62] The defence points to some of the discrepancies in the information contained in the Skype chats, such as the fact that the author identifies himself as 22 years old, 5'6 and 135 pounds whereas the accused testified that he is in his late 20's, 5'4" in height and 150 lbs. in weight. The other information, such as concerning the bike trips and the scene in Halifax are well known facts among family and friends and could have been woven into the discussion for the purpose of looking like it was the accused communicating in the Skype chats when in fact he was not. There was no evidence whatsoever of any accessing or uploading of child pornography, or Skype chats, on the November date, so the accused didn't sneak into his parents' basement for that reason that evening and none of this incriminating activity attaches to his involvement with the electronic devices in question on that day.
[63] The defence argue that much of the information contained in the Skype messages is common knowledge in the family and therefore not circumstantial evidence of the accused's guilt. For example, it was argued that everyone knew the accused was in training for a cycling fund raiser to Montreal and therefore could have added in details about a bike trip so as to shore up the masquerade that it was the accused that was authoring the texts, and uploading the child pornography associated with those Skype exchanges. The defence argue that the accused was unshaken in his cross-examination and that his denials should either be accepted or give rise to reasonable doubt. This is particularly so when his evidence if fortified by two witnesses, both of whom have no criminal record and are responsible people.
Analysis and Findings of Fact
[64] The Crown's case against the accused is entirely circumstantial. The Crown bears the burden of proving each and every element of the alleged offences beyond a reasonable doubt and this includes disproving beyond a reasonable doubt the alibi defence.
[65] The real issue in this case is whether it was the accused that knowingly possessed, accessed and distributed child pornography as alleged in the information. In applying the burden of proof in a purely circumstantial evidence case, a court must be alert to the dangers of the path of reasoning involved in drawing inferences from circumstantial evidence. An inference of guilt drawn from circumstantial evidence should be the only reasonable inference that such evidence permits: R. v. Villaroman, infra, in particular at paras. 37, 42 and 50.
[66] In assessing circumstantial evidence, inferences consistent with innocence do not have to arise from proven facts. If there are reasonable inferences other than guilt, the Crown's evidence does not meet the proof beyond a reasonable doubt standard. For example, a gap in the evidence may result in inferences other than guilt. But those inferences must be reasonable given the evidence and the absence of evidence, assessed logically, and in light of human experience and common sense. When assessing circumstantial evidence the trier of fact should consider other plausible theories and other reasonable possibilities which are inconsistent with guilt. I have done so in this case and I am satisfied that the Crown has proven the case beyond a reasonable doubt.
[67] In this case, the surface pro tablet was found open and running on the accused when he was found on the bed in the basement during the course of the execution of the search warrant. On that device numerous images and videos containing child pornography were readily accessible to the average user. Many of these images were found in the open downloads file, lurking below the movie that the accused testified he was watching. In the download files, that are open and visible to the viewer when the movie is minimized or closed, are actual, graphic pictures of unmistakable child pornography. The thumbnail images of obvious child pornography and other graphically named files would be apparent to anyone that used the computer before opening the movie or after closing or minimizing it.
[68] The child pornography is organized into sub folders, some of which have surreptitious names and others of which have less surreptitious names, such as "14 y.o. raped". There was a relatively large collection of videos of images of child pornography on the device. As set out in slide 11 of the PowerPoint presentation of Officer Kidd, there were quick links to 4 folders named AAAboys that had been recently accessed (though how recently was not clear from the evidence).
[69] The circumstantial evidence against the accused concerning his knowledge and control over the child pornography that was possessed on November 16 of 2017 (both on the tablet and the hard drive) and possessed, accessed and distributed by way of the Skype application on May 28, 2017 is overwhelming and includes:
The Skype alert directed the Toronto police service to a particular IP address and a subsequent production order connected that IP address to 93 Abbeywood Trail – the accused's parent's home where he has a bedroom.
