A non-publication and non-broadcast order in this proceeding has been issued under subsection 486.4(3) of the Criminal Code. This subsection and subsection 486.6(1) of the Criminal Code, which is concerned with the consequence of failure to comply with an order made under subsection 486.4(3), read as follows:

486.4(3) CHILD PORNOGRAPHY — (1) In proceedings in respect of an offence under section 163.1, a judge or justice shall make an order directing that any information that could identify a witness who is under the age of eighteen years, or any person who is the subject of a representation, written material or a recording that constitutes child pornography within the meaning of that section, shall not be published in any document or broadcast or transmitted in any way.

486.6 OFFENCE — (1) Every person who fails to comply with an order made under subsection 486.4(1), (2) or (3) or 486.5(1) or (2) is guilty of an offence punishable on summary conviction.

ONTARIO COURT OF JUSTICE

DATE: 2022-03-09

BETWEEN:

Her Majesty the Queen

— and —

Aleksandr Shaporov

Judgment

J. Stanton ............................................................................................... Counsel for the Crown M. Sciarra ......................................................................................... Counsel for the Defendant

Felix J.:

Table of Contents: R. v. Shaporov

I. Introduction 4 A. The Trial 6 B. The Defence Position 7 C. Decision 8 D. Organization of this Judgment 8 II. Electronic Evidence 10 A. Introduction 10 B. The W2V Website 11

1. The Existence and Purpose of the W2V Website 11
2. TOR Browser 12
3. Accessing and Downloading Child Pornography from W2V 13
4. “Flydaze”, and Various Permutations and Iterations of Same 13
5. “Super2323” 14
6. The W2V Credentials 14
7. Conveying BTC to W2V 15
8. Downloads from W2V 16 C. Coinbase BTC Wallet 17
9. Introduction 17
10. Coinbase Password 17
11. Coinbase Account Creation 18
12. Coinbase – Adding a Payment Card. 18
13. Coinbase Login to Convey BTC 19
14. Conclusion 22 D. The Defendant’s Computer 22
15. Lack of IPA Regarding Downloads 22
16. The Downloaded Files 23
17. Linkfiles and Download Times 23 E. Conclusion – Electronic Evidence 25 III. Roman – Third Party Suspect 26 A. Introduction 26 B. Application Issue – R. v. Grandinetti, 2005 SCC 5 27
18. Crown Position 27
19. Defence Position 27
20. Characterization of the Roman Issue -- Did the Defendant Raise Third Party Suspects? 27
21. Was an Application Required? 28 C. Permissible use of the Defendant’s Statement to the Police 30
22. Introduction 30
23. The Right to Silence 31
24. Impermissible Use of the Statement 31
25. Discreditable Conduct 32 D. Does “Roman the Roommate” Exist? 32 E. The Police Statement and Roman 34 F. Roman and BTC Mining 36 G. The Defendant’s Testimony in Court about Roman 37 H. The Roman Communications 37 I. Conclusion – Roman 38 IV. Deficient Investigation 39 A. Introduction 39 B. Reconstructed Memory and the Defendant’s Travels 40 C. Uber, Esso, the Mechanic, and Pizza 41 D. Possession of the National Bank Credit Card 44 E. Deficient Investigation – Tower Information and SMS Messages 45 F. Deficient Investigation - Roommates 45 G. Deficient Investigation – Roman 46 H. Deficient Investigation – Subway, Canadian Tire, Seneca, Restaurant. 47 I. Access to the Defendant’s Seized Items 48 J. Hacking 48 K. “Drinking Buddies” 49 L. Guests of Roman 49 M. Mercedes Benz Job 49 N. Out of Province Travel 49 O. Conclusion 49 V. Credibility and Reliability of the Defendant 50 A. Demeanour 50 B. Credibility, Reliability, and the Criminal Burden of Proof 51 VI. The Criminal Offences – Knowledge, Possession, and Control 53

I. Introduction

[1] Beginning in 2016, an international group of law-enforcement agencies investigated a child pornography website located in South Korea named Welcome to Video [W2V].

[2] The police investigation primarily involved authorities from the United Kingdom, United States, Germany, and the Republic of South Korea. Ultimately, cooperating law-enforcement agencies conducted arrests of individuals in Australia, Brazil, Canada, Croatia, Finland, France, Hungary, Ireland, Italy, Poland, Saudi Arabia, Spain, Sweden, and the United Arab Emirates.

[3] In the United States of America, the Department of Homeland Security led a diverse group of law enforcement and private industry contractors in the investigation of the W2V website. Investigators discovered that the W2V website was receiving Bitcoin [BTC] as part of the operation. In the United States, specialized Internal Revenue Service investigators took a keen interest in this BTC angle.

[4] On March 5, 2018, the Korean National Police Agency raided the premises where the server for the W2V website was housed. The website was neutralized. The W2V server hard drives were forensically copied and provided to numerous police services around the world to investigate persons who had allegedly accessed the W2V website.

[5] American investigators recognized that many users of W2V had conveyed BTC to a BTC wallet registered to W2V in exchange for access to the website and child exploitation material. The investigators obtained subpoenas for records held by virtual currency exchanges.

[6] As part of the investigation of many individuals, the American investigators took note of one member of W2V who had selected “flydaze” as a username. The American investigators examined records held by Coinbase – a BTC wallet company associated to the user “flydaze”. Based on the Coinbase subpoena results, the American investigators obtained the name, address, cellphone number, internet protocol address, credit card details, and other information, demonstrating that the BTC conveyed to the W2V website was from the defendant - Aleksandr Shaporov. The American investigators conveyed the product of their investigation to the Canadian authorities.

[7] Detective Constable ALEXA [D.C. ALEXA] of the Toronto Police Service was assigned to the case. The Department of Homeland Security conveyed the identifying particulars of the defendant and the product of the investigation so far. D.C. ALEXA examined the actual files downloaded from W2V and determined that four of the five downloaded files met the definition of child pornography in the Criminal Code. He also investigated the residence of the defendant. Finally, he confirmed the details of the BTC transaction, verifying that in fact, a BTC wallet associated to Aleksandr Shaporov conveyed BTC to the W2V website.

[8] The Toronto Police Service executed a search warrant on the defendant’s residence and seized electronic devices. The defendant was arrested. He spoke to Defence counsel. He provided a statement to the police where he chose to speak about some subjects and declined to speak about other subjects.

A. The Trial

[9] The main focus at trial during the prosecution case involved the continuity and admissibility of electronic evidence sourced from the W2V website, the devices seized from the defendant, and the electronic data relevant to the identity of “flydaze”.

[10] The defendant retained special Defence counsel to challenge the seizures from his residence pursuant to s.8 of the Charter of Rights and Freedoms [Charter]. The defendant, as was his right, instructed prior Defence counsel to admit nothing, provide no admissions, and to vigorously challenge the admissibility of electronic evidence.

[11] This provoked a significant response from the prosecution. The Crown Attorney went on to conduct a veritable “Master Class” in how to prove the continuity of electronic evidence, notwithstanding it’s international character. The “Master Class” continued with the prosecution’s meticulous approach to the admissibility of the electronic evidence and technical evidence in a criminal trial. The prosecution response comprehensively addressed every single issue in this regard. During submissions, Defence counsel cited the prosecution’s response and provided no submissions challenging the continuity or admissibility of the electronic evidence record.

[12] The electronic evidence overwhelmingly and convincingly establishes beyond a reasonable doubt that a person using the defendant’s peculiar credentials conveyed BTC to the W2V website, accessed the W2V website, downloaded child pornography movie files to the defendant’s desktop computer, and opened the movie files.

[13] While the electronic evidence solidly documents many facts supporting the identification of the defendant, there is one core area of evidence that deserves preeminent focus.

[14] The W2V resided on the “Dark web”, a place unreachable by conventional web browsers. A TOR-enabled browser, stripping the user of all identifying features in a quest for anonymity, had to be used. A specific URL address had to be inputted. In that remote environment, a person selected the username “flydaze” to create a free account on the W2V website. The prosecution has proven that the defendant held an affinity for this precise username. The defendant’s evidence at trial only confirms this fact.

[15] The W2V website required users to select a password to accompany their username. These passwords were encrypted on the W2V server. The password selected by “flydaze” was also encrypted. American investigators decrypted the password and discovered that “flydaze” selected the password “Super2323”. The prosecution has proven that the defendant commonly utilized this password. Again, the defendant’s evidence at trial confirms this fact.

[16] In addition to the W2V login credentials, the prosecution proved that the five movie files downloaded from the W2V resided on the defendant’s desktop computer hard drive despite it having been reformatted. Further, the files had been opened.

B. The Defence Position

[17] The defendant testified at trial. There are four central components of the defence presented at trial.

[18] First, the defendant expressly denied accessing his Coinbase account, conveying BTC to the W2V website, or downloading child pornography.

[19] Second, the defendant testified that he was not within his residence at the time BTC was conveyed to the W2V website or when child pornography was downloaded.

[20] Third, the defendant testified a third party named Roman – his roommate at the time – was responsible. He also speculated that perhaps his roommate could have admitted guests to the residence they shared, and the guests were responsible.

[21] During submissions, Defence counsel eloquently submitted that a deficient police investigation and “tunnel vision” contributed to reasonable doubt.

C. Decision

[22] Ultimately, this criminal trial is resolved based on issues around identification evidence, the electronic evidence, and the technical record. These issues must be analyzed through the application of the criminal burden of proof as articulated in W.(D). v. The Queen (1991), 63 C.C.C. (3d) 77 (S.C.C.) [W.(D.)], and with the guidance provided by R. v. Villaroman, 2016 SCC 33 [Villaroman], with keen attention to the contours of reasonable doubt.

[23] On Thursday March 3, 2022, I found the defendant guilty of possessing and accessing child pornography. I provided a brief outline of reasons in court and advised the parties that a supplementary written decision would be provided.

[24] I do not believe the defendant’s testimony denying responsibility for having accessed the W2V website and downloading child pornography. It is true that there are more than seven billion people inhabiting planet Earth. While I accept that it could be a possibility that some one else on Earth would use either “flydaze” or “Super2323” as login credentials, the notion that someone other than the defendant would randomly use the combination of the two – both his peculiar username and his encrypted password of choice -- is too fantastic for rational acceptance.

[25] In addition, I reject the implication presented by the defendant’s evidence -- that Roman compromised the defendant’s credentials on at least two separate occasions, on two different dates, for the purpose of surreptitiously downloading child pornography.

[26] The defendant’s evidence does not raise a reasonable doubt on stage two of the W.(D.) analysis. Finally, having considered the guidance of Villaroman, I am not in a state of reasonable doubt nor are there other plausible theories or possibilities which are inconsistent with the defendant’s guilt. The purpose of this supplemental written decision is to more fully explain the findings outlined during the oral decision on March 3, 2022.

D. Organization of this Judgment

[27] There are four central pillars to the Defence case:

[28] First, the defendant expressly denied accessing his Coinbase account, conveying BTC to the W2V website, or downloading child pornography.

[29] Second, the defendant testified that he was not within his residence at these material times.

[30] Third, the defendant testified in support of a theory that his roommate Roman was responsible. He also speculated that perhaps his roommate could have admitted guests to the residence they shared, and the guests were responsible.

[31] Finally, Defence counsel eloquently submitted that a deficient police investigation and “tunnel vision” weakened the circumstantial case presented by the prosecution thereby contributing to reasonable doubt.

