COURT FILE NO.: CR-11-0026-00

DATE: 2012-11-13

ONTARIO

SUPERIOR COURT OF JUSTICE

B E T W E E N:

HER MAJESTY THE QUEEN

Mr. C. Busque, for the Crown

Crown

• and -

JOHN GAROFALO

Mr. G. Joseph, for the Accused

Accused

HEARD:

May 1-2, May 4, August 1 and 3, 2012,

at Thunder Bay, Ontario

Regional Senior Justice H.M. Pierce

Reasons For Judgment

Reasons for Judgment

Introduction

[1] John Garofalo is charged that between August 13^th – 14^th, 2009, he communicated by means of a computer system with a person under the age of 18 for the purpose of facilitating a sexual assault on her, contrary to s. 172.1 of the Criminal Code. He pleaded not guilty to the charge. The defence presented evidence but the accused did not testify.

[2] The issue in this case is identity: is the accused the person who committed the offence? The defence concedes that an offence occurred based on the agreed statement of facts. However, the accused denies he is the offender.

[3] The agreed and conceded facts, set out in exhibit 1, are as follows:

• The complainant, A.H., was 15 years old in August, 2009. She placed a notice on Kijiji.com looking for a person who would dress as a cartoon character and attend a cartoon convention with her.
• Kijiji.com is a free internet site for personal messages and the sale of items, similar to the classifieds section of a newspaper. It allows users to contact others through a message system.
• On August 12, 2009, A.H. received a reply to her notice from a user whose e-mail address was tomford1999@hotmail.com. On August 13, 2009, this person provided a telephone number, (807) 629-4270.
• During the initial e-mail exchange with this person, A.H. supplied her age.
• The responding person indicated he was “a guy”, aged 36. This person solicited A.H. twice to meet for a sexual purpose. These solicitations occurred on August 14, 2009. A.H. declined to meet this person. The solicitations constituted a criminal offence pursuant to s. 172.1 of the Criminal Code.
• A.H. reported the solicitations to Detective Constable Heyder of the Thunder Bay Police Service.
• The police served a production order on Microsoft Canada for customer account information and the internet protocol (“I.P.”) connection logs for the e-mail address, tomford1999@hotmail.com. These productions were filed as exhibit 5.
• Police also served a production order on Shaw Cablesystems for the business records of the associated I.P. connection logs and client information. These productions were filed as exhibit 6. They contain customer information related to I.P. addresses and the dates and times specific I.P. addresses were accessed.
• The former fiancée of the accused, Maria Sgambelluri, has a nephew, Joseph Sgambelluri, and two nieces, Daniela and Alysia. The children were 14, 12, and 9 respectively at the time of the offence. All three children used Maria Sgambelluri’s computer. None of the children knew or accessed the e-mail address, tomford1999@hotmail.com. None of them wrote or sent the e-mails that are the subject matter of this case.
• The accused and Maria’s brothers, Joe and Tony Sgambelluri, and others had access to her computer as well.

[4] The case against the accused is based on circumstantial evidence. The Crown contends that the offending messages can be traced back to the accused through computer records and a cell phone number associated with an account holder called Tony Fraser. The Crown says the Tony Fraser phone number belongs to the accused. Finally, the Crown submits that Sandra Sgambelluri identified the accused’s voice during a telephone call to the Tony Fraser number.

[5] The defence submits that the Crown’s evidence proves that the tomford1999 password was compromised because Tony Sgambelluri had access to his sister, Maria Sgambelluri’s computer. The defence argues that if the password was not secure, it could have been accessed by multiple users, any one of whom could have inserted any phone number in a message.

[6] The defence also submits that the voice identification evidence provided by Detective Constable Heyder and Sandra Sgambelluri is contradictory and fallible. Finally, the defence offers alibi evidence to establish that the accused was at work on a date and at a time when the tomford1999 account was used on Maria Sgambelluri’s computer. The Crown challenges the quality of the alibi evidence.

[7] The burden is on the Crown to prove the charge beyond a reasonable doubt.

The Evidence

Computer Evidence

[8] The first question for the court to consider is whether the accused can be identified with the tomford1999@hotmail.com address in the offending message. To do so, a consideration of the computer evidence is required.

[9] Maria Sgambelluri lived with her mother, Angela Sgambelluri, at 449 Sycamore Place in Thunder Bay. Maria and the accused became engaged in December, 2008. Their engagement ended in November, 2009, when Maria became aware of the investigation into this charge.

[10] In August, 2009, Maria and the accused purchased a home at 347 Lambton Crescent that they intended to occupy on marriage. In the meantime, Maria continued to live with her mother. The accused lived at 348 Ryerson Crescent, Thunder Bay, with his father, Vittorio Garofalo, his mother and younger sister. He lived at this residence until the end of July or early August, 2009, when he began sleeping at the new house on Lambton. There was no internet service at Lambton. A tenant also occupied a room in the Lambton house. Although the tenant had a computer, Maria never saw Mr. Garofalo use it. The police did not seize the tenant’s computer. The tenant advised police that the accused did not use his computer.

[11] The accused did not own a computer. However, the accused’s parents kept a desk top computer and monitor in the basement of their home. They had high speed internet. Maria was present when the accused used this computer; she also observed the accused’s sister and nephews use it.

