WARNING
The court hearing this matter directs that the following notice be attached to the file:
A non-publication and non-broadcast order in this proceeding has been issued under subsection 486.4(3) of the Criminal Code. This subsection and subsection 486.6(1) of the Criminal Code, which is concerned with the consequence of failure to comply with an order made under subsection 486.4(3), read as follows:
486.4(3) CHILD PORNOGRAPHY — (1) In proceedings in respect of an offence under section 163.1, a judge or justice shall make an order directing that any information that could identify a witness who is under the age of eighteen years, or any person who is the subject of a representation, written material or a recording that constitutes child pornography within the meaning of that section, shall not be published in any document or broadcast or transmitted in any way.
486.6 OFFENCE — (1) Every person who fails to comply with an order made under subsections 486.4(1) to (3) or 486.5(1) or (2) is guilty of an offence punishable on summary conviction.
ONTARIO COURT OF JUSTICE
DATE: November 16, 2022
BETWEEN:
HIS MAJESTY THE KING
— AND —
MAHESH BISESAR
Before: Justice L. Botham
Reasons for Judgment released on November 16, 2022
Counsel: P. Santora, counsel for the Crown M. Huberman, counsel for the accused Mahesh Bisesar
Reasons for Judgment
BOTHAM J.:
[1] Mahesh Bisesar is facing five charges relating to the making, accessing and possession of child pornography. The charges in my view can be grouped into two categories. The first three charges require a consideration of what are the elements of the offence of making child pornography. I will deal with them first.
[2] He is charged under 172.1 of the Criminal Code with communicating with a person under the age of 18 years, for the purpose of facilitating the commission of the offence of making child pornography.
[3] He is also charged under 172.2(1) of the Criminal Code with making arrangements by way of telecommunication with a person who is or who he believes is under the age of 19 years to make child pornography.
[4] Finally, he is charged under s. 163.1(2) of the Criminal Code with making child pornography.
[5] These three offences are said to have occurred between the 21st day of May 2018 and the 9th day of February 2019, at the City of Toronto in the Toronto Region. The evidence relevant to these three offences are essentially the records of Skype text messages which occurred during that time period and certain images located on the computer seized from his home.
[6] An Agreed Statement of Facts (ASF) was filed in this matter. There is no dispute that Mr. Bisesar’s personal computer was seized pursuant to a search warrant and searched. At the time, the police were investigating connections between Mr. Bisesar and Clairebe Cristobal, a woman residing in the Philippines who had been arrested for selling webcam shows involving the sexual abuse of children worldwide.
[7] A search of the computer located Skype records containing copies of chat logs between webpromo-inc.com and various email addresses associated with Ms. Cristobal. It is clear from a review of those chat logs that webpromo-inc.com was seeking to purchase viewing access to these webcam shows. It would appear from a review of those chat logs that at times webpromo-inc.com was viewing someone or a visual representation of someone. Messages were sent to Ms. Cristobal stating, “ok, send me cam, I want to see her body shape and breast size, if I like then we deal” or “I need to see them stand so I can see their shape, I need to see their breast sizes”. Although the text messages themselves are recorded in the Skype chat logs and it can be seen that webcam activity occurred contemporaneous with these requests, the actual online viewings are not recorded.
[8] It is conceded by the defence that images consistent with the Criminal Code definition of child pornography were found on the computer, as were videos. It is conceded that cached images consistent with child pornography were stored in the Skype cache file.
[9] Detective Constable Kidd, who was qualified to give opinion evidence with respect to the forensic examination of computers, testified that caching is a passive function. The existence of a cached file does not establish that the image contained in the cache file has been downloaded. Rather, if one was to browse through a web site, that information once viewed would be cached. The user is interacting with the browser but has no control over what the browser is doing.
[10] Constable Sisk, who had been the lead investigator on this file, testified that she had been provided with photographs of Ms. Cristobal and her children and upon viewing some of the videos located in the computer, she located video images of a girl she believed to be associated with Ms. Cristobal, naked with the camera focused on her genitals. That video was not located in a Skype file and she conceded that she could not say that it was associated with the live streaming, documented in the Skype chats.