[32] The purpose of this written judgment is to explain in detail the findings I have reached and why I reached those findings. My aim is to be responsive to the issues at trial and the submissions of counsel.

[33] First, I will address the admissible electronic evidence record.

[34] Second, I will squarely address why I reject the central premise of the defendant’s testimony – that his roommate Roman was responsible. I will analyse the defendant’s defence and the evidentiary record using the guidance in W.(D.) and Villaroman.

[35] Third, I will address why the submissions suggesting inadequate police investigation have minimal impact on my findings.

[36] Finally, I will summarize the credibility and reliability findings concerning the defendant.

[37] This written judgment is provided as the best means to explain my findings to the defendant, provide public accountability, and provide for appellate review: (See the authorities cited in R. v. G.F., 2021 SCC 20, at para. 108)

II. Electronic Evidence

A. Introduction

[38] The lion share of multiple days of trial focused on continuity and the admissibility of the electronic evidence and technical evidence record.

[39] During submissions, Defence counsel submitted that previous Defence counsel focused on issues around continuity and the admissibility of the technical record. As a result, the Crown “plugged those holes” by presenting a comprehensive record addressing these issues. Defence counsel took the responsible position that given the record adduced by the Crown, the Defence would present no submissions on the issue. Defence counsel invited the court to seize upon any perceived weakness in the record in aide of reasonable doubt.

[40] This court received a significant exposure to the electronic record during the litigation on the s.8 Charter application. Notwithstanding Defence counsel’s concessions concerning continuity and the electronic record, I have re-examined the submissions presented by two prior Defence counsel on the s.8 proceedings [1] and re-canvassed the record a second time using my notes of the evidence and a digital record of the trial.

[41] Front of mind during this endeavour is Defence counsel’s appropriate caution that a trier-of-fact should be cautious and guard against the apparent allure of electronic evidence. While electronic evidence is silent, and presents as objective, I heed Defence counsel’s submission that we are dealing with human beings, and a trier of fact should carefully examine what facts have been established.

[42] I conclude that the prosecution has proven the entire electronic evidence and technical record. Given the appropriate position taken by Defence counsel and the sheer enormity of the electronic evidence record, I decline to comprehensively regurgitate the electronic evidence record in this judgment. Nor will I exhaustively document every single available conclusion provided by the evidence: Welton v. United Lands Corporation Limited, 2020 ONCA 322, at paras. 56-63. I will restrict myself to explaining the factual findings that I rely upon in support the defendant’s guilt.

B. The W2V Website

1. The Existence and Purpose of the W2V Website

[43] There is no question that the W2V website existed and that the purpose of the W2V was to facilitate the distribution of child pornography.

[44] As to the existence of the W2V website, law enforcement persons accessed the website, observed topic contents, the organization of the contents including thumbnails of movies, [2] and even acquired child pornography. South Korean law enforcement seized the servers supporting the W2V website. Forensic examination showed the contents and workings of the W2V website.

[45] As to the purpose of the W2V website, having regard to the electronic evidence, and the viva voce evidence of Jeffrey DANIELS [DANIELS], Christopher MCGUCKIN, Darrell FRANKLIN, and Aaron BICE [BICE], there is no question that the purpose of the website was to facilitate the distribution of child pornography. It is incontrovertible, that this purpose would be apparent to any person accessing the site.

[46] The W2V website provided membership privileges including access to child exploitation material through the acquisition of points funding by the conveyance of BTC or uploading child exploitation material.

[47] Given the evidence provided by DANIELS and FRANKLIN, I am satisfied that persons downloading child exploitation material had the opportunity to see thumbnail pictures of the contents of the material prior to download. Having regard to the evidence of BICE, I am satisfied that the five videos at issue in this case were in fact available on the W2V website. [3]

[48] Homeland Security Investigator FRANKLIN accessed the website on August 31, 2017, September 28, 2017, February 22, 2018, February 23, 2018, February 24, 2018. The child exploitation material was arranged by categories such as “child porn” “boys” or “cellphone videos” byway of example. The children ranged in age from 3 or 4 years old to aged fifteen, sixteen, or seventeen.

[49] Investigator FRANKLIN has a vast experience as an investigator having been involved in perhaps one hundred child exploitation investigations. He has sufficient experience to ascertain age of persons in videos. In addition, he defined what constituted child pornography from his perspective as an American law enforcement agent, I am satisfied that his definition mirrors the Canadian definition of “child pornography”.

[50] It is true that none of the investigators accessed the W2V site on the same day as the downloads in this case. But I am satisfied that the W2V website did not materially change throughout all of the times FRANKLIN attended including the time he visited, 11 days after the downloads at issue in this case.

2. TOR Browser

[51] A TOR enabled browser was required to access the W2V website.

[52] In his statement to the police, the defendant told the police that he had the TOR browser installed. During cross-examination at trial, the defendant suggested that his admission to possessing the TOR browser during his police statement was restricted to the time-frame of his arrest (i.e., not necessarily at the time of the offence).

[53] This was a transparent attempt by the defendant to adjust his evidence in cross-examination because he perceived that it might assist him. I reject this vacillation. The context of the TOR-related discussion in his statement is clearly August 2017. Listening to the defendant being cross-examined on this issue, it was apparent that defendant wished to present some lack of clarity as to the existence of the TOR browser on his desktop computer in August 2017.

[54] The prosecution has proven that the defendant’s desktop had the TOR browser installed. In particular, D.C. Jeff KIDD testified that TOR was installed on the defendant’s desktop computer. [4]

[55] It is also important to note that the electronic evidence in this case establishes that the TOR browser does not allow for an “autofill” function for password insertion on websites. The W2V Darknet website was only accessible via a TOR browser. The person who downloaded child pornography on the defendant’s computer would have had to possess the username “flydaze” and the password “Super2323” as I have explained above. Even if I believed the defendant’s position that Roman must have been responsible (and I do not), there was no way for Roman to use TOR to access W2V website without the defendant’s peculiar username and password.

[56] The Crown insinuates possession of a TOR enabled browser is suggestive of culpability. While there are circumstances where that might be so, I must stipulate that in this case, I do not draw any adverse inference against the defendant based solely on the fact that the defendant possessed a TOR enabled browser. The defendant is a Russian national who lived in Russia. I do not believe that I am engaging in baseless stereotypical reasoning by acknowledging that persons in certain countries commonly use TOR to avoid scrutiny from government oversight.

[57] What remains is the credibility finding that the defendant sought to adjust his testimony, even in the face of his own admission to the police and the definitive evidence provided by D.C. KIDD – that his desktop had the TOR browser installed.

3. Accessing and Downloading Child Pornography from W2V

[58] Amongst the thousands of persons allegedly involved in accessing and downloading child pornography on the W2V website, this case concerns a single user [5] named “flydaze”. [6]

[59] Investigator DANIELS examined the W2V server hard drives and determined that on April 4, 2017, a server backup disclosed a member named “flydaze” with an encrypted password. By December 30, 2017 “flydaze” had accumulated 95 points on the website, used 0.01 BTC, and had downloaded five specific child exploitation videos. [7]

4. “Flydaze”, and Various Permutations and Iterations of Same

[60] The Crown has proven beyond a reasonable doubt that the username “flydaze” was used by the defendant in myriad websites. The defendant’s affinity for all things “flydaze” extended to permutations using the root “flydaze” across several email addresses and usernames.

[61] In addition, in his statement to the police, the defendant initially refused to discuss usernames [8] but later, when asked in a different way, told the police that he used “flydaze” for Facebook and non-TOR websites. [9]

[62] When cross-examined – the defendant broadened this narrow admission to encompass his predilection for using the name “flydaze” in a plethora of electronic locations.

5. “Super2323”

[63] When Homeland Security Investigators first acquired the username “flydaze” there was an associated password, but it was encrypted. Certain means were used to defeat the encryption. As a result, the Crown has proven beyond a reasonable doubt that the unencrypted password for user “flydaze” on the W2V website was “Super2323”.

[64] This is significant because as part of the electronic evidence record adduced in the prosecution case, the Crown also proved that the defendant used password “Super2323” on a transportation application housed on his iPhone. [10]

[65] During direct-examination the defendant acknowledged that he used this password across a number of websites and email accounts. He also volunteered that it was his password on Coinbase subject to his constant refrain accompanying his evidence -- “to the best of my recollection”.

6. The W2V Credentials

[66] As it concerns the issue of identity, the prosecution has proven beyond a reasonable doubt that the combination of “flydaze” and “Super2323” was used by the person accessing the W2V website in this case.

[67] There are more than 7 billion people on Earth. The defendant told the police that the username “flydaze” was the name of a song performed by an American music band. While no evidence has been presented as it concerns the fanbase or popularity of the American band or their song “flydaze”, I may infer that there must exist other persons who are fans of the American band and perhaps even the song “flydaze” – the defendant must not be the only fan. As such, perhaps there are others in the world who could possibly select the username “flydaze” on W2V. Perhaps there are also others in the world who would select the password “Super2323”.

[68] But the notion that a person, other than the defendant, selected his username of choice, and combined it with his password of choice, in joining the W2V website, is implausible. I would require the skills of a mathematician using a probability theory calculus to determine the magnitude of the coincidence that a person, other than the defendant, used his favoured login credentials. No rational, logical, objective person could accept this as mere coincidence.

[69] I reject the defendant’s evidence implicating Roman. Further, his evidence does not raise a reasonable doubt.

[70] The defendant told the police in his statement that he kept his passwords in his head. Even at trial, the defendant’s testimony was that Roman did not have his passwords.

[71] There is no evidence or foundation for a reasonable inference that Roman possessed the login credentials for the W2V website.

7. Conveying BTC to W2V

[72] A significant aspect of the prosecution’s evidence involved proving the time that the defendant’s Coinbase BTC wallet purchased BTC, the time when the defendant’s Coinbase BTC wallet conveyed BTC to the W2V website, and the time when child pornography was downloaded from the W2V website.

[73] Once again, I endorse the submissions of Defence counsel as it concerns any weakness in the electronic evidence record. Notwithstanding the fact that Defence counsel did not challenge the electronic evidence record in submissions, he properly asserted that if there was a weakness, it should be examined by the court to determine if the prosecution has proven the case beyond a reasonable doubt.

[74] The international investigation presented challenges around determining time. It is critical to keep in mind the differences between the usage of Korean Standard Time, Coordinated Universal Time [UTC], and Eastern Standard Time [EST] across the electronic evidence analysis. Furthermore, it is important to keep in mind the application of Eastern Daylight Time [EDT].

[75] Defence counsel’s cross-examination of D.C. ALEXA illuminated the fact that the police investigation perhaps did not explicitly consider the application of the EDT change in August 2017. D.C. Alexa’s evidence on this point was unclear. I may take judicial notice of the notorious fact that in Toronto, Ontario, EDT is observed. I am confident that in August 2017 Toronto was experiencing EDT, contrary to the viva voce evidence of D.C. ALEXA.

[76] A fundamental consideration in a criminal possession case must be a focus on the time frame of possession. An error in time could be a significant feature of a possession case. But, despite the controversy around this issue in the Crown’s case, ultimately, this issue did not contribute to reasonable doubt for several reasons.

[77] First of all, D.C. ALEXA articulated the correct time, he just mislabeled the time as EST rather than EDT. The effect of persuasive cross-examination leading the witness into this error should not be understated. Further, clearly the use of UTC is designed to mitigate the confusion that can result from time zones in technological investigations.

