R. v. S.E., 2021 ONSC 4124

COURT FILE NO.: CNJ 9559

DATE: 2021-06-10

ONTARIO

SUPERIOR COURT OF JUSTICE

BETWEEN:

HER MAJESTY THE QUEEN

Applicant

– and –

S.E.

Respondent

Laura Doherty, for the Crown

Stephen Gehl, for the Applicant

HEARD: APRIL 6, 7, 8, 9, 12, 13, 14, 15, 16, 19, 20, 21, 26, 27, 28, 29, May 4, and 26, and June 10, 2021

By Court Order, there is a ban on publishing any information which could identify a victim, person under 18, or the accused, in any document or transmitted in any way, except through the use of their initials. Failure to comply is punishable by summary conviction.

The Honourable Justice James W. Sloan

REASONS FOR JUDGMENT

INDEX

1. Detective Tyler Shipp..................................................................................................... 9

Shipp – Cross-Examination 18

Breach of Recognizance. 22

Reply………………………………………………………………………………..... 22

2. Detective Matthew Loschmann.. 22

Gateway Laptop………………………………………………………….……..…... 28

HP Slimline Computer.……….…………………………………..……………….... 29

Summary……………………………………….….………………………........…... 29

Supplemental Report Prepared by Detective Loschmann – Ex………..…....... 30

Supplemental Report - CAT 1 - River - Ex. 6.……….………………….……....... 30

Forensic Analysis Report - Gateway Laptop - Ex. 11.…………………….…..…. 32

Forensic Anlysis Report - HP Slimline - Ex. 12 ……………………….……..….. 33

Loschmann - Cross-Examination…………..………….…………….……... …….. 33

Loschmann - Reply………...………………………..……………………………... 42

3. Constable Chris Moore. 43

4. Sergeant Eugene Silva.. Error! Bookmark not defined................................................................................................... 43

Silva - Cross-Examination…..…... ..………………………..….………………….. 45

5. Constable James Bowden…………………………………………………………… 46

6. M.A. Complainant…………………..……………………….………………...……… 47

Cross-Examination of M.A..………………………………………..…………….… 48

7. C.C. Complainant . 50

Cross-Examination of C.C. …………………………….. ………….………...…… 55

8. S.E. - Accused………………………..……………………………………………….. 57

Criminal Record………….………………………………... ………...…...………… 57

iCan Computer - (Ex. 9, P. 142)…………………………………………………… 61

HP Laptop - (Ex. 9, P. 142)………………..…………………..……………………. 63

Gateway Laptop - (Ex. 9, P. 142)…………………………..………………………. 63

HP Pavilion Slimline Computer - #Ex. 9, Page 143)………………..……………. 64

64GB Lexar thumb Drive - (Ex. 9, P. 144) ……………..…………………………. 65

16GB SanDisk MicroSD Card - (Ex. 9, P. 144)………………………….……….. 65

Cell Phones………………………………………………………………………..… 66

Social Media……………….………... ………………………………………...….… 67

River Videos - (Ex. 3-C)…………………………………….……………...……….. 67

M.A. Complainant…………………………………………………………………… 69

C.C. Complainant……………………….…………….……………………..……… 71

Cross-Examination of the Accused………………………… ……………….……. 78

C.C. Complainant…………………..…………...……………………………...…... 83

M.A. Complainant…………………………………..………………………….……. 86

General………………..…………………………………………………………...… 88

Images from the River Videos………………...…………………………...………. 88

9. The Accused's Summation

Count 1 - Did Access Child Pornography - s. 163.1(4.1)………….………….…. 91

Count 2 - Surreptitiously Recording CC - s. 162(1)…………………….…….….. 93

Counts 3 and 4 - Did Make Child Pornography - s. 163.1(2) & s. 162(1)…..…. 94

Count 5 – Make Available Intimate Images Without Consent – s. 162(1)…..…. 96

Count 6 – Extort Sexual Favours from M..A - s. 346(1.1)(b)…………….…..…. 97

Count 7 - Possession of Child Pornography – S. 163.1(4)……………….…...… 98

Count 8 - Breach of Recognizance – s. 145(3)…………………..……………… 98

Count 9 – Criminal Harassment – s. 246(2)…………………..………………….. 99

Browne v. Dunn [1893] J.C.J. No.5…………………………..…..………...…… 100

10. The Crown's Summation

Counts 1 and 5………………………………………………………..……………. 100

Circumstantial Evidence…………………………….………………….....…..….. 102

Count 1 – Accessing Child Pornography……………………………..……..…... 102

Count 2 - Voyeurism (C.C.)……………………………………….…….……..…. 102

Count 3 - Make Child Pornography……………………………………...…..…… 103

Count 4 – Voyeurism………………………………………………………..…..… 104

Count 5 – Make Available Intimate Images……………………………...…..….. 104

Count 6 – Extortion (M.A.)………………………….………………………….….. 105

Count 7 – Possession of Child Pornography……………………….……..…..… 106

Count 8 – Fail to Comply with the Recognizance………………..…..……….... 108

Count 9 – Criminal Harassment (C.C.)………………………..……………….… 109

The Crown’s Submissions on the Evidence for the Defence………..……….… 111

The Rule in Browne v. Dunn………………………………………………..…….. 111

The Crown’s WD Analysis…………………………….………………………..… 112

Creator of the River Videos……………….... ………………………………….... 116

Evidence Related to the Accused’s Security Systems on Seized Devices…… 117

The Accused’s Access to Email Addresses………………………………..……. 118

Breakup With C.C………………………………………………………………….. 120

The 2018 Computer Hacking……………………………….…………………….. 120

Issue Regarding the Phone in the Profile Photo for ImgSrc.ru……………….. 121

The Video of the Accused and His Daughter – Ex. 19………………………… 122

The Accused was an Evasive Argumentative and Wholly Uncooperative Witness 122

The Accused Added Unprompted, Negative Information About C.C. and M.A. 122

The Accused Revealed a Pattern of Blaming Others………………………….. 123

The Accused is a Poor and Uncooperative Witness……………………....…… 123

The Rule in JJRD……………………………..…………………………..………...124

Conclusion………………………………………………………………….…..….. 125

11. Summary and Findings……………………………………..………………………. 125

Count 1 - Did Access Child Pornography – s. 163.1(4.1)………………………128

Count 2 - Did the Accused Surreptitiously Record C.C. Contrary to s. 162(1). 131

Counts 3 and 4 - Did Make Child Pornography – ss. 163.1(2) & 162(1).……. 132

Count 5 - Make Available Intimate Images Without Consent – s. 162(1)…..... 134

Count 6 - Extortion of M.A. s. 346.1(1.1)(b)…………………………..…………. 137

Count 7 - Possession of Child Pornography s. 163.1(4)……………………..… 138

Count 8 - Breach of Recognizance – s. 145(3)……………………………..…… 138

Count 9 - Criminal Harassment (CC) – s. 264(2)………………………………. 139

Other Considerations by The Court……………………………………... ……… 141

12. APPENDIX A

Chronology…………...…………………………... ……………………..……….. 145

13. APPENDIX B

Glossary of Computer/Software Terms……………………...…………..…….. 148

14. APPENDIX C

Exhibit List…………... ………………………………………………..……………151

[1] On April 6, 2021, the accused was arraigned and pled not guilty to nine charges, witnesses, with the exception of the investigating officer, were excluded and the accused consented to what I will term a highbred Zoom trial. The proceedings on April 6 were held in person, but the remainder of the trial was held online via Zoom. The accused, who is currently in custody, physically attended at the courthouse each day and participated in the trial from a courtroom, in which he, his lawyer, the registrar and the reporter were present.

[2] Because of the sensitivity of the evidence involved in this case, the Court has used initials when referring to all parties involved in the allegations. Also, sometimes people used their first names or short forms of their first names on email addresses or for usernames. That makes some of the email addresses look unusual, however, for the sake of anonymity, I have used initials throughout. I have used the following initials to mean the following people:

S.E. or the accused - is the accused

A.E. - is the accused’s daughter

S.H. - is the accused’s current spouse

C.C. - is a former girlfriend of the accused

J.W. - is a former spouse/girlfriend of the accused

M.A. - is the accused’s stepmother

D.L. - is the accused’s biological father

Z.N. - was a surety for the accused

[3] The nine Counts of the indictment in summary form, allege that the accused:

1. did access child pornography – s. 163.1(4.1) – December 13, 2014 – January 3, 2016;

2. did surreptitiously record C.C. – s. 162(1) - January 1, 2011 – December 31, 2014;

3. did make child pornography – s. 163.1(2) – on or about August 31, 2014,

4. did surreptitiously record an unidentified female – s. 162(1) - on or about August 31, 2014;

5. did make available intimate images without consent – s. 162(1) - November 4, 2014 – July 13, 2017;

6. did without excuse and with intent to obtain sexual intercourse, induce M.A. by threats – s. 346(1.1)(b) - January 1, 2015 – December 31, 2015;

7. did have in his possession child pornography – s. 163.1(4) - on or about June 2, 2017;

8. did fail to comply with the terms of his recognizance not to possess or use any device connected to the Internet or digital network – s. 145(3) - July 9, 2017 – August 17, 2017;

9. did threaten C.C. – s. 264(2) - January 1, 2011 – December 31, 2014.

[4] The parties entered into an agreed statement of facts which has been marked as Ex. 1.

[5] In addition, part way through the trial as set out in Ex. 7, the accused S.E. admitted that:

1. All material, including images and videos, categorized by Detective Shipp as child pornography across all devices and platforms is child pornography except:

(a) the series of seven videos referred to as “the River Videos”; and

(b) the series of eight images accessed and commented on by Criza on ImgSrc.ru (Ex. 3B)

2. He was the user of the Facebook page named “SS”;

3. He was the creator and user of the Instagram profile under the name “criza80”;

4. He was the creator and user of the YouTube channel “SE”;

5. The folders posted by the ImgSrc.ru user Criza, which were named ‘CPT-15 Correctional Officer at Kent Prison BC’, ‘CPT-15 Correctional Officer at Kent Prison BC’ (password-protected), and ‘Step’ contained intimate images.

6. Images found in the ImgSrc.ru folders ‘CPT-15 Correctional Officer at Kent Prison BC’, ‘CPT-15 Correctional Officer at Kent Prison BC’ (password-protected), and ‘Step’ which were posted by ImgSrc.ru user Criza were present on devices seized from S.E.’s residence at Apt. 8-616 Silverbirch Dr., Waterloo.

7. Images found in the ImgSrc.ru folders posted by Criza named ‘CPT-15 Correctional Officer at Kent Prison BC’, ‘CPT-15 Correctional Officer at Kent Prison BC’ (password-protected), were present on S.E.’s cell phone which was seized from his person upon his arrest on June 2, 2017.

Detective Tyler Shipp

[6] Shipp has been an officer with the Waterloo Regional Police Services (WRPS) since 2004. He has been with the cybercrime and Internet Child Exploitation (ICE) section of the Force since 2017.

[7] He became involved in the present case when the OPP advised the WRPS of information it had received with respect to a resident of Waterloo Region named S.E.

[8] The information he received from the OPP was:

A. Identification of a person of interest being S.E., born September 3, 1980, residing at 616 Silverbirch, Apt. 8, Waterloo, Ontario;

B. Identification of S.E.’s car bearing Ontario license plate number BJSN 448;

C. That the suspect material was housed on a Russian website iMGSRC.ru; and

D. The user of that website known as CRIZA was suspected to be S.E.

[9] Shipp testified that the Russian website was open source, meaning that anyone with Internet access could access it. He accessed the website and confirmed the information he had received from the OPP. Essentially, the website was for sharing and posting photographs/images.

[10] Shipp created a “John Doe” account to learn about and become familiar with the subject website. He found that a member of the public needed an account to be able to comment on the photos and that an account could be obtained by simply having a valid email address and generating a username.

[11] Upon becoming a member of the subject website, a person can host pictures and allow people to access them either at large or only with a password. A registered user of the website can leave comments pertaining to the pictures they view. These comments are time stamped and the flag of the country where the commenter’s computer is located, is affixed to each comment.

[12] Both counsel and the Court were given an encrypted police computer (Ex. 3) containing the images relating to the charges before the Court, and access was allowed to the computer, subject to an order restricting what use could be made of the computers and that they would be returned at the end of trial pursuant to s. 490(15).

[13] Shipp referred to a 79 page document he created, titled “R. v. SE WA 17–078399 Investigative Services/Cybercrime and ICSE Unit” for part of his testimony. (Ex. 4) The document includes what he described as screen grabs from his computer. Once on the subject website, Shipp was able to locate the account of CRIZA which gave the following information:

Email : crizacustoms@yahoo.ca

Birthdate : September 3, 1980

User info : I love to trade girls only

Registered on: 2014–11–04 (November 4, 2014)

[14] Shipp further testified that CRIZA hosted 10 albums that contained 141 images, and of the 10 albums, seven were password-protected. Of the 10 albums, Shipp thought four were worthy of note. These included:

A. Pictures of C.C. a former girlfriend of S.E.’s who is now a correctional officer in B.C. (Ex. 4, P. 8) In addition, CRIZA provided C.C.’s Facebook URL information. CRIZA used the password “C” (the first name of the complainant) for the associated album. The majority of the 32 photos were nude images and images of adult sexual organs.