[12] Maria had a laptop computer that stayed at her residence except when the police examined it. The accused visited her home daily, usually between 4:30 – 5 p.m. after his work, unless he had an appointment. Then he might come earlier. Maria worked on Thursdays from 3– 9 p.m., Friday and Saturdays from 9:30 a.m. – 6 p.m., and Sundays once a month.

[13] Mr. Garofalo used Maria’s computer very frequently. She estimated, at a minimum, that he used her computer 5 days out of 7. He accessed the Kijiji site to shop for furniture and other acquisitions. Maria did not go on the Kijiji site and was not aware of anyone else at her home who did.

[14] She testified that the accused’s internet address was jgarof@hotmail.com. Maria gave this information to Detective Constable Heyder. Maria also knew his password: jgarof. Maria never received an e-mail from tomford1999@hotmail.com. Mr. Garofalo’s cell phone did not have e-mail capacity.

[15] Detective Constable Heyder obtained a source code from the offending e-mails in the complainant’s possession. The source code identified an I.P. address from the tomford1999 address: 216.26.209.28. An I.P. address is the number assigned by the internet service provider to a computer user during a particular connection to the internet. When the user disconnects from the internet, the I.P. address is assigned to another internet user. While there are permanent I.P. addresses, these are assigned to commercial users. Residential users share I.P. addresses. Thus, an I.P. address does not usually identify a single computer on an on-going basis. However, it can be useful to narrow the location of the computer and identify the service provider.

[16] Detective Constable Heyder initially took the I.P. address from the offending e-mails to TBaytel to determine what computer was assigned the I.P. address contained in the e-mail. Shirley Whiteman, a corporate security officer with TBaytel, testified that her company has a block of assigned I.P. addresses; the prefix, 216, is within that block.

[17] Exhibit 4 shows the customer information in the possession of TBaytel. The registered customer name was Vittorio Garofalo, 348 Ryerson Crescent, Thunder Bay. The user name was tgarofalo@tbaytel.net. Vittorio Garofalo’s I.P. address was not permanently assigned but changed randomly with each internet connection. A user name is not the same as an account subscriber. Any person can log onto the internet who has access to a subscriber’s account; the account is merely a portal. The account information, alone, does not identify the accused as the sender of the offending e-mails. Anyone who has access to the service can adopt the user name, if known, for the purposes of access to the internet.

[18] Exhibit 4 shows that between August 14, 2009 at 10:23:14 hours and August 15, 2009 at 10:15:57 hours, the computer was connected to the internet through the user name, tgarofalo@tbaytel.net and with an I.P. address of 216.26.209.28. This is the I.P. address that was attached to the sender’s offending e-mail.

[19] Exhibit 7 lists the I.P. addresses with a 216 prefix assigned to TBaytel customers. The times in the exhibit are expressed in Pacific Time, three hours earlier than Eastern Time which is the time zone for Thunder Bay. The last page of that exhibit shows that the account registered to tgarofalo accessed the internet on August 14, 2009 at 10:23:14 through to August 15, 2009 at 10:15:57. The I.P. address for this connection was 216.26.209.28. This is also the I.P. address attached to the offending e-mail.

[20] The tgarofalo user name was also connected to the internet on August 15, 2009, between 11:37:04 hours and 11:43:18 hours. The I.P. number associated with that transaction was changed to 216.211.122.209. Later on August 15, 2009, the tgarofalo user name logged onto the internet between 20:14:13 hours and August 18, 2009 at 9:15:10 hours. The I.P. address assigned to that connection was 216.211.93.103.

[21] Next, Detective Constable Heyder sought information from Microsoft Canada about the tomford1999 hotmail address. Hotmail is a free e-mail service provider. A prospective user can obtain an e-mail account from the website by providing required information, including a user name and password. There are no safeguards to ensure the information provided is truthful. If the password is known to others, it can be accessed by them. If the password is protected, however, access to the e-mail account will be limited.

[22] Exhibit 5 is the reply to the Microsoft Canada production order. The application for a hotmail account shows the applicant for that account was Tom Ford, with an address of Ontario, Canada, postal code “P7C1Y3.” The postal code is for the Northwood area of Thunder Bay.

[23] The time zone in the application was said to be “America/Toronto.” The internet address was registered as tomford1999@hotmail.com on 11/3/2008 at 4:17:43 Pacific Time (i.e. three hours behind Eastern Standard Time, the zone in which Thunder Bay is situated). Referring to other logs provided in the Microsoft return, I conclude the registration was effected on November 3, 2008. The I.P. address associated with the computer at the time the application for the hotmail address was registered was 216.26.201.244, a TBaytel account.

[24] Microsoft Canada also provided the history of the use of the tomford1999 hotmail address and the associated I.P. addresses assigned to it from August 15, 2009 to October 14, 2009.

[25] The Microsoft records show that on August 15, 2009, the tomford1999 account was active at 6:15:38 a.m. Pacific Time with an assigned I.P. address of 216.26.209.28. This is the I.P. address identified on the offending e-mails. The tomford1999 address also accessed the internet that day at 8:41:32 a.m. and 5:21:42 p.m., Pacific Time from different I.P. addresses.