[78] Second, as it concerns the timing of the BTC transfer from the defendant’s Coinbase wallet to the BTC wallet associated to the W2V website, D.C. ALEXA checked the open source Blockchain capture of this transaction thereby verifying that the conveyance occurred on 2017-08-18 15:43.32 UTC which is 11:43 AM EDT in Toronto.

[79] Third, both the Coinbase subpoena evidence and the W2V server observations made by DANIELS corroborate the time.

[80] Finally, as I will more thoroughly explain further on in his judgment when I evaluate the defendant’s evidence, the precise time of the BTC conveyance is not critical as it concerns the defendant’s whereabouts on August 18 and 19, 2017.

8. Downloads from W2V

[81] The precise time of the BTC conveyance or the precise time of the W2V downloads is not critical to my evaluation of the defendant’s evidence.

[82] The defendant’s position is that he was not present within his residence at the time a person logged in to his Coinbase credentials and conveyed BTC was conveyed to the W2V website. Nor was he present when child pornography was downloaded.

[83] First of all, I do not believe the defendant’s evidence based on his lack of reliability and his lack of credibility. But more particularly, given the defendants lack of specificity and precision in his evidence, his reconstructed memory of his movements at the relevant times does not equate to an alibi defence in the sense that he is suggesting that he was engaged elsewhere at the precise time of the BTC conveyance or the precise time of the downloads. Finally, later in this judgment I will specifically address the defendant’s evidence about his movements and explain why I do not believe the evidence, nor does it raise a reasonable doubt.

C. Coinbase BTC Wallet

1. Introduction

[84] Daniel CURTIN [CURTINS], the Director of Global Intelligence for BTC Wallet company Coinbase, attended court in-person and testified. The Crown adduced two large spreadsheets into evidence through this witness comprehensively addressing the activity that occurred on the defendant’s Coinbase account. This information was legally obtained by American law enforcement in the United States. Of particular interest in this trial, the records capture both user inputted information associated to the accountholder as well as activity generated by Coinbase as a result of interaction with the accountholder.

2. Coinbase Password

[85] During direct-examination, the defendant testified that his password to his Coinbase account was “Super2323”. The implication being that Roman could have accessed his password.

[86] I do not believe the defendant’s insinuation that Roman knew this password or accessed his Coinbase account for several reasons.

[87] First of all, while it appears that the defendant used this password on many websites, the defendant testified that this was his password “to the best of my recollection”. This was a ubiquitous caveat to much of the defendant’s evidence and did not inspire confidence in the reliability of the evidence.

[88] Second, when asked about his Coinbase account during his police statement, the defendant told the police “Oh. No. I don’t keep passwords on the computer.” He also told the police “I keep all of the passwords in, well, inside of my head. I don’t use anything to keep my passwords really.”

[89] Third, during his police statement the defendant was asked if he was in the habit of leaving his BTC wallet open on his computer, and he agreed he was not. I would also observe that according to the defendant’s testimony at trial, he did not even use his Coinbase BTC wallet – all the more reason to conclude that it was not left open on his computer in an insecure manner for Roman to surreptitiously access.

[90] Finally, the defendant admitted during his testimony that he never gave his Coinbase password to Roman. In fact, he never provided any passwords to Roman save for a generic password (e.g., 1234) used to access the desktop computer.

3. Coinbase Account Creation

[91] On January 16, 2017, a person created a Coinbase account using the name Alexsandr SHAPOROV, email address flydazeeffort@gmail.com, phone number 647-802-1922, and using the IP address associated to the defendant’s residence.

[92] In order to create an account on Coinbase the defendant would have engaged two-factor security authentication involving communications sent to his Gmail account and his cellphone. He would have had to input an SMS code into the Coinbase website to set up the account.

[93] Coinbase customers may add a payment card to the account to fund the purchase of BTC. The customer must “add” the payment card which involves inputting the card information in the Coinbase website and then “verify” the card before it is used. Verification involves Coinbase charging a nominal amount to the added payment card. The accountholder must obtain this amount from their online payment card website and then input the nominal amount into the Coinbase website.

[94] At the time this account was created, a person attempted to add the defendant’s National Bank credit card but was unsuccessful. Shortly thereafter a person successfully added the defendant’s CIBC credit card.

4. Coinbase – Adding a Payment Card.

[95] In direct-examination, the defendant was adamant that while he had opened a Coinbase account, he never engaged in any activity in relation to the account and specifically, he did not add any payment cards to fund the account at any time. He explained that when Roman moved into his residence in January 2017 he provided the defendant with a list BTC wallets and guided the defendant in this regard.

[96] During cross-examination the defendant acknowledged receiving the two factor communications from Coinbase. He initially maintained his position that he never added any credit card payment cards to his account. As cross-examination went on, he changed his position and ultimately admitted that he added his CIBC card to the Coinbase account. He then expanded his testimony to explain that when Coinbase required a verifying phone number and credit card to purchase cryptocurrency he abandoned the endeavour of verifying the account. The defendant did not address the unsuccessful attempt to add his National Bank credit card during his testimony.

[97] The defendant’s testimony was materially inconsistent on this issue. It is also curious that he did not explain why adding a verified phone number and credit card in his name to purchase cryptocurrency caused him to abandon the endeavour. If it is true that Roman re-ignited his burgeoning interest in BTC and BTC mining, why was adding a credit card in his name a problem?

[98] I am satisfied beyond a reasonable doubt that the defendant set up this account. I am satisfied that he added the CIBC credit card as a payment card but never verified it. I am satisfied that the defendant was well aware of Coinbase two factor security procedures including the fact that multiple communications and procedures were involved.

5. Coinbase Login to Convey BTC

[99] The defendant disavowed any further contact with his Coinbase account after he opened the account in January 2017 until he was cross-examined.

[100] On August 18, 2017, at 11:23 AM EDT an email was sent to the defendant’s email account and a person clicked on the email to acknowledge it confirming and thereby facilitating entry into the defendant’s Coinbase account. Thereafter, an SMS message was sent to the defendant’s iPhone with the two factor confirmation code, and an email was sent to the defendant advising of the sign-in to his Coinbase account. [11]

[101] An attempt was made to add the defendant’s National Bank credit card [12] and the defendant’s CIBC credit card [13] but the attempts failed. The witness from Coinbase explained that this was not unusual, as Coinbase users often had difficulty adding credit cards. At 11:40 EDT the defendant’s Russian card was successfully added to his Coinbase account, and he was authorized to purchase BTC. [14] At 11:43 EDT the defendant’s Coinbase BTC wallet, using the IP address associated to the defendant’s residence, conveyed 0.1 BTC to the BTC address for the W2V website. This transaction took approximately ten minutes to complete.

[102] The defendant implies that Roman must have engaged this purchase. This is not plausible. I am satisfied beyond a reasonable doubt that the defendant performed this transaction for several reasons.

[103] First, while I concede that if the defendant is telling the truth, Roman had access to his desktop computer password (1234), Roman could not have successfully added the defendant’s Russian payment card to the Coinbase account. In order to successfully “add” and “verify” the Russian payment card a person would have required access to the online account for the Russian credit card and input the nominal mount charged to the card in order to verify that the person had access to this payment option. While the defendant chose to speculate during his testimony that Roman could have written down his credit card numbers on a piece of paper, even the defendant’s evidence at it’s highest does not support Roman having online access to his Russian credit card.

[104] During cross-examination the defendant testified that he did not provide any passwords to Roman other than the generic password to access the desktop computer itself. There is no evidence that Roman had access to the defendant’s Russian payment option and no foundation to draw a reasonable inference that this was a possibility.

[105] Second, the defendant received at least six emails, one SMS text message, and charges to his Russian credit card that had to be confirmed. When cross-examined on the fact that the defendant must have noticed these communications, the defendant testified that he could not recall any of these communications and speculated that perhaps all of the email messages went into his junk folder. I do not believe the defendant’s testimony. His credibility was harmed by his evidence that he never received or could not recall receiving any of the flurry of emails and SMS messages associated with Coinbase login and BTC transaction. The defendant was notified by email and SMS message as his account was logged into. Multiple emails were sent to the defendant as BTC was purchased and conveyed to the W2V website documenting each step of the process.

[106] Third, it is not as if the defendant was receiving regular communications from Coinbase associated with frequent use so that I might infer that these communications were just “trees in the forest” of communications. These communications should have stood out as unusual.

[107] Fourth, the defendant received the authentication communications when he set up the account in January 2017. His email and cellphone number had not changed. Surely he received the messages in August 2017 as well.

[108] Fifth, when I consider the guidance of Villaroman on circumstantial evidence, I note the absence of evidence about the Russian payment card. The police did not obtain judicial authorization to seize the records associated with the defendant’s Russian credit card. But I also recognize that while there is no onus on the defendant, he voluntarily testified that he had access to the online accounts of all of his credit cards. He did not produce a Russian payment card statement suggesting that the Coinbase process failed.

[109] Sixth, during cross-examination on some basic features of Coinbase two factor identification process in 2017, the defendant was extremely sensitive to this area of questioning. He constantly couched his answers with caveats. He would not even acknowledge the two-factor identification process until the cross-examiner appropriately admonished him that the evidence had been presented in court just the day prior. Then, and only then, was the defendant willing to acknowledge the Coinbase two-factor authentication procedures.

[110] Finally, the person engaged in this transaction had all three of the defendant’s credit cards as they were inputted into the Coinbase account. The likelihood that the defendant left his National Bank credit card next to his desktop computer while he was supposedly out of the residence using the card to charge at Subway, Canadian Tire, a restaurant, and a parking lot is remote. When confronted during cross-examination on this issue the defendant’s credibility was not assisted by his malleable speculation that perhaps he used Apple Pay (i.e., his phone rather than the physical card).

[111] The Coinbase evidence documents the identify of the BTC conveyer (the defendant), the hash value associated with the transfer, and the fact that the W2V BTC address received the conveyance. [15]

6. Conclusion

[112] As to the circumstantial evidence of identity, I am satisfied beyond a reasonable doubt that the defendant opened the Coinbase account and that it was he who used that account to convey BTC to the W2V website.

D. The Defendant’s Computer

1. Lack of IPA Regarding Downloads

[113] Defence counsel made no submissions challenging the admissibility of the electronic evidence but cautioned the court that if there were any weaknesses in the evidence that might inure to the benefit of the defendant, the court should address that evidence.

[114] There is no evidence of the IPA address associated with the download of the child pornography from the W2V website. This evidence is commonly available in child exploitation cases. It is notably absent in this case.

[115] Having considered the issue in the context of the totality of the electronic evidence record, I conclude that this is not a weakness in the prosecution case or a source of reasonable doubt for several reasons.

[116] The first reason concerns the username and login information used to access W2V. As I have outlined above, the W2V login credentials were peculiar to the defendant.

[117] Second, the Crown has proven beyond a reasonable doubt that the defendant conveyed BTC to the W2V website.

[118] Third, the TOR browser does not disclose an IPA when traversing the electronic world including the Dark Web.

[119] Fourth, the W2V website was an inherently illegal entity, and the server did not retain IPA information.

[120] Given the totality of the admissible electronic evidence record showing “flydaze” was the member who downloaded the files, the fact that the prosecution proved the downloads occurred, and the defendant’s desktop contained evidence of the prior existence of four of the five files available on the W2V website, I have no hesitation in finding that the downloads occurred despite there being no evidence of the IPA associated with the downloads.

