DATE : March 21, 2022 ONTARIO COURT OF JUSTICE
BETWEEN:
HER MAJESTY THE QUEEN
— and —
JAMES TRELOAR
Before Justice John North
Reasons for Judgment released on March 21, 2022
Pamela Santora.......................................................................................... counsel for the Crown Jody Berkes.............................................................................................. counsel for the Defence
NORTH J.:
INTRODUCTION
[1] The Applicant is charged with accessing child pornography contrary to section 163.1(4.1) of the Criminal Code. The defence brought an application under sections 8 and 24(2) of the Charter to exclude evidence that had been seized by the police during the execution of a search warrant at the Applicant’s residence. A search of a laptop computer that was seized during the execution of the warrant revealed evidence that the user had accessed over 2600 unique child pornography images and conducted online searches for similar material.
[2] On behalf of the Applicant, Mr. Berkes argued that the information to obtain (ITO), on its face, did not provide a basis upon which the issuing justice, acting judicially, could have issued the search warrant. Ms. Santora, on behalf of the Crown, argued that the ITO disclosed sufficient information to support the issuance of the search warrant under section 487 of the Criminal Code.
[3] For the reasons set out below, the application is dismissed. I have concluded that the ITO contained reasonable grounds upon which the issuing justice could have issued the search warrant.
BACKGROUND [1]
[4] On January 3, 2020, Microsoft sent a “Cyber Tipline” report to the National Centre for Missing and Exploited Children (NCMEC). [2] The report stated that on January 1, 2020 an image containing child pornography was uploaded to an online search service operated by Microsoft (Bing Image) from an identified IP address. [3] A copy of the image was included in the report.
[5] The report stated that the IP address used to upload the image “fell within the jurisdiction of Toronto”. NCMEC sent the report to the National Child Exploitation Coordination Centre (NCECC) in Ottawa. [4]
[6] On March 7, 2020, an RCMP officer assigned to NCECC contacted Rogers Communications Canada Inc. (Rogers) to determine whether Rogers had subscriber information for the IP address mentioned in the report. Later that day, a member of the security department at Rogers advised the RCMP officer that Rogers had subscriber information for the IP address and that the “jurisdiction for that IP address is East York, Ontario.”
[7] The RCMP officer prepared an investigative package and sent it to the Toronto Police Service (TPS).
[8] On April 9, 2020, Detective Constable Scott Peters was assigned to investigate this matter. Detective Constable Peters was with the TPS Child Exploitation Unit. He was an experienced officer and had attended many conferences and courses regarding both child sexual exploitation investigations and investigations involving computers and the Internet.
[9] Detective Constable Peters viewed the image that had been uploaded on January 1, 2020. He concluded that it constituted child pornography as defined by the Criminal Code. The image is of a child between six to eight years old engaged in explicit sexual activity with an adult.
[10] Detective Constable Peters applied for a production order to obtain subscriber information for the IP address mentioned in the report. On May 1, 2020, the production order was granted. On May 11, 2020, Rogers provided Detective Constable Peters with the subscriber information. The subscriber’s name was Jim Treloar and his address was unit 326, 35 Brian Peck Crescent, East York.
[11] After receiving the subscriber information, Detective Constable Peters conducted several database searches. He found one TPS occurrence associated to that address. On August 19, 2019, a driver of a vehicle was cautioned for failing to stop at an intersection. The driver was identified as James Treloar, and his address was unit 326, 35 Brian Peck Crescent, East York. A Ministry of Transportation Ontario (MTO) database stated that James Treloar was a registered driver and his address was unit 326, 35 Brian Peck Crescent, East York. The MTO database indicated that on September 18, 2018, James Treloar’s address was changed from 88 Springdale Boulevard, Toronto to unit 326, 35 Brian Peck Crescent, East York. Detective Constable Peters found no information to suggest that anyone other than James Treloar lived at unit 326, 35 Brian Peck Crescent. At the time Detective Constable Peters conducted the database checks, James Treloar did not have a criminal record and had no outstanding charges.
[12] On July 7, 2020, Detective Constable Peters applied for a search warrant pursuant to section 487 of the Criminal Code for unit 326, 35 Brian Peck Crescent, East York. The search warrant was granted on July 9, 2020.
[13] Police officers executed the search warrant on July 15, 2020. The officers seized a laptop computer and a USB flash drive. These items were subsequently searched by a TPS forensic computer examiner. The laptop computer contained “evidence that the user had accessed 2678 unique child pornography images, conducted on-line searches for similar material, and visited a number of related websites.” [5]
[14] The Applicant was arrested and charged with child pornography offences on November 5, 2020.
THE ITO
[15] I will briefly review the relevant parts of the ITO.
[16] Detective Constable Peters stated that he had reasonable grounds to believe that the items set out in Appendix A will afford evidence of the offences of possess and access child pornography. Those items included:
- Electronic devices and data storage media, including computers, smartphones, modems, USB flash drives and memory cards.
- Photographs, videos, written stories, audio files, text or printed material made by electronic or mechanical means which shows a person who is or is depicted as being under the age of eighteen years engaged in or depicted as being engaged in explicit sexual activity.
- Documents pertaining to the occupant or occupants of the residence that will assist in proving their occupation of the place and access to and control of the computer systems located therein.
- Documents pertaining to the identity of the Internet subscriber and others associated to the use of the Internet at that location.
- Documents containing passwords relating to computer accounts, encryption keys, data storage devices, email accounts, software clients, cloud storage, or online data storage that will afford evidence of the offences of possess and access child pornography.