B. Shipp testified about other albums under the names Ex, Me, Kay, Jessica, Neighbours and Step. (Ex. 4, P. 9) He was able to open Ex using the password “J”. “J” is the first name of J.W., an ex-girlfriend of S.E. These albums contained intimate images of unidentified adult women’s sexual organs and some women being involved in sexually explicit acts such as fellatio.

[15] Using the Boolean search method, he searched the subject website for the years 2014, 2015, 2016 and 2017. While he does not believe he found all of the times CRIZA commented on pictures, he did find 81 comments with respect to 77 pictures. (A few pictures were duplicates.)

[16] At Ex. 3-A, (Ex. 4, P. 60) Shipp organized the images that were accessed by CRIZA into a chart containing eight columns as follows from left to right:

1. Album Host

2. Album Name

3. Verbatim Comment Made by Criza

4. Date of Comment

5. Child Pornography

6. iMSRC.ru User Information/Album Associated Comment

7. Image Description

8. Image

[17] The comments under the headings child pornography and image description are those of Detective Shipp. He took the Court through the following entries on the following pages:

1. emyemily – page 2/14

2. youngteens14 – page 2/14

3. young_girl – page 2/14

4. jailbaitkatie – page 3/14

5. littlegirldraw – page 3/14

6. littlegirls69 – page 4/14

7. 12-16yo59 – page 4/14

8. pseudo-mom-usa – page 4/14

9. legalize10 – page 6/14

10. childgirllove.ok – page 9/14

11. 8-is-the-new-18 – page10/14

12. 13nsexy – page 10/14

13. 12-16yo69 – page 13/14

[18] Shiff testified that the following short forms in child pornography have the following meanings:

1. yo – young

2. p4p - password for password, which means if you give me your password so I can view your pictures, I will give you my password so you can view my pictures.

3. 69 - is a sex act

4. series - in child pornography means a set of pictures

5. pedo – pedophile

6. nsa - no strings attached

7. hc – hardcore, i.e. being engaged in explicit sex acts

8. pthc - preteen hardcore

9. plz – please

10. bi - bisexual

[19] On the “emyemily” site, Criza commented “do you have more”. Other comments state the young girl is 11, she is wearing a bra and transparent black lace underwear, there is no pubic hair visible and little to no breast development.

[20] On the “youngteens14” site, Criza commented “do you have any nude 14yo girls”. Other comments include, I’m a 14 yo boy that loves to see pics of 12–15 yo girl.

[21] On the “young_girl” site, Criza commented “plz trade with me”. Other comments include, girl, young/nice little girls.

[22] On the “jailbaitkatie” site, Criza commented “please email to trade”. Other comments include, I like my girls real young in nude.

[23] On the “littlegirldraw” site, Criza commented “me to”. Other comments include, Gemma is 8 now, and she is good in the bedroom, this is her daddy and her lover.

[24] On the “littlegirls69” site, Criza commented “trade”. Other comments include a top collection of pics and videos is waiting for you… and your wildest dreams come true.

[25] On the “12-16yo59” site, Criza commented “passplzzzzz”. Other comments include, p4p for nude.

[26] On the “pedo-mom-usa” site, Criza commented “Very nice Trade?” Other comments include, daughter lover, looking for other pedo-moms…for some NSA action.

[27] On the “legalize10” site, Criza commented “so sexy”. Other comments include I love the beauty of young girls, I love girls with braces and glasses. Freckles drive me crazy to.

[28] On the “childgirllove.ok” site, Criza commented “trade”. Other comments include, looking for h c.

[29] On the “8-is-the-new-18” site, Criza commented “trade”.

[30] On the “13nsexy” site, Criza commented “Pls email me”. Therefore, it appears Criza left an email address. Other comments include, my name’s lucy im 13 years old im bi im more into girls and guys.

[31] On the “12-16yo69” site, Criza commented “trade”. Other comments include, I want only preteen and teen (11 to 16 yo) and pthc (preteen hardcore).

[32] In determining if an image or video would be considered child pornography, detective Schiff testified that among other things he would consider:

1. The definition of child pornography under s. 163.1(a)(ii) which reads:

163.1 In this section, “child pornography” means

(a) a photographic, film, video or other visual representation, whether or not it was made by electronic or mechanical means,

(ii) the dominant characteristic of which is the depiction, for a sexual purpose, of a sexual organ or the anal region of a person under the age of 18 years:,

2. The case law with respect to similar images,

3. The name of the picture or video,

4. The context of the picture or video,

5. Where the picture or video was found,

6. How people commented on the picture or video,

7. The reason people would have for accessing the picture or video (is it for sexual interest in children?),

8. Why the picture was hosted (i.e. - to trade),

9. The totality of the comments.

[33] Because of the numbers of devices, images, videos, people and entities involved in the investigation, Shipp made several charts. He labelled one chart “Categorization of Seized Child Pornography & Analysis of iMGSRC.ru Related Media”. (Ex. 4, P. 59-60)

[34] The chart contains eight vertical columns which spread out horizontally and whose headings from left to right are, Item #, Category, Images, Unique, Video, Unique, Total, and iMGSRC.ru Related Media.

[35] The first vertical column, “Item #”, has 11 entries below it. Each entry refers to one of the devices seized at S.E.’s home, or on his person when he was arrested. Each item is referred to by the make of the device, along with an evidence number given to the device by the police.

[36] From top to bottom under the heading “Item #”, Shipp has listed the following digital devices, (1) iCAN Computer Tower [17-148-1], (2) HP Pavilion Laptop [17-148-2], (3) Gateway Laptop [17-148-3], (4) HP Pavilion Slimline [17-148-4], (5) 1TB Drive [17-148-6], (6) DVD [17-148-7], (7) Lexar thumb Drive [17-148-8] , (8) SanDisk [17-148-9], (9) 10:Phone [17-148-10] , (11) SD Card from Phone [17-148-10A] . The last entry under “Item #” is labeled “Combined Item Totals”, which allows Shipp to display the total number of images from all eleven devices, that he thought fell into the categories of Child Pornography, Investigative Interest or Other.

[37] Since some pictures and videos appear on more than one device, Shipp created an extra column to differentiate the “total number” of images from the “unique” ones, which appear only once. (Ex. 4, P. 60)

[38] The Second vertical column which is “Category”, further refines what Shipp found on the various devices into three subcategories. Here, Shipp refers to the images/videos as either “Child Pornography”, “Investigative Interest” or “Other”, after which he subtotals the number of images found for each device.

[39] By use of this chart, the reader can quickly and systematically find the “number of images”, that fall into each category and whether they are unique, by looking at where the vertical and horizontal columns intersect.

[40] The last vertical column is title “iMGSRU.ru Related Media”. In oral conversation, “iMGSRU.ru” is simply pronounced “image source”. Where the horizontal and vertical

vertical columns intersect under this heading, Shipp has entered either the word Yes or No.

[41] If Shipp typed in the word “Yes”, it means that images which are hosted on the Criza website were found on the device referred to in the first vertical column under the heading “Item #”. Shipp stated that images from 5 out of the 10 Criza albums hosted on iMGSRC.ru, being Jessica, Kay, Neighbours, Ex and CPT–15 Correctional Officer, were found on other devices.

[42] Shipp then gave the Court a short computer lesson on how to find the subject files that were saved on the devices. With respect to the pornographic images, including the child pornographic images stored on the iCan Computer Tower (17-148-1), they are stored approximately four levels down, i.e. hidden on the hard drive, under the heading “Virus Files”.

[43] All the seized devices contained a total of 1,490 child pornographic images. While categorizing the images and videos, Shipp found what has become known in this case as the River Videos. He determined, because of the background in the pictures, that the videos were taken at the West Montrose family campground, which is not far from Waterloo, Ontario. (Ex. 3-C and Ex. 4, Ps. 62 and 65)

[44] There are 15 relatively short videos and the child in question is wearing a relatively small tightfitting blue bikini. Shipp determined that it was the accused who made the videos because his daughter briefly appears in the videos, along with pictures of the accused’s feet and sandals worn by him. In addition, a person by the name of “S___ (Zee)” (where S___ is the first name of the accused) signed into the campground that day. Zee (Z.N.) had been a surety of S.E. at one point in time.

[45] The young girl in the video appears to be between 12 and 14 years of age and has not been identified. The young girl’s voice is also that of the young teen. The videos for the most part, focus on her buttocks and vaginal area to the almost total exclusion of her face and other parts of her body. (Ex. 3-C) Much of the video is zoomed in to highlight her vaginal and anal area. The videos become more invasive as the series progresses. In addition, when the subject moves, the camera immediately comes back to focus on her sexual organs. These files were not stored on the computer with the other family pictures, rather they were buried deep in the computer’s hard drive along with pornography of older women in a file labelled “Virus”. The accused’s daughter, A.E., appears briefly in the videos. (Ex. 4, P. 64)

[46] While doing his investigation, Shipp came across extremely intimate pictures of adult women which he determined were reproduced from pictures on the iMGSRC.ru website. Shipp has created a flowchart to assist the Court with understanding where the pornography comes from and on what device it was found. (Ex. 4, P. 75) He stated that the word “master” in the right-hand column on P.75 should be deleted.

[47] The file CPT–15 Correctional Officer at Kent Prison BC comes from iMGSRC.ru website. Shipp testified that a former girlfriend of S.E.’s, named C.C., is a correctional officer at the Kent prison.

[48] Although the images do not show anyone’s face, they are extremely graphic, showing close-ups of a female vagina, a man’s penis partly penetrated into a female vagina or anus and several pictures of a vagina and penis with significant bodily fluid on them. These images were reproduced from the iMGSRC.ru website.

[49] Apparently iMGSRC.ru can only store images not videos. At P. 74 of Ex. 4, Shipp has taken two screenshots from one of the videos on iMGSRC.ru. He identified the female in the picture as M.A. and the hand on her vagina as belonging to S.E.

[50] Shipp has created a large flowchart at P. 77 of Ex. 4. He described it as the Master Investigative Summary and that the right side of the summary is re-created at P. 75 of Ex. 4.

[51] Shipp testified that there are three files connected to C.C., M.A. and J.W., who are all former female acquaintances of S.E. The Brybeck Crescent address was one where S.H. lived with S.E. He further testified that the four files on the flowchart on the left-hand side of P. 77 (Ex. 4) are the files containing evidence against S.E. with respect to the three female complainants.

[52] P. 78 of Ex. 4 shows a chart of the judicial authorizations sought by the police during the investigation of this case.

[53] Shipp next identified a report prepared by Detective Loschmann. It is titled “Cybercrime CAT 1 Files River Videos” and has been marked Ex. 6 under the heading Supplemental Report CAT 1.

Shipp – Cross-Examination

[54] Anyone with Internet access could access the material on iMGSRC.ru that the OPP accessed.

[55] With respect to the image of S.E., which was registered on November 4, 2014 when the account was created, Shipp does not know when the picture was put on the website. He only knows it was there when he accessed the website. This image was also on the website when it was searched by the OPP. (Ex. 4, P. 3) It has been referred to as the “Criza photo”

[56] He confirmed that basically the only thing a person would need to access the subject website would be an operational email and that anyone could make an email using someone else’s name.

[57] There were questions concerning virtual private networks which are often referred to as VPNs. Shipp testified that if a computer was connected to a VPN provider first and then connected to a website, the computer’s Internet provider, for example Rogers, would see the VPN IP address, but not the user’s computer’s IP address.

[58] With respect to the middle picture of C.C. at Ex. 4 P. 8, Shipp is not sure if the image is from Facebook, although it does have a Facebook URL at the top.

[59] On P. 13 of Ex. 4, the photos on the left come from the Internet and not S.E. Shipp testified he believes the pictures are from the St. Jacobs Farmers’ Market and he does not know who took the pictures or who the people are in the picture on the right. The photo on the right is one of the 81 photos Criza commented on from the subject website.

[60] Shipp testified that the bottom picture at Ex. 4, P. 14, was posted on December 28, 2014, and appears to be the same picture as that on page 3. He stated, that on the website one would see the whole bottom box including the image and comments. The picture shows the accused, shirtless from the waist up, holding a cell phone in a red case and standing by a door

[61] With respect to Ex. 4, P. 25, the accused suggested he used a VPN and therefore it would have been impossible for the police to get his IP address. Shipp responded that people often forget to turn their VPN on.

[62] The image at Ex. 4, P. 32 is the same picture as on page 3 and is on the subject website. While the cell phone looks like S.E.’s cell phone, what Shipp was looking for was a large cell phone in a red case which is what is in the picture. Shipp thought the picture was important because it was on the website and other social media and the big red case was unique. He admitted that anyone could get the picture if they log into Facebook with an account.

[63] When S.E. was arrested on June 2, 2017, he had a Galaxy Samsung S7 phone, model # SM-G930W8. The defence suggested that this model of phone did not come to market until March 2016, and therefore it could not be the phone in any pictures posted in 2014.

[64] Shipp stated he did not know the different models of the phones in 2014, 2015 or 2016 and he would have to do more research before he could comment on the defence’s suggestion.

[65] The image at Ex. 4, P. 33 is a screenshot of S.S.’s Facebook page. The name Connor near the top right-hand corner of the page is the fake account name Shipp used. He agreed that a person could make a fake account named Criza.