2. The Downloaded Files

[121] The defendant had control over the desktop computer, MacBook Pro, iPad, and iPhone seized and forensically investigated by the Toronto Police Service.

[122] The desktop computer containing two hard drives was the central focus of the investigation given the evidence of the downloaded child pornography from W2V in unallocated space.

[123] There was only one user-generated account on the desktop computer – “flyda”. The files were located on the hard drive in a folder under username “flyda”. These files were in existence on the defendant’s hard drive [16] prior to the hard drive being reformatted. Even after the hard drive was reformatted, metadata associated with the files was still accessible by way of forensic examination. [17]

[124] The Crown has proven that the five downloaded files [18] that existed on the defendant’s desktop hard drive shared the exact same file attributes [19] as the files that existed on the W2V server. [20]

3. Linkfiles and Download Times

[125] Defence counsel’s submitted caution around technical evidence is front of mind as I evaluated the evidence concerning the timeframe of downloads. Earlier in this judgment I outlined some potential confusion caused by the difference in time zones. As such, keen attention to the details around the downloads was important.

[126] If there is any confusion in the electronic evidence associated with the computation of time zones, the evidentiary record was amplified by the forensic examination of the defendant’s desktop computer and the evidence of DANIELS about the server-side workings of the W2V website. As it concerned the defendant’s hard drive, D.C. KIDD’s evidence about linkfiles was also highly probative on the issues of proving the downloads and possession.

[127] D.C. KIDD testified that linkfiles are unique files created by the Microsoft operating system automatically when files are opened. D.C. KIDD was definitive and clear -- that the only way for the system to create linkfiles is for the user to click on the file and open it.

[128] D.C. KIDD explained that the linkfile itself contains valuable forensic information including the time and date the file was created, [21] the location of the file (i.e., external medio or fixed hard drive), the volume serial number, a unique net bios identifier, a Mac address akin to a serial number for a part of the computer, and the file size in bytes.

[129] D.C. KIDD testified that the child pornography files from W2V were in fact present on the defendant’s desktop hard drive. The filename pathway was C:Users\flyda\desktop\po. It is clear that the file attributes associated with the W2V files matched the files on the defendant’s desktop hard drive. While it was true that the hard drive had been re-formatted, this merely re-indexed the contents. By the time of the forensic examination by D.C. KIDD, the linkfiles associated with the child pornography files remained.

[130] It is also clear, courtesy of the linkfile evidence, that someone clicked on each file thereby “opening” the file. D.C. KIDD was definitive that the create time for the linkfiles evidence the downloaded file had completed downloading and a user had clicked on the file. The evidence shows that the download times began on August 19, 2017, at 21:33:15 UTC until 21:40 UTC. [22] Having regard for EDT this would mean from approximately 5:33 PM until 5:40 PM Toronto time.

[131] This is the central relevant factual conclusion as it concerns the issue of possession and accessing child pornography – the criminal offences before the court. The child pornography files were in fact on the defendant’s hard drive based on the unchallenged expert opinion evidence of D.C. KIDD. Furthermore, I accept D.C. KIDD’s opinion evidence that the presence of linkfiles created on the defendant’s desktop hard drive is singularly associated with the action of having opened each downloaded child pornography file.

[132] D.C. KIDD could not forensically tell when precisely the child pornography files had been deleted. This might have been a key issue had the defendant testified that he clicked on a downloaded file by accident or that he did not possess the mental intent to possess child pornography and he deleted the files at the first opportunity after download. But the defendant did not so testify.

[133] Lastly, my confidence in this evidence is bolstered by the evidence of DANIELS who independently forensically examined the W2V server. There was no suggestion at trial that these two experts worked cooperatively on this investigation. [23] That they arrive at the same conclusions around the download of child pornography files -- one having examined the W2V server, and one having examined the defendant’s hard drive -- lends strength to the certainty of the electronic evidence record.

E. Conclusion – Electronic Evidence

[134] The criminal burden of proof is not compared to pieces of evidence in a case in a piecemeal fashion. A trier-of-fact must examine the case as a whole and apply the criminal burden of proof to the entire record.

[135] The electronic record is circumstantial evidence of the identity of the person who conveyed BTC to W2V and downloaded child pornography. As this is an essential element of the offences before the court, it is appropriate to consider the criminal standard of proof beyond a reasonable doubt as applied to the issue of identity.

[136] The record outlined in this judgment definitively and persuasively establishes that the defendant is the person who set up the “flydaze” account on W2V, conveyed BTC, and downloaded child pornography.

[137] I do not believe the defendant’s denial or his attempt to implicate Roman. But simple rejection of the defendant’s evidence is not enough in a criminal trial. I must also consider stage two of W.(D.) and the guidance in Villaroman.

III. Roman – Third Party Suspect

A. Introduction

[138] During examination-in-chief the defendant testified that he was not home at the time the downloads occurred, he did not download child pornography, he never visited the W2V website, he never transferred BTC to the W2V website, and he was not aware of any child pornography being downloaded to his computer.

[139] The defendant went on to testify that he had a roommate named Roman, [24] and that he was at home on the date and time of both the BTC conveyance and the downloaded child pornography.

[140] The defendant testified that Roman had knowledge about BTC. The defendant testified that he shared his desktop computer with Roman for the purposes of setting up a BTC mining operation. Further, he testified that Roman had the password for the desktop as they had jointly created an easy password (i.e., 1,2,3,4,) to facilitate their joint venture. Finally, during cross-examination on this issue, the defendant testified that he was not “pointing the finger” at Roman as it was also possible that Roman had admitted other unknown persons into the defendant’s condominium, and that others were responsible.

[141] The defendant was an unreliable witness. While I would not necessarily fault the defendant for some reliability issues given the timespan between the criminal offences and his arrest, he was also starkly incredible as it concerns his testimony in several areas. Finally, while demeanour evidence is of limited assistance in a criminal trial, the defendant’s performance as a witness did not assist in the credibility assessment.

[142] I do not believe the defendant’s evidence about Roman.

[143] I do not harbour a reasonable doubt based on the evidentiary record at trial.

[144] There are many reasons for these findings.

B. Application Issue – [R. v. Grandinetti, 2005 SCC 5](https://www.canlii.org/en/ca/scc/doc/2005/2005scc5/2005scc5.html)

1. Crown Position

[145] The defendant’s testimony about Roman was characterized by the Crown Attorney as the invocation of third party suspects – both known (Roman) and unknown (the speculation about Roman’s admitting other persons who were potentially responsible). The Crown position is that the defendant’s invocation of other suspects clearly mandated a pre-trial application: R. v. Grandinetti, 2005 SCC 5. The Crown submits that given this issue arose for the first time during cross-examination, the appropriate remedy is an adverse inference.

[146] Implicit in the Crown complaint is that the timing of the issue – arising for the first time during the defendant’s examination in chief – prejudiced the prosecution case. An application would have afforded the Crown an opportunity to investigate the claim that Roman was responsible. The Crown demonstrated a willingness and ability to present an international cast of witnesses in this case. I am aware that an investigation might have even produced Roman as a witness at trial.

2. Defence Position

[147] Defence counsel submitted that his cross-examination of D.C. ALEXA in December 2021 provided sufficient notice that the deficient police investigation of roommates was in issue. As such, given the Defence was entitled to point to a deficient police investigation of roommates, no formal application was required. Defence counsel argued that given the Defence was entitled to point to a deficient police investigation of Roman in defence of the allegations, this did not invoke the third party suspects application requirement.

3. Characterization of the Roman Issue -- Did the Defendant Raise Third Party Suspects?

[148] At trial, the defendant never explicitly testified that Roman committed the child pornography offences. Cloaked with a veneer of objectivity, the defendant reasoned that given he was not home at the time, Roman (and or others) must have been responsible.

[149] In sum, [25] the central testimonial defence was (i) the defendant was not at home at the time of the downloads; (2) the defendant did not personally download any child pornography; (3) Roman was at home at the relevant time;(4) Roman had the password to the defendant’s desktop computer; and (5) Roman had more knowledge about BTC than the defendant (relevant to the conveyance of BTC to W2V).

[150] There is no question that the defendant “pointed the finger” at Roman. He testified that Roman was the only person with possession and control of his computer at the time of the downloads. He speculated that Roman could also have let in a guest who was responsible. That the defendant refused to explicitly utter the words – “Roman did it” is not important. The defendant neatly and clearly implied that Roman was responsible and speculated that Roman could have admitted other unknown persons. In my view, on the circumstances in this case, this is a clear invocation of third party suspect Roman.

4. Was an Application Required?

[151] The Crown is on solid footing to submit that a pre-trial application was required: Grandinetti. I need not explore the preconditions associated with adducing evidence of third party suspects – none were met in this case. The Defence did not adduce a single piece of evidence concerning Roman let alone evidence directed at his responsibility for the offences. In fact, the defendant testified (albeit in cross-examination) that Roman never displayed any interest in child pornography and never exposed him to any child pornography.

[152] It may be that the Crown is absolutely correct. Whatever the Defence position on a deficient police investigation, the invocation of third party suspects required an application. But after careful analysis, on the unique facts in this case, I respectfully decline to draw an adverse inference against the defendant sourced in the failure to bring an application. There are several reasons for this finding.

[153] First, this is not a jury trial. Any prejudice against the prosecution was not cast amongst a jury with potentially exponential effect. While I in no way dimmish the application requirements, I can easily balance any prejudice to the prosecution. In this case there was very little prejudice to the prosecution’s conduct of the case.

[154] Second, the Crown did not seek an adjournment to investigate Roman and secure reply evidence. I do not criticize this tactical decision. It may be that the Crown Attorney simply decided that litigation on the record at trial was sufficient.

[155] I am mindful that the Crown Attorney and Defence counsel have possession of the disclosure brief and a criminal trial judge is privy only to the admissible record adduced at trial. Based on the record adduced by the parties, I note that there was not a whisper of Roman throughout the prosecution case. Across all of the terabytes of data and seized evidence, there is but one slender reference to a “Roman”. Or perhaps the Crown Attorney merely recognized that defendant never mentioned Roman in his police statement. An issue I will address in detail below.

[156] I also consider that the Crown Attorney may have simply determined that it would have been difficult to find Roman so an adjournment for this purpose would simply delay the trial.

[157] Finally, as it concerns the identification of Roman, I am positive it was not lost on both Defence counsel and the Crown Attorney that the defendant did not even spell Roman’s last name correctly until his memory was refreshed during cross-examination. I was curious about the defendant’s spelling of Roman’s name and even asked the defendant to repeat the spelling during his direct-examination.

[158] There are additional reasons for my decision not to visit an adverse inference upon the defendant. I am entitled to rely upon Defence counsel as an officer of the court and a professional. Defence counsel’s professional opinion was that a pre-trial application was not required, and his cross-examination provided sufficient notice. I take Defence counsel’s submission in good faith.

[159] Further, Defence counsel is owed some latitude. Defence counsel came onto this case after it was commenced by another Defence counsel. I have no hesitation in finding that the circumstances would be challenging as new Defence counsel acquired a command of not only the disclosure brief, but the record of the proceedings. It is possible that the issue of a pre-trial application would have been addressed by current Defence counsel had he been on the case from the beginning. It is also possible that the issue of a pre-trial application was canvassed and rejected by prior Defence counsel. Finally, it is also at least possible that the defendant’s testimony pointing to Roman was a revelation for Defence counsel or aroused Defence counsel’s ethical obligations. [26] Were this the case, of course, Defence counsel could not professionally or ethically so advise the court.