[11] The first issue to be resolved in my view is whether the actions captured in the Skype chats, coupled with the fact that images that would meet the definition of child pornography were located in the Skype cache files, prove that the defendant is guilty of making child pornography, communicating with a person under the age of 18 for the purpose of making child pornography, or making arrangements through telecommunications with a person under or believed to be under 19 for the purpose of facilitating the making of child pornography.
[12] It is conceded that certain images located on the defendant’s computer meet the definition of child pornography, either as discreet images or videos. It is not alleged that the defendant created those videos or images.
[13] However, the Crown submits that those Skype chats where webpromo-inc.com is directing the actions of whoever he is viewing on the live stream, by asking them to show their breasts or turn in such a way that they are more visible, makes out the offence of making child pornography and by extension the other two related offences because, if I understand her argument, he is changing how the person he is viewing is presented.
[14] The relevant definition of child pornography referenced at this trial is s. 163.1(1) of the Criminal Code which defines it as a photographic, film, video or other visual representation, whether or not it was made by electronic or mechanical means that shows a person who is or depicted as being under the age of 18 years and is engaged or depicted as engaged in explicit sexual activity or where the dominant characteristic of the visual representations is sexual in nature and depicted for a sexual purpose.
[15] Section 163.1(2) makes it an offence for anyone to make, print, publish or possess for the purpose of publication any child pornography.
[16] I don’t understand the Crown to be asserting that the directions captured in some of the chats would constitute print, publish or possess for the purpose of publication, so the issue is really whether by providing the directions captured in the chats, the speaker can be said to be making child pornography, rather than simply viewing it.
[17] It is clear from a review of the Skype chats that webpromo-inc.com is seeking to pay for web streaming of young girls for sexual gratification. There are many discussions about how payment has been made but that there has been no ability to access that web streaming. There are discussions about the type of girls, webpromo-inc.com wants to view, specifically with respect to age and body development.
[18] I think it a fair inference that in at least one series of chats, webpromo-inc.com is viewing someone on Skype and it makes sense that person is under the age of 18 or presenting themselves as such. It appears to me from viewing the chats, that the young woman is being presented with a view to essentially establishing that this would be a web stream that webpromo-inc.com would like to purchase.
[19] The Canadian Oxford Dictionary, second edition defines the verb “make”’ as “construct, create, form from parts of other substances”. I am not persuaded that the issuing of directions as captured by the Skype messages, change the act of viewing a pornographic web stream to one of making a visual representation. I can see no basis for finding that the actus reus for 172.1, 172.2(1) or 163.1(2) have been made out on this evidence and those charges will be dismissed.
[20] Another issue had been raised by the defence with respect to these charges and I think it appropriate to address it, even though it is somewhat moot, given my dismissal of those charges.
[21] It is conceded that webpromo-inc.com is Mr. Bisesar’s email account. It is also conceded that the chats are recorded on Mr. Bisesar’s Skype account. A review of his PayPal account shows that charges were accrued to a company in the Philippines which appear at times proximate to what would appear to have been streaming opportunities with the live streaming company operated by Ms. Cristobal.
[22] Left with only that evidence, one might fairly find that the only reasonable inference to be drawn is that Mr. Bisesar is the participant, named webpromo-inc.com.
[23] However, Mr. Bisesar has testified that at the time of these Skype chats, he was not the only one accessing the Skype account. He had a tech company and at least two employees who used that Skype account to communicate with customers. From 2016 to 2019 or 2020, he had two employees who had previously been a co-op student with him. They used his Skype account to communicate with customers. They used the same passwords that he did for Skype. His PayPal account used the same password as the Skype account.
[24] That in and of itself, would not necessarily explain how 35 cached files containing images consistent with child pornography were found on his computer. However, Aniko Kiss, who was also qualified to give opinion evidence with respect to the forensic examination of computers, testified that she investigated what could happen should two devices be logged into the same Skype account.
[25] She logged into a Skype account, where another device was already logged in, using a second, separate device and determined that the images viewed, would also be saved on the Skype folder of the initially logged in device. This evidence has to be viewed with the caveat that she could only test Skype as it exists now, not the software as it existed in 2018.
[26] Cst. Kidd who had reviewed her report, didn’t take issue with her findings.