The Rogers account holder associated with that IP address was identified as Shirley L-F Yuen and searches revealed three known parties associated with the account phone numbers. The open source information through Facebook (FB) led the officer to identify three FB accounts associated with these same phone numbers and one of them was the account of "Jeremy Tsang" with photographs and updates from July of that same year. In the information section of the page the person associated with the account indicates that they live in Toronto and are employed as a pixel layer for Double Happiness Projects, Jeremy Does Art Prints and an artist under the name T-Sang.
During the course of the search of the home on November 16, 2017 Officer Jodoin found the accused lying on his back on a bed in a bedroom in the basement with the Microsoft tablet open and active on his lap/belly with the screen facing towards him. It appeared to Officer Jodoin that the accused had fallen asleep while watching a movie on the tablet and that he had been startled awake by the officer's presence.
It is noteworthy that at the time that the tablet was seized from Mr. Tsang the downloads folder was actually open and readily accessible, as depicted in slides 8 and 11 of the PowerPoint that is Exhibit 1D. This is significant because this particular documents file was not only open on the tablet at the time it was seized from the accused but the downloads folder contains both obvious child pornography and personal information associated with Mr. Tsang, such as a picture of him with a friend, party invites etc.
Some of the sub folders in documents are named "porn boys video", "yng boy 22", etc. and they contain both images and videos that constitute child pornography. Some of the folders have pictures that appear right in the downloads folder that show obvious child pornography.
Some of the other files in the downloads folder include: photos of Mr. Tsang's driver's license, front and back; a PDF document named Davlet Memorial Ride, generated by a GPS ride application; an invoice to Jeremy Does Art Prints from an electrical company; a document labeled Warden, Musselman's Lake – 97-7, Kolantis Red, which was created on May 31, 2017. In his trial testimony the accused admitted to doing at least some of these bike rides.
The Skype application was open on the tablet when it was found in the accused's possession but was not logged in. It would require the user to sign in with a username and password in order to send and receive messages through the open Skype application. As the officer was photographing the screen of the tablet during the execution of the search warrant a warning popped up indicating that the Skype application had just been updated, showing that the application was not dormant but instead was being regularly updated as part of the update process for Windows 10.
Officer Kidd then examined the Skype application that was open on the tablet. Though the application was not currently logged into, the officer was able to examine the login for the computer itself which shows that the Skype application was version 7.35 and had just been recently automatically updated. The sign in page, as depicted in the photograph of the screen that is slide 17, shows the information associated with the currently signed on account includes a profile picture, and the Administrator of the account is listed as T – SANG, with an email address Jeremy@t-sang.com.
Next to the bed that the accused was found sleeping on there was a nightstand and a number of personal effects. On the nightstand was an expired Canadian passport in the name of the accused, among other things. Some of those pictures taken during the execution of the search warrant show the contents of the bedroom in the basement where the accused was found. They show various credit cards and pieces of identification in the name of the accused that were found on or near the bed side table in basement bedroom. The hard drive that was seized and Mr. Tsang's nexus cellphone were also found on or near the bed side table, the latter was charging.
Because the tablet was open and active the officer was able to access its contents by merely swiping the screen. It opened up to what is referred to as a sort of "walk-in" page, as depicted in slide 5 of Exhibit 1 D (the Powerpoint). He then was able to slide up the screen revealing what is depicted in slide 6 of Exhibit 1 D. There was a video running in the background and the officer recognized it as the TV series "NCIS". When he minimized the movie it minimized to an application called Plex, which is a media sorter that allows a user to play movies as depicted in slide 7 of the Powerpoint. The officer then brought up the tab view in Windows 10, as depicted in slide 8, and that gave him an overview of all of the currently opened windows in the Windows environment. The officer then took pictures of the individual windows that were open on the screen including the Skype application.
D.C. Kidd then went to the next tab, the Windows File Explorer tab, which is how most people would see the file stored on their computer. He photographed it as it would appear to any user that would have opened it, as depicted at slide 11. The tab was open and child pornography readily apparent. The officer arrived at this tab within minutes of being directed to the device by officer Jodoin and within seconds of examining it. There were 6 applications open in the Windows File Explorer when it was found. The officer could readily cycle through the tabs which were layered one behind the other.