[160] Finally, while not relied upon by Defence counsel during submissions, I find there is some appellate support for his conception of the proper approach in this case: R v. Gauthier, 2021 ONCA 216, at paras. 41 to 51.

C. Permissible use of the Defendant’s Statement to the Police

1. Introduction

[161] Upon his arrest, the defendant spoke with legal counsel. Thereafter, he provided a video statement to the police.

[162] The admissibility of this statement was initially challenged as involuntary and violative of s.8 of the Charter. Ultimately, the challenge was not maintained, and the statement was conceded as voluntary.

[163] The defendant had spoken to a lawyer and clearly understood that he did not have to speak to the police. Nevertheless, the police cautioned him that he did not have to answer any questions.

[164] The defendant had never been in trouble before. I accept his testimony at trial that notwithstanding the objective presentation of the statement, he was scared and intimidated by the circumstances. Notwithstanding this understandable state of mind, the conversation between the defendant and the police was friendly, as much as a police interrogation can be “friendly”. There were a few jokes. The police did not raise their voices. The police did not pressure the defendant in any way.

[165] The defendant’s will was not subverted in any way.

[166] The defendant posed questions for the police. The police answered every question asked. The police posed questions to the defendant. The defendant chose to answer some questions and respectfully declined to answer other questions.

2. The Right to Silence

[167] The defendant agreed to discuss some issues with the police such as his family background, educational pursuits, employment pursuits, differences between Russian society and Canadian society, his email address flydazeeffort@gmail.com, his phone number, [27] that he paid for his own internet, the identity of his internet provider, BTC mining, that he keeps his online passwords in his head, and that he had no earthly interest in child pornography. [28]

[168] The defendant also exercised his right to silence and chose not to speak about other issues such as his place of employment, the password for his iPhone, [29] usernames, [30] whether he rents or owns the search warrant premises, [31] where he goes on TOR (except specifies certain “legal” places he will visit), [32] whether he has a BTC wallet, [33] the subject of BTC exchanges, [34] and passwords to investigate his claim that hackers may be responsible for the child pornography on his computer. [35] The defendant’s expressed wish not to speak about these subjects was respected by the police interrogators. [36]

[169] It is critically important to clearly acknowledge that the defendant is entitled to the protection of the right to silence even when he choses to speak about some subjects and not others: R. v. J.S., 2018 ONCA 39.

[170] Clearly, the defendant was able to apply the legal advice he presumably received and made his own decisions as to topics of discussion.

3. Impermissible Use of the Statement

[171] The statement to the police was not edited in any way. During the interview with the defendant there were certain themes enlisted by the police. One theme was to ask the defendant to explain how the evidence was inconsistent with his guilt. I have self-instructed as it concerns the criminal burden of proof and ignored these areas of questioning.

4. Discreditable Conduct

[172] During the defendant’s statement he provided, objectively speaking, an odd response to a question about whether he had observed child pornography before. This response involved the defendant volunteering information about his exposure to other online content. [37] During cross-examination, the defendant denied exposure to the other online content. The Crown Attorney sought to cross-examine the defendant about this issue arguing that a pre-trial application to adduce discreditable conduct could not have been anticipated. Defence counsel submitted the issue was irrelevant and inadmissible.

[173] For the purposes of this judgment, the particulars around this evidence need not be explored. Suffice it to say, it relates to highly prejudicial un-charged conduct on the part of the defendant. I find that it engaged legal considerations around the admissibility of other discreditable conduct. I do not criticize the Crown Attorney or Police for failing to edit the statement to remove the reference to the subject matter because it was comingled with relevant and admissible discussion about child pornography.

[174] As the Crown was in mid-cross examination, the cross-examination on this issue was received on a voir dire subject to further argument from counsel at the end of the trial.

[175] While it might be true that the defendant was not forthright about this issue, in the end, I agree with Defence counsel’s submissions on this issue and I hereby rule the evidence inadmissible. [38] The prejudicial effect associated with admission of this evidence at trial is outweighed by the probative value of demonstrating that the defendant did not tell the truth about a peripheral issue. I disabuse my mind of the issue.

D. Does “Roman the Roommate” Exist?

[176] The defendant testified that Roman was his roommate for more than a year – from fall 2016 until the end of October 2017. He also testified that “he believed” that the building management received notice that Roman was a tenant and that “he believed” that Roman was on the marquee directory.

[177] My preliminary focus is to examine the evidence as it concerns Roman given his prominence in the defendant’s evidence implicating him in the criminal offences before the court.

[178] First, I observe that there is no objective evidence establishing that Roman was the defendant’s roommate in August 2017 or at any other time.

[179] Second, for a person who apparently lived with the defendant for approximately a year, Roman has an ephemeral quality. There is not a scrap of objective evidence showing any connection between Roman and the defendant’s condo. No lease, no contract agreement, not a piece of paper, no personal objects, no photographs. Given the unkempt state of the defendant’s condo, (something the defendant testified was in existence in August 2017), it is perhaps surprising that there is nothing supporting Roman’s residency.

[180] Third, it is interesting that the defendant testified that Roman’s roommate status warranted notifying the building management, yet there is no written document (informal or otherwise) memorializing the roommate agreement. It is also clear that the defendant, while visibly reluctant provide the information at first, ultimately testified that his condo was owned by his mother. Even more reason for any available documentation to be available. Or, in the circumstance of a less formal arrangement involving the defendant given the landlord was the defendant’s mother, I note the absence corroborating viva voce evidence. [39] Whatever the arrangement, the defendant’s evidence that the building management received notice that Roman was living in the unit is self-serving.

[181] Fourth, the exploration of objective evidence to support the existence of Roman as a roommate must consider the context of the admissible electronic evidence. The electronic and technical evidence robustly implicates the defendant in the offences before the court as set out in this judgment. What is glaringly absent from the electronic record is any electronic evidence concerning Roman.

[182] Having regard to the vast expanse of electronic evidence adduced at trial, there was not a spec of evidence even supporting the existence of Roman during the prosecution case. At the end of the defendant’s examination-in-chief, there was no objective evidence supporting the existence of Roman. It was only during cross-examination that emails from a Roman were adduced. Nothing in the emails supports Roman’s residency.

[183] While the defendant does not have an onus in a criminal trial, I may assess the state of the evidentiary record as it concerns issues of credibility. This is a credibility consideration about the defendant’s assertion that Roman was his roommate and that Roman was likely responsible for the crime.

[184] The defendant never told the police about Roman, so I do not fault the police for failing to acquire evidence of Roman. The defendant possessed this peculiar knowledge of Roman’s alleged involvement in 2019,2020,2021, and 2022. A trial judge is entitled to use common sense when evaluating the credibility of a witness. This is not reversing the burden of proof. I am simply recognizing that the defendant had the peculiar capacity to place information about Roman before the court. Yet the objective evidence supporting the existence of Roman was adduced into evidence by the Crown Attorney during cross-examination. And even that evidence does not support the defendant’s position that he was a roommate.

[185] The defendant’s viva voce evidence in support of the existence of Roman and his status as a roommate has a flimsy foundation. But I should not draw an adverse inference or refuse to analyse the main pillar of the Defence case. The prosecution has not established that the defendant fabricated this evidence on the stand.

[186] For the purpose of analyzing the defendant’s evidence, I will assume that Roman actually existed and was in fact the defendant’s roommate for approximately one year.

E. The Police Statement and Roman

[187] No defendant is compelled to testify at a criminal trial. Further, it was the defendant’s choice to testify implicating Roman during his examination in chief. Strictly as it concerns the defendant’s credibility, it is notable that he had many opportunities to mention Roman during his police statement and did not do so.

[188] During the defendant’s interview the police provided an overview of the evidence they possessed incriminating the defendant. The police also made it clear that they were dealing with child pornography accessed from the defendant’s residence in August 2017 – specifically August 17, 2017. [40] During the interview the police asked the defendant about roommates during this time period to which the defendant answered:

A. “In the search warrant sheet showed me the date of 2017 August and I don’t remember what I was doing in August 2017, especially something related to the topic of our conversation. Yah I don’t remember.” [41]

Q. Did you have anybody who lives with you, who lived with you at that time?

A. At the time of 2017? [Sigh] [pause], I had roommates before, like you remember I told you about a girl living as my roommate and before her I had roommates, but I don’t think someone used to live there. Not at that time. [42]

[189] During cross-examination, the defendant agreed that the above-noted portion of his statement referred to a prior conversation with D.C. ALEXA that was not on video. During that conversation. he told the police about certain female roommates and the police asked him further questions about those roommates. The defendant also agreed, albeit under intense cross-examination, that he told the police that he did not have any roommates in August 2017.

[190] During cross-examination the defendant on two clear occasions while discussing the subject matter of roommates during his statement, he never mentioned Roman. This was exceedingly fair on the part of the Crown Attorney. In fact, there were half a dozen occasions during the statement where the police drew the defendant’s attention to the August 2017 timeframe and access to his electronic devices. Rather than discuss Roman the roommate at these junctures, the defendant engaged the police with myriad nihilistic speculative possibilities such as “hackers” or “drinking buddies”. [43] The defendant engaged the police in rhetorical questions. For example:

Q. Why would you download child pornography?

A. That is a topic for a bigger conversation, and I would not like to speak about it right now. I have to ask myself, did I at all in August 2017? Do I? Did I do it? Was it me? Was it done on my computer? Was it done on my computer by somebody or was it someone using my computer through some sort of virus to mislead? I have seen real stories of hackers and how they do it. They mislead the police so good. [44]

[191] In these endeavours, the defendant presented as exerting great effort, struggling to recall the time-frame in question, physically straining and demonstrating his effort at recalling the circumstances.

[192] The defendant’s pre-trial silence about Roman can not be used as a “brick” in support of the prosecution’s “house of guilt”. But I am permitted to consider the inconsistent versions of events provided by the defendant at trial as compared to his police statement including material omissions as it concerns the assessment of his credibility: (See the instructive guidance provided in R. v. Kiss, 2018 ONCA 184, at paras. 35-50 including the cases highlighted therein; R. v. J.S., 2018 ONCA 39, at pars 55-56; R. v. McNeill, [2000] O.J. No 1357 (C.A.)).

[193] The adverse credibility consideration in this area of the evidence is not founded upon the extraneous speculative thought presented by the defendant as his effort in searching for truth, it is that all of this occurred without Roman, the central figure responsible, coming to mind.

F. Roman and BTC Mining

[194] The central premise advanced by the defendant is that he shared access to his desktop computer with Roman in furtherance of their developing BTC venture. According to the defendant, it was Roman who was the “expert” possessing BTC knowledge and experience. The defendant testified that his involvement was limited to supplying the desktop computer and a bit of financial capital.

[195] While it is clear that portions of one of the hard drives attached to the desktop computer had been overwritten, it is still notable that the forensic evidence does not disclose a single byte of evidence demonstrating a connection between Roman and the desktop computer. For someone who lived with the defendant for more than a year, and according to the defendant shared access to the desktop computer, it is remarkable that there is not a single item attributable to Roman. The only user on the desktop computer was the defendant. [45]

[196] What about the BTC venture involving Roman as a mentor? Nothing. There is no evidence of even the preliminary efforts on the part of Roman and the defendant to set up this venture. The defendant testified that ultimately the BTC project never flourished with Roman. So, despite this apparent interest, and the fact that Roman apparently lived with the defendant for many months, their mutual efforts produced no result.