[17] In Appendix C, Detective Constable Peters set out the grounds in support of the application for a search warrant. I have already described some of these grounds (in the “Background” section) and it is not necessary to repeat them. However, I will mention some additional information, as described by Detective Constable Peters in Appendix C:
- “Bing Image is an online search service owned by Microsoft. Bing Image (referred to as Visual Search) is a service that provides similar images to an image provided by the user. This image can be provided by the user either via the upload of the image or as a URL (the webpage address of the image). In order for the user to search an image on Bing, a user can simply visit the webpage www.bing.com, click on the camera icon that appears in the search bar, and then drag or paste an image or paste the URL of the image they want to search into the ‘Visual Search’ window. When the user drags or pastes the image they want into the visual search window, that image is uploaded to Bing in order to perform the search. Bing will then search the Internet for similar images and show those results in a ‘Similar images’ column.”
- “In order to upload a child pornography file to the Microsoft Bing image search service the person would need to be in possession of the image and also have access to it in order to do so.”
- “I am also aware and believe it is common knowledge that people often possess photographs, videos, written stories, audio files, text, or printed material, made by electronic means, within their homes, and as a result I believe these items will be found at the location to be searched.”
- “It has been my experience, and I believe it is common knowledge, that people often keep types of electronic devices and data storage media described in Appendix A in places they habitually use and occupy, including their homes, workplaces, and their vehicles.”
- “I have found during previously executed search warrants that people tend to keep these types of electronic devices and data storage media for long periods of time, usually for several months and even for years at a time.”
- “I am also aware, and I believe it is common knowledge, that when people purchase new computers or smartphones, they often transfer their data from the old device to the new device. I have also found that some people also keep a back-up copy of the data they have on their computer on a back-up device (e.g. an external hard drive), in case the original device is damaged or lost.”
- “The electronic devices and data storage media I am seeking in Appendix A, can store data and can be analyzed by computer forensic investigators attached to the Child Exploitation Section to retrieve a wide variety of evidence in relation to the offences listed in Appendix B, including the following: a. Copies of web pages created on the computer or downloaded from the Internet, details of Internet sites visited by the suspect, and copies of electronically created documents and images/videos. Searching for a history of Internet activities may help determine where the person who possessed the child pornography images and videos obtained them from, and may also determine with whom they are sharing the images. b. The forensic analysis of the electronic devices can retrieve data that may be hidden or previously deleted, including prior documents, images/videos and e-mails. Further, it may assist in identifying when an image or document was created, or modified, when an email was sent or received, or when a chat conversation occurred. c. Deleted files or file fragments may exist for an extended period of time (e.g. months or years) on the computer system, due to the design of most common computer operating systems (e.g. Microsoft Windows). Files that have been deleted by the user are not physically erased. Rather, the operating system merely marks the area of the storage drive where the file was stored as available to be re-used in the future. If the space is not re-used prior to seizure, forensic programs can retrieve these deleted files or file fragments.”
- “Locating computer data relating to the use of Microsoft Bing Image search service will afford evidence of the offences because that service was used to upload the child pornography file during an image search completed by the unknown suspect on January 1, 2020. Further, should the forensic examination reveal that the Microsoft Bing Image search service was used on a device on January 1, 2020, at the exact time the offences were committed, then that information will afford evidence of the opportunity to commit the offences on that date using the device, and will assist in identifying who committed the offences.”
POSITIONS OF THE PARTIES
[18] Mr. Berkes argued that the ITO provided no basis to conclude that, six months after a single image of child pornography was uploaded, “there were reasonable grounds to believe that the same image would be found on a computer in the Applicant’s residence.” Mr. Berkes noted that there was no information in the ITO that the Wi-Fi network at the Applicant’s residence was password protected. Mr. Berkes also argued that “the fact that people put information on their home computers and the information may remain for months or years or be transferred to new devices is incapable of supporting an inference that there would be child pornography found on the computer seized in this case.”
[19] Ms. Santora argued that the ITO contained sufficient information to permit the issuing justice to conclude that there were reasonable grounds to believe that evidence of possession and accessing child pornography would be found in the Applicant’s residence. In advancing this argument, Ms. Santora observed that the police were searching for more than the actual image that was uploaded. Ms. Santora also noted that child pornography is not a consumable item like illegal drugs.
LEGAL PRINCIPLES
A. Review of a Search Warrant
[20] A review of the validity of a search warrant begins from a presumption that the warrant is valid: R. v. Pires; R. v. Lising, 2005 SCC 66, [2005] 3 SCR 343, at paragraph 30; R. v. Muddei, 2021 ONCA 200, at paragraph 37. The onus is on the party challenging the validity of a warrant to demonstrate that it was not validly issued: R. v. Crevier, 2015 ONCA 619, at paragraph 66; R. v. Campbell, 2011 SCC 32, [2011] 2 SCR 549, at paragraph 14.
[21] A reviewing court works “within a narrow jurisdictional compass”: R. v. Ebanks, 2009 ONCA 851, at paragraph 20. A reviewing judge cannot substitute his or her view for that of the issuing justice. It is not the role of the reviewing judge to decide whether he or she would have issued the warrant. Instead, the sole function of the reviewing court is to determine whether the issuing justice could have issued the warrant: R. v. Sadikov, 2014 ONCA 72, at paragraph 37. A court reviewing the issuance of a warrant asks whether “there was reliable evidence that might reasonably be believed on the basis of which the warrant could – not would – have issued”: Sadikov, at paragraph 84; R. v. McNeill, 2020 ONCA 313, at paragraph 34.