[26] Exhibit 7 also showed that the tomford1999 user accessed the internet using an I.P. number beginning with the prefix 70. Detective Constable Heyder testified that the designation, 70, indicates a Shaw Cable address. The officer obtained evidence shown in exhibit 6 from Shaw indicating that the tomford1999 user accessed the internet using the Shaw service subscribed in the name of Angela Sgambelluri of 449 Sycamore Place, Thunder Bay. These connections were assigned the following I.P. addresses on the following days:

• 70.76.195.166 on August 30, 2009 at 4:52:40 p.m. PDT
• 70.76.195.166 on September 4, 2009 at 7:32:37 p.m. PDT
• 70.76.195.166 on September 11, 2009 at 4:40:40 p.m. PDT
• 70.76.195.166 on September 26, 2009 at 4:16:49 p.m. and 5:43:11 p.m. PDT.

[27] Exhibit 6 also indicates that the tomford1999 user accessed the internet using the Thunder Bay Public Library’s Shaw service twice, on September 9, 2009 at 8:07:56 a.m. and 8:09:26 a.m. PDT. The I.P. addresses for those connections were 24.109.252.202. The Thunder Bay Public Library does not maintain video surveillance of its computer users.

[28] Finally, exhibit 6 showed the tomford1999 user accessed the internet using the Shaw service subscribed by Dominic Lento of 339 Lambton Crescent, Thunder Bay on eight occasions. All of the I.P. addresses are traced to Vittorio Garofalo. The record of these connections is as follows:

• 24.109.207.113 on September 15, 2009 at 9:33:52 p.m., 10:29:57 p.m. PDT and on September 16, 2009 at 11:27:36 a.m. PDT
• 24.109.207.113 on September 19, 2009 at 4:55:20 a.m., 7:25:15 a.m., 7:42:06 a.m., 8:07:17 a.m. and 8:23:03 a.m.

[29] During the period from August – October, 2009, Domenic Lento resided at 339 Lambton Crescent, with his wife and two children. Mr. Lento’s children were 13 and 10 at that time. He testified that his wireless service was unprotected for a period of 5 - 6 years from when he moved into the house, though he did not say when the family moved in.

[30] Mr. Lento’s residence is two doors away from the home the accused and Maria Sgambelluri purchased at 347 Lambton. Mr. Lento had wireless internet service at his home which was not secured by a password at the time of the police investigation. Detective Constable Heyder used a hot spot locator, which is an electronic device that searches for an open wireless internet source. She discovered that the internet service at the Lento home was not protected and could be accessed by others in the area, as far away as 4 – 5 houses distant. The officer did not indicate when this testing was done.

[31] As it was unprotected at the time of the police investigation, and had been unprotected for 5 – 6 years, I conclude it was also unprotected in August, 2009.

[32] The Lento children were at school on week days, and in bed between 9:30 – 10:00 p.m.; they would not have had access to the computer during school hours or late at night. Mr. Lento testified that no one in his residence would have been on the computer on September 16, 2009 at 12:33 a.m. or at 1:29:57 a.m. He indicated he would have been sleeping. By inference, I conclude the rest of his family would also have been sleeping at those times.

[33] When asked about computer activity in his home on September 16, 2009 at 2:27 p.m., Mr. Lento indicated that his wife was home during the week, and all of the family was home on the weekends. Mr. Lento was not familiar with the e-mail address, tomford1999@hotmail.com. He was also not familiar with anyone in his home using this e-mail address.

[34] Detective Constable Heyder sought a production order from TBaytel to see if there was any correlation between the I.P. addresses Microsoft supplied for tomford1999@hotmail.com and TBaytel subscribers. The results are contained in exhibit 7. In each instance, the user name was tgarofalo. The officer explained that the tomford hotmail account was not always accessed via TBaytel; there are instances when it was accessed via Microsoft.

[35] With respect to the TBaytel records, she found that between August 25, 2009, at 7:31:37 a.m. and 3:38:56 p.m., a connection belonging to Vittorio Garofalo was used to access tomford1999@hotmail.com twice. The I.P. address assigned to both connections was 216.211.73.109.

[36] The officer noted that from August 26 at 10:55:37 – August 31, 2009 at 14:23:36 Eastern Time, the user accessed the tomford hotmail account 18 times from Vittorio Garofalo’s account.

[37] In the interval between September 1 at 9:45:17 and September 6, 2009 at 14:37:44 Eastern Time, a period of 5 days, the user accessed the tomford hotmail account 24 times using Vittorio Garofalo’s account.

[38] From September 7 at 17:03:15 to September 13, 2009 at 00:03:30 Eastern Time, a period of 5 days, the user accessed the tomford hotmail account 20 times using Vittorio Garofalo’s account.

[39] Finally, from September 14 at 10:22:02 to September 28, 2009 at 09:58:19 hours Eastern Time, the user accessed the tomford hotmail account using Vittorio Garofalo’s internet account 27 times.

[40] Maria Sgambelluri’s younger brother, Antonio (Tony) Sgambelluri, works at Future Shop in Thunder Bay. He is computer - savvy. He is also protective of his sister.

[41] Tony received a Facebook message suggesting that the accused was involved with other women during his engagement to Maria. In particular, the Facebook informant suggested the accused had been accessing a dating website called Plenty of Fish. He knew that the accused used Maria’s computer and decided to investigate. Unbeknownst to Maria or anyone else, Tony installed a trial version key logger program on her computer.