[27] Mr. Bisesar testified that he did receive some emails from his PayPal account showing that there had been transactions with the Philippines in Philippine currency. The emails had links attached to them that could be opened. He did not and in fact ignored the emails, believing that they were simply spam or phishing, given that it was a foreign currency and he had not initiated any transactions with any company in the Philippines. I don’t reject Mr. Bisesar’s evidence on this point. He was not challenged on the fact that he had a tech company during the requisite time and that he had employees who were accessing his Skype account. There is expert evidence that images downloaded by one user of a Skype account, could be saved on the Skype folder of another logged in device.
[28] The Crown submits that if I find that the defendant was in possession of the other pornographic images located on his computer, then I can consider that as evidence from which an inference can be drawn that the defendant was more likely to be the person involved in the live web chats and that he was in possession of the images saved in the Skype file.
[29] I am not aware of any authority which would support this proposition. There is a general prohibition against the cross-count admissibility of evidence in a multi-count information or indictment. In this case the Crown did not apply for an order that evidence relevant to one count could be used as evidence with respect to other counts, on the basis that it was admissible as similar fact evidence. If this was a jury trial it would be incumbent on me and reversible error not to instruct the jury that evidence on one count was not to be used on other counts but also that guilt with respect to an individual count cannot be inferred from evidence of general disposition or propensity. See R. v. M.(B), 1998 130 CCC 3d 353.
[30] It is possible that the 35 images located in the Skype file were downloaded by one of the other users of the Skype account and had I found that the Skype messages established that the offences relating to the production of child pornography were made out, I would still have been left in a state of reasonable doubt as to whether or not those actions were the actions of the defendant.
[31] Mr. Bisesar is also charged that, between the 21st day of May in the year 2018 and the 4th day of March in the year 2021, he did possess child pornography under s. 163.1(4) of the Criminal Code and that during the same time period that he accessed child pornography per s. 163.1(4.1) of the Criminal Code.
[32] It is admitted that images and videos were found on his computer which would meet the definition of child pornography.
[33] Mr. Bisesar testified that his company provided a website hosting service for various clients. There were times when a website might become compromised and because the websites were still operational, he would download the websites to his computer and order a new server. Once that was received, he would upload the websites to the new server. Once that had occurred, he would delete the client’s files.
[34] This could involve thousands of files being downloaded to his computer. Generally, he would download to his D drive although there may have been times when those files might have been moved to a secondary drive to make space on the D drive.
[35] He specifically recalled that in June 2018 a client reported that they had been hit with ransomware and asked if he could assist. He copied the files to his computer to attempt to decrypt them. He had had to disable his antivirus software to accomplish this.
[36] He didn’t look at the files. He saved the files onto his drive and once the job was complete, he would have deleted the files.
[37] He thought it was possible that the images and videos found on his computer might have been introduced into his computer by downloading a client’s files in this manner. He was aware that his computer might have been compromised at one point and he sought assistance to deal with that and wondered if the images and videos might have been introduced as a result of malware being introduced into his computer.
[38] Detective Constable Kidd testified that there did exist some malware that could access another person’s computer and go online and download images and videos. He did agree that if Mr. Bisesar had copied a client’s files from his server, they would end up on his computer and he would not see the content of the files if he simply downloaded them without opening the files.
[39] Mr. Bisesar also testified that from 2011 to 2016, he had co-op students working for him. They worked in the office. There were perhaps 5 students who had access to his computer when they were dealing with files that were too large for the computer that had been assigned to him. There were also times, quite naturally, when he might be out of the office for an hour at a time and the students in the office would have access to his computer, if they chose to do so and the passwords for his computer were readily available. Two of the co-op students continued to work for him up until 2019 or 2020. They worked from home and would connect remotely to the computers in the office. He was asked if they would connect remotely to his computer and he replied that they shouldn’t have but technically they could have. I have no reason to reject his evidence on this issue.
[40] I also can accept that Mr. Bisesar, may well have downloaded client files as he has described as part of the technical services he offered. He has described those files as being saved to the D drive, although he offers that he might possibly have moved those files to a secondary drive to open up space on the D drive. As I say, that may well be true, however, the issue at trial, is not how he operated his business but whether I am satisfied beyond a reasonable doubt that the child pornographic images and videos on the computer were knowingly stored there by Mr. Bisesar’s actions and or that he knowingly accessed such images and videos.