[22] The record on a facial challenge to a search warrant is restricted to the ITO: Sadikov, at paragraph 82; McNeill, at paragraph 33. The statements in the ITO are “accepted as reliable and accurate”: Crevier, at paragraph 73. On a facial challenge, a court “simply looks to whether the ITO, on its face, was sufficient to support the warrant”: Crevier, at paragraph 73. In Sadikov, at paragraph 37, the Court stated as follows:
“A facial validity challenge requires the reviewing judge to examine the ITO and to determine whether, on the face of the information disclosed there, the justice could have issued the warrant: R. v. Araujo, 2000 SCC 65, [2000] 2 S.C.R. 992, at para. 19.” [Emphasis in original.]
[23] In McNeill, at paragraph 30, the Court stated that on a facial validity challenge, the reviewing judge must consider: “(i) the statutory threshold for issuing the warrant; and (ii) whether the issuing justice could have concluded that this threshold was met.”
[24] Like the issuing justice, a judge reviewing the issuance of a search warrant is entitled to draw reasonable inferences from the contents of an ITO: R. v. Nero, 2016 ONCA 160, at paragraph 71. An affiant “need not underline the obvious”: R. v. Vu, 2013 SCC 60, [2013] 3 SCR 657, at paragraph 16.
[25] A reviewing court must conduct the review on “a contextual analysis of the record, not a piecemeal approach to individual items of evidence shorn of their context in a vain search for alternative exculpatory inferences”: Nero, at paragraph 68. A reviewing judge must remember that “if the inferences of criminal conduct and recovery of evidence are reasonable on the facts as disclosed in the ITO, the warrant could be issued”: Sadikov, at paragraph 81.
B. Reasonable and Probable Grounds
[26] Before a search warrant may be granted, the police must provide a justice with “reasonable and probable grounds, established upon oath, to believe that an offence has been committed and that there is evidence to be found at the place of the proposed search”: Hunter v. Southam Inc., [1984] 2 SCR 145, at page 168; Campbell, at paragraph 14. [6]
[27] The reasonable and probable grounds standard does not require proof beyond a reasonable doubt or even proof on a balance of probabilities: R. v. Beauchamp, 2015 ONCA 260, at paragraph 92; Muddei, at paragraph 37. Instead, the standard is one of “credibly-based probability”: Sadikov, at paragraph 81.
[28] The assessment of reasonable grounds “does not depend on mathematical notions of probability”: R. v. Cusick, 2019 ONCA 524, at paragraph 89. Instead, the question is whether the issuing justice:
“…considering the evidence as a whole on a common sense, practical and non-technical basis, and drawing reasonable inferences therefrom, could have reasonably believed that there was evidence to be found at the place to be searched. The standard to be met is determined qualitatively by applying reason to the evidence, not quantitatively by attempting to apply notions based on the probability branch of mathematics.” Cusick, at paragraph 89.
[29] In determining whether an ITO contains sufficient facts to establish reasonable and probable grounds, an issuing justice “considers the ITO as a whole, in a common sense, practical, non-technical way, and may draw reasonable inferences from its contents”: McNeill, at paragraph 33.
[30] In some circumstances, officer training and experience can be relevant in determining whether the requisite legal standard for a search or detention has been met: R. v. MacKenzie, 2013 SCC 50, [2013] 3 SCR 250, at paragraph 62; Cusick, at paragraphs 91 and 99. However, courts are not required to uncritically accept or defer to a police officer’s conclusion that is grounded in his or her experience and training. Reasonable grounds to believe and reasonable suspicion are objective standards that “must stand up to independent scrutiny”: MacKenzie, at paragraph 64.
[31] If the police seek to search the contents of a computer or a mobile communication device found during the execution of a search warrant the ITO must:
“…contain sufficient information to permit the authorizing justice to find that there are reasonable grounds to believe that any computers or communications devices they discover on execution of the search will contain what they seek”: Nero, at paragraph 159.
C. Staleness
[32] While the Applicant’s section 8 argument is not limited to the assertion that information in the ITO was stale-dated, “staleness” is one of the cornerstones of the Applicant’s argument.
[33] Courts in both Canada and the United States have considered the issue of whether information is so dated that that it cannot be relied on to obtain a search warrant. Some Canadian decisions have relied on American jurisprudence in this area: R. v. Ballendine, 2011 BCCA 221, at paragraphs 54 and 56; R. v. Morelli, 2010 SCC 8, [2010] 1 SCR 253, at paragraph 173 [7]; R. v. Cusick, 2015 ONSC 6739, at paragraph 146, aff’d 2019 ONCA 524. [8]
[34] The decisions that address staleness are largely factually-driven: R. v. Williams, 2019 ONCJ 619, at para. 70. However, some general principles may be extracted from the jurisprudence.
[35] There is “no is rule as to how recent information has to be in order to be relevant”: R. v. James, 2019 ONCA 288, at paragraph 55. [9] In R. v. Porter, 2016 ONSC 5589, at paragraph 58, George J. (as he then was) stated that “[w]hile there is no bright line or fixed date, there is a point at which information can no longer be relied upon.”
[36] In determining whether information is so dated that it cannot be relied upon to obtain a search warrant, the analysis “must be undertaken on a common sense and practical basis, taking all of the prevailing circumstances into account”: James, at paragraph 64. This is “a question to be answered on a case by case basis, confined to its particular facts”: Porter, at paragraph 58.