While triaging the tablet during the execution of the search warrant, Officer Kidd went to the downloads folder and the next folder was "YNG BOY 22" as depicted in slide 12. The file path to this folder is depicted in slide 13. It is a very simple and direct file path to this folder which contained the thumbnail of a number of videos that could be played with VLC. The thumbnail depictions of the videos clearly show that they include obvious child pornography. The names of the files also suggest that they contain child pornography as shown on slide 13.
As he continued his on scene investigation into the device Officer Kidd saw that on the left hand side of the Windows Explorer tab there were folders containing child pornography pinned to the quick access folder as depicted in slide 15.
Officer Kidd continued to triage the tablet on scene having regard to what was contained in Appendix A to the search warrant. The user account signed into the tablet was named "T-SANG" and the password for this account was not enabled. The device was bitlocker encrypted. During the search of the device Officer Kidd very quickly found 38 hash matches. Hash matches are essentially digital fingerprints of images that can be compared to a police database of known child pornography from previous investigations. In this case, the officer found 38 "hits" for images found on the device right away.
The Rogers modem was located in the master bedroom of the house and the serial number associated with it is depicted in slide 20. The serial number of the modem was a match to the one listed in Appendix A to the search warrant. Next, in order to capture the IP address, it was necessary for the officer to plug his own forensic laptop into the network at the address, which then shows the Internet Protocol address that links the house to Rogers and then out to the world wide web. The IP address captured was different than the one contained in the appendix to the search warrant. However, it is not uncommon that the IP address could change during this period of time, for example when the network was done perhaps due to a power outage or the unplugging of the modem at some point.
During the subsequent forensic examination of the two devices, the Axiom program revealed that the current version of the Skype application found on the tablet was installed on May 17, 2017 as depicted in slide 22, and that it is being continually updated showing that it is running properly.
Through the information extracted by the Axiom program it is possible to discern that there were three unique user accounts associated with the Skype application as depicted in slide 23:
Skype Name: live.Jeremy_3120 Full Name: Jeremy Tsang Email: jeremy@t-sang.com
That email account would have been provided at the time this account was originally created by the user Jeremy T-sang, in September of 2014. There is also a mobile number associated with the account: 647-880-0140.
Skype Name: live: dadsboiboi Full Name: Lil Johnny Email: dadsboiboi@yahoo.com
That profile account was created in August 14 of 2017.
Skype Name: johnnyboytoy6 Full Name: yng boytoy Email: George.lyon9802@gmail.com
An account created on May 30, 2013 and the one referred to in Appendix A of the search warrant. Further information associated with this account is: gender male and country C – which appears to be CA cut off.
An analysis of the account information revealed that the first Skype account to be created was the johnnyboytoy6 account which was active for four years and then was shut down and a new account then created in August of 2017. The shutdown of the account is in the time frame of the Skype alert – created by Skype as part of its automatic process of closing, freezing or suspending accounts immediately upon finding possible child pornography – generated on May 28, 2017. This same user account utilized the IP address referred to in Appendix A of the search warrant, that is the IP address from the Skype alert. In other words, the johnnyboytoy6 user accessed the Skype application on May 28, 2017 starting at 9:04 p.m., logging in and probably having generalized chat and then Skype intercepts the transmission of the offending files later on that evening, around 10:00 p.m. and eventually alerts local police. Then there is no IP address associated with this jonnyboytoy6 account after May 28 which is indicative of the account being shut down at around that time. Then in August of 2017 there is a new live account using the same Skype application and the same device but now accessing the new IP address and that is the dadsboiboi account.