[197] If Roman was the “brains” why is he a ghost in the electronic record of the desktop computer? If the BTC project was abandoned so quickly, why did Roman apparently still have access to the defendant’s computer in August 2017? The answers to these questions do not provoke reasonable doubt.

[198] Finally, it is also notable that the forensic evidence discloses only the defendant associated with BTC wallets (Coinbase and Paxful). There is no evidence of Roman the “BTC expert” having a BTC wallet.

G. The Defendant’s Testimony in Court about Roman

[199] The defendant testified in examination in chief that he did not tell the police about Roman because it did not occur to him. He was terrified during the police interview and neglected to mention Roman. He also neglected to mention a trip to New York as well.

[200] During cross-examination the defendant testified that he did not tell the police about Roman because “he did not want to get anyone else involved”. Leaving the manifest inconsistency aside for the moment, there is good reason to disbelieve the defendant’s evidence that he forgot about Roman – evidence of communications from Roman.

H. The Roman Communications

[201] During cross-examination the Crown Attorney confronted the defendant with a record of email communications from a “Roman” to the defendant. The defendant testified that he did not recall the emails from Roman. He further claimed that he had no recollection of Roman sending him money on the dates disclosed in the email correspondence.

[202] The defendant was clearly unnerved by this evidence. He physically squirmed and stammered as the Crown Attorney cross-examined him in this area. He was argumentative with the Crown (e.g., his quarrel over the use of the word “transaction”). The defendant’s memory was often refreshed by Defence counsel during direct-examination using such evidence, in fact, Defence counsel used a different portion of the same extraction report during examination-in-chief without complaint from the defendant. But in cross-examination, the extraction did not assist the defendant with his memory.

[203] The extraction report was illuminating.

[204] First, apart from the defendant’s testimonial reaction, it was also interesting that he used the report to correct himself on the spelling of Roman’s last name – something he incorrectly provided during his earlier testimony.

[205] But more important was the content of the extraction report. It documented a series of emails concerning interact money transfers from Roman to the defendant. The last email from Roman is one month prior to the defendant’s arrest.

[206] I do not believe that the defendant simply forgot about Roman during his police interview. The series of emails including one a month prior to his arrest should have made Roman top of mind.

[207] Finally, during examination in chief the defendant was crystal clear that he had no further communication with Roman after the first week of November 2017. This evidence and cross-examination rendered that testimony manifestly untrue. A realization that I am confident dawned on the defendant as the Crown Attorney kept probing on the issue.

I. Conclusion – Roman

[208] I am certain that there are many Romans in the world. It might even be true that the defendant had a friend named Roman. But I reject the defendant’s evidence about Roman insofar as it is being suggested that he was a roommate and responsible for the criminal offences before the court.

[209] The defendant never mentioned Roman in his statement to the police. I do not believe either of the conflicting explanations provided by the defendant for why this occurred. Furthermore, it is clear that a person named Roman was communicating with the defendant one month prior to his arrest.

[210] I do not believe that the defendant forgot about Roman due to the pressure of the circumstances. I do not believe that the defendant did not mention Roman because he did not want to get anyone else involved (thereby implying he did in fact turn his mind to Roman but positively declined to mention him). The defendant could not even keep his story straight throughout his testimony.

[211] There is no objective evidence supporting Roman’s status as a roommate. There is nothing in the electronic record supporting Roman’s status as a roommate. I decline to rely upon the defendant’s viva voce evidence alone in support of the position that Roman was a roommate, let alone responsible for the criminal offences before the court, based on my assessment of the defendant’s credibility and reliability.

IV. Deficient Investigation

A. Introduction

[212] Having addressed the credibility and reliability of the defendant as it concerns a central pillar of the defence – Roman, I now turn to the analysis of a collection of other trial issues.

[213] During submissions, Defence counsel comingled several trial issues with the assertion that the police suffered from “tunnel-vision” and failed to properly investigate the circumstances. In addition, Defence counsel persuasively argued that the deficiencies in the police investigation were an important consideration both as it concerns a fair evaluation of the reliability of the defendant’s evidence that he was not at home during the timeframe of the child pornography downloads, and the notion of reasonable doubt.

[214] As I have set out earlier in this judgment, the defendant bears no burden in a criminal trial. The defendant is entitled to point to an alleged deficient police investigation in combination with other issues and argue that there is reasonable doubt.

[215] While I do not find the defendant to be credible or reliable, I agree with Defence counsel that these issues must be addressed insofar as they are relevant to stage two of W.(D.) and the considerations under Villaroman given the circumstantial case presented by the Crown.

[216] Having self-directed in this manner, while some of the submissions provided by Defence counsel are persuasive, in the end, on the analysis mandated by W.(D.) and Villaroman, I am satisfied beyond a reasonable doubt of the defendant’s guilt. I will explain my reasoning based on a number of factors set out below.

B. Reconstructed Memory and the Defendant’s Travels

[217] Ancillary to the defendant’s testimony about Roman, he testified that he was not home at the time his Coinbase wallet conveyed BTC to the W2V website or at the time child pornography was downloaded to his desktop computer. The defendant testified that he was elsewhere at these relevant times.

[218] The defendant used charges on his National Bank credit card statement to assist his memory with his whereabouts at the relevant times on August 18, 2017. He testified that he went to Subway to get breakfast at 8:00 AM, then to Canadian Tire to purchase a knapsack for a trip, then to Seneca for school, and finally, a restaurant on Steeles avenue in Toronto. [46] Much of these being consistent with his ordinary custom or habit.

[219] As for August the 19 during the timeframe of the child pornography downloads, the defendant relied upon an UBER record in support of his evidence that he was dropping off his car at his mechanic in Concord Ontario.

[220] I accept the defendant’s testimony that he did not necessarily have an independent recollection of his movements on August 18 and August 19, 2017. The defendant explained that he was doing his best to track his movements based on reasonable inferences from the charges listed on the National Bank statement and his normal routine or pattern of behaviour.

[221] This was an area of the defendant’s evidence that was logical and made common sense. I accept the defendant’s general premise that but for the record, he would have had difficulty reconstructing his whereabouts. This is a credible explanation for the lack of reliability in the defendant’s evidence given the gap in time between August 2017, the arrest of the defendant in 2019, and trial in 2022.

[222] But it is the defendant’s lack of credibility, not simply his explained lack of reliability, that impacts the weight I assign to his evidence.

[223] There are further reasons why this body of evidence does not raise a doubt in my mind.

[224] First, none of the travels described by the defendant were adduced as formal alibi. The travels described by the defendant, even if I accepted his evidence, would not conflict with the timeframe of the BTC conveyance from his Coinbase account to the W2V website, the time of the downloaded child pornography to his desktop computer, or the time those files were opened on his desktop computer.

[225] Second, considering the defendant’s evidence about his trip to Canadian Tire in chief, it is notable that he ordered his travels as Subway (at 8:00 AM for breakfast), shopping at Canadian Tire (Dundas Square), and then attending school at Seneca (Finch and Highway 404) for 9:50 AM. For anyone living in Toronto, travelling from Fort York Blvd to Dundas Square, parking, shopping, and then travelling up the Don Valley Parkway would be a tight timeline. I am able to take judicial notice of the heavy traffic patterns predominating this route and wonder aloud whether the defendant would have even made it to school on time, assuming that this was important to him.

[226] It is also notable that the defendant’s memory was easily malleable about his reconstructed travels as ably demonstrated by the Crown Attorney during cross-examination about a photograph taken by the defendant’s iPhone at the Canadian Tire store time stamped at 3:37 PM. This was a neat illustration of the defendant’s testimony crossing the Rubicon from reliability to credibility.

[227] The defendant was also incredible on this issue. When confronted with this photograph, rather than simply accept that his reconstructed memory could be in error, the defendant suggested that perhaps he went to Canadian Tire twice on the same day. He also testified that it was possible that he did not take the photograph notwithstanding it was retrieved from his iPhone. He incredibly suggested that someone else could have taken the photograph but declined to mention who that person might be.

C. Uber, Esso, the Mechanic, and Pizza

[228] The defendant testified that on August 19, 2017, he purchased gas for his vehicle and then dropped his vehicle off at the mechanic shop in Concord Ontario. The defendant testified that he used his iPhone to summons an Uber to take him home. He also testified that he had to reset his Uber password prior to summonsing the Uber.

[229] Defence counsel confronted D.C. ALEXA during cross-examination about the failure of the police to obtain a production order for the Uber records associated to the defendant. Defence counsel pointed out that the forensic evidence showed that five minutes before the download of child pornography to the defendant’s desktop computer, the defendant received an email regarding resetting his Uber password. I agree with Defence counsel’s submission that this was important given the reasonable inference that the defendant would have actioned the password issue via his iPhone prior to summonsing the Uber to take him home from the mechanic. It is reasonable to assume that records from Uber would have shown the defendant’s movements.

[230] D.C. ALEXA testified during cross-examination that there was no evidence that the Uber email was actioned from the desktop computer. The obvious import being that the defendant’s evidence that he reset his password from his iPhone could not be disputed. Further, D.C. ALEXA could not recall if the defendant had the Uber app on his iPhone at the time it was seized from the defendant.

[231] Notwithstanding endorsing the concern outlined by Defence counsel in this area, ultimately, I do not believe the defendant’s testimony that he was in Concord travelling by Uber at the time of the child pornography downloads. There are several reasons for this finding.

[232] First of all, the following factual findings are established:

1. On August 19, 2017, at approximately 5:25 PM EDT the defendant received an email from Uber regarding a request to reset his password on his iPad;
2. The iPad did not have cellular capability, only Wi-Fi;
3. The forensic examination of the iPad revealed a user account for Uber;
4. The forensic examination of the defendant’s desktop computer shows that the Chrome browser was used to login to an UBER URL associated with lost passwords at 5:27 PM EDT;
5. At 6:30 PM EDT the defendant’s iPad received an email concerning his password; and,
6. At 6:55 PM EDT the defendant’s iPad was used to order a pizza from Pizza Pizza for delivery to the defendant’s condo address.

[233] This evidentiary record strongly suggests that the defendant was within his residence at the relevant times.

[234] Second, while it is true that D.C. ALEXA testified that there was no evidence that the Uber email was actioned from the defendant’s desktop computer, [47] I prefer the expert opinion evidence from D.C. KIDD, who conducted the forensic analysis of the defendant’s computer. D.C. KIDD testified that the Uber password reset was actioned from the desktop computer.

[235] Third, the defendant’s credibility was harmed by his evidence about Uber. When examined in chief by Defence counsel, the defendant easily testified that he reset his password and summoned an Uber to his location after dropping of his car at the mechanics. In so testifying, the defendant immediately adopted parts of the disclosure brief showing he received emails about his Uber account at the time.

[236] During cross-examination the following day, the defendant testified that he could not remember if he brought his iPhone to the mechanic’s shop. When the Crown Attorney impeached him using his testimony in chief, the defendant then began to speculate that he could have taken a taxi instead of an Uber. Ultimately, the defendant grudgingly admitted that it was “likely” he took his phone with him when dropping off his car.