[37] Courts in the United States have taken a similar approach to this issue. American courts have recognized that there is “no bright-line test for determining when information is stale”: United States v. Koelling, 992 F (2d) 817 at 822 (8th Cir 1993); Walczyk v. Rio, 496 F (3d) 139 at 162 (2nd Cir 2007). Whether or not information is “stale” must be evaluated “on the basis of the facts of each case”: United States v. Martino, 664 F (2d) 860 at 867 (2nd. Cir 1981).
[38] While the passage of time is a relevant consideration in determining whether the reasonable grounds to believe standard has been met, “it is but one factor”: Ballendine, at paragraph 54; James, at paragraph 64. Simply because information is “dated” does not mean that it is “stale”: Ballendine, at paragraph 54.
[39] In Ballendine, at paragraph 54, the Court adopted the following passage from Andresen v. State, 331 A. (2d) 78 at 106 (Md. Court. Spec. App. 1975), aff’d 427 U.S. 463 (1976):
“The ultimate criterion in determining the degree of evaporation of probable cause, however, is not case law but reason. The likelihood that the evidence sought us still in place is a function not simply of watch and calendar but of variables that do not punch a clock…”. [10]
[40] In United States v. Espinoza, 9 F (4th) 633 at pages 635 to 636 (8th Cir 2021), the Court concluded that “[f]actors relevant to whether information is sufficiently current to establish probable cause include the nature of the criminal activity, the lapse of time, and the property that would be subject to the search.” In R. v. Burke, 2013 ONCA 424, at paragraph 32, the Court concluded that “the nature of the item sought and believed to be retained is a factor which may inform that the reasonableness of a belief that possession continues.” In R. v. Ramlogan, 2018 ONCJ 805, at paragraph 25, MacKay J. observed that “[d]epending on the length of the delay and the nature of the object(s) to be searched for, stale information can diminish an officer’s reasonable and probable grounds.”
[41] In child pornography cases, “the nature of the criminal activity and the nature of the property to be seized are especially relevant factors”: United States v. Burkhart, 602 F (3d) 1202 at 1206 (10th Cir 2010). [11]
[42] Courts have concluded that the issue of staleness in a child pornography investigation is different from a drug trafficking investigation. One reason for that is because a child pornography image or video is “not a consumable item like drugs”: Ballendine, at paragraph 50. [12] This conclusion is consistent with the Court’s reasoning in United States v. Vosburgh, 602 F (3d) 512 at 529 (3rd Cir 2010):
“The staleness inquiry requires us to consider the ‘type of evidence’ at issue, and we think it obvious that the type of evidence agents sought from Vosburgh’s apartment – computers and/or computer equipment – is not the type of evidence that rapidly dissipates or degrades. Nor is it the type of property that is usually quickly or continuously discarded … Therefore, the passage of weeks or months here is less important than it might be in a case involving more fungible or ephemeral evidence, such as small quantities of drugs or stolen music.” [Cases and citations omitted.]
[43] In Cusick (Sup Ct), Ricchetti J., sitting as a summary conviction appeal court judge, cited a decision of a court from the United States which concluded that the concept of staleness in a child pornography investigation is “radically” different from a drug trafficking or gun possession investigation: Cusick (Sup Ct), at paragraph 146. See also R. v. Wissink, 2018 ONSC 6787, at paragraph 31.
[44] In Cusick (Sup Ct), at paragraphs 148 and 149, Ricchetti J. concluded that, in the circumstances of that case, including the fact that the police were seeking “computer-based evidence”, the “elapse of time does not erode the evidence into the realm of suspicion.”
[45] In United States v. Espinoza, at page 637, the Court considered a staleness argument made in a child pornography case, and stated as follows:
“We give less weight to the lapse of time in these circumstances than in a case involving ‘ephemeral evidence, such as small quantities of drugs’ United States v. Vosburgh, 602 F (3d) 512 at 529 (3rd. Cir 2010)”.
[46] In United States v. Seiver, 692 F (3d) 774 at 777 (7th Cir 2012), the Court concluded that the concept of “staleness” as it relates to a proposed search of a computer is fundamentally different from a search for illegal drugs:
“‘Staleness’ is highly relevant to the legality of a search for a perishable or consumable object, like cocaine, but rarely relevant when it is a computer file. Computers and computer equipment are “not the type of evidence that rapidly dissipates or degrades.” United States v. Vosburgh, 602 F (3d) 512, 529 (3rd. Cir 2010). Because of overwriting, it is possible that the deleted file will no longer be recoverable from the computer’s hard drive. And it is also possible that the computer will have been sold or physically destroyed. And the longer the interval between the uploading of the material sought as evidence and the search of the computer, the greater these possibilities. But rarely will they be so probable as to destroy probable cause to believe that a search of the computer will turn up the evidence sought; for probable cause is far short of certainty—it “requires only a probability or substantial chance of criminal activity, not an actual showing of such activity,” Illinois v. Gates, 462 U.S. 213, 244 n. 13, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983), and not a probability that exceeds 50 percent (“more likely than not”), either. Hanson v. Dane County, 608 F (3d) 335, 338 (7th Cir 2010). Notice too that even if the computer is sold, if the buyer can be found the file will still be on the computer’s hard drive and therefore recoverable, unless it’s been overwritten. The search warrant will have designated the premises where the computer was expected to be found, and though a computer sold by the occupant will obviously no longer be there, evidence may be found there of the buyer’s identity.”