[66] Shipp confirmed that you need a username to be logged in but that a vanity name like Criza could be manipulated. He is not sure how or how much a vanity name can be manipulated for each platform. He stated that more than one person could have an account with the name of Criza on social media.

[67] He was not aware if there was more than one Criza during his search and said that he was quite focused, because the OPP had done a lot of the legwork.

[68] At Ex. 4, P. 37 is a picture of S.E.’s car posted on the Instagram account of criza80.

[69] At Ex. 4, P. 39 are pictures which were posted on the criza80 Instagram account. The defence suggested that there was a mirror behind the accused when the picture was taken. Shipp replied that he did not know how the image was taken or what device took the picture.

[70] Shipp testified that the picture at Ex. 4, P. 40 is different from the picture on the subject website. He stated that in the picture on page 40 the door is closed, and he does not know if it is the same door, S.E. has more facial hair and he appears to be standing slightly differently. Shipp confirmed the picture was posted on April 19, 2017, and his cell phone appears to be in the same red case as the red case seen in previous pictures. He stated, he could not say if it is the same phone, and he could not see anything that would allow him to confirm whether or not it was a Galaxy S7.

[71] At this point, the accused suggested that in 2014 he had a BlackBerry Z10 phone which would not fit in the red case. He further suggested that the time stamped comments on the website have the same image in them as the image that appears on page 40.

[72] Shipp testified, that during his investigation he ran S.E. through the police database. He confirmed that the accused was charged in 2004 with molesting J.W.’s daughter but was acquitted. The defence suggested that because of this and other aspects of S.E.’s history, Shipp was motivated to charge the accused.

[73] The image of S.E.’s cell phone is reproduced at Ex. 4, P. 52. It was suggested that the picture of this phone is different than the picture on page 40, because the position of the camera and flash are reversed. Shipp stated that he thought the picture on page 40 was taken with a mirror, which would reverse the positions of the camera and the flash.

[74] Shipp confirmed that there was no child pornography on the Gateway computer. Although he could not confirm whether or not the Gateway computer accessed the website, he found images on the Gateway computer similar to images on the website in a file labelled “me”.

[75] He stated, there was one image of child pornography on the SanDisk and it was of a younger female touching the vagina of an older female. On the SD card were the seven “River Videos” and other website media. The DVD had no child pornography on it. The Lexar thumb Drive had the River Videos on it. He confirmed that the River Videos were a live event recording.

[76] There is a heavily redacted sign-in sheet for the West Montrose family campground reproduced at Ex. 4, P. 63. On the right-hand side is the name S___ (Zee) (where S___ is the first name of the accused). In answer to a suggestion by the defence, Shipp agreed that this suggests S.E. was at the campsite of Zee (Z.N.)

[77] Shipp stated that the close-up of S.E.’s face, the sandals and the car reproduced on the right-hand side of Ex. 4, P. 64, were taken/posted on August 31, 2014. He does not know when the other three images were taken.

[78] S.E. had a cell phone on him when he was arrested on June 2, 2017 and another cell phone when he was arrested on August 17, 2017. The defence suggested that Shipp could not have seen him using his phone in the manner he described because the phone had no data package. Shipp denied the defence’s suggestion, that S.E. did not have the phone in his hands when he approached him.

[79] Shipp testified, that although the phone was locked, when he tapped on the phone it showed the word Rogers, 4G and had the usual bars showing that it was connected to the Internet. In addition, the date was accurate and when he swiped up the face of the phone the weather network appeared.

[80] Shipp agreed that a subscriber could request to have his/her data blocked, however the data on this phone did not appear to be blocked because Shipp could access autotrader.ca.

Breach of Recognizance

[81] Shipp testified, that when he arrested S.E. for the second time at a job site, S.E. was looking at the Weather Network app on his phone. Since the Weather Network was displayed on the phone, Shipp concluded that the phone had a data package and was connected to the Internet, which was a breach of one of the terms of S.E.’s recognizance.

Reply

[82] Although the shirtless image of the accused with his cell phone at Ex. 4, P. 40 was posted on April 19, 2017, that date has no relationship whatsoever to when the photograph was taken.

Detective Matthew Loschmann

[83] Loschmann joined the WRPS in 2007 and became a member of the Cyber Crimes Unit in April 2015. He is a computer forensic examiner and his primary duties are forensic analysis of seized devices. Before doing any analysis, he makes an exact copy of the material that is on each device and does his analysis only on the copy.

[84] His PowerPoint presentation to the Court was marked as Ex. 9.

[85] He confirmed that he originally got nine devices from 8–616 Silverbirch Road in Waterloo on July 3, 2017. On September 15, 2017 he received the Samsung Galaxy S7 cell phone. As technology improved, he was able to get more information off the cell phone in January 2019. In total, he confirmed that he received the 11 devices testified to by Detective Shipp.

[86] His job was to extract images for the investigating ICE officers (i.e. Shipp). At Ex. 9, P. 10 he set out the questions that he tries to answer with respect to each device. Those questions are:

i. Who used the devices?

ii. Are they password-protected?

iii. Who had access to the devices?

iv. Are there any virus or malicious applications?

v. Is there any evidence of hacking or remote access to the devices?

vi. How did the data on interest get on the device?

vii. When did the data on interest get put on the device?

[87] He took the Court through pictures of S.E.’s residence to show where each device was found. He confirmed that the settings on the computers were such, that the time and date were set correctly.

[88] In the iCan computer he found three hard drives, but only the Western Digital and Maxtor hard drives were connected. He stated that what he termed the “hidden” files were on the Maxtor hard drive. He testified that a computer would not be sold with this configuration of hard drives and that someone would have modified the computer by adding some of the hard drives to it.

[89] He testified that the Western Digital hard drive was named “AESDESKTOP” and contained the computer operating system which runs the computer and provides the user interface. He stated that the 80 GB Maxtor hard drive was a storage device only and he analogized it to a thumb Drive. There is a picture of the Maxtor hard drive at Ex. 9, P. 30.

[90] He testified that the HP Slimline Computer had its faceplate removed and a Toshiba hard drive was connected outside of the computer case by means of a cable. (Ex. 9, P. 38-39)

[91] The cellular phone was password protected and the time and date on the phone were automatically set by a cellular network. The phone displayed two email addresses and using initials only, they were, “SE0@gmail.com” and “AE.2008@gmail.com”. In addition there was an Outlook account “chopper80@msn.com:Outlook”, and a personal Internet Message Protocol (IMAP), which, (using initials only) was “S-J@hotmail.com”, where S is the first name of the accused and J is the first name of one of his own girlfriends.

[92] The iCan computer, Gateway laptop and HP Slimline computer, all used the Microsoft Windows operating system.

[93] He took the Court through many of the complexities of a computer. He stated that the Windows Registry, while hidden to the average computer user, tracks all the systems settings. It can be accessed by typing “regedit” into the Windows search bar and selecting the Registry Editor application. The user will then be presented with a window that contains several registry “keys” that will allow a user to view or change settings. (Ex. 9. P. 60)

[94] He stated that there are binary toggles a user can use to turn hidden files in the Windows Registry “on” or “off”. He stated “1” would equal “on” or “true” while “0” would equal “off” or “false”.

[95] A local area network or LAN is a collection of devices connected together in one physical location, such as an office or home. Its defining characteristic is that it connects devices that are in a single, limited area. He stated that there was a LAN at the Silverbirch residence.

[96] He then took the Court through external and internal IP addresses. The external IP address is what the Internet sees, and the internal IP address is what a device sees. He testified that the most common format used in small residential settings, are four sets of eight bits (2 bytes) separated by a “.”. An example would be192.168.xxx.XXX where xxx equals a subnet and all devices need to be on the same subnet. Typically, it will be a 0, 1, or 2, i.e. 192.168.0. XXX identifies a device on the network and an example would be 192.168.0.10.

[97] All devices connect to a router to get onto the Internet and to connect with each other over the LAN. The computer automatically gives each device an internal IP address. The last two numbers (XXX) for the iCan computer were 12, for the Gateway laptop computer 11 and for the HP Slimline computer 10 (Ex. 9. P. 68-71).

[98] Loschmann described a Remote Desktop Protocol (RDP), which allows a user such as an IT specialist to take control of another person’s computer. It also controls firewalls, which block unwanted traffic and manage the different ports. He stated that the manufacturers default settings are the most restrictive ones, but the settings can be changed by the user. The user can turn the settings off or on or configure them to be somewhere in between.

[99] P. 76 of Ex. 9 is the screen that comes up when the iCan computer is turned on. It shows a landscape and the Internet username, which is the full name for the initials AE.2008@outlook.com. A.E. is the accused’s daughter.

[100] He stated that no recycle bin exists on a computer until someone logs in for the first time. The user account “AE” first logged in on March 22, 2017 at 5:33 p.m. (Ex. 9, P. 77)

[101] On the iCan computer, the Maxtor hard drive is designated as the “G” drive and is assigned the binary value by the windows operating system of 01 00 00 00 00 00 00 00 00 00 00 00, which could not have been found without using forensic tools. (Ex. 9, P. 79)

[102] The file name Volume beginning with “$” means the file is hidden and could not have been put on the hard drive before April 26, 2013. He said it would not be available to a regular user. The term $Volume is the file name used when referring to the structure, i.e. like a Rolodex, but when the file is just on the hard drive it is referred to as Volume without the $.

[103] There is a file name “$Volume” on the Maxtor hard drive which is shared as the “G” drive across the LAN. When the G drive was mounted on Loschmann’s computer it became the “H” drive on his computer because he already had a “G” drive. This “H” designation was generated by his computer, but the file name “Volume” would have been generated by the user.

[104] The creation of the “Volume” file creates a time benchmark for any files created after that point. The “$Volume” file is created by Microsoft Windows and is created the first time the user formats a particular hard drive. Therefore, Loschmann can tell when the last time was, that the hard drive had been formatted. This was the benchmark he was looking for.

[105] The benchmark timeline for the Maxtor HD was April 26, 2013, at 10:19 a.m. Therefore, the files on the hard drive must have been created after that date.

[106] Four folders are contained within the “Volume” file, being DJ Music, Home Videos, Music, Pictures. They were all created on April 26, 2013. In the pictures file there are six folders and four files. Of the four files, three are images and one is a web file. (Ex. 9, P. 85) This file would not be hidden. A folder can be used to organize files and the user can put documents into it.

[107] The image on page 86 is the same as the one on page 85, except the user has clicked in a box at the top called “Hidden Items”. By doing so two more folders, which are slightly greyed out on page 86, become visible to the user.

[108] These previously hidden files are named “Life with CC 2011–2014” and “Virus Files”.

[109] To hide files, the user would choose the files, right click on the selected files, then go to the Context Menu, left click on properties which would then display a window showing a box beside the words “Hidden Items”. When the user clicks on that box, the files will become hidden or not hidden. (Ex. 9. P. 87) The “Virus” file was created on February 3, 2014, however, Loschmann cannot determine when the file was hidden.

[110] Although two files in the “Virus” file are not hidden by using the method described above, you need to get to the Virus file to find them. The word Virus itself camouflages the content one would expect to find in a file labelled Virus. When the user clicks in the box beside the words “Hidden Items”, 17 more files are revealed. (Ex. 9, Ps. 88-89) Therefore, since the Virus file was camouflaged by its name and there are files within the Virus file which are hidden, this amounts to effectively two levels of concealment.

[111] When a user creates a new folder without naming it, the computer will simply name it New Folder(1) or (2) as the case may be. This name can be changed at any time by the user.

[112] The file “Bean” contains images of C.C. and is at third level of concealment. The Bean file contains 77 other files or images. (Ex. 9, P. 91) The “New Folder (2)” file contains and hides the River Videos.

[113] The metadata from the device taking the videos (Ex. 9, Ps. 94-95) shows that the content was created on August 31, 2014 at 1:57 p.m. and the last time entry for that day was 5:34 p.m.

[114] The file name “New Folder2” has been renamed by the user. If it was computer-generated, the name would read New Folder (2). This file contained three zip files and one RAR file which is like a zip file.

[115] The file “Sexy” containing images of M.A., is hidden three levels deep in the hard drive. (Ex. 9, in P. 98)

[116] The file “time” is the uncompressed Zo Lekker file and contains child pornography. (Ex. 9, Ps. 97,100) The name “time” is a user created name. The right-hand column on page 100 shows the dates the files had when they were put into the zip folder. There are two folders and the rest are files.

[117] Page 102 shows the date and time when the zip files were uncompressed. Zo Lekker was uncompressed at 3:18 p.m. on March 22, 2017. User intervention is needed to zip and unzip a file. Each time the file is compressed or uncompressed the computer keeps track of the time and date on the folder, but the original files retained the date and time on which they were created.

[118] Loschmann checked the Maxtor hard drive with a virus scanner and found no malicious applications on the computer. There was an antivirus program called AVS installed on the computer which had been updated recently.

[119] At P. 104, which is not an exhaustive list, the log shows that the Gateway computer was connecting to the iCan computer, but Loschmann cannot confirm if any material was being transferred from one computer to the other. What he did confirm, is that the Gateway computer reached out and made connections with the iCan computer.

[120] Similarly, P. 116 shows that the Slimline computer was reaching out and connecting to the iCan computer.

[121] Loschmann testified that the System Hive was set, (Ex. 9, P. 61) such that the iCan computer could not be remotely controlled by another computer and the firewalls were fully enabled on the iCan computer.