[42] The key logger program is a type of spyware. The contents of the program were recovered from Maria’s computer by Detective Constable Dunnill of the Thunder Bay Police. They are marked as exhibit 10. Although Tony Sgambelluri could not recall when he installed the key logger program, he believed it was a thirty day trial program. The program recorded three types of transactions on Maria’s computer from October 18 – November 10, 2009:

• websites visited;
• keystrokes typed; and
• screen captures of websites visited at prescribed intervals.

[43] The key logger confirmed that someone using Maria’s computer had visited the Plenty of Fish website. Tony suspected it was the accused, but he couldn’t prove it.

[44] On October 26, 2009 at 4:24:46 p.m. the key logger shows three groups of signature keystrokes accessing the internet through Maria’s computer:

• jgarof@hotmail.com bowling;
• tomford1999@hotmail.com 9902hubbtu; and
• jgarof@hotmail.com bowling

[45] These transactions all occur during the same entry. Officer Heyder testified that because there are no spaces between the names, she is fairly certain the internet was accessed via logging into John Garofalo’s hotmail account, then exiting that account, immediately logging into the Tom Ford address, exiting, and logging back into John Garofalo’s hotmail account. The key logger also shows that the Kijiji site was accessed on Maria’s computer that day immediately after the above entries at 4:25:05 p.m.

[46] The key logger program also indicates that a user accessed the internet via Maria’s computer on October 26, 1999 at 7:51:37 p.m. using the tomford1999@hotmail.com address. These are the only tomford entries captured by the key logger.

[47] Tony Sgambelluri observed the accused use Maria’s computer and noticed that he was on the Kijiji site quite often. The key logger program reflects repeated access on Maria’s computer to the Kijiji site.

[48] The defence challenged the accuracy of the key logger program, pointing to the discrepancy in a log-on time to the Kijiji Thunder Bay site on October 26, 2009 at 4:24:59 p.m. (in the sites visited portion of the program) and an entry on the same day in the keystroke portion of the program marked Kijiji.ca at 4:25:05 p.m. The defence posed the question to Detective Constable Dunnill: How can a site be visited before the keystrokes are entered?

[49] In cross-examination, the officer could not explain the discrepancy. He commented it could be a malfunction or there could be another explanation. However, he did not agree that the key logger program is inaccurate. In re-examination, he explained that the entry at 4:25:05 for Kijiji.ca is the parent site. If a computer has visited the site before, it might offer the user a url option to visit the site by a direct link. In other words, the computer might bookmark the site so that the user need only click on the site without entering the key stokes. Alternatively, the user could use a mouse and click on a “favourites” file or a book-marked link to get access to a site, avoiding the use of keystrokes. The program does not show where the keystrokes are entered, whether via a search engine, a url, or other mechanism.

Telephone Evidence

[50] The Crown submits that the accused is linked to the telephone number recorded in the offending e-mail: 629-4270.

[51] During their relationship, Maria Sgambelluri saw the accused with three cellular telephones. His personal cell phone number was 628-2707. This is the number she reached him at 95% of the time. The rest of the time, Maria contacted him at his mother’s on her land line. Maria and the accused also communicated by e-mail and text message when they were not together.

[52] Mr. Garofalo gave a second cell phone to his mother that was primarily used at her cottage. The third cell phone was earmarked for Maria’s use upon marriage. She did not recognize the telephone number 629-4270, the number included in the offending e-mail.

[53] Detective Constable Heyder attempted to find out the owner of the cell phone number listed in the e-mail. As there was no area code shown in the message, she concluded it was a Thunder Bay number. She served a production order on TBaytel to get that information. The results are shown in exhibit 8. The number proved to be a pay-as-you-go phone. As the subscriber pre-pays the phone charges, there is no obligation to prove one’s identity or correct address when applying for this type of service. Phone service is merely discontinued when the account balance is exhausted.

[54] TBaytel records show the owner of the phone number, 629-4270, as Tony Fraser. He registered his address as the TBaytel office. Searches of police, CPIC, and MTO records did not identify an individual called Tony Fraser.

[55] Exhibit 11 is a TBaytel subscriber account; it was explained by TBaytel’s corporate security officer, Shirley Whiteman. The document shows John Garofalo as the account holder for a cell phone with an assigned number of 621-0471. The account was opened on June 29, 2005. This was a pay-in-advance plan that continued until it was cancelled by the customer on August 18, 2007 at 3:20 p.m., pursuant to instructions from the customer.

[56] Each cell phone has an electronic serial number (“ESN”) on the back of the phone, under the battery. The ESN is specific to the mother board of each communication device.

[57] The ESN assigned to John Garofalo’s cell phone was 21810584788. The phone was a Noikia, model A-252. It was owned by the customer, rather than being rented from a dealer.

[58] Exhibit 12 is the subscriber particulars for Tony Fraser’s cell phone account. The phone number assigned was 629-4270, the target telephone number. The account was opened on August 18, 2007, at 3:23 p.m., three minutes after John Garofalo cancelled his cell phone service for 621-0471.