“No doubt after a very long time, the likelihood that the defendant still has the computer, and if he does that the file hasn't been overwritten, or if he's sold it that the current owner can be identified, drops to a level at which probable cause to search the suspect's home for the computer can no longer be established. But seven months is too short a period to reduce the probability that a computer search will be fruitful to a level at which probable cause has evaporated.” [Emphasis in original.] [13]
[47] In Ballendine, at paragraph 55, the Court referred to the following excerpt from Deschamps J.’s dissenting judgment in Morelli, in which she concluded, as Frankel J.A. stated, “the passage of time will not necessarily negate the existence of reasonable grounds with respect to current possession of child pornography”:
“In child pornography cases, Canadian and American courts have frequently upheld warrants issued months and even years after the occurrence of the facts relied upon for the search. In their decisions, they have relied on various combinations of three elements: the proclivity of offenders to collect child pornography, the application of common sense in light of the nature of the material, and the ability of computer forensics examiners to recover data. For example, in Neveu more than four years had elapsed between the closing of a Web site on which paying subscribers accessed child pornography and the issuance of the warrants. In Neveu, the judge explained his rejection of a staleness argument as follows:
Child pornographic images on the other hand, as disclosed in the Information to Obtain, are likely held for much longer periods of time by individuals who purchase them than the items mentioned above. In addition to relying on the opinion to that effect set out in the Information to Obtain herein, the issuing Justice could have also concluded, employing her common sense, that the retention of child pornographic images is likely more analogous to the lawful acquisition and collection of books, C.D.’s, D.V.D.’s, photographs, paintings and such items which offer the prospect of ongoing enjoyment thereby giving them their collectable nature. Collectible items are distinctively different than items which are consumable or acquired for quick resale.” [14]
[48] In Ballendine, at paragraph 55, Frankel J.A. noted that Fish J.’s majority’s reasons in Morelli did not express disagreement with this part of Deschamps J.’s reasoning. Frankel J.A. also observed, at paragraph 55, that Fish J. “distinguished the cases cited by Deschamps J. on the basis that they did not support an inference that somebody who had merely viewed child pornography in the past would currently be in possession of it.”
[49] In Ballendine, the appellant argued that the reasoning of the majority in Morelli supported his position that certain information in the ITO was too stale to be given any weight. Frankel J.A. did not agree with this argument. In Ballendine, there was information in the ITO that the appellant had purchased child pornography approximately two years before the police obtained a search warrant. Frankel J.A., at paragraph 52, stated that “central to the outcome in Morelli is the majority’s conclusion, set out in the judgment of Mr. Justice Fish, that merely viewing child pornography on the internet does not constitute possession of it.” [Emphasis added.] Frankel J.A. reasoned, at paragraph 52, that, given this conclusion by Fish J., “it is readily apparent why the majority found that reasonable grounds to search for evidence of possession of child pornography were lacking.”
REVIEW OF SELECTED CASES
[50] I will briefly review a few of the “staleness” decisions in somewhat more detail. As I previously stated, the decisions in this area are largely factually-driven.
Espinoza
[51] There are some similarities between the facts in the case at bar and the facts in United States v. Espinoza. In both cases, about seven months before the search warrants were obtained, police had information that a single image of child pornography had been uploaded. The Court in Espinoza rejected a staleness argument. At page 636, the Court stated as follows:
“That Espinoza used a computer to upload the image further increased the likelihood that evidence of child pornography would be found. After seven months, there was a fair probability that Espinoza still possessed the device he used to upload the image, and the nature of computer technology means that ‘evidence of a crime was almost certainly still on his computer,’ even if Espinoza attempted to delete the image.” [Cases and citations omitted.] [15]
[52] In Espinoza, the Court concluded, at page 636, evidence that an image of child pornography was uploaded is significant in determining whether there was probable cause to obtain a search warrant:
“When there is evidence that an image is uploaded, it is reasonable for the issuing justice to infer that the person uploading the image previously had received the file through some means, stored it on the device, later navigated to the social networking website, and then purposefully placed the file on the website. The Tumblr upload thus provided reasonable cause to believe that Espinoza willfully and deliberately accessed child pornography, and that evidence of crimes could be found on a device within his apartment.” [Cases and citations omitted.]
Raymonda
[53] In U.S. v. Raymonda, 780 F (3d) 105 at 114 (2nd Cir 2015), the majority of the Second Circuit Court of Appeals concluded that a “single incident of access to thumbnail images of child pornography, absent any other circumstances suggesting that the suspect accessed those images deliberately or had a continuing interest in child pornography, fails to establish probable cause that the suspect will possess illicit images many months [nine months] later.” [Emphasis added.] The Court held, at page 117, that the suspect’s actions were consistent with “an innocent user inadvertently stumbling upon a child pornography website.” The Court in Espinoza, at page 636, concluded that Raymonda was distinguishable because the defendant in Raymonda merely accessed a website housing thumbnail links to images of child pornography. Once again, in the case at bar, there was information in the ITO that on January 1, 2020, a child pornography image had been uploaded.
Cusick
[54] In some respects, the facts in Cusick are similar to the facts in the case at bar. [16] In Cusick, Microsoft became aware that a user of its cloud-based storage service had uploaded approximately 2000 images of child pornography between May 10 and May 19, 2012. Microsoft sent 41 Cyber Tipline reports to NCMEC. These reports included the two IP addresses of the computer or computers used to connect to the Internet and upload the files. NCMEC determined that the IP addresses originated in Canada and sent the reports to the RCMP in two groups.
[55] The RCMP received 21 reports in August, 2012 and an additional 20 reports in December, 2012. The RCMP contacted Bell Canada to identify the customer accounts associated with the two IP addresses. After the RCMP determined that the Bell client accounts had two Mississauga addresses, the information was sent to Peel Police.