The 6 images of child abuse identified by Skype as having been transmitted on May 28 at certain dates and times were uploaded from the tablet found on the accused showing that they were sent from that device. For example, the image of child pornography identified by Skype as having been transmitted at 10:26 p.m. on May 28 was found on the device itself along with corresponding information. That information includes the fact that there was a Skype chat between the users "tony baloney 7" and "johnyboytoy6" (with a display name of "yngboytoy") on that date and that the image was transmitted from the Microsoft tablet seized by police and from the IP address then associated with the residence of the accused's parents. Further, the image had been retrieved from a subfolder of the documents folder under the user account name of T-sang and then transmitted through the Skype application and made available to the other user account. The same can be said for the five other images identified by Skype in its alert. All six of the images caught by Skype were stored on the T-sang user account and transmitted to the Skype application that intercepted them while they were being sent to tonybaloney7. All six images were being transmitted in a period of approximately 30 minutes, between 10 and 10:30 on May 28, 2017.
There were also chats between the users associated with the transmitted images of child abuse and the contents of some of those Skype chats provides some further evidence that it was the accused that was using Skype at the time of the transmission of child pornography through the application. For example, on May 28 the user Johnny tells Tony that he lives in Toronto and "I cycled 95 kilometers today" and the accused admitted in evidence that he cycled that day, though points to the fact that it was 98 km and not 95 km and many people know that he trains. Johnny sends six images of child pornography to Tony over the course of approximately ½ hour on May 28, 2017. Again, one of the images Johnny sent to Tony was an original image taken from user T-Sang's pictures folder stored on the computer.
In an ongoing chat with a user named "virginboycollector" (Daddy Kevin) that took place between May 1 and May 16, 2017, the user Johnny sent him some images of children. Virginboy tells Johnny that he is going to a conference in Halifax and Johnny assures him that "theres a lot of pervs there" and offers to find him a Halifax "hook up". Mr. Tsang attended university in Halifax for a number of years. The contents of the Skype chats strongly suggests their author.
In an ongoing chat with user "lilithsboy (Jason)" that being on March 29, 2017 Johnny says that he does art for a living – "sculptural and conceptual things". Mr. Tsang is an artist and works with artists for a living. It should be noted that during this same conversation the user Johnny provides a physical description of himself that does not match that of the accused and I have taken this into account. For example, in a chat with user "srg874 (srg874)" Johnny describes himself as 19 years old – which is not Mr. Tsang's age.
In a chat with user "ruiben40 (ruiben nebiur)" Johnny asks "u play with bois a lot?" One of the subfolders in documents on the tablet found in the accused's possession is a file named "bois". I place some, but very little weight, on this particular fact given the evidence of the officers that this is not uncommon slang in the world of child pornography.
In a chat with user "sendmeanim (tom)" Johnny sends him an image that is taken out of user T-sang's new documents folder, as can be seen from a review of the Skype media cache that is exhibit 1E.
[70] There was some evidence at trial of a possibility that some of the documents in the downloads folder on the tablet could have ended up there when the accused opened certain email attachments. The accused testified that this fact might explain the presence of at least some of his documents ending up in the downloads folder on the tablet, though he was not very specific. Further, Officer Kidd confirmed in cross-examination that though he is not aware of an email application that automatically downloads attachments that are clicked on/ opened, he couldn't say that this was not a possibility just as long as that setting was available on the device in question. Officer Kidd also testified that in his ten years of investigating child pornography cases he has never run across a case where child pornography ended up on a computer without having been placed there by user action. No further evidence was adduced on this point that would show such an application was available on the tablet or pointing to certain emails and attachments that might elevate this suggestion beyond mere speculation and conjecture. I do not accept that this is the explanation for the presence of the documents on the accused's tablet.
[71] Further, anyone can create a Skype account as long as they have an email and phone number. I have taken that fact into account in finding the accused guilty beyond a reasonable doubt. Though it may be that some other persons accessed the tablet from time to time, I do not accept that this was as regular occurrence as the defence witnesses sought to portray it. The mother and Aunt testified that they used the device but could not remember the password. Further, the mother agreed in cross-examination that she has her own computer in her own room. Given how readily accessible the child pornography was on the tablet, it would have been observed by the average user of that tablet and yet the mother and aunt testified that they never saw any child pornography on the tablet. The tablet belongs to the accused, is used by the accused, and he is the one that possessed, accessed and distributed the child pornography from that device. The possibility that someone was, for example, including information in the chats to make it look like it was the accused who engaged in them, when in fact it was not, does not raise a reasonable doubt given the totality of the evidence in this case.