[237] The defendant’s attempt to cloud this issue was obvious. Clearly he had realized the significance of the prosecution point – that if he was in possession of his iPhone at the mechanics consistent with his in-chief testimony that he had taken an Uber, he must have received the Coinbase verification communications. Someone acted on the Coinbase verifications procedures because the defendant’s Russian bank card was successfully added and BTC was conveyed to W2V. [48] The Crown theory being advanced was that “someone” was the defendant. From home. Not from the mechanics shop in Concord Ontario. Clearly, the Crown Attorney was implying that the car drop-off story was an inaccurate product of the defendant’s reconstructed memory, or a lie.

[238] Trial judges have the benefit of watching witnesses during their testimony. While demeanour evidence is unreliable as an indicator of truth, it is not totally irrelevant in a human endeavour. During this ten minute area of cross-examination the defendant obfuscated and stalled, insincerely sought clarification of the examiner’s questions, and feigned lack of comprehension. This was painfully evident when the Crown asked the defendant whether he had checked his prior history of Uber rides. [49]

[239] The defendant was materially inconsistent on the Uber issue and demonstrated an ability to be malleable depending on his perception of his jeopardy.

[240] Finally, the defendant’s testimony about a pizza order also impacted his credibility. The forensic examination of the defendant’s iPad showed he ordered a pizza for delivery to his condo at 6:55 PM utilizing his apple email APP. When confronted during cross-examination about this order the defendant testified that he could not recall the pizza order, where he was when he ordered it and it was unclear if the order was for pickup or delivery. He also testified that it was possible he ordered the pizza to be delivered to his home even though he was not at home at the time. Ultimately, the defendant was forced to agree that the order was delivered to his condo when directed to the contents of the order.

[241] While the defendant’s reconstructed memory evidences reliability concerns, I might be inclined to forgive such frailty were it not for the defendant’s lack of credibility.

[242] Turning my mind to W.(D.) and Villaroman, I attribute no weight to the defendant’s reconstructed memory of his movements on August 18 and August 19, 2017.

D. Possession of the National Bank Credit Card

[243] During direct-examination the defendant was clear that he had his National Bank credit card with him on August 18, 2017, in furtherance of his travels away from his residence during the time frame of the BTC transfer to the W2V website. In particular, he had his credit card with him at lunch at a restaurant after college. When examined by Defence counsel the defendant readily and easily maintained this position. The defendant had no caveat to his position that the National Bank charges were corroborative of his travels.

[244] During cross-examination, the Crown Attorney pointed out to the defendant that his National Bank credit card was being added to his Coinbase account on August 18, yet he claimed to be away from home in possession of his credit card. The defendant became aware of the obvious issue -- how did Roman supposedly add the National Bank credit card to the defendant’s account, when the card was in the defendant’s possession.

[245] Faced with this dilemma, the defendant testified that a person could have written down the information for the credit card. When cross-examined further, the defendant changed his evidence and suggested that perhaps he had used Apple Pay byway of his iPhone to pay for the transactions rather than his physical card. This vacillation affected the reliability of the defendant’s evidence in addition to his credibility.

E. Deficient Investigation – Tower Information and SMS Messages

[246] I agree with Defence counsel’s submission that the police could have obtained tower records for his cellphone potentially showing his movements at relevant times in the investigation. I also agree that the police could have at least attempted to see if text message confirmations from Coinbase were received by the defendant’s cellphone.

[247] The absence of tower information does not leave me in a state of reasonable doubt as to the defendant’s presence at home at the time of the downloads given the electronic evidence and the W2V username and password analysis set out above.

[248] The SMS message confirmations are documented in the Coinbase subpoena records and supported by Daniel CURTIN’s evidence.

[249] While the police might have further investigated these areas to obtain corroboration of the Coinbase communications, the failure to do so does not place me in a state of doubt.

F. Deficient Investigation - Roommates

[250] There is some credence to the Defence submission that the police could have more thoroughly investigated the defendant’s roommates or the defendant’s residential circumstances. It is true that the police could have obtained security footage from the defendant’s condo, access card usage, and any available information held by building management as it concerned the residents of the defendant’s premises. A methodical approach to residency issues must be the central focus of a police investigation directed at knowledge, possession, and control of criminal items within a residence.

[251] But on the record adduced in this trial, I find no significant deficiency in the approach of the police.

[252] The defendant told D.C. ALEXA information about his past female roommates, and it is clear that D.C. ALEXA evaluated this information. At the time of the execution of the search warrant the defendant had a roommate. D.C. Alexa investigated this person. As for the subject of subletting, D.C. ALEXA relied upon the defendant’s statement provided to the police. [50]

[253] I have already addressed the defendant’s statement to the police wherein he told them that he did not have roommates in August 2017. Further, the defendant did not tell D.C. ALEXA about Roman. I do not fault D.C. ALEXA for failing to run down information about Roman when, on the record at trial, there is no evidence D.C. ALEXA knew about Roman or should have known about Roman.

G. Deficient Investigation – Roman

[254] I do not accept Defence counsel’s submission that the police investigation of Roman was deficient. In addition to the observations set out above, purely as part of the balancing of considerations on this specific submission only, I also observe that the defendant never notified the police that Roman played a significant role in this case. As I outlined above, this was not addressed byway of pretrial application and there is no evidence of the defendant instructing his counsel to notify the police that he was away from his residence at the time of the crimes or that Roman was perhaps responsible.

[255] Of course, I recognize that the defendant did not have an onus to engage these options. But in light of the defendant’s criticism of the police investigation, there is some latitude for the court to consider the circumstances.

[256] The prominence of Roman only became evident as the defendant testified at trial. The defendant held peculiar knowledge about Roman which was not revealed to the police until he testified.

[257] Finally, I do not find that Defence counsel’s cross-examination of D.C. ALEXA placed an onus on the police to investigate Roman in December of 2021. I find that D.C. ALEXA can not be faulted for failing to investigate Roman – a person who was not disclosed by the investigation.

H. Deficient Investigation – Subway, Canadian Tire, Seneca, Restaurant.

[258] I accept Defence counsel’s submission that the police could have investigated the defendant’s movements as disclosed by his credit card charges on August 18 and 19, 2017. While this is a case predominated by electronic evidence, ordinary police investigative steps were also available. It is true, that in furtherance of a police investigation into possession issues, the police could have investigated the places disclosed by the defendant’s credit card charges. The police received the results of the production order in December 2019. The police could have investigated further (i.e., video, receipts) notwithstanding the gap in time.

[259] I accept Defence counsel’s submission that the police could have investigated the defendant’s school to see if there was evidence of the defendant actually having attended school on August 18, 2017.

[260] But weighed against these considerations, D.C. ALEXA possessed a substantial body of electronic evidence clearly documenting the defendant’s culpability. He had the defendant’s statement that he kept his passwords in his head and that he did not have roommates in August 2017.

[261] During the investigation of this case, D.C. ALEXA had no idea that the defendant would one-day implicate an unmentioned roommate and take the position that he was not at home at the time of the offences.

[262] I have set out above my analysis of the defendant’s right to silence and his choice to speak to the police about some subjects and not others. There is no evidence that D.C. ALEXA was advised (either during the defendant’s statement or at any point after) that the defendant was occupied outside of his residence at Subway, Canadian Tire, Seneca, a restaurant, or a mechanics shop during important timeframes. Again, this is not a brick solidifying the prosecution’s case. It is merely a credibility observation relevant to the assessment of stage two of W.(D.) and the circumstantial case.

[263] That the police could have explored other possible investigative avenues is important because it can factor into the analysis of reasonable doubt. Reasonable doubt can be premised on the absence of evidence. But my central finding is that the “failure” to investigative the areas identified by Defence counsel does not support a reasonable doubt. This is particularly so given my finding that the defendant is both unreliable and incredible.

I. Access to the Defendant’s Seized Items

[264] To the extent that Defence counsel submits that this court consider the fact that the defendant did not have access to his electronic devices seized from his residence, this is deserving of minimal weight.

[265] I may only assume that the defendant had the product of the disclosure brief including the extractions of evidence. Further, it is routine in criminal law cases for the defendant to apply to gain access to items to prepare the defence (e.g., expert evaluation).

J. Hacking

[266] The defendant told the police during his statement that it was possible that hackers had visited these circumstances upon him. The police asked him to assist with investigating whether this was so. The defendant declined.

[267] It is not a violence of the right to silence to make the ironic credibility observation that having chosen to speak about some issues and not others, and having suggested hacking, the defendant thereafter declined to assist the police in their investigation of the hacker issue.

[268] Notwithstanding the vast electronic evidence record at trial, the defendant’s statement to the police is the only place where the issue of hacking surfaces. The Coinbase evidence documents the use of algorithmic analysis to detect hacking or the compromise of a BTC wallet. No one asked question about this issue at trial. There is no evidence that the defendant’s computer was captured by external hackers. There is no evidence that his computer was infected with a virus or viruses. There is no evidence that his computer had been compromised by anyone else. In fact, during the trial I can not recall there being important questions about such subjects. Nor were there any submissions on the issue.

K. “Drinking Buddies”

[269] The defendant told the police that it was possible that “drinking buddies” had access to his computer. It was possible that he left his computer insecure in the presence of “drinking buddies”.

[270] Applying Villaroman, this speculative possibility does not leave me in a state of doubt. While the defendant has no burden, and reasonable doubt may rest upon the presence or absence of evidence, there is simply nothing to this scenario advanced by the defendant.

L. Guests of Roman

[271] I do not have any doubt based on the defendant’s speculation that Roman admitted guests to the defendant’s condo who utilized the defendant’s credentials to access the W2V website and download child pornography.

M. Mercedes Benz Job

[272] Defence counsel submits that the police should have investigated the circumstances of the defendant’s employment. This issue is irrelevant.

N. Out of Province Travel

[273] D.C. ALEXA did not investigate precisely when the defendant left the country and went to New York. The National Bank records show this was after the timeframe of the investigation. This issue is not relevant.

O. Conclusion

[274] The issue should not be approached from the perspective of what additional avenues of investigation were left untouched by the police. Anyone can point to a police investigation and suggest that an investigation could have explored other areas. The central focus must be whether the police investigation was deficient such that there exists a reasonable doubt.

[275] Nothing in these varied themes leaves me in a state of reasonable doubt or contributes to other plausible or reasonable possibilities which are inconsistent with the guilt of the defendant: Villaroman, at paras. 32-43.

V. Credibility and Reliability of the Defendant

A. Demeanour

[276] The defendant speaks accented English with almost perfect sentence structure and grammar. His language skills are impressive. It is apparent that the defendant has received excellent guidance as it concerns the English language. The defendant explicitly declined the assistance of a Russian-speaking interpreter.

[277] Prior to testifying, without any prompting from counsel, the defendant spoke to the court directly and advised that if he was pausing after questions, this is because he was translating Russian in this head before answering. While this warning was appreciated, I did not find any inordinate delay during the defendant’s testimony associated with pausing after questions.

[278] During direct-examination, the defendant’s evidence was clear and concise. He confined himself to the questions asked by Defence counsel. He was responsive and direct. In sum, the defendant presented as intelligent, clear, educated, respectful, and polite.

[279] During cross-examination, there was a wholesale change in the defendant’s demeanour. The Crown Attorney cross-examined using clear and understandable questions. The defendant’s veneer of polite discourse began to shift. The defendant presented as not comprehending the questions at time. He sought constant clarification as to the scope of the question. He became highly specific and literal. He answered questions with questions of his own. He required constant clarification from the Crown Attorney as to the meaning behind her use of words (e.g., “opening two Coinbase accounts”; “operate”; and “how it can be used”). He thoroughly answered questions that were not asked. He became deliberately obtuse. In one glaring example of his effort to stall and delay, for the first time, on the second day of his testimony, he sought clarification as to whether the microphone was picking him up if he turned his head 30 degrees to look at a screen. [51] An issue that had not presented itself through two days of testimony. Essentially, all of this presented as a rather obvious obstructive delay tactic as the Crown Attorney cross-examined.