[56] Peel Police conducted surveillance on both addresses. Police determined that each had a Wi-Fi network that was protected by security to prevent people from using it without a password. Police obtained search warrants for both addresses. The search warrants were executed on January 13, 2013. Police found 131 unique child pornography images and 24 unique child pornography videos on a computer that was located in the accused’s residence.
[57] The accused brought an application challenging the validity of the search warrant under sections 8 and 24(2) of the Charter. The Crown consented to the defence application to cross-examine the affiant of the ITO. The affiant was qualified as an expert “in the areas of “online cloud storage and Internet investigations”: Cusick, at paragraph 29.
[58] During cross-examination, the affiant could not say what the “chances” were, prior to executing the warrant, that the police would find relevant evidence. The affiant also testified that “he had no grounds to believe the actual image files would be at either address”: Cusick, at paragraph 81. The affiant explained that during the search of electronic devices the police look for “artifacts”, which he described as “electronic footprints left behind by the use of the computer”. The affiant testified that “how long these artifacts remain depends on many factors such as the hard drive size, user activity, the type of artifact and so forth.”
[59] The trial judge found several deficiencies with the ITO, including that it was premised on stale information. The trial judge allowed the application to exclude the evidence, after concluding that the ITO did not contain reasonable grounds to believe that evidence would be found at the address searched. The Crown appealed.
[61] The Court of Appeal upheld the decision of Ricchetti J.
[62] Juriansz J.A. stated that, given the affiant’s education and experience in cloud computing and Internet investigations, his evidence that he had reasonable grounds that relevant artifacts would be found during a search “had to be carefully considered and was deserving of weight”: Cusick, at paragraph 91. Juriansz J.A., at paragraph 99, concluded that the issuing justice, in assessing whether there were reasonable grounds to believe that evidence of the offence would be found in the accused’s residence eight months after the files were uploaded:
“…could have accorded the passage of time less weight, and attached greater weight to the expert opinion of Constable MacDonald, in this highly technical field in which common sense intuitions about the lapse of time are less helpful.”
Goodfellow
[63] Mr. Berkes argued the analysis in the case at bar should be guided by the decision in R. v. Goodfellow, 2014 ONCJ 567, aff’d 2016 ONSC 5445. In Goodfellow, the trial judge excluded evidence that police seized from the accused’s computer following the execution of a search warrant. The trial judge concluded that the ITO did not provide reasonable grounds to believe that evidence would be found in the home in which “the accused happened to reside”. In that case, the RCMP was advised by Interpol that on May 11, 2011 child pornography had been downloaded by a user at an IP address in Canada. The police applied for a search warrant 13 months after the child pornography was downloaded. In the interim, the police connected the IP address to a female subscriber who resided at the Milton address that was later searched. In concluding that the information in the ITO did not establish that there were reasonable grounds to believe that evidence of the offence would be found at the Milton address, the trial judge relied on a number of factors that are set out at paragraph 106 of his reasons, including the following:
- There was a 13-month gap between the date that the child pornography was downloaded and the date the police obtained a search warrant.
- The trial judge found that, with the exception of one person (not the accused) there was “no evidence of the identity of the residents” of the home on the date the child pornography was downloaded. The trial judge found that the affiant’s statement in the ITO that the occupants of the target residence “appear unchanged” in the 13 months since the child pornography was downloaded was a “significant overstatement”.
- The trial judge found that the affiant exaggerated or embellished other grounds in the ITO.
- The trial judge concluded a statement made by the affiant in the ITO that it had been her experience that people who download child pornography retain these files for a long time and consider their child pornography collection to be “their most prized possession” was, in the absence of information about what specific training the affiant had regarding the habits of offenders involved in offences of this nature, a broad generalization which invited “dependence on stereotypes and prejudice in lieu of evidence” and was contrary to guidance provided by Fish J. in Morelli.
[65] There are a number of factual differences between the case at bar and Goodfellow, including the following:
- In Goodfellow, the delay was 13 months. In this case, the delay was 6.5 months.
- In Goodfellow, the ITO stated that child pornography had been downloaded. In this case, the ITO stated that child pornography had been uploaded.
- In Goodfellow, the Court concluded that there was no evidence, except about one person, regarding who lived at the home when the child pornography was downloaded. In this case, based on the information in the ITO, the issuing justice had reasonable grounds to believe that the Applicant lived at unit 326, 35 Brian Peck Crescent when the child pornography was uploaded.
- In Goodfellow, the trial judge concluded that the affiant had exaggerated or embellished information in the ITO. That was not an issue in this case.
- In the case at bar, the affiant did not state in the ITO that people who download child pornography tend to view it “as their most prized possession”.
[66] In my view, the decision in Goodfellow is distinguishable on the facts from the case at bar.
ANALYSIS
[67] Mr. Berkes argued that the ITO did not support a reasonable inference that the actual image that was uploaded on January 1, 2020 would be found in the Applicant’s residence over six months later. With respect, I do not accept this argument. Given the subject matter of the image, the fact that the image was uploaded and the information in the ITO regarding the ability of forensic examiners to extract evidence from computers, it was reasonable to infer that this image would be found in the Applicant’s residence in July, 2020.