Gateway Laptop

[122] With respect to the Gateway Laptop, Loschmann created a virtual image as he had done for the iCan computer. He stated that the first user account is in the name of S.E. and login requires a password. The image of the login screen is reproduced at P.122. Since he did not have the password, he used his forensic tools to determine what was on the computer.

[123] The only username on the computer is “chopp” and the full name is S.E. The accused and chopp are one and the same person. The Internet username was chopper80@msn.com. The first time someone logged onto the computer was March 21, 2017.

[124] The remote desktop (RDP) is disabled and all the firewall settings are turned on. This would block unwanted access by third parties to the computer. He did not find any viruses or malware on the computer.

HP Slimline Computer

[125] He went through the same process with this computer that he had done with the previous two computers. He found three user accounts, one in the name of the accused, one for A.E. and one for S.H. The accused was the last person to have logged onto the computer and he never used the computer after March 16, 2017.

[126] There were only two recycle bins and it appeared that computer had never been accessed under the username S.H. To create a user account, a person would need to have administrative authority.

[127] The first time the accused logged onto the computer was February 24, 2014. (Ex. 9, P. 134) By far the main user of the computer was the accused. No malicious software was found in the computer and antivirus software was installed and updated on June 2, 2017.

[128] All of the computer’s firewalls were enabled, meaning that the user had taken appropriate steps to prevent unauthorized access to the computer from outside the residence.

[129] The computer’s remote desktop connections were enabled, which is standard where the device is used as the media device for something like a television. The Hewlett-Packard Slimline was found in the living room by the television. It was configured to allow LAN connections within the residence. (Ex. 9, P. 141)

Summary

[130] Loschmnnn told the Court, that where he referred to items as child pornography, those opinions were the opinions of Detective Shipp.

[131] The iCan Computer was found in the child’s bedroom. It contained child pornography including the River Videos and intimate images of women. The Hidden attribute of the computer was enabled.

[132] Nothing of note was found on the HP Laptop which was used as a media device to watch television, etc.

[133] The HP Slimline Computer was used to connect to the iCan computer and contained the River Videos, along with intimate and iMGSRC media. Its Hidden attribute was enabled.

[134] Both the Seagate Barracuda and Western Digital hard drives were damaged, and no evidence was obtained from them. There was nothing of note on the Memorex DVD.

[135] The SanDisk contained child pornography and images from iMGSRC.

[136] The Samsung Galaxy S7 cell phone and microSD card contained images from iMGSRC and child pornography from the River Videos.

Supplemental Report Prepared by Detective Loschmann – Ex. 10

[137] Loschmann prepared this report using data from the seized devices in his analysis of same. To access some of the materials he used forensic software known as X-Ways.

[138] He searched for keywords which were given to him by Detective Shipp. The numbers in brackets on pages 3 and 4 of his report refer to the number of times a specific search term was located on the specified device. Page 4 simply totals the number of hits for all the devices combined.

Supplemental Report - CAT 1 - River - Ex. 6

[139] Ex. 6 contains information from all the devices.

1. The first column under “#” is Loschmann’s sequential numbering of all the images or videos.

2. The second column under “Name” sets out the charted name of the image or video.

3. The third column under “Created” displays the date the image or video was put onto the hard drive, not when it was made.

4. The fourth column “MD5” was described as a fingerprint for the image or video. The X-Ways software uses a mathematical algorithm to create a unique number.

5. The fifth column called “Metadata” includes a significant amount of computer-generated data including the date when the image or video was made/created.

[140] Pages 3 and 4 deal with the River Videos and the remainder of the report deals with Category 1 files, as categorized by Detective Shipp.

[141] Starting on page 5 of the report, there are nine vertical columns as follows:

1. The first column is Loschmann’s sequential numbering.

2. Name - is the file name.

3. Path - is where the image or video is located on a device.

4. Evidence Object - is the specific device that the image or video is on.

5. Created - is the date the image or video was put on the hard drive.

6. Modified - is the date on which an image or video was modified in any way. If the content has not been modified in any way it keeps its creation date.

7. Record Changed - is the date an image or video is moved from one location to another, but the content isn’t necessarily changed. The three dates are generated by the computer but would be dependent on user interaction.

8. Hash1 – means MD5 hash values which are the most commonly used hash values.

9. Hash2 - means SHA hash values.

[142] A “hash value” is a digital fingerprint for a file. Even if only one pixel of an image is changed, the hash value changes. The software X-Ways produces the hash values.

[143] Hash values can be used to compare a file that you have, to a database of known child pornography. While filenames can be removed or changed, hash values cannot.

[144] Beginning at Ex. 6, Page 27, line 179, the columns under Created, Modified and Record Changed are blank. Loschmann testified, that while the files still exist on the computer, the computer has no knowledge that they exist. He testified that he can find these files using his forensic software.

[145] He tried to explain by analogy that it was like trying to find a book in a library, where the book title does not exist on any type of index, yet the book is still somewhere in the library. The designation “\Path unknown\Carved files” is simply a label produced by the software.

[146] The software uses information from the header for image files to try to find and access images.

[147] He said that there is something called a master file table, “$MFT” which he likened to an index or Rolodex. He stated you would need user interaction to remove a file from the MFT.

Forensic Analysis Report – Gateway Laptop – Ex. 11

[148] This 34 page report was prepared by Loschmann on October 30, 2017, using information from the Gateway laptop. He stated that by using Google Chrome and logging in with a Google account, a person can sync their search results across their various devices.

[149] Page 8, item 2, shows that the user logged into iMGSRC, while item 3 shows the user logged into my.pcloud.com.

[150] Item 18 shows that the search is synced with (using initials for the accused’s full name) SE0@gmail.com.

[151] Item 4 shows that the username was not saved, however this is something that would be set by the user. The Galaxy 7 cell phone was not sync enabled.

Forensic Analysis Report – HP Slimline – Ex. 12

[152] This 36 page report was prepared in the same way as Ex. 11 and was prepared to try to extract similar information from the Slimline computer.

Loschmann – Cross-Examination

[153] Loschmann confirmed that the Western Digital hard drive on the Maxtor computer contained the Windows 10 Pro operating system and that an operating system is necessary to run the computer. The operating system was installed on March 22, 2017, which means that all the data on the hard drive was put on after that date. Also, the setting for sharing material over the LAN would have been enabled on or after March 22, 2017.

[154] He further stated that the Hitachi hard drive was not attached, appeared corrupted, and no evidence was obtained from it. He confirmed that the Maxtor was being shared over the LAN and that the Western Digital hard drive contains the settings to allow for that.

[155] He confirmed that no evidence was found on the HP Laptop that had been seized by Silva. He did not know why it had been seized. He also confirmed that nothing of interest was found on the damaged Seagate Barracuda hard drive, damaged Western Digital 1 TB hard drive or Memorex DVD.

[156] The Gateway Laptop connected numerous times with the Western Digital hard drive. This information comes from the AVG logs which reside on the Western Digital hard drive and go back to the spring of 2017. He could not say which files the Gateway computer was accessing. He does not recall the media files on the Gateway computer being hidden, including eight files being listed as “files of interest” by Shipp.

[157] The HP Pavilion Slimline computer contained two hard drives and was used to connect to the iCan computer. It contained the River Videos which were hidden. A user would use the control panel, i.e. Windows Explorer, to access any files including hidden files.

[158] The defence suggested, by using a filing cabinet analogy, that if the filing cabinet was locked, one would need a key to access it and there was no key in here. Loschmann responded that a user would need a password to log onto the computer.

[159] He agreed that the River Videos were made up of nine clips of short videos strung together.

[160] He does not know where the Lexar thumb Drive was found in the apartment, but he confirmed that media could have been put on the thumb Drive from the phone, as long as the user had a proper cable. With respect to the 16 GB SanDisk microSD card, he does not know what device it was supposed to connect to nor who the user of the SD card was.

[161] He confirmed that the cell phone was a Galaxy S7 and not an S10. He confirmed that there was a typo at page 43 of Exhibit 9 and it should read S7 not S10. The S10 was not released until 2019. He confirmed that the micro SD card (Ex. 9, P. 144, #9) had been in a BlackBerry phone and was not the same as the 16 GB SanDisk microSD card which was not attached to any device when it was found. He could not tell what model of BlackBerry phone the card had been inserted into.

[162] He confirmed that any references to child pornography on Exhibit 9 are those of Detective Shipp and not his.

[163] When asked about his search experience using X-Ways, he confirmed it was set out in his curriculum vitae (Ex. 8). In addition to taking courses and using the software for 5 years, he stated it was the main tool taught at the police college. Up to January 24, 2021, he had completed 584 computer searches using the X-Ways forensic software. He is not aware of anyone ever having had an inaccurate reading when using X-Ways software. He stated that if he ever did have an inaccurate reading, he would validate it.

[164] He stated it was not possible for the X-Ways software to put child pornography onto someone’s computer

[165] Loschmann stated that he has been looking at this case since June 1, 2017 and even after 4 years with the updates in software for detecting malware, none have been found on any of the devices. Therefore, there is no evidence that anyone from outside the home could have placed the images on any of the devices. In addition, there was virus scanning software on all devices and firewalls were enabled on all devices. Remote Desktop Protocol (RDP) was enabled on all the devices except the Slimline computer, which is normal when the device is used for watching television.

[166] For a third-party to put material on one of the devices, they would need:

1. to be invited into the home;

2. have access to the device;

3. have knowledge of the LAN; and

4. have the password.

[167] With respect to the Galaxy S7, he was unable to bypass the security for 2 years after it was seized, but finally after his technical tools got better, he was able to do it. The security on the Galaxy S7 is very strong and he has never seen a Galaxy S7 with malicious software on it.

[168] When asked if someone could breach the computer if it had been in a storage area for 5 years, Loschmann responded that the person would still need access to the device and have the password. He further stated that he could not breach the password. Even if a third-party was in the residence, they would still need the password.

[169] Loschmann, was then asked numerous technical questions involving commands for the computer, including a CDM function which is short for Command. He stated that it is accessed by clicking on the Windows key and typing CMD near the bottom of the screen. This brings up numerous settings which a knowledgeable or very knowledgeable computer person may wish to modify.

[170] These include commands such as, NETSH, PING, PROMPT, RESET SESSION, RUNAS, SSH and TSDISCON. Loschmann is not familiar with the commands RESET or SESSION.

[171] Loschmann testified that changes to any of the settings are made in the Windows setting. They can be changed for whatever period of time the user wants, including repeatedly on a one-time basis. He further testified that if any of these settings are changed, no matter how frequently, such changes would show up in the Windows Security Event Log after March 2017.

[172] He testified that these commands could be communicated to the computer in different ways, including using typing them in like the old computer DOS commands and/or using a graphical interface. No matter what method is used, all changes are still kept track of in the event logs and the Windows Registry always show the current setting.

[173] When asked about the Virtual Network Computing (VNC Viewer), he stated it was third-party software, which operates similarly to Remote Desktop and allows someone using a Google Chrome browser to control another computer if they have access to it.

[174] He stated that a virtual private network VPN was typically used to mask/hide a network from the computer it is connected to.

[175] With respect to the photograph of the accused and the young girl at Ex. 9, P. 95, he testified that from the view of the camera it was the accused who was taking the picture. He said it would have been taken from a mobile device, but the metadata does not say what device took the picture.

[176] He is not very familiar with iMGSRC and he has never set up an account on that website.

[177] He took the Court through part of the hard drive on the HP Slimline computer. He started by saying he initially found four folders and one of those folders was labelled Photo, which from the point of view being hidden or camouflaged, he labelled level I. Within that folder were four other folders, one of which was named “photo” beginning with a lowercase “p” - level 2.

[178] Within the photo file, were several files. One was named “effetica” which contained six files which were non-hidden, plus a file labelled “girls” which was hidden - level 3 and 4.

[179] He likened the hidden “girls” file as being hidden on level 4. When it was unhidden, there were many more hidden (greyed out) files. There were nine more folders and 10 zip files, one of which was a file labelled Bean, which contains images of C.C. - level 5.

[180] He testified that the path and other data for all the files except Bean are set out at Ex. 6, P. 258-9, #2025-2038 - level 6.

[181] When asked about the River Videos and referring to Ex.6, Loschmann stated the folders were initially coming out New Folder (2). (Ex. 6, Ps. 259-60) Those pages under the heading “Evidence object” show that the River Videos were found on the Toshiba, Lexar SD and Galaxy phone.

[182] He testified that the image referred to at Ex. 6 P. 258, #224, came from a compressed file which was recovered from the Maxtor hard drive after it had been deleted. Its name on the chart starts with the letters “lfs” which is a naming convention for child pornography.

[183] When asked about the AVG vault, he stated that AVG is a third party virus scanning program which had been installed on the iCan and HP Slimline computer and while he was not sure, he said the vault may be quarantine space for any viruses found, but he did not detect any viruses in the AVG vault.

[184] He was then asked about the Dynamic Host Configuration Protocol (DHCP). He explained that on a network every device needs an internal IP address and while a very knowledgeable user could set his/her own, Windows automatically sets an internal IP address for each device. In noncomputer parlance, he said it was like setting an address so Canada Post could deliver mail to individual addresses.