The Alibi Defence and Denials
[72] The Crown bears the burden of proof in this case and that never shifts to the accused. The accused testified and denied any knowledge of the child pornography found on any of the devices seized during the course of the search. Further, he testified to an alibi that is supported by the evidence of his mother and his aunt.
[73] I do not accept the evidence of the accused and nor does it raise a reasonable doubt. I reject the alibi evidence provided by his mother and aunt and their testimony does not give rise to a reasonable doubt either on its own or in conjunction with the testimony of the accused. The Crown has disproved the alibi, and the accused's denials, beyond a reasonable doubt through a very strong circumstantial body of evidence. But there are other reasons why I reject the defence proffered evidence and it does not raise a doubt.
[74] With respect to the accused's testimony, I do not find him to be a credible witness. Some of his evidence simply does not make any sense. For example, he testified that he does not live at his parent's home and only went there on November 16, 2017 because his mother had asked him over for dinner and he wanted to please his mom. However, he arrived well into the early morning hours and long after everyone had gone to bed. He denies that it was him on Skype on May 28 communicating the fact that he had ridden his bike 95 km that day because he had in fact ridden 98 km that day. He testified that he was standing when the police entered the bedroom during the execution of the search warrant and not lying down on the bed with the laptop on him and in this he is contradicted by Officer Jodoin whose evidence I accept.
[75] The accused claims to be unaware of the content of any of these folders and yet a photograph of his driver's license can be found in the down loads file. When asked about this in cross-examination the accused testified that he "possibly took" this photo but had no idea how it ended up in the downloads file. As for the picture of him holding the same driver's license, again he has no idea how that ended up in the downloads folder. That is not credible.
[76] As well, there was an invoice for electrical work done at his office that the accused admitted was emailed to him. That document was found in the downloads folder on the tablet and appears to be work related, contrary to the accused's testimony that he did not use this device for work as it was not powerful enough for that purpose. The accused testified that he does not know how that ended up on the tablet and was not sure if he put it there or not.
[77] As for the GPS maps of bike routes found in the downloads folder, the accused admitted that he had cycled some of those routes, but testified that he had never seen them before and had no idea how they got there. He suggested that some of them might have been emailed to him an automatically downloaded to the file folder, but couldn't say which ones, if any, this ended up in the downloads folder on this basis. In any event, that does not explain all of the documents in that folder, many of which are clearly associated with Mr. Tsang. For example, one of the documents is an invitation to a block party at the Drake. Mr. Tsang testified initially that the Drake is across the street from his studio and he "presumes" it is a restaurant, but that he is unfamiliar with the invitation. He later testified that the Drake is a restaurant and that he has been to it in the past.
[78] Mr. Tsang tried to leave the impression with the court that the tablet was a communal device, and not really his. However, he had to agree that it was gifted to him by his uncle. When he took it in to be refurbished in November of 2016 the customer contact information was his. It was found on his person during the course of the search. Many of his personal documents, including photos of him, are on that device. The device was found on him and in a room that contains at least some of his belongings. His email and phone number is associated with some of the applications, including Skype, found on the device. Child pornography is readily accessible to the average user that would use the device. In short, he possesses the child pornography on that device on the dates alleged in the information. His denial in this regard is rejected and does not raise a reasonable doubt.