[41] Detective Constable Kidd conducted the examination of Mr. Bisesar’s computer. He explained that there were two physical hard drives in the computer. He characterized them as 2-1 and 2-2. In total there were three user utilized partitions. Two of the partitions were in a RAID 1 format and accounts for Drive C. The other 1TB of exhibit 2-1 was a separate partition and was referenced as drive D.
[42] Child pornography was found on 2-1 and 2-2. The images and videos were stored in the user generated accounts. Some were files visible to a user. Others were cached files or thumbnail files.
[43] Both cached files and thumbnails are passively created files. The user is interacting with the browser but has no control over what the browser is doing. Some may well not have been downloaded to the computer but the cached files and thumbnails, would require that the images were viewed, although not downloaded. Neither of those files would be visible to the user.
[44] There were also orphan files. These are also files which are not in plain sight. They are created when a folder is deleted and the files contained in that folder are now orphans.
[45] Exhibit 5, which is a chart prepared by the officer outlines the file paths for the 475 unique images of child pornography and 132 unique videos. Some are described as orphan files, others as cached files but there are also a number of images and videos, located in 2-1, partition 5 which were visible to a user.
[46] The officer located on drive D, which he described as partition 5, located in 2-1, a folder labelled New Folder which contained 8 other folders. He manually confirmed that those folders would be easily available to anyone accessing the computer. Images which met the definition of child pornography were located within those folders. Within the folder labelled ‘latin masturbation’, were a number of videos which met the definition of child pornography.
[47] The Crown bears the onus of prove guilt beyond a reasonable doubt. The defendant is entitled to the benefit of reasonable doubt on any of the issues I need to decide. I accept what Mr. Bisesar says in terms of having downloaded clients’ files to his servers during the course of business. I accept that in the past he has had co-op students who may from time to time have used his computer.
[48] He has also testified, as previously discussed, that he had downloaded client files as part of his work. It is suggested inferentially that that could have been the source of the images and videos in question.
[49] I am well aware that where proof of one or more elements of an offence depends solely or largely on circumstantial evidence, as it does here, the Crown will not meet its standard of proof beyond a reasonable doubt where there are reasonable inferences other than guilt available on the evidence led at trial. (R. v. Villaroman, 2016 SCC 33, 2016 1 SCR 1000 para 35.)
[50] Justice Cromwell at para 37 of Villaroman writes that,
when assessing circumstantial evidence the trier of fact should consider other plausible theories and other reasonable possibilities which are inconsistent with guilt. The crown may need to negative these reasonable possibilities but certainly does not need to negative every possible conjecture, no matter how irrational and fanciful which might be consistent with the innocence of the accused. Other plausible theories or other reasonable possibilities must be based on logic and experience applied to the evidence or the absence of evidence, not on speculation.
[51] Images and videos which meet the definition of child pornography were located in the 2-1 hard drive, on what the officer described as the D drive, which I understand was the drive that Mr. Bisesar would have used to store client files while servicing their websites. However, those images and videos had not been deleted, as Mr. Bisesar testified he would have done once client files had been reloaded to their server. Rather, the officer was able to open the files and view the images and videos. The officer pointed to one file, entitled latin masturbation, which when opened contained a number of such videos. The names of other of the files were also sexually suggestive.
[52] Nor were the images confined to the D drive. The second hard drive 2-2, also contained images and videos which meet the definition of child pornography. Some were orphan files, suggesting that a file had been previously deleted, others were cached files, which would have been generated by the viewing of those images.
[53] The suggestion that the source of these images and videos may have been from malware or a client’s server which had been downloaded to Mr. Bisesar’s computer, or as a result of an employee accessing his computer, is not in my view a reasonable possibility when I consider all of the evidence at this trial. It does not amount to anything more than speculation and does not leave me in a state of reasonable doubt on the issue of whether Mr. Bisesar was aware of the existence of child pornography on his computer.
[54] I am satisfied beyond a reasonable doubt that he had knowledge of the images and videos in question and that he was in possession of those images, both those that were readily accessible at the time that the computer was seized and the orphan files which would have been created by the deletion of files that had contained those images. With respect to the cached images, except for the cached images located in the Skype file, I am satisfied beyond a reasonable doubt that any other such images would have been generated by the viewing of the images by Mr. Bisesar. As such the offence of possession of child pornography and accessing child pornography have been made out.
[55] I find him not guilty on count 1, 2 and 3 but guilty on count 4 and 5.