[280] In the ordinary course, criminal court trial judges exert caution as it concerns testimonial demeanour for good reason: R. v. Chacon-Perez, 2022 ONCA 3, at para. 119. But on rare occasion it deserves modest recognition.

B. Credibility, Reliability, and the Criminal Burden of Proof

[281] The analysis of evidence at a criminal trial requires the application of a particular framework of important criminal law principles to ensure that the court remains fixed on the criminal burden of proof.

[282] It is axiomatic that there is no burden on a criminal defendant. The defendant is presumed innocent. The burden of proof does not shift from the Crown during a criminal trial.

[283] The guidance provided by the Supreme Court of Canada in W.(D.) v. The Queen (1991), 63 C.C.C. (3d) 77 (S.C.C.) [W.(D.)] applies to this trial. In addition to the oft-cited three stage-consideration applicable to assessing credibility, the central consideration in W.(D.) is that the court remain focused on the criminal burden of proof when evaluating conflicting evidence, including conflicting witness testimony: R. v. Smith, 2020 ONCA 782, at para. 11 [Smith]. I favour adding a “fourth stage” considerations in the W.(D.) analysis. If the court is unable to decide the material issues as between the testimony of the prosecution witnesses and the defendant, this state of mind would mandate an acquittal: R. v. S. (J.H.), 2008 SCC 30, at para. 12; R. v. Austin, [2006] O.J. No. 4660 (C.A.), at para. 20.

[284] A court must consider any exculpatory evidence in the W.(D.) analysis whether it emanates from the case for the Defence, or the prosecution. (See the authorities cited in Smith, at para. 12; R. v. M.P., 2018 ONCA 608, at para. 60.) Where there are credibility findings to address concerning conflicting evidence, it does not matter whether the record was adduced by the Defence or the Crown -- the concept of reasonable doubt must be addressed: R. v. Marki, 2021 ONCA 83, at paras. 23, 25; R. v. Charlton, 2019 ONCA 400, at para. 45; R. v. Kirlew, 2017 ONCA 171, at para. 17; R. v. B.D., 2011 ONCA 51, at para. 114.

[285] A reasonable doubt may not be characterized as speculative simply because there is no direct evidence on the issue: Villaroman, at para. 36. The trier of fact should consider “other plausible theories” and “other reasonable possibilities” which are inconsistent with guilt: Villaroman, at para. 37-38; R. v. SB.1, 2018 ONCA 807, at para. 124. Where a conviction is registered, the only available inference drawn from the record should be the guilt of the defendant: Villaroman, at paragraph 30.

[286] If there exists any reasonable doubt, that doubt must be resolved in favour of the defendant. Reasonable doubt is based on “reason and common sense”, is not “imaginary or frivolous”, does not “involve proof to an absolute certainty”, and must be “logically connected to the evidence or absence of evidence”: (Villaroman, at paras. 28, 36 citing R. v. Lifchus, [1997] 3 S.C.R. 320.)

[287] Reasonable doubt does not take on the character of an inference or a discrete finding requiring foundational support in the evidence presented at trial: Villaroman, at para. 28. The defendant bears no burden to establish foundational facts in support of an inference of innocence: Villaroman, at para. 35; R. v. Khela, 2009 SCC 4.

[288] I am mindful that a criminal trial can not be permitted to become a contest of credibility between the prosecution witnesses and the defendant. Further, particularly where the electronic evidence is so powerful, a court must still guard against shifting the onus to the defendant.

[289] Credibility has to do with the veracity or truthfulness of a witness while reliability has to do with the ability of a witness to accurately observe, recall, and recount events in issue: R. v. C. (H), 2009 ONCA 54, at para 41.

[290] The defendant was an unreliable witness in many respects. Reliability has to do with the accuracy of the defendant’s evidence: R. v. Slatter, 2019 ONCA 807, at para 60. Earlier in this judgment I addressed the inherent unreliability of the defendant’s reconstructed memory based on his review of his National Bank credit card statement. In addition to these observations, a predominant theme in the defendant’s testimony was the caveat “to the best of my recollection”. But as I have explained in this judgment, my assessment is more focused on credibility than the defendant’s poor reliability. The defendant’s lack of reliability was simply compounded by the fact that he was also an incredible witness on the material issues at trial.

[291] I do not believe the defendant’s evidence implicating Roman as the person responsible for the criminal offences before the court. I do not believe that the defendant was away from his residence at the material times in issue. I do not have a reasonable doubt based on the defendant’s evidence or anything in the evidentiary record at trial.

[292] I do not believe the defendant’s evidence at stage one of W.(D.). I do not harbour a reasonable doubt at stage two.

[293] On the third branch of W.(D.), the electronic evidence record solidly and convincingly supports the culpability of the defendant. While I accept certain features of the defendant’s testimony (e.g., that he was intimidated and afraid during his police statement), I do not accept the central pillars of his evidence. I do not believe his emphatic testimony that he did not access the W2V website and access child pornography. I reject his testimony attributing culpability to his roommate Roman (and potentially others) as implausible and untrue.

[294] Finally, having regard to the circumstantial evidence and the guidance in Villaroman I must consider the entire evidentiary record including the arguments presented in furtherance of the suggestion that the police investigation was deficient. Particularly as it concerns a Defence submission that the police had “tunnel-vision”, it is important that a court guard against similar alleged bias.

[295] The evidentiary record at trial does not support other plausible theories or possibilities inconsistent with the guilt of the defendant. Using common sense, reason, and life experience, the circumstantial evidence demonstrates only one conclusion – the defendant’s guilt. Nothing in the record provokes reasonable doubt or a concern that there is a construction of the evidence that mandates an acquittal.

VI. The Criminal Offences – Knowledge, Possession, and Control

[296] Neither the Crown Attorney nor Defence counsel addressed the elements of the offences during submissions.

[297] Any person who took the trouble to convey BTC to the W2V, use a TOR browser, input the particular URL, and access the W2V website, would be confronted with a website dedicated to child pornography. Having seen categories of media, the thumbnails showing the content of media, and the description, there could be no question that the person was accessing child pornography.

[298] Having clicked on thumbnail links to download five files, the person would have to be aware that they were downloading images of child exploitation.

[299] I am satisfied beyond a reasonable doubt that the defendant accessed the W2V website from his desktop computer, conveyed BTC to the W2V website, and later downloaded child pornography to his computer hard drive. I am also satisfied beyond a reasonable doubt that the files were clicked on and “opened”.

[300] The evidentiary record establishes that the files were deleted. There is no evidence as to when the files were deleted. Put another way, there is no evidence as to how long the files remained on the defendant’s computer.

[301] Nevertheless, I am not in a state of reasonable doubt on the issue of possession given the evidentiary record before the court. If, for example, the defendant had testified that he simply downloaded files out of curiosity, viewed them momentarily, and then deleted them having recognized the magnitude of the material, a different analysis would be required and the issue of how long the files remained would gain prominence. Given the evidence at trial, this issue is not important.

[302] The evidence establishes that the files were opened, but the expert evidence could not demonstrate what the eyes of the downloader viewed or for how long. No forensic electronic evidence could address this issue. In layperson’s terms, there is no forensic technique that might show that the defendant’s eyes were cast upon the impugned media. But it is the only reasonable and supportable inference that I draw based on the evidence at trial.

[303] For the oral reasons provided in court, and these written reasons, I find the defendant guilty of both counts before the court.

Released: March 9, 2022 Signed: “Justice M.S. Felix”

Footnotes

[1] In so doing I have observed a distinction between the record produced on the s.8 applicant and the record ultimately adduced at trial.

[2] Representing the contents of the movie file associated with the thumbnail.

[3] Exhibit 30.

[4] Police exhibit 1-1 hard drive.

[5] BICE testified that there was only one member of the W2V website named “flydaze”.

[6] It is conceded that four of the downloaded files constitute “child pornography” as defined by the Criminal Code.

[7] See evidence of DANIELS.

[8] 11:29 Video Statement.

[9] 12:10 Video Statement.

[10] As evidenced by the presence of the password in the Apple IOS keychain.

[11] Line 216 Coinbase Subpoena Record Exhibits 25 and 26.

[12] Line 244 Coinbase Subpoena Record Exhibits 25 and 26.

[13] This card was added in January 2017 but never verified.

[14] Line 256 Coinbase Subpoena Record Exhibits 25 and 26.

[15] Line 294 Coinbase Subpoena Record Exhibits 25 and 26.

[16] Police exhibit 1-2.

[17] See evidence of D.C. KIDD.

[18] Four of which meet the definition of “child pornography” in the Criminal Code.

[19] Including unique HASH values.

[20] Combination of evidence from DANIELS, BICE, and KIDD.

[21] The “Target File Created Date/Time field” as opposed to last modified or last accessed date fields.

[22] For example, the linkfile associated to download 2013.wmv was created on August 19, 2017, at 21:35:15 UTC which is 5:35 PM EDT Toronto.

[23] While the Crown Attorney’s submissions are not evidence she submitted that the two experts were independent.

[24] I have omitted the last name.

[25] After a trial in which continuity and admissibility of the technological evidence was the primary theme.

[26] I note that Defence counsel did not adduce the Roman emails or any other evidence that might have lent evidentiary support to the Roman issue nor did the Defence address other means to substantiate Roman such as calling the defendant’s landlord, his mother, to substantiate the identity of roommates.

[27] After first confirming that the police would seize his phone still within his condo unit.

[28] 11:49 Video Statement.

[29] 11:29 Video Statement.

[30] 11:29 Video Statement.

[31] 11:30 Video Statement.

[32] 12:00 Video Statement.

[33] 11:35 Video Statement.

[34] 12:04 Video Statement.

[35] 12:08 Video Statement.

[36] Asking the Defendant about usernames twice is the notable exception. Nevertheless, no egregious police trickery was involved. The police simply asked the question twice in forty minutes. The second time the question was asked, the defendant answered.

[37] The subject matter is clearly documented in the trial record. There is no need to illuminate the subject in this written judgment given my admissibility ruling.

[38] Given my ultimate ruling, I decline to provide a more through explanation of the issue in this public judgment. The nature of the subject matter is accessible to any review Court in the record at trial.

[39] I was advised by Counsel that she was sitting in the body of the Court during the defendant’s trial.

[40] The evidence at trial demonstrated that this specific date was not accurate, but the important consideration is that the defendant was fixed with dates during August 2017.

[41] 11:41 Video Statement.

[42] 11:42 Video Statement.

[43] 11:42 Video Statement.

[44] 11:51 Video Statement.

[45] “flyda”.

[46] He provided the name of the restaurant, but it is not important to state the name in this judgment.

[47] While simultaneously maintaining a subjective belief that the defendant had actioned the Uber password issue from the desktop computer.

[48] See “Coinbase Login to Convey BTC” section above.

[49] This occurred at approximately 10:08 AM on February 16, 2022.

[50] Detective ALEXA was careful not to provide the content of the statement under cross-examination during the Crown’s case.

[51] 10:51 AM February 16, 2022, proceedings at trial.