[59] The Tony Fraser phone was also a Nokia model with the same electronic serial number as John Garofalo’s cell phone: 21810584788. This phone was also owned by the customer. Although the Nokia model number, D-3285, is different than the model number for the Garofalo phone, Ms. Whiteman commented that the model number is not determinative of the identity of the phone as the model could be incorrectly identified. She added that it would take a few minutes to terminate the phone account, activate a new account with billing particulars, and assign a new phone number. Because of the technology and the pay-as-you-go billing plan, this phone would have been re-programmed at the store. Ms. Whiteman testified that because the ESN is the same for both accounts, the Tony Fraser account was opened using the same phone associated with the cancelled Garofalo account.

[60] Ms. Whiteman noted that even though the caller can conceal his or her number from a recipient when making a call, the originating telephone number is still recorded by TBaytel provided the transmission is via telephone technology. If a call were activated using the internet, such as via Skype or similar technology, TBaytel could not identify its origin.

[61] Officer Heyder attempted to call the telephone number shown in the offending e-mail on four occasions. A male person answered her calls but hung up when she identified herself as a police officer.

[62] Next, Officer Heyder sought to track all telephone calls to the target number. Exhibit 8 is the result of that inquiry. The TBaytel record tracks more than 2400 calls to the target telephone. Each transaction is numbered. All calls are in Thunder Bay local time.

[63] When a connection is made, the call is designated “complete.” Otherwise it is marked “no answer.” The record shows the subject phone number and area code in the third column. In each instance, exhibit 8 shows the target number, (807) 629-4270 as being involved in the communication. Next, the record shows the date of the transaction, the time of the connection or attempted connection, and the duration of the call in seconds. Then, the coordinating phone number is listed. In some instances, the target phone is making the call; in other instances, it is receiving.

[64] Detective Constable Heyder testified that transactions number 2330 – 2333 record brief telephone calls she made from her office telephone, (807) 684-1211, to the target number. These are all shown as inbound calls to the target number, meaning that her telephone originated the call. This is noted on the exhibit as IB807629-4270 in each instance. The duration of these calls was 7 seconds, 13 seconds, 10 seconds, and 34 seconds respectively.

[65] Detective Constable Heyder examined exhibit 8 for other identifiable telephone numbers. She found that on February 20, 2009, a call originating from a number registered to Vittorio Garofalo, (807) 475-3983, attempted to call the target number at 12:55:23 but got no answer.

[66] The officer learned that the accused’s home phone number was 577-2339.

[67] There was telephone contact between the target number, (807) 629-4270, and the accused’s cell phone number, 628-2707 on five occasions: January 29, 2009 at 21:35:29 for a duration of 121 seconds; January 29, 2009 at 21:35:29, for 121 seconds; April 2, 2009 at 16:49:02 for 121 seconds; May 1, 2009 at 19:34:50 for 121 seconds; and May 2, 2009 at 12:27:53 for 121 seconds. Each call is noted “no answer,” meaning that the call was incomplete.

[68] Officer Heyder then tracked contact between the Tony Fraser number, 629-4270 and the accused’s cell number, 628-2707. She found that the accused’s cell phone contacted the Tony Fraser phone on January 12, 2009 at 21:01:08 for a duration of 21 seconds (no answer); January 25, 2009 for 122 seconds; February 13, 2009 at 17:49:09 for 121 seconds; March 16, 2009 at14:18:10 for 121 seconds; and April 2, 2009 at 16:49:58 for 121 seconds. Each of this series of calls was incomplete.

[69] On August 27, 2009 at 18:43:03, the Tony Fraser number called the accused’s cell phone, 628-2707 for a duration of 122 seconds. This entry is also marked “no answer.”

[70] There is no record of a call between the Tony Fraser number and Maria Sgambelluri; however, there is one call to Joseph Sgambelluri, Maria’s brother.

Voice Identification

[71] The voice identification evidence comes from four witnesses: Detective Constable Heyder, Sandra Sgambelluri, Joe Sgambelluri and Tony Sgambelluri.

[72] As I previously mentioned, Detective Constable Heyder made four telephone calls from her direct office line to the telephone number listed in the offending e-mail, 629-4270. She dialed direct, without an area code. She estimated the collective duration of all of the phone calls was 45 seconds. A man answered and hung up when she identified herself as being a police officer. She didn’t ask for Tony Fraser and the man did not identify himself. During the last call, the man said that he was on the road and had connectivity issues. He didn’t call her back.

[73] She estimated the man’s age as between 25 – 35 years old, based on his voice, observing that the voice changes as a person ages. She described a younger voice as being higher in pitch, whereas an older voice may develop a rasp. She testified that the responding voice had no lisp, accent, or regional dialect.

[74] Tony Sgambelluri was questioned about the accused’s voice characteristics. He stated that the accused has a lisp, as he has difficulty pronouncing “s.” He added that it is evident when the accused starts to speak.

[75] Joe Sgambelluri explained that he came to know the accused when he began dating Joe’s sister, Maria. He encountered the accused about four times per month plus when the families enjoyed holiday get-togethers. He characterized the accused as having a soft voice but stated that he didn’t notice a lisp.

[76] Sandra Sgambelluri is married to Joe Sgambelluri. She became acquainted with the accused in the fall of 2008, when Mr. Garofalo began dating Maria. She had contact with him through visits at Angela Sgambelluri’s home, or her own home, or via cell phone. She estimated she had weekly contact with the accused and contact on the cell phone once a month. She stated that the accused is shy, soft-spoken, and has a pronounced lisp. She added that she has spoken on the phone with him before and recognizes his voice.