[185] He was asked if all the files and folders would be lost or removed if a hard drive was reformatted. He testified that all the folders and files would remain but the structure, like the Rolodex, would be missing. Therefore, to find a particular file, it would have to be manually looked for, which is what the forensic software assists a person in doing.

[186] He confirmed that if the hard drive was reformatted, the date and time stamp on the $Volume file would be updated, however he stated that the Maxtor hard drive had not been reformatted since April 26, 2013. (Ex. 9. P. 80). He stated that the $Volume file is like the Rolodex and it is on every computer running a Windows operating system. The $Volume file can only be accessed using forensic tools.

[187] He stated that the email address, using initials only, SE0@Gmail.com was on all the devices and that the only user account on the iCan computer was A.E.’s (the accused’s daughter) name in the full.

[188] He confirmed, that with filesharing enabled on the G drive of the iCan computer, a user could move a folder from the G drive to another device on the LAN.

[189] From the Google Chrome history, a person can tell what websites have been accessed.

[190] He testified that a thumb cache contained scaled-down images of an image or video and allowed the user to quickly ascertain what was in the file. He told the Court that the thumb cache database is not accessible to a user without the assistance of forensic tools.

[191] When asked why all the dates at Ex.9, P.91 and on P.97 were the same, he replied that they were all copied onto the Maxtor hard drive at the same time.

[192] He testified that the Command function of a computer can be accessed in numerous ways, from typing in prompts like in the old DOS system to using graphical interfaces. The command function allows the user some granular control to modify the hard drive from how it is set at the factory.

[193] He stated the Command function could be initiated using various methods, including using notepad and batch files. He stated that batch files are simply a set of instructions for the computer and are used as opposed to retyping the commands from scratch every time the user wants the computer to repeat a task.

[194] On the system involved in this trial, to issue a command using Remote Desktop Protocol (RDP), a person would need to be in the residence and connected to the LAN because the Remote Desktop (RDP) was turned off on all the devices except the Slimline computer.

[195] In summation, he stated, to send a Command to the computer, a person would need the device, login credentials and be physically sitting at the device and be connected to the LAN.

[196] Loschmann was asked about a VNC viewer, which he said is a third-party application, is not part of Windows and works similarly to the RDP. The RDP would have to be turned on, on a device to be able to use VNC viewer. To manipulate a computer using the VNC viewer, the user, like when using the RDP, would need the device, login credentials and be physically sitting at the device and be connected to the LAN.

[197] The only device that had the VNC viewer software installed on it was the HP Slimline, which was used as a media server in the living room and it had its RDP enabled.

[198] He was asked about a Secure Shell. SSH. He said it was a text-based program and would be quite convoluted to use with a Windows operating system. The user would have to have intimate knowledge of the LAN, including the internal IP addresses of the computer to be accessed.

[199] He was also asked about the Security Account Management Function (SAM) and stated that it can be used to access passwords, but not a device’s IP address, which is contained in the Systems Hive and not in the SAM.

[200] Passwords are stored on the Microsoft server. These are Windows live accounts and at the first-time installation of Windows, the software requires an email and password.

[201] In answering questions related to firewalls, he stated that a user can subtract items that might otherwise be caught by the firewall to allow the user to play video games or access illegal downloads, etc.

[202] If a hidden file is moved to another place on the same computer, the hidden attribute remains. If it is moved to another device, it may or may not retain its hidden attribute.

[203] Loschmann agreed that all the devices could “talk” to one another, but the iCan computer Maxtor hard drive was the only device sharing information.

[204] He stated that a flash or thumb Drive could only be copied onto a device that it was plugged into, however, in this situation, under its configuration, a thumb Drive could have been copied to the Maxtor hard drive, if it was plugged into a laptop which was connected to the LAN.

[205] When asked, he stated that he scanned the computer for viruses and there was no record of any viruses in the Vault or anywhere else.

[206] The 16 GB SanDisk microSD card labelled #9 at Ex.9, P.144, was formatted for a BlackBerry phone and contained a BlackBerry folder and BlackBerry messenger folder.

[207] Windows live accounts are not stored locally on the computer’s hard drive.

[208] The Windows Registry (Ex.9, P.61) contains registry files referred to as hives. He stated that since this system was a Windows Live account, the password is not stored in the SAM hive.

[209] In answer to Mr. Gehl’s question, Loschmann confirmed that the Hitachi hard drive was not connected to the iCan tower and therefore the computer’s operating system did not reside there. He agreed that it was possible that the operating system could have resided there at some time in the past but stated currently the computer’s operating system is on the Western Digital hard drive.

[210] He was next asked about the Master Boot Record (MBR). By analogy he said it was part of the Rolodex and manages the structure of the hard drive. It helps the computer to boot, which he said is to turn on and get functional. It transfers control of the start-up process for the Windows operating system, to the operating system on the hard drive. The MBR does not allow the computer to share information with other devices.

[211] He confirmed there were devices in the residence that he did not check because he was not asked to check them. When asked if viruses from these other devices could have infected the devices he checked, he replied no, because all the devices he checked had no viruses. All the devices he checked had up-to-date virus scanning software which would have removed any viruses. He confirmed that upon checking for viruses 3 to 4 years later, with better and updated software, he still found no viruses.

[212] He confirmed that initially in 2017, he was simply unable to bypass the security on the Galaxy S7 phone but was able to do so in 2019 because of better forensic software. He deferred to Shipp for what was found on the phone.

[213] Loschmann said it was possible to allow a virus into a system once it was quarantined.

[214] He said the accused would have needed the password for “A.E.” to get into the iCan computer, because the only user account was in the name of A.E. Since other devices on the LAN had an S.E. account, the accused could have signed in from them using his password.

[215] Loschmann stated there were three sign-in options for the Slimline computer, (Ex. 9, P.130) however S.H. never logged into the computer and A.E. never logged in after March 16, 2017. The Gateway computer only had one user account.

[216] He walked the Court through different options a user would have had to sign in. These would include using a PIN and if you forgot your PIN, Windows would give you a prompt to assist you in remembering your password. He said there were other methods such as biometrics by using a fingerprint or facial recognition from the laptop computer. When Gehl asked about some other methods he replied that he was not sure what he was talking about.

Loschmann - Reply

[217] Loschmann introduced a 290 page Cybercrime Supplemental Report, dated January 7, 2019. (Ex. 16)

[218] At page 12 of the report under paragraph 3.3.3, he said there were 661 search hits of A.E.’s desktop IP address on the Gateway computer.

[219] Although he was not really looking for it, he did not observe if the firewall setting had been enabled and un-enabled repeatedly.

[220] The red number 4624 on page 12 is a unique number generated by the Windows operating system. It helps security people to filter what they are looking for. Each type of event gets a unique number. If the same event happens 10 times, that unique number will be found 10 times.

[221] He testified that the iCan computer was not configured for alternate methods of signing in. He stated that if a user knew the internal IP address of the Maxtor hard drive, he/she could sign in, in an alternate way.

[222] When asked, if a person signed in using a device with the alternate sign in methods enabled, would the fact that they signed in on the other device, mean that they also signed in on the Gateway or Slimline computer? Loschmann said it would not.

Constable Chris Moore

[223] Moore has been with the Waterloo Regional Police Force for 20 years. Between April 12 and June 2, of 2017, he worked with the ICE unit under Shipp. He initially had contact with a Constable Butler in Australia and put Butler in contact with Shipp.

[224] On June 2, 2017, he assisted with the enforcement of the search warrant at 8-616 Silverbirch Drive, Waterloo, Ontario. When the officers who were to be involved in the search attended the accused’s residence, his car was not there. The police waited approximately an hour, hoping the accused would return, but when he did not, they knocked on the door at approximately 8:03 a.m.

[225] A female by the name of S.H. let them in. After entry, Moore and Shipp left to search several job sites where S.E. might be working. They located the accused at approximately 10:30 a.m. at a job site and arrested him.

[226] At the time of arrest, Moore removed S.E.’s personal belongings, including his cell phone in a red case, however, Moore does not know the make or model of the cell phone. He did not return to search the residence.

[227] On cross-examination, he testified that after putting the cell phone in a property bag, he gave it to Shipp. He does not know whether the black Acer laptop was seized by the police.

Sergeant Eugene Silva

[228] Silva is now retired, but in 2017 he was a Sergeant with the Waterloo Regional Police Service. He had been in charge of the Cyber Crime Unit since 2004 and Shipp reported to him.

[229] On June 2, 2017, he read and signed the search warrant and had the officers who would be assisting with the search read the search warrant. He confirmed the evidence about their arrival and ultimate entry into the subject premises.

[230] Silva took three sets of photographs of the residence. The sets have been labelled pre-search, during the search and post search, and have been entered as Exs. 13, 14 and 15.

[231] He testified to doing preliminary searches, at the residence on the devices they found, using the X-Ways forensic software. Part of that software allows for a preview of words or phrases that the user can search.

[232] He explained, that if any of the computers were turned on, he would do a “live memory transfer”. He explained that the live capture allows him to preserve volatile information that would be held in RAM and that, that information would be lost if the computer was turned off.

[233] He explained that the X-Ways software does not change anything on the computer that is being searched. He also testified that the search the software allows a user to do is similar to a Google search. The search results will show approximately 100 words on each side of the keyword or phrase being searched. The software also allows searches by images. The user of the software can also tell the software to access a specific file or Internet catch file.

[234] The software also allows the user to manually navigate to areas of the hard drive where he/she thinks content of interest may reside. After doing a preliminary search on the Toshiba laptop, Acer laptop, Western Digital hard drive, which was loose on the floor, and a Fujitsu hard drive, along with three other storage devices, he did not seize them.

[235] He was given the password by S.H. to the HP Pavilion Slimline computer which was running. Therefore, he did a live memory transfer before turning it off. Since he found evidence of the material he was looking for, he seized the computer.

[236] Similarly, he found evidence of material he was looking for, on a USB thumb Drive, SanDisk, Gateway laptop, HP Pavilion computer and iCan computer, all of which he seized.

[237] He was having technical difficulties doing preliminary searches on a 1 TB Western Digital hard drive and a Seagate hard drive, so out of an abundance of caution he seized them as well.

[238] The iCan computer was found in a child’s bedroom. When he found child pornography on its hard drive, he stopped searching so he could apply for additional judicial authorization.

[239] He completed his search at 1:45 p.m., took photographs of how he left the apartment and left the premises at 1:54 p.m. On July 3, 2017, he turned all of the seized devices over to Detective Loschmann.

[240] Thirteen pages of his pre-search photographs were entered as Ex. 13, fifteen pages of his photographs taken during the search were entered as Ex. 14, and ten pages of his post search photographs were entered as Ex. 15.

Silva – Cross-Examination

[241] Silva has taken two or three training courses including an advanced level course on the X-Ways software directly from personnel who work for X-Ways. In June 2017, he was using the X-Ways Forensic Suite, version 19.2.

[242] In his preview of the devices, he was looking for copies of the profile picture known as criza or a similar picture downloaded from iMGSRC. While he found similar pictures, he did not find an exact match. He did not take a look at the dates, because he had concluded that the device warranted a further look.

[243] The defence suggested that the HP Pavilion Slimline computer was not password protected and therefore he did not get the password from S.H. Silva denied this allegation.

[244] To search a hard drive, he uses his own computer which is connected to what he described as a “write blocker”. This device, which gets inserted between Silva’s computer and the computer being searched, prevents Silva’s computer from putting any material onto the seized hard drive. He downloads the contents of the hard drive from the computer to be searched onto his computer and then proceeds with his keyword searches. While the software is searching for the keywords that he has entered, he can simultaneously search other locations in the computer that he thinks may contain files of interest. Because this was only meant to be a preliminary search, as soon as he found the word criza, he terminated the search and seized that device.

[245] He was asked questions regarding what appeared to be error messages in the top picture on P. 13 of Ex. 14. The image on the screen is from the Gateway computer. He acknowledged that the Gateway computer could have been networking with the iCan computer during the search. The error in red print seems to be saying that the TV show of The Simpsons was unable to be opened.

[246] When the accused suggested that the Gateway computer was trying to get The Simpsons TV show from the HP Slimline computer, Silva answered that he did not know. Silva said that in general, because there is a LAN in the residence, if a device is turned on, it should be able to communicate with any other device on the network. He did not confirm during his search whether any of the devices were communicating with each other.

[247] At P. 6 of Ex. 13, Silva testified that it looked like there was an episode of The Simpsons TV show, showing on the monitor, and that the Gateway computer in the picture was connected to the monitor via a VGA cable.

Constable James Bowden

[248] Bowden was dispatched to assist with the execution of the warrant on June 2, 2017 at 8–616 Silverbirch Drive in Waterloo.

[249] Essentially, he assisted with locating the storage devices which did not appear to be difficult. He only did a visual search for the devices and did not take part in any computer searches.

[250] The defence did not cross-examine him.

M.A. - Complainant

[251] At the time of trial M.A. was 62 years of age. At one time she was in a relatively long-term relationship with the accused’s father (D.L.) and therefore was technically S.E.’s stepmother. She described the relationship with D.L. in his later years as on again off again.

[252] It appears that the accused was raised for the most part by his mother, however, he lived with M.A. and his father part of the time. M.A. said the accused was always in trouble and that his mother did not want him, so she and D.L. took him in for awhile.