[68] In any event, an assessment of the sufficiency of the grounds in the ITO in this case cannot be limited to whether there were reasonable grounds to believe that the actual image would be found in the Applicant’s residence. The question is whether there were reasonable grounds to believe that evidence of the offences of possess and access child pornography would be found in the Applicant’s residence in July, 2020. In James, at paragraph 53, Nordheimer J.A. concluded that the trial judge erred in narrowing the inquiry to whether the ITO established that there were reasonable grounds to believe that the respondent was carrying drugs, 23 days after there was information that the respondent was in possession of a large quantity of drugs, when the appropriate question was whether there were reasonable grounds to believe that evidence (including cell phones, debt lists and packaging materials) of an offence would be found, either in the vehicle the respondent had been driving or in the residence to which he appeared to be connected. In the case at bar, if I were only to consider whether there were reasonable grounds to believe that the actual image was in the Applicant’s residence, I would commit the same error as the trial judge did in James.
[69] As explained in the ITO, the police sought judicial authorization to search for a number of items beyond the actual image that had been uploaded, including “deleted files or file fragments.” According to Detective Constable Peters, deleted files and file fragments may exist for months or years on a computer system. In assessing the weight that should be given to this part of the ITO, Detective Constable Peters’ experience and training must be considered: Cusick, at paragraph 91. While Detective Constable Peters was not qualified as an expert (unlike the affiant in Cusick), he was an experienced officer who had received significant training in conducting investigations involving computers and the Internet. In my view, the issuing justice could have reasonably accorded more weight to the information in the ITO that deleted files and file fragments may exist in a computer system for months or years, and less weight to the passage of time: Cusick, at paragraph 99.
[70] In support of the Applicant’s position, Mr. Berkes argued that “a single purchase of a gram of fentanyl in a residence six months previous cannot (without other evidence) support reasonable grounds to issue a search warrant of the residence.” I agree. However, that example is fundamentally different from the circumstances of this case. Courts in Canada and the United States have consistently concluded that the concept of staleness is different in a child pornography investigation than a drug trafficking investigation.
[71] In a helpful document filed as a guide to his oral submissions, Mr. Berkes argued that while common experience may support the conclusion that “personal items” in digital form (such as photographs of vacations and weddings) may be kept “forever” on a person’s computer, there was “no statement in the ITO deposing as to how long can one expect to find contraband on an electronic device.” The affiant stated in the ITO that people tend to keep electronic devices and digital storage media for years and that people often transfer data from an old device to a new device. Based on that information, the issuing justice could make reasonable inferences. It goes without saying that it is possible to keep a digital file containing child pornography as long as any other digital file. In my view, it was not necessary for the affiant to state how long a person might be expected to keep digital contraband. Information of that nature would likely be speculative and not particularly helpful to the court.
[72] A delay of over six months between police receiving information that a suspect had viewed one image of child pornography and the police obtaining a warrant, without something more, would very likely not support an inference that the suspect would be in possession of evidence of a child pornography offence: Morelli. That is not this case. In the case at bar, the affiant stated in the ITO that an image of child pornography had been uploaded from an IP address associated to the Applicant’s residence.
[73] Whether a user accessed, downloaded or uploaded child pornography is a relevant factor in assessing whether there were reasonable grounds to believe evidence of a child pornography offence would be found at a location: Ballendine, at para. 55; Morelli, at paragraph 87; Burke, at paragraph 32; Espinoza, at pages 636 to 637. As described in the ITO in the case at bar, there are a number of steps involved in uploading an image to the Bing image search service. Based on the information in the ITO, an issuing justice would have a reasonable basis to conclude that uploading an image to the Bing image search service involved a deliberate decision. In my view, for the purpose of determining whether the ITO contained reasonable grounds, evidence that a person uploaded a child pornography image to the Bing image search service is different from evidence that a person potentially either inadvertently stumbled upon a child pornography website or unwittingly downloaded a file containing child pornography: Espinoza, at page 636.
[74] Further, it was clearly open to the issuing justice to conclude that the person who uploaded the child pornography image to the Bing image search service did so to search for similar photographs. In my view, that is also a relevant factor in the analysis.
[75] In considering whether the ITO contained reasonable grounds, I have taken into account that at the time the ITO was drafted, the police only had information about one image of child pornography being uploaded; there was a 6 ½ month gap between the time the image was uploaded and when the search warrant was obtained; and that the ITO did not indicate whether the police conducted surveillance to determine if the Applicant’s residence had a Wi-Fi network that was password protected.
[76] I will briefly address the absence of information in the ITO about whether the Applicant’s Wi-Fi network was password protected. If the Wi-Fi network was not password protected, it may have possible for someone to have used the network without the Applicant’s knowledge. Ms. Santora acknowledged that the grounds in support of the warrant would have been stronger if the police had determined that the Applicant’s Wi-Fi network was password protected. The absence of any information in the ITO about whether the Applicant’s network was accessible without a password is a relevant consideration in assessing whether the information in the ITO contained reasonable grounds that evidence would be found in the residence. However, in my view, while the possibility that the Applicant’s Wi-Fi network may not have been password protected was a relevant factor to consider, this possibility did not so dilute the strength of the inferences which support the issuance of the warrant that the issuing justice could not have concluded that the ITO contained reasonable grounds to search the Applicant’s unit.
[77] I have concluded that the ITO contained sufficient reliable information upon which the issuing justice, acting judicially, could conclude that there was a credibly-based probability that evidence of the offences of possess and access child pornography would be found at the Applicant’s residence in July, 2020. To summarize, in support of that conclusion I rely on the following:
- The image that was uploaded on January 1, 2020 clearly depicted child pornography.
- A digital file containing child pornography, unlike illegal drugs, is not transitory or consumable.