[77] Sandra testified that on August 9, 2009, while the accused was dating Maria, her brother-in-law, Tony Sgambelluri received an anonymous e-mail which he passed along to her and her husband. She knew the accused kept a second cell phone in his truck. She blocked her home phone number, (807)768-7426, and called the number listed in the e-mail, 629-4270. She stated that she called the number until the accused answered. She could not recall the number of calls required or whether she only placed calls from her home. Her recollection was that she made these calls after August 9^th, and before October, 2009 at around 1 p.m.

[78] The man answering said, “Hello, who’s this?” Sandra said she had spoken to the accused on numerous occasions and recognized the accused’s voice. When he answered, she hung up. The call lasted just seconds.

[79] In cross-examination, Sandra admitted that she has sometimes been mistaken about voices, especially her children. She was vigorously cross-examined about why she had not come forward to the police earlier with this information. She replied that she did not know the significance of the telephone number.

[80] Sandra’s evidence at trial about the number she called differed from the number disclosed in her statement to the police. She believed the number had a “4” and a “7” in it, but was uncertain about the order of the numbers. She was more definitive about the order of the numbers in her statement to police. She explained that she called the number that was recorded in the e-mail her brother-in-law forwarded.

[81] In this instance, exhibit 8 corroborates Sandra’s testimony, despite its frailties. On August 9, 2009, at 13:01:21, a call was placed from (807) 768-7426, which is Sandra Sgambelluri’s home phone number, to (807) 629-4270, the Tony Fraser number. The call lasted 122 seconds. There was no answer. The identical call was made at 23:07:53 later that day. Exhibit 8 shows the call as being complete. It lasted 3 seconds. Sandra reiterated in cross-examination that she remembered making the call although she did not recall the exact number. She added that her children would not have made that call.

[82] Sandra did not recall making a second call to the Tony Fraser number. She stated that she did not continue calling the number after the man answered and agreed she would have had no need to call again once she verified the identity of the call recipient. Despite this evidence, exhibit 8 shows that on September 18, 2009 at 9:21:07, she placed a call to the Tony Fraser number from her home telephone number. Although the transaction lasted 122 seconds, the phone was not answered.

Alibi Evidence

[83] The defence called Mr. William Mayer as its alibi witness. The purpose of this evidence is to show that the accused could not have accessed the internet via Maria Sgambelluri’s computer on October 26, 2009 at 4:24:46 p.m., as the Crown alleges. The Crown argues that these entries, shown on the key logger program in exhibit 10, connect the accused with the tomford hotmail address.

[84] In October, 2009, Mr. Mayer was the site supervisor for Gateway Contractors. The accused was then employed with Gateway and had worked under Mr. Mayer’s supervision on a number of previous construction jobs. Mr. Mayer commented that Mr. Garofalo’s work ethic was not in question.

[85] Mr. Mayer kept a personal daily journal in which he recorded weather and work-related notes. Each employee on the job completed time sheets that Mr. Mayer collected, verified, and submitted to the employer on the final day of the pay period. After the time sheets are submitted, only the accountant has access to them. Mr. Mayer testified that he obtained copies of Mr. Garofalo’s time sheets, at his request, after he was charged with this offence. The accused would have no awareness that he was under investigation until November 4, 2009.

[86] On Monday, October 26, 2009, Mr. Mayer was employed at the Isabella retirement home site, located at the corners of Isabella and Franklin Streets in Thunder Bay. Mr. Mayer arrived at the site at 7:45 a.m. and found the accused already there.

[87] Mr. Mayer’s journal recorded that October 26^th was a rain-out day, with a temperature ranging from 3 – 5 degrees. I infer he meant Celsius, as it was raining. The workers had excavated the basement and poured some concrete the Friday before. Mr. Mayer didn’t want the surface around the concrete to “turn to mush” as there was concrete work to be done the next day, so he directed that pumps be used to keep the surface dry. He instructed the accused to man the pumps that day. Mr. Mayer was on-site until 1:30 p.m. The accused was still at the work site when he left. Mr. Mayer understood that Mr. Garofalo would remain at the work site, manning the pumps, until the end of the regular working day, which is normally around 4:30 p.m. Mr. Garofalo was the sole Gateway employee assigned to the site after Mr. Mayer left at 1:30 p.m.

[88] Exhibit 15 is the time sheet the accused submitted for October 26, 2009. It shows that the accused worked from 8:00 a.m. – 4:30 p.m.. The hours logged are shown as 8 hours. In cross-examination, Mr. Mayer agreed that he corrected the hours on the time sheet; he thought the start time was 8:00 a.m., rather than 9:00 a.m. A hand-written correction in the total hours Mr. Garofalo worked on October 26^th was also shown on Mr. Mayer’s summary of hours at the second page of the exhibit.

[89] In cross-examination, Mr. Mayer stated he had no reason to doubt the accused’s record of hours worked that day. However, he agreed that it was possible the accused could have left the work site between 4:10 – 4:15 p.m. that day without his knowledge.

[90] Mr. Mayer estimated the distance between the work site and Sycamore Place where Maria Sgambelluri lived was 5 – 10 minutes by vehicle. He indicated that there was no internet at the work site on October 26^th, and no computer on site that day.