[253] The accused had a daughter with J.W., named A.E. The family would all get together on some special occasions like birthdays. She recalls the accused living in Waterloo but forgets the address.

[254] The relationship between her and the accused started out as a familial type of relationship and although she is not sure, she thought it changed in approximately 2012, when it became sexual. She looked at it as a fling.

[255] She stated that the accused lured her in somehow and at the time her relationship with D.L. was not going well.

[256] Her relationship with the accused, which lasted about two or three years, was not going well and she was not enjoying it, however she said he took some compromising pictures and then threatened to expose her with the pictures, basically saying if she did not submit to having sex with him on occasion, he would expose their relationship. The sex seems to have been sporadic and at times three or four months apart and at other times perhaps a year apart.

[257] She testified that she felt trapped and did not want to keep going, but the accused continued to threaten her, particularly, he threatened to tell his father and other members of the family.

[258] She would ask him if he deleted the photos, he would reply positively, and they would get on good terms. Later he would say no he did not and threatened her, to get sex. She said she could not tell anyone, and she was ashamed.

[259] She told the Court that he contacted her and when he did, she would indicate to him that she wanted to stop. That is when he would threaten her with the pictures and say that he loved her. While she told him she wanted to end the relationship, he extorted and blackmailed her into having sex with him when he wanted and she was essentially helpless not to comply.

[260] She told him she did not want to continue, both by phone, text and face-to-face and has deleted him off Facebook and other social media apps during parts of their three year relationship.

[261] She admitted taking a selfie of herself in the nude and sending it to him. He stated that he took all the other pictures that he kept on his phone.

[262] She testified that the accused liked looking at the pictures and got off on them.

[263] She confirmed numerous times that she never gave him permission to share the photos and that she continually asked him to delete the photos.

[264] The nude photos are contained in Ex. 3-D. There are numerous photos of body parts including her vagina and the accused’s penis. She identified the photos but said she was unaware there were so many.

Cross-Examination of M.A.

[265] She confirmed that she took the first nude photo of herself in about 2012 and sent it to the accused. She claims to have taken it at the request of the accused.

[266] The defence suggested that he did not ask for a nude picture of her, however she maintained that he asked her for one and that at the time he was horny or something and that they were on the phone when he requested a nude photo of her.

[267] When asked to confirm the pictures are of her, she said that she assumed the pictures were of her. She could not confirm whether a video was taken of them and whether the photos we have been referring to are still pictures from the video. She said she never saw a video.

[268] She said the pictures were taken after they had sex and the sex was consensual at the beginning. She also said the sex was consensual a few times afterwards, but other times she was threatened into having sex.

[269] The defence acknowledges that the accused did not seek M.A.’s consent to show the pictures to anyone else.

[270] She acknowledged that the sex took place sometimes at her place and sometimes at the accused’s place.

[271] She denied that the accused ever told her on occasion that he was in a new relationship and wanted nothing more to do with her.

[272] When the defence suggested that she went looking for the accused at a worksite to ask him over for a beer, she said that was not true and that it was the accused who contacted her, telling her that he was working down the street and that he wanted to come over for a beer.

[273] She does not remember sending any more than the one picture to the accused and while she stated she blocked him on social media she does not know whether he blocked her on social media.

[274] She said some of the accused’s requests for sex came from BlackBerry Messenger. She testified that she got a new phone in 2018 and does not have the texts anymore.

[275] She denied asking him to watch her shower and said it was he who asked her to watch him shower. She denied ever asking to watch him shower and she denied ever asking him to send any pictures to her, but he did anyway.

[276] Gehl took her through some parts of the preliminary hearing and statement to the police.

[277] In her statement to Shipp, she indicated that she took one picture, maybe two.

[278] She acknowledged the accused was living on Overlea Drive in approximately 2012- 2013. It was suggested to her that she visited him before she went to work, and she responded that she did not remember if it was before work. She said the question refers to things that took place almost 10 years ago and they are unpleasant memories. When asked why she would visit him there in any event, she said because the threat was always over her head.

[279] She stated the accused, when he wanted something, would keep at it, telling her that he needed to see her, and she had to come over.

[280] Gehl suggested, that when she first talked to Shipp, she did not know what he wanted to see her about. He suggested that she made up the story she just told the Court because she needed an explanation for why she would have sex with her stepson.

[281] She denied that was the case.

[282] There were no reply questions.

C.C. - Complainant

[283] C.C. had been S.E.’s girlfriend for between 2 to 3 years. They met in approximately 2011 when the accused worked in the warehouse for RIM (BlackBerry) in Waterloo and she worked for a third-party security company.

[284] She lived in an apartment on Overlea Drive and he gradually moved in until he was living there full-time. The relationship ended at the beginning of 2014, when, after taking a three-month training course in Regina, she became a correctional officer and took a job in British Columbia.

[285] When she began the process to apply to become a correctional officer, she was working at the women’s Grand Valley prison facility in Kitchener. Although there was some discussion about her applying for the job, while she was going through the application process, she said the accused was never against her applying to become a correctional officer.

[286] At the time she was applying to go to Regina, she stated that the relationship was not good. There were more bad days than good days and she wanted to escape. She stated that the accused was emotionally abusive, and the relationship had turned unhealthy. The accused was smothering and obsessive. She could not go out without him accusing her of cheating and him threatening to kill himself. Whenever she went out, he would obsessively text or call her, to the point where she described her phone as “blowing up”.

[287] Afterwards he would always apologize and grovel, but then continue acting as he had done before. It wore her down emotionally and because of his behaviour she lost friends and had less contact with her family.

[288] When she left for Regina for the three-month training course, she left all her furniture and her dog at her apartment with the accused. She described the training as strict and intense and the days being very long, beginning at 5:30 a.m.

[289] The phone calls and video chats with the accused were not always nice and not the easiest to deal with. Because of his behaviour she was stressed and even though she tried to discuss his behaviour with him, it did not change the volume of texts or calls which occurred up to 30 times a day.

[290] She tried to keep the peace as much as she could because she was fearful of what he might do to her belongings and her dog at her apartment. Sometimes, in an effort to calm him down, she would tell him what he wanted to hear, however after one week in Regina she told the accused that the relationship was over.

[291] Since he was still in her home she had to keep up some communication with him, however he did not seem to get the message and continued to obsessively text and email her, professing that he loved her, wanting to get back together and accusing her of cheating on him. She continued to try to tell the accused that she no longer had feelings for him.

[292] After her three-month training course in Regina, she came back to Kitchener for two weeks before leaving for B.C., where she works at a prison known as the Kent Institution. She told him she had a job at that institution. As far as she was concerned it was a permanent job and she intended to stay in B.C. As far as she knows the accused stayed in her Overlea Drive apartment, and he took over the lease.

[293] During her two weeks in Kitchener, the accused wanted to reconcile. To keep the peace and to protect herself emotionally and stay safe from the accused, because she said she knew what he is capable of doing, she told him some things that he wanted to hear.

[294] As he had done in the past, during their fights he would threaten to kill himself and wrap his car around a pole. This only heightened her concerns for her safety.

[295] When she left, because he still had her dog, she tried to remain friendly and he kept sending numerous texts and kept trying to communicate with her. He told her he would come out to B.C. and something about animal welfare people and her dog. She stated this was designed to make her stressed and anxious. She never gave the accused her address in B.C. because she did not want him out there and she was afraid he might show up.

[296] She testified to receiving emails from the accused stating things like “I know where you are” and “I can find you”. Although she never saw him in B.C., she was still trying to keep the peace.

[297] Finally, the accused’s behaviour got to the point where enough was enough. He had contacted her work and posted intimate image pictures of her online. At that point she contacted the WRPS and sent an email to him dated Monday, December 22, 2014, demanding that he take down the pictures he had posted, and stating unequivocally that he never had her permission to post them. She sent it to him using the email address chopper80@msn.com and told him not to reply.

[298] The accused replied on January 1, 2015. He started out by saying “no idea what you are talking about sorry”, and went on to say, “as for pictures, they are my photos and no legal action can be taken sorry”. This email came from (using initials only) se0@Gmail.com via a BlackBerry 10 smartphone and his name and mobile number are typed at the bottom. Both emails have been marked as Ex. 17.

[299] She stated that she never told the accused she lived in Chilliwack.

[300] C.C. was then taken through four sets of photographs which have been marked Ex. 3-E. The first set consisted of 12 photographs. She does not recall sending any of them to the accused. Some she said she took in Regina to show her physical progress from the training program. She commented on the pictures as follows:

1. She took this picture of herself fully clothed in the mirror but did not send it to the accused, it was taken in Regina.

2. She took this close-up picture of her in a bra and could have sent it to the accused.

3. Someone took this picture of her with her phone at the shooting range and she does not recall sending it to the accused.

4. She took this picture of herself wrapped in a towel in the bathroom mirror in Regina for personal development. She did not send it to the accused.

5. Someone took this picture of her fully clothed sitting with a phone in Regina. She might have sent it to the accused.

6. She does not recall who took this picture of her sitting on a toilet, but it could only have been the accused, because it was taken in the bathroom on Overlea drive. She did not consent to this picture being taken and looks angry in the picture.

7. This is simply a picture of her fully clothed.

8. This is simply a picture of her at a rifle range.

9. This is a picture of her at a mini putt.

10. This is a picture of what appears to be an incredibly lethal looking knife-like weapon, she does not know anything about it.

11. She does not know anything about this picture of a skimpily clad woman.

12. She does not know anything about this picture of a different skimpily clad woman.

13. She does not recognize the person in the picture.

[301] She does not recall sending any of the above 13 pictures to anyone.

[302] The second set of pictures contains 12 photos. She confirmed they were all of her. They are very intimate pictures of her in the nude with close-ups of her breasts and vaginal area. She admitted to taking some and assumed that the accused also took some, since he was the only person in their apartment.

[303] She stated that she probably took the close-ups and might have sent them to the accused since he was her boyfriend.

[304] The third set of pictures also contains 12 photos. Like the second set they are very intimate pictures of her in the nude with some close-ups of her vaginal and anal areas. She stated she may have taken a few but assumes that the accused took more than half. She stated that she did not consent to the first picture, which is a full frontal picture of her in the nude, being taken.

[305] She definitely did not consent to anyone sharing any of these photos beyond herself and the accused.

[306] The fourth set of pictures contains eight pornographic photographs of the penis and vagina of S.E. and C.C. and some pictures capture acts of intercourse showing large amounts of bodily fluid. Like the other series of pictures, she testified that she did not provide these pictures to anyone else and she did not give the accused her consent to share them in any way.

[307] With respect to the name Bean, it was a nickname her family called her. The accused was aware of the nickname and sometimes used it.

[308] Criza was a nickname or alter ego name for the accused. He used the name regularly and as a game name for his Xbox. She was also familiar with the name crizacustoms, stating she had heard it before, and she thought it came from the fact that the accused did custom work on his car.

Cross-Examination of C.C.

[309] The first time she knew the photos were posted was when she was contacted by the WRPS. She acknowledged taking some of the intimate photos and sending them to the accused, who at the time was her boyfriend.

[310] She did not consent to the accused taking pictures of them having intercourse, although she knew that he took a lot of pictures. She denied that there was any such practice between the two of them to take photographs during sex. She reminded the Court that these photos were taken up to ten years ago between 2011 and 2014. In addition, she stated she would not have been in the position to know every time he was taking a picture.

[311] She did not give the accused consent to take the picture of her sitting on the toilet.

[312] She told the Court that the accused is very tech savvy and would have the ability to sync pictures on any device, including her phone, with one of his devices.

[313] Gehl suggested their first kiss was on the steps of the courthouse after the accused had been found not guilty of molesting J.W.’s daughter. He further suggested that she knew the accused’s name was in the sex offender registry and because of that he was unable to leave the province. She denied ever being told by the accused or knowing that his name was on the sex offender registry, or that he could not leave the province of Ontario because of that.

[314] Gehl further suggested that any talk of suicide by the accused was over the charges he was facing with respect to J.W.’s daughter. C.C. testified that the accused’s threats of suicide were never about J.W.’s daughter and were always about their relationship.

[315] She testified that there were way too many times to count how often he threatened to commit suicide and that the threats occurred after every fight. It was one of the accused’s way of abusing her. She did not take his threats lightly and was always cautious. At the time, he was her boyfriend, and she was concerned about his suicide threats, however she said it happened so often, that it started to have less meaning. She was focused on him and suggested that he get help, while at the same time she was concerned for her safety.

[316] His words scared her, as did his driving superfast with her in the car, while talking about wrapping his car around a pole. In addition, he was mentally and emotionally abusive, verbally threatened her and referred to her in demeaning terms such as slut and bitch.

[317] She said the first discussion about ending their relationship was by phone. She was basically tired and worn out from all of his texts, they were always negative and constantly accusing her of things like cheating.

[318] On one occasion after telling the accused that she was not prepared to get back together he yelled fuck you, etc. and then threatened her with something to the effect “I’ve got your stuff”.

[319] Although she thinks he treated the dog well, he used the dog as an excuse to contact her.

[320] She testified that the accused made a complaint to her employer accusing her of being a drug user. When asked if he ever physically threatened her safety, she replied that she was worried about her job and livelihood and did not want to move back to Ontario. Although she told the accused not to contact her, he would either do it directly or get someone like his girlfriend to contact her via Facebook. This continued on for a year after she went to B.C. She showed these electronic communications to the police in B.C. who told her to contact WRPS. She no longer has the texts, etc.