- There was information in the ITO that deleted files and file fragments may exist on a computer system for “months or years”, and that evidence of this nature can be retrieved by computer forensic investigators.
- The image was uploaded, not downloaded or merely accessed.
- The image was uploaded to an online search service “that provides similar images to an image provided by the user.”
- There was evidence that the Applicant lived at unit 326, 35 Brian Peck Crescent, when the files were uploaded and continued to live there when the search warrant was obtained.
[78] I will address one additional issue. The scope of the items to be searched for and seized under the warrant was broad. However, in my view, it was not unconstitutionally broad. I have concluded that the ITO contained sufficient grounds to support the issuance of the warrant allowing for the search for and seizure of all of the items listed in Appendix A. [17] Even if I am wrong in concluding that the warrant was not overly broad, the ITO contained reasonable grounds to support both the search for the computer (which was later found to contain the child pornography) and the examination of its contents. Search warrants are severable. Where there is “a clear dividing line between the good and bad parts of a search warrant, the bad part of the warrant can be severed from the good, and the good part stands”: R. v. Yabarow, 2019 ONSC 3669, at paragraph 30. [18] In this case, it is possible to sever any part of the warrant which could be seen to be overly broad from the part of the warrant which authorized the search and seizure of the computer.
CONCLUSION
[79] Despite the very able submissions of Mr. Berkes, I am satisfied that there was a reasonable basis upon which the issuing justice could have issued the search warrant. Given my conclusion that the Applicant’s rights under section 8 of the Charter were not violated, there is no need to consider section 24(2). The application to exclude the evidence is dismissed.
NORTH J.
Notes
[1] The information in this section was contained in Appendix C of the ITO, other than the description of what occurred during and after the execution of the search warrant.
[2] NCEMC is an organization in the United States that serves as a resource centre for families, victims, private organizations, law enforcement and the public in relation to missing and sexually exploited child issues.
[3] In Appendix C, the affiant stated that “uploading” means “data is being sent from your computer to the Internet.” The affiant stated that “downloading” means “your computer is receiving data from the Internet.” Finally, the affiant explained what “Bing Image” is, and how it works. I address that later in these reasons.
[4] According to the ITO, NCECC is “Canada’s main portal for all matters related to the sexual exploitation of children on the Internet.” NCECC “validates international requests and prepares and disseminates investigative packages to the proper jurisdiction within Canada.”
[5] This information was contained in the Form 2 response filed by Crown counsel on this application.
[6] In this case, the statutory threshold for issuing the search warrant is set out in section 487 of the Criminal Code. Section 487(1) (b) provides that a justice who is satisfied by information on oath that there are reasonable grounds to believe that there is in a building, receptacle or place anything that there are reasonable grounds to believe will afford evidence with respect to the commission of an offence may issue a warrant authorizing a peace officer to search the building, receptable or place for any such thing and to seize it. [Emphasis added.]. The phrase “will afford evidence with respect to the commission of an offence” includes all materials which might shed light on the circumstances of an event which appears to constitute an offence: CanadianOxy Chemicals Ltd. v. Canada (Attorney General), [1999] 1 SCR 743, at paragraph 15.
[7] Deschamps J., in dissent.
[8] This is from the decision of the Superior Court in Cusick. In these reasons, I will be referring to the decisions of both the Superior Court and the Court of Appeal in Cusick. I will indicate when I am referring to the Superior Court decision (“Sup Ct”).
[9] In James, Nordheimer J.A. dissented. The Supreme Court of Canada allowed the appeal “substantially for the reasons of Justice Nordheimer, to the extent that he concluded that there was no breach of s. 8 of the Canadian Charter of Rights and Freedoms”: R. v. James, 2019 SCC 52. When I refer to the decision in James, I am referring to Nordheimer J.A.’s reasons.
[10] See also Koelling, at page 822.
[11] This passage from Burkhart was cited by the British Columbia Court of Appeal in Ballendine, at paragraph 56.
[12] This statement was made by the trial judge in Ballendine and was referred to by the Court of Appeal in its reasons.
[13] In Seiver, the Court rejected an argument that information that child pornography had been uploaded seven months before the search warrant was obtained was stale. The reasoning of the Court in Seiver has been relied on in a number of decisions, including: United States v. Carroll, 750 F (3d) 700 at 706 (7th. Cir 2014); United States v. Reichling, 781 F (3d) 883 at 887-888 (7th. Cir 2015); United States v. Rees, 957 F (3d) 761 at 770-771 (7th. Cir 2020); United States v. Bosyk, 933 F (3d) 319 at 331 (4th. Cir 2019); Espinoza, pages 636-637.
[14] R. v. Neveu, [2005] NSPC 51.
[15] In Espinoza, at pages 636-637, the Court was clear that this evidence was not restricted to the child pornography image itself.
[16] There are two obvious differences between the facts in the case at bar and Cusick. First, in Cusick, there was information in the ITO that the user uploaded about 2000 child pornography images. Second, in Cusick, as noted at paragraph 9, there was information in the ITO that the user’s Wi-Fi network “was protected by security to prevent use by persons without passwords.”
[17] In arriving at this conclusion, I adopt the reasoning of Borenstein J. in R. v. Stemberger, 2012 ONCJ 31, at paragraphs 109 to 113.
[18] See also R. v. Paterson (1985), 18 CCC (3d) 137 (Ont. C.A.), aff’d , [1987] 2 SCR 291; Nader Hasan, Mabel Lai, David Schermbrucker and Randy Schwartz, Search and Seizure, Criminal Law Series (Toronto: Edmond Publishing, 2021), at pages 647-649.