[79] As for the testimony of the mother and Aunt, I find their evidence to be problematic and incredible not only due to the strength of the Crowns case but for the following additional reasons. The Aunt testified that at no time did she ever discuss the allegations, or the events of May 28, 2017, with either the accused or his mother (her older sister) following the arrest in November of 2017 to the date of her testimony at trial. The accused did ask her to speak with his lawyer at some point at the end of December of 2018 – some 13 months after the events in question – but according to her he never told her what the lawyer wanted to talk to her about. Then after her meeting with the lawyer, she never discussed the allegations or the events of May 28, 2017 with either the accused or her sister. This seems implausible on its face given what a close family this is and her presence at the time of the arrest. Perhaps she did not discuss the allegations in detail with anyone but for the subject to not have come up seems highly unlikely.
[80] More importantly, on this point, she is directly contradicted by her sister - the accused's mother - who testified that there was a conversation involving all three of them and that both she and her sister right away recalled the events of May 28, 2017. According to the Aunt, she was able to recall that she left Jeremy's studio at 11:10 or 11:15 on May 28, some 13 months later and again without knowing the significance of the date or discussing the matter with her nephew or sister. Both witnesses claim that they were regular users of the tablet but could not recall the passwords (which on its own might be explained by the passage of time) but, at least the mother, had her own computer in the house. I reject the testimony of these two witnesses and their evidence does not raise a doubt either on its own or in conjunction with the other evidence adduced at trial.
[81] It is a reasonable possibility that some other person was masquerading as the accused and downloading child pornography to his laptop and uploading it for third parties on his Skype account? I find that it is not in this case having regard to the totality of the circumstances. Human experience makes it more likely that the person that collected and carefully organized the child pornography on the laptop is the same person that uploaded some of these very same images to the Skype account set up under the accused's name and phone number. The only user account on that computer was in the name of the accused and associated with his email address. He is the one with administrative privileges in terms of what was installed on that computer. The computer had been given to him by an uncle as a gift. He admits to using that tablet on occasion including to access email and the internet. The titles of the files on the computer are very explicit, disturbing and strongly suggestive of child pornography. The nature of the material would be obvious, and readily accessible, to anyone using the tablet. The accused was found in physical possession of the laptop.
Conclusion
[82] For these reasons, I find the accused guilty on all counts in the Information.
Released: July 9, 2019
Signed: "Justice S. Chapman"
Footnotes
[1] It is clear that merely being associated with the Rogers account does not mean that one is a resident of the home.
[2] This video did not contain child pornography and was playing in full screen mode.
[3] Such as "14 y old raped" and "Boy 10 enjoying", etc.
[4] In contrast to a logical copy, a physical copy of the device makes a copy of the hard drive from start to finish. A physical copy of the device was not possible in this case because of encryption.
[5] The back of someone's head, not inconsistent with the accused.
[6] The serial numbers are how Rogers keeps track of its own hardware.
[7] It is best described as a tablet and not a laptop because the keyboard is external.
[8] Exhibit 1 contains child pornography and is therefore subject to a sealing order.
[9] That number may include some duplicates.
[10] Recovered files are those that exist on the operating system in a folder structure but require an extra step or two to locate, for example deleted files or files that may exist in allocated space but need to be reconstructed in order to be seen by the average user. Files are found in "plain sight" – a colloquial rather than forensic term – essentially when they do not require recovery.
[11] Skype identified these particular images as previously known child pornography. The Skype cache shows that johnny actually sent tony 71 images in total over the course of their exchanges, some of which are duplicates.
[12] In terms of dates and times, the time stamps on the extractions are in UTC and there was agreement between the parties that they should be adjusted to local time. For example, the transmission of the photo depicted in slide 25 of the powerpoint was transmitted on May 29 at 2:26:03 a.m. UTC time which is 10:26 p.m. on May 28 eastern standard time.
[13] Intercepted but not prevented from being transmitted.
[14] See Exhibit 4.
[15] See Exhibit 5.
[16] The downloads folder is Exhibit 1F.
[17] The back of someone's head, not inconsistent with the accused.
[18] Such as "14 y old raped" and "Boy 10 enjoying", etc.
[19] Intercepted but not prevented from being transmitted.
[20] See Exhibit 4.
[21] See Exhibit 5.