[321] While in Regina she admits telling the accused some things that he wanted to hear. In her opinion she had to, basically because he had all her worldly possessions, including her dog, in her apartment.

[322] She stated, she did not remember ever giving the accused her address, but he may have gotten the city of where she was living, because she may have said she was flying into a certain location.

[323] With respect to her application to the RCMP college in Regina, it was suggested that the accused helped her study to which she replied no.

[324] It was suggested that it was the accused who messaged C.C., telling her not to message him and in response she would tell him that she loved him. This was denied by C.C.

S.E. – Accused

[325] The accused is 40, having been born on September 3, 1980. He is currently in a common-law relationship with the lady referred to as S.H.

Criminal Record

[326] His criminal record consists of a break and enter in 2004 for which he received four months plus 1.5 years probation. Also, in 2004, he was convicted of failing to comply with the recognizance and sexual assault. He received a sentence of 12 months in jail on top of the seven months spent in pretrial custody. In February 2021, he pled guilty to a breach of recognizance and was sentenced to one day, deemed served.

[327] In 2011 he was accused of sexual interference with J.W.’s daughter but was found not guilty.

[328] He was born in Barrie and thought a person who had his current surname was his father. He was later told by his mother who is biological father was. The family moved to Sudbury for a short time and ended up in Kitchener in 1983, where the accused went to grade school and ultimately graduated from University Heights at the age of 16. He then spent some time in Parry Sound with his aunt and also in Kitchener. He fathered a son and daughter by different mothers.

[329] He seems to have been quite industrious from a working point of view, including jobs working with steel at High Points Steel Riggers, McDonald’s, Georgian Bay Forestry, construction for a company out of Pointe au Baril, Tim Horton’s, Bay St. Café, Weston Bakery, Research in Motion, Clinton Landscaping, Vista Contracting and O2 Management. He lost a good job in construction in Parry Sound building docks, and also his dream job at RIM, over the criminal charges and/or allegations.

[330] He was intrigued and consumed by all things to do with computers and the software that ran them. While at RIM he took employer sponsored classes and virtual training in computers and software. In his words he “learned as much as I could”. He was able to join the “alpha team” designing software. He worked on security software both to make it more user-friendly, but also harder to crack for outsiders.

[331] He was issued a BB cell phone by RIM which was upgraded from time to time. Unfortunately, because of the allegations about J.W.’s daughter he was forced to resign.

[332] In 2006, he met J.W. and ended up moving in with her. That relationship ended in 2011 when he was charged with inappropriate behaviour in relation to J.W.’s daughter. It was eight months later that he lost his job at RIM when J.W. sent the charges to his superiors. This was a very dark point in his life and at times he did not want to exist anymore.

[333] He was essentially under house arrest in 2011 and up until July 7, 2012, when he was acquitted of the charges.

[334] In 2013 he fell at a construction site and broke one vertebra in his back.

[335] Around that time, he moved in with C.C., whom he had met while he was working at RIM. They lived together for approximately two years on Overlea Drive. The relationship ended when C.C. moved to Regina to take a training course to become a prison guard.

[336] He told the Court that C.C. broke up with him, stating that she could not be in a relationship with someone who was on the sex registry because it would not look good on her.

[337] At that time, in March 2014, C.C.’s lease was transferred into the accused’s name. The accused testified that C.C. said she loved him, cared for him and did not want to see him on the street.

[338] Approximately a year later he moved to Brybeck Crescent with a lady known as S.H. They left in June 2016 because of a cockroach infestation. He is still in a relationship with S.H. and they have a son who is almost 2 years old and a 3 month old daughter.

[339] In June 2016 he moved in with a friend while S.H. and his daughter moved in with the accused’s ex. J.W. He maintained contact with all three of them.

[340] On October 1, 2016, he, S.H. and his daughter moved to 8–616 Silverbirch Drive in Waterloo. He described the apartment as having two bedrooms, one bathroom and a living room all in one floor. Both bedrooms had doors.

[341] After his arrest on June 2, 2017, he moved to Heritage Drive to live with his surety, Z.N. After he was rearrested on August 17, 2017, he moved back to Silverbirch with S.H. who became his surety.

[342] In August 2017 he was issued a flip phone by Vista Contracting. The phone basically stayed in his truck and was used almost exclusively for business. It was essentially a device that was restricted to phone or text only. When he was arrested in 2017, the flip phone was turned into Vista and then returned to him in 2018.

[343] Before the flip phone he had his own device, which was a Samsung S7. He got this phone in September 2016 with a red case because his old BB was dying

[344] When he was arrested in June 2017, he had his Samsung Galaxy S7 phone. It is his evidence that he was allowed to have a phone for work, but it had to be such that it could not access data. He testified that Rogers configured its service to him so he would only have phone and text. He stated the phone could not get or send an email or search the Internet, although on occasion, for a split second, something like the weather network might populate itself on the screen. He stated that he could not connect to the Internet or to social media such as Facebook.

[345] Because he was not hooked up to the Internet, the most he could do for work would be to take a poor picture to send to his boss. If none of his devices could connect to the Internet, he thought he was adhering to the terms of his bail. Although the weather network would come up randomly and for extremely short periods of time, all he would get on his phone was the time, the date and the outside temperature. He testified that the weather network tries to update itself every 5 to 10 minutes and therefore on occasion his phone would grab it for a very short period of time. He testified that the weather network, being grabbed for brief intervals, was due to the internal workings of the phone and not the Internet.

[346] In 2018, he stated that the landlord asked him to leave because of the current charges, at which time he and S.H. moved in with Z.N. In April 2019, Z.N.’s wife moved in and in August 2019, essentially threw S.H. out.

[347] On October 11, 2019, the accused’s bail was pulled because of a breach related to a cell phone and he spent approximately 40 days in jail. Upon his release, he again moved in with Z.N. and Z.N.’s wife, in December 2019.

[348] While residing at Silverbirch he used two storage units, one known as Space at Hand on Northfield Drive, after which he used U-Haul on Colby Drive. Since the Silverbirch apartment was small, items that went into the storage unit included, tools, memorabilia, computers, computer paraphernalia and other things that were seldom used. Access was by means of a password and a key and S.H. had access.

[349] He cannot recall when he got his first computer but has had a cell phone since 1996. Because of his interest in and obsession with computers, he has owned and worked on many different devices.

[350] In 2011 he lost everything to J.W. through a separation but kept his cell phone. It was not explained what he meant by lost everything.

[351] With respect to some of the items seized by the police he stated the following:

1. Acer laptop - he got it from his cousin and tried to fix it for her.

2. Toshiba laptop – C.C. gave it to him in 2011.

3. Flash drives - he cannot say if they were all his. Other people would give him flash drives when they upgraded their SD cards to get more memory. He would assist them by copying the material from their SD cards to his computer and then back to a larger capacity SD card which he would then put back in their device, often their phone. Because of this, SD type devices could be anywhere in his apartment.

iCan Computer – (Ex. 9, P. 142)

[352] The next series of questions related to Ex. 9 and following the headings set out at pages 142 – 145.

[353] The accused testified that he did not make the River Videos, nor did he put them, or any child pornography or intimate images on the iCan’s hard drive.

[354] He got the iCan tower from C.C. when she left for B.C., which would have been in March 2014. C.C. got a new Acer laptop in January 2014. He testified that prior to that time, she had been the original owner and main user of the iCan computer.

[355] To the best of his knowledge, and he didn’t say where this knowledge came from, C.C.’s ex named Tyler put the hard drive in the iCan. The Crown objected to this evidence under the rule in Brown v. Dunn because these questions had not been put to C.C. when she testified.

[356] He testified that he gave the iCan computer to his daughter who lived with J.W. in 2014, at Kingsway Drive in Waterloo. He got it back from her in March 2017. At that time, it had the Maxtor & Toshiba hard drives and in his opinion was quite old technology.

[357] Therefore, he stated he had no access to the iCan computer between March 2014 and March 2017, because it was at J.W.’s home. That may be correct, but it takes mere seconds to transfer electronic files from one computer device to another. He upgraded and installed a new operating system into the iCan computer in March 2017.

[358] After giving the computer to J.W. in 2014 he was told to get it by J.W.’s ex. in 2017 because she was moving out. He went and got the computer, which was beat up, the power button was broken as was the side of the computer. Initially he kept trying to bring it back to life. He took out an old hard drive and put in a new one but did not specify what hard drives he meant.

[359] In March 2017 all the devices in his apartment were connected to each other. Before March 2017 the iCan computer did not require a password.

[360] After that date he made it, such that the iCan computer required a password to allow a user to use it. That password was a combination of his and S.H.’s names, followed by a numerical birthdate. He, S.H. and his daughter would have known the password and J.W. may have known the password.

[361] He stated that in June 2017, when the police seized the computer, no password would have been required, notwithstanding it had one, because the computer was not set up to automatically lock after a certain period of time, and if the user wanted to lock the computer they would have had to do it manually.

HP Laptop – (Ex. 9, P. 142)

[362] The accused testified that it was not working when he initially got it from C.C.’s brother, but he fixed it.

[363] This computer was password-protected with the same password used for the iCan computer. S.H. used this computer and the accused did not.

Gateway Laptop – (Ex. 9, P. 142)

[364] He initially got this computer from O2 Management and when they refused to pay him his last week’s wages, he kept the computer in lieu of his pay. He dropped it in 2015, damaging the hard drive at which time he put it in storage, first at Space at Hand and then it was moved to U-Haul.

[365] In March 2017, he installed a new hard drive. He reformatted the hard drive and installed Windows 10 Pro N. He explained that he took everything off the hard drive before installing the new operating system and that the operating system he installed had all the bells and whistles, which gave the user many more options. He referred to it as being in “God mode” which he translated to mean that the user had full control and did not need any administrative approval when using the CMD menu for issuing commands to the computer.

[366] At the same time, he put the same password on this computer that he had put on other computers but stated that the computer was never locked so the password was not needed. In any event he, S.H. and his daughter knew the password. In addition, a user could get in by using the LAN to share videos pictures and music.

[367] He confirmed again that all devices are connected through the LAN. In addition, the Gateway laptop was turned into a repeater which he stated increased the strength of the Wi-Fi signal.

[368] He stated that between March and June 2017, he never accessed the iCan computer through the Gateway computer. He stated that before June 2017 he had never heard of and never accessed the iMGSRC.ru website.

HP Pavilion Slimline Computer – (Ex. 9, P. 143)

[369] The accused was aware it had two hard drives and that one was connected via a cable. He stated the hard drive connected by a cable came from a PlayStation 3 device.

[370] He stated that the HP Slimline computer was used for the iCan to connect to it, not for the HP Slimline to connect to the iCan and that the HP Slimline was used to watch TV shows. He testified that he never used the HP Slimline computer to connect to the iCan.

[371] He again reiterated that he did not make the River Videos and he did not put the images of the River Videos on the HP Slimline.

[372] Because the River Videos on the Slimline and the Lexar thumb Drive are identical, he assumes that someone put the River Videos on the Slimline computer using the Lexar thumb Drive. He stated he never owned a Lexar thumb Drive, has no knowledge of it and does not know how it got into his apartment.

[373] He did not put any media from iMGSRC on the Slimline. He was aware of the intimate images of M.A. and C.C. He testified that all the images were taken with the ladies’ consent. He further stated that while he may have put the images on other devices owned by him, he never put any of the images on the Internet.

[374] He does not recall placing the intimate images in the folder that the police said they found on the Slimline.

[375] When assisting himself or other people to get more memory on their cell phones, his procedure for doing so was to:

1. transfer the images to the Slimline computer from the phone/microSD card,

2. take the microSD card out of the phone,

3. insert a microSD card with more storage into the phone,

4. transfer the images from the Slimline computer back to the larger SD card on the phone,

5. then delete the images from the computer, and

6. finally, he would delete all the images from the smaller SD card.

[376] With respect to the intimate images of M.A. and C.C., he acknowledged that he would have enabled the hidden attribute setting on his phone. He stated that this hidden attribute setting would follow when he transferred the photos from his phone to his computer.

[377] Like the other computers, this computer had password protection and after March 2017 it would have used the same password as described above. The same people knew the password, but the computer was never locked therefore making the password unnecessary to access the computer.

64 GB Lexar thumb Drive – (Ex. 9, P. 144)

[378] The accused testified that it was not his and he does not know whose it is or where it came from. He stated that he did not put it in any of his devices. He opined that his common-law partner, S.H., may have done it because she is very snoopy.

[379] He did not put any of the material found by the police on the Lexar thumb Drive and has never owned a Lexar thumb Drive.

[380] Although he claimed to know nothing about this thumb Drive, he did say that a thumb Drive could be password-protected.

16 GB SanDisk microSD card – (Ex. 9, P. 144)

[381] He denied ownership of this card and stated he does not know who owns it or how it got to 8- 613 Silverbirch Drive.

[382] He stated that he owns lots of SD cards, but he did not put any of the images on this particular SD card.

Cell Phones

[383] He owned several BlackBerry phones while working for RIM and all were password-protected.

[384] The Samsung Galaxy S7 phone was also password-protected. Its initial release was in May 2016, and he purchased his phone in September 2016. He testified that he did not purposely put the River Videos on his phone. He speculated that the River Videos could have mixed in with a bunch of his other files that he was copying.