Discussion

[91] As explained by Professors Paciocco and Stuesser in The Law of Evidence, 2^nd ed. (Toronto: Irwin Law, 1999) direct evidence, if believed, “establishes a material fact in issue without the need for any inferences to be drawn” (p.21). This contrasts with circumstantial evidence which requires inferences to be drawn before a fact is proven. In this case, the Crown’s proof rests on circumstantial evidence.

[92] The defence submits that the circumstantial evidence does not prove the charge beyond a reasonable doubt. It argues that there is no direct evidence that the accused accessed the tomford1999@hotmail.com account; or if he did, there is no direct evidence that he is the only individual who accessed that account. The defence also submits there is no direct evidence that the accused owns a cell phone with the number 629-4270.

[93] The defence argues that the voice identification evidence is frail and contradictory such that it does not connect the accused with the telephone number in question. Finally, the defence contends that the alibi evidence provides a reasonable doubt that the accused was at Maria Sgambelluri’s home on October 26, 2009, using her computer to access the internet at 4:24:46 p.m.

[94] The court must assess the evidence as a whole in determining whether the Crown has proven beyond a reasonable doubt that the accused has committed an offence. While each piece of evidence, taken in isolation, may not establish proof beyond a reasonable doubt, the cumulative effect of circumstantial evidence may be so compelling, that it reaches the highest standard of proof. In this case, I am persuaded that the cumulative effect of the evidence reaches much beyond coincidence to the criminal standard of proof.

[95] Two questions are at the heart of this case: who would uniquely have access to the computers and telephone used in the transactions identified? Is the user linked to the tomford1999 hotmail address and the cell phone number, 629-4270?

[96] The inquiry begins with the e-mail sent to the young complainant, A.H., at the Kijiji website between August 13 and 14, 2009. The sender’s e-mail address was tomford1999@hotmail.com. The sender identified himself as a 36 year-old male.

[97] The I.P. address related to these e-mails was identified as 216.26.209.28 an address that belongs to TBaytel. The computer that accessed the internet at this time and via this I.P. address belonged to the accused’s father, Vittorio Garofalo, a man in his sixties. Notably, there was continuous internet access from that address for almost 24 hours. This suggests that the user had unfettered access to the computer in Vittorio Garofalo’s home at the time the e-mails were transmitted.

[98] The tomford1999 user accessed the internet from Vittorio Garofalo`s service twice on August 25, 2009; 18 times between August 26 – 31, 2009; 24 times between September 1 – September 6, 1999; 20 times between September 7 – 13, 2009; and 27 times between September 14 – 28, 2009. This suggests that the user also had frequent access to the computer.

[99] The evidence also shows that the tomford1999 accessed the internet 8 times using an unprotected internet service at the Dominic Lento household on Lambton Crescent, an address two doors away from the new home that the accused and Maria Sgambelluri purchased in anticipation of their pending marriage. Maria Sgambelluri had not moved into the home. However, the accused began sleeping there from the end of July or early August, 2009 and was at the house daily. While this may seem a coincidence, the I.P. address was traced to Vittorio Garofalo`s service. Since Dominic Lento was unfamiliar with the tomford1999 address, and since some of these internet connections were made very early in the morning when he testified the Lento household was asleep, I conclude that those connections were not made by any member of the Lento family.

[100] In addition to accessing the internet via Vittorio Garofalo’s and Dominic Lento’s internet service, the tomford1999 user accessed the internet via the Shaw service registered to Maria Sgambelluri’s mother, Angela Sgambelluri on 4 occasions between August 30 and September 26, 2009. Maria testified that the computer accessing this service belonged to her. The evidence supports that the accused had frequent access to Maria’s computer: at a minimum, five days out of seven. He was a frequent visitor to the Kijiji site.

[101] The key logger program on Marias computer shows that the tomford1999 user logged onto the internet via Marias computer twice on October 26, 1999. Maria Sgambelluris nephew and two nieces had access to her computer but were unaware of the tomford1999 address. The same late-night tomford1999 user accessed the Lento internet service as the Sgambelluri service; I find that Maria’s nephew and nieces would not have been using their aunts computer at a very late hour. They can safely be eliminated from the pool of users common to these access locations.

[102] Who would have extensive access to the internet using the Garofalo and Sgambelluri computer services as well as through the Lento service on Lambton Court? The cross-connection of possible users at these three locations narrows the pool of individuals who might have used the tomford1999 address very significantly.

[103] The defence complains that the password for tomford1999 was compromised because Tony Sgambelluri obtained it when he installed the key logger on his sister, Maria`s computer. The defence contends that once the password was compromised, any telephone number could be inserted in the e-mail sent to A.H. I conclude that Tony Sgambelluri could not have accessed the tomford1999 password until he retrieved it from the key logger program that began recording on October 18, 2009. By that time, the tomford1999 user had already sent the offending e-mail to A.H on August 14, 2009. There is no other evidence that the password was compromised prior to that date.

[104] Maria knew the accused’s e-mail address, jgarof@hotmail.com and his password, “jgarof” but she did not know the tomford1999 address and had never received an e-mail from this address. I accept this evidence. Tony Sgambelluri, the only person aware of the key logger program before the police investigation, was also unfamiliar with the tomford1999 address until he spotted it on the key logger program much after the offending e-mails. There is no suggestion that he visited at Vittorio Garofalo’s home and used the computer there. He indicated that he only socialized with the accused at Maria’s home. There is no evidence he visited Lambton Court. I accept his evidence.

[105] On October 26, 2009, the key logger program shows consecutive connections to the internet from Maria’s computer using jgarof@hotmail.com, tomford1999@hotmail.com and jgarof@hotmail.com addresses. These transmissions began at 4:24:46 p.m. Immediately after, at 4:25:05 p.m., the Kijiji site was accessed on Maria’s computer. The tomford user again accessed the internet at 7:51:37 p.m. the same day, also using Maria’s computer.

[106] The accused submits that he could not have accessed the internet at 4:24:46 p.m. on October 26, 2009, because his time sheets show that he was working until 4:30 p.m. that day. He says that if he was not on-line at that time, he could not have been associated with the impugned internet messages to A.H. The Crown says that the association of the tomford1999 address and the jgarof address are key to understanding the identity of the tomford user.

[107] I do not accept that the accused’s time sheets confirm he was in fact at his work site at 4:30 p.m. on October 26, 2009. His supervisor left the site earlier in the afternoon. He was not in a position to observe the accused. The accused was the only person from his employer’s work crew left on site that cold, rainy afternoon. There was no eye witness who could confirm the accused’s presence at the work site. The work site was not more than 5 – 10 minutes from Maria Sgambelluri’s residence where the computer was accessed, coincidentally, at about the time the work day would have finished. Maria testified that the accused previously visited her after work at 4:30 p.m.

[108] Another key piece of evidence is the telephone number in the offending e-mail: 629-4270. As I have said, the unique serial number for the cell phone associated with this number was first registered to the accused who owned the phone. Subsequently, the accused discontinued his service with TBaytel. Within 3 minutes of the accused cancelling his service, an individual identified as Tony Fraser subscribed to pay-as-you go service, using a subscriber-owned cell phone with the same serial number. He provided no home address. The three minute interval is the minimum time required to re-program a cell phone at the TBaytel office. It is too much coincidence to suppose that the phone was passed to another individual who opened a new account within three minutes. I find that the accused cancelled the service and purchased the pay-as-you go service registered to Tony Fraser.

[109] The telephone logs demonstrate that there are repeated telephone calls between the accused’s cell phone, 628-2707, and the Tony Fraser number. The Tony Fraser phone also called Joe Sgambelluri, Maria’s brother, on one occasion. Given that the accused previously owned the phone, the exchange of phone calls is not a coincidence.

[110] The defence disputes the quality of the voice identification evidence. Specifically, there is conflicting evidence as to whether the accused had a lisp and whether it was apparent in calls made to the Tony Fraser number by Detective Constable Heyder.

[111] Voice identification, by itself, is fraught with problems. It is even more uncertain when a voice is identified over the telephone, as here. In evaluating the quality of this evidence, the court must consider the clarity of the telephone transmission; the listener’s familiarity with the voice ; the ability of the listener to hear, and to discern; the volume of the speech; the distinctiveness of voice or speech patterns and accents; the duration of the conversation; distractions; ambient noise; or other factors that support or negate the identification.

[112] In this case, Joe and Tony Sgambelluri disagreed about whether the accused had a lisp, even though they knew the accused well. Tony described the accused having difficulty pronouncing “s”.

[113] Detective Constable Heyder telephoned the Tony Fraser number 4 times and identified the person answering as a man between the ages of 25- 35 based on his voice. She did not notice a lisp or distinctive voice characteristics. She indicated the man cited connectivity issues as a reason for hanging up.

[114] Sandra Sgambelluri, who also called the Tony Fraser number, testified that she recognized the accused as the person who answered the phone, based on his response, “Hello, who’s this?” even though their conversation lasted just seconds. She testified that she had previous regular telephone contact with the accused. In cross-examination, she agreed that she had previously confused voices, especially of her children.

[115] I agree that this voice identification evidence alone is not of sufficient quality to identify the accused. However, the voice identification of both Detective Constable Heyder and Sandra Sgambelluri is corroborated by the telephone logs that show contact between the Tony Fraser number and Sandra’s home phone, and between the Tony Fraser number and Detective Constable Heyder’s direct office line. It is not coincidence that the accused transferred his phone service to Tony Fraser and the caller on Tony Fraser’s number was identified as the accused. I find that Sandra Sgambelluri recognized the accused’s voice when she called the Tony Fraser number.

[116] The cumulative effect of all of this circumstantial evidence points only in one direction: to the accused. It is only the accused who had frequent access to the internet from the three locations. It is only the accused who could have immediately transferred his cell phone account to another who used the same phone. It was only the accused who used that phone and whose voice was identified by Sandra Sgambelluri. I find that the Crown has proven beyond a reasonable doubt that the accused is the originator of the impugned e-mail. I find him guilty of the offence as charged.

“Original signed by”

Regional Senior Justice H.M. Pierce

Released: November 13, 2012

COURT FILE NO.: CR-11-0026-00

DATE: 2012-11-13

ONTARIO

SUPERIOR COURT OF JUSTICE

B E T W E E N:

HER MAJESTY THE QUEEN

CROWN

• and –

JOHN GAROFALO

ACCUSED

REASONS FOR JUDGMENT

Pierce J.

Released: November 13, 2012

/nf