[385] He testified, that when he was copying there would be lots of data and he could not/would not look at each piece of information being copied. He further stated that when his phone was plugged into the computer it would automatically sync.

[386] He stated that other devices which are connected to his VPN could put folders onto his cell phone, but devices that would not be recognized by his VPN could not do so.

[387] He purchased the red cover for his phone in October 2016 shortly after purchasing the phone and it stayed in the red case until it was seized by the police. He stated that the red case is very secure and fastened down by six torque screws. He further stated that he did not have the red case in 2014 or 2015 and that the case was much too large to allow it to fit on a BlackBerry phone.

[388] In 2017 his Internet Service Provider (ISP) was Rogers. After explaining that someone hijacked his Rogers account and ran up large bills, he stated that in March 2017 Rogers reset his account.

[389] He further stated that numerous communications between himself and Rogers about having his phone hijacked were on the phone when it was seized by police.

[390] In 2017, he had three external IP addresses, one for his home, one for his cell phone and one for S.H.’s cell phone.

[391] His VPN was set up for 10 internal IP addresses of which nine were used.

Social Media

[392] In 2012 he had Facebook on his computer. He had two different YouTube names, one being his full name and another being shansass, his Xbox name was criza27, his Instagram name was criza80 and then just criza.

[393] He has used the name criza in one form or another for many years including when he was a DJ and on a University of Waterloo radio station.

[394] The accused created his first social media account in 2011 or 2012. He used several emails with respect to the accounts including chopper80@msn.com, s_j@hotmail.com and se0@gmail.com. I have used the initials S., J. & S.E. rather than the full names used in the email addresses.

[395] He denied knowing anything about the website iMGSRC.ru and denied visiting, placing images, placing his picture or placing any comments on the website.

River Videos – (Ex.3-C)

[396] Notwithstanding that his picture appears in some of the videos and his voice is on some of the videos, he denied being the person who would have been the videographer of any of the videos. He thinks he knows who took the videos but is not sure. He did not state who he thought the videographer was or why he thought that.

[397] There are 15 videos in total and while they are all short, some are exceedingly short. Using the numbers of the videos as shown in Ex. 3-C he testified to the following:

34044 – He admits his voice can be heard in the video but does not know where the camera is located that is making the video. His daughter appears in the video along with another girl who is a friend of Z.N.’s children. He and his daughter were invited by Z.N. out to Z.N.’s campsite for the day. There were lots of people in the park that day, but none appear in any of the video clips.

35453 – The accused stated that this video was taken from behind the children and that he is in front of them. His voice and that of the children can be heard.

35737 – He admits that his foot appears at the beginning of the video but states that he was on shore.

35756 – The accused believed that Loschmann said he could see a camera in the video, but he does not. His face appears on camera and one of his hands may be in the water. He does not recall having a phone with him at the time and stated that the phone he did have was a BlackBerry, which was not waterproof and did not take good pictures.

35932 – He does not know where he was when this video was taken.

40008 – He suggested he would have been with his daughter, probably at the picnic bench. He further suggested that the video is not continuous and seems to have been edited.

40405 – The voice in the video is the accused’s voice.

40706 – The accused’s voice can be heard on the video and one hand is in the water. He suggested that the hand in the video is smooth as opposed to his hand, which is scarred from an accident with battery acid. No picture of his acid scared hand was produced to the Court.

40818 – He stated because of the shadow in the picture, that he is standing to the right and is holding a large object, likely a rock, in his one hand.

40836 – The accused stated that his voice can be heard in the distance. He suggested he would be to the left of the child.

41118 – He suggested that it sounded like two voices, one of which was his and the other he does not recognize. He further stated that he did not have the camera.

41213 – The accused stated the voice was his and that he was talking to his daughter.

41344 – He suggested there were two female voices and one of the legs in the picture is his, but he does not know who the other leg belongs to.

41512 – This picture shows someone wearing blue Crocs. The accused does not know whose leg is in the picture but stated that it was not his daughter’s.

63340 – He acknowledges that his voice can be heard in the video and states he was standing to the right of his daughter.

[398] The accused testified that he did not become aware of the River Videos until August 2017 after his arrest. He testified that he took pictures that day and does not know when these videos were made. He does not think they were made when the police say they were made but did not say why he has that opinion.

[399] He denied putting the River Videos on the iCan computer and does not know how they got there. Similarly, he denied putting the River Videos on the Slimline computer but suggested they probably got there from the Lexar thumb Drive, but he does not know when or who put them on.

M.A. – Complainant

[400] He confirmed her relationship with his father and that he considered her his stepmom. Throughout his many moves he always maintained some contact with her. He recalls M.A. trying to get him to talk with his biological father.

[401] Their consensual sexual relationship commenced in 2011 and they had sex at different locations including his father’s residence.

[402] He said that their sexual relationship was M.A.’s idea. He denied ever threatening or coercing her to have sex because of their relationship.

[403] He admits to taking some of the pictures, but not all of them, and they were always taken with her knowledge and consent. He denied ever posting any of the intimate images on the Internet. On one occasion they made a video together using the Toshiba laptop computer.

[404] M.A. took several intimate photographs of herself and sent them to the accused.

[405] With respect to Ex. 3-D he did not make the folder labelled “step”. In that folder, referred to in the Court as the first set, the following images appear:

1. A full-frontal nude shot of M.A. M.A. took this and sent it to him. The first time he saw it was in 2011 after M.A. and his dad had separated to the point of sleeping in separate bedrooms. M.A. took the image, sent it to him and he saved it on his BB Bold cell phone.

2. He did not create a folder of images for M.A. and did not put such a folder on any other of his devices.

3. He took this picture of M.A. and she consented to it. The picture was taken with his BB Z10 and the camera was not working well.

4. This picture is of better quality than the previous one and was taken at the same time and with the same device.

5. The accused does not recall taking this picture and says therefore M.A. would have sent it to him.

6. M.A. took this intimate picture of the two of them showing their private parts.

7. This image is the start of a video.

8. M.A. took this picture and sent it to the accused. None of the hands in the picture are his.

[406] With respect to all of the above pictures the accused stated that M.A. either took them or consented to them being taken, he did not create the folder of images for M.A. nor did he create a folder labelled “step”. He never posted any of the images on the Internet and only saved them on his phone.

[407] The following images appear in the second set of photos:

1. This image is part of the video. M.A. was aware of and consented to the video being taken since it was being shown on the 32 inch Samsung TV while it was being made.

2. This is a photo which shows M.A. pulling up her shirt. She took the video and if it was taken in 2017, it looks like it was taken at her place.

[408] He denied luring M.A. into sexual acts. From time to time they would contact each other. During the charges concerning J.W.’s daughter, the accused wanted to talk to M.A. for support.

[409] After C.C. left for B.C., M.A. would come over before work, bring coffee, they would smoke a joint and have sex, then she would go to work.

[410] There was never any discussion about the images and he never threatened “to expose” her by using the images.

[411] After the accused told her about his new waterproof cell phone, she asked if she could watch him while he showered.

[412] Although M.A. was still living with his biological father, they were not getting along and slept in separate bedrooms. During this period of time he and M.A. had consensual sex in his car, at the wreckers across the street, at the park across the street and in her bedroom when his dad was at work. Only M.A. knew his dad’s work schedule, he did not.

[413] He denied that she ever blocked him on social media but said that he blocked her.

[414] With respect to hidden files, the accused admitted he knew how to do it, but stated that he did not create or hide any folders.

[415] He denied creating downloading or knowing about the Zo Lekker zip file. In addition, he never unzipped the Zo Lekker file on March 22, 2017, because he did not know it was there. He denied knowing anything about the Zo Lekker file or how it got on his devices.

C.C. - Complainant

[416] He confirmed that they met at RIM where she worked as a security person. His recollection was that he was part of the alpha team at that time. In any event, they had casual contact with each other through their employment. They found out they enjoyed the same videogame, which ultimately led to their relationship. He stated that they shared their first kiss on the courthouse steps.

[417] After he was acquitted regarding the charges involving J.W.’s daughter, C.C. asked him to move in with her and he accepted that proposal. They lived at 1010-11 Overlea Drive.

[418] They physically split up on January 7, 2014, when she went to Regina for training.

[419] Initially the relationship was stressful because the accused was not in a good place owing to the outstanding criminal charges. While he never tried to commit suicide, he did get to some low points where he discussed it. In addition to the criminal charges, he said he lost everything including his new car when he split up with J.W.

[420] He denied ever using talk about suicide to try to make C.C. do anything. He described the relationship as an emotional roller coaster. They argued a lot and C.C. complained a lot about her job and was stressed out. He denies ever raising his hand to C.C. or any female.

[421] In the upper left-hand corner of the first page of the first set of photos is a shirtless picture of the accused holding his S7 cell phone in a red case. The picture is small and becomes fuzzy when expanded. The accused stated that it can be seen on the cell phone when looking at the picture, that the camera is on the right side of the phone while the flash is on the left. He said a Galaxy S7 phone was first released in March 2016 and he got his in September of the same year.

[422] He was asked about numerous photos of C.C. set out at Ex. 3-E and with respect to the first set he replied as follows:

1. This picture from January 2014 was sent to him by C.C.

2. This picture showing C.C.’s breasts was taken by her and sent to him.

3. This is a picture of C.C. on a firing range.

4. She took and sent this picture to his BB Z10 cell phone.

5. This picture of C.C. in a sweatshirt holding a cell phone was taken with her consent to the accused.

6. The accused took this picture of C.C. on the toilet in their Overlea Drive bathroom. He admits he did not ask permission but took the photo as a joke. At the time they were the only two living in the apartment and they would both use the toilet in front of the other.

7. This photo of C.C. fully clothed was taken by him with her consent.

8. He does not know who took this picture of C.C. with a large rifle.

9. He took this somewhat blurry picture of her with his BB Z10 at a mini putt park.

10. Not commented on.

11. Unknown female in skimpy dress. He does not know who took the picture.

12. Unknown female in skimpy dress. He does not know who took the picture.

[423] With respect to all of the above photos, he did not send them to anyone else or post them anywhere. Photos taken by his phone would be automatically saved on his phone.

[424] With respect to the second set of photos, several of which are intimate, most were taken by C.C. and sent to him. While he might have taken a couple, he would not have done so if she did not consent. There are several photos of her nude or partially nude because she wanted to see what kind of physical shape she was getting into from all the training she was doing.

[425] The third set of photos are very intimate. They include close-up photographs of sexual organs. Most of the photographs were taken by the accused, however he would not have taken them if C.C. had not consented. In fact, in some photos he said she was posing.

[426] Like the other sets of photos, he testified that he did not send them to anyone else or post them anywhere, however, like before, they would have been saved by his phone.

[427] The fourth set of photos are also very intimate and include close-up photographs of sexual organs and the couple having intercourse. The accused took all the photos with the consent of C.C. and has not shared them with anyone or posted them anywhere, although like the others they would have been automatically saved on his cell phone

[428] When C.C. left for her training in Regina in January 2014, the accused was under the impression that everything in their relationship was great. He stated that the plan was for him to meet her out in B.C. He testified that there was an issue with respect to his daughter and her mother, J.W., which kept him from going. Whatever the issue was, it was never explained in Court.

[429] In anticipation of their move to B.C., he packed up the whole apartment while C.C. was in Regina. He denies ever damaging or even threatening to damage any of her property or her dog.

[430] When C.C. was in Regina, they were in regular contact and he was working 70 hours a week. He denied that she ever told him the relationship was over before she went to B.C. and testified that he knew her address in B.C.

[431] He then stated that two days after she went to Regina, she broke up with him. He said he tried contacting her and that she would contact him regarding his daughter and her dog.

[432] He said he was surprised by the December 22, 2014 email, (Ex.17) and did not understand what she was talking about. That is exactly what he tried to convey in his January 1, 2015 reply. He thought she must be referring to someone posting photos on Facebook. After this exchange of emails there has been no further contact between the two of them.

[433] He denied trying to scare or threaten her and said he loved her. At no time during their relationship did C.C. indicate to him that she was scared or intimidated and in fact it was the accused’s opinion, that she was the dominant one in the relationship.

[434] He denied ever owning a Lexar thumb Drive and therefore did not put files called “bean”, “zip” or “new file”, on it. He also denied putting the file called “new folder” on his phone which contained the River Videos.

[435] He testified that a strange thing happened in 2018 to his Acer computer. This computer was used by S.H. in the bedroom. One night this computer just “woke up” and his 32 inch TV illuminated. He determined that his computer had been taken over by a virus which contained some Russian language. He tried to isolate and save the virus files and took as much evasive action as he could.

[436] He unplugged his modem, because he knew someone was using his laptop from outside the apartment. His AVG virus software was not showing any intruders. He booted his computer into a safe mode and tried to track the virus, but no matter how many times he deleted the virus, he could not get rid of it. He testified that he finally captured the file, i.e. the virus, and rebooted the computer and transferred the virus onto an external hard drive. Unfortunately, he did not get the IP address for the virus before he was incarcerated.

[437] He stated that his computer was taken over by a Google Chrome knockoff that may have entered his computer when he downloaded programs or movies. He said the virus would capture whatever anybody was doing on his computer. He did not explain how he knows this.

[438] He next took the Court to pages 12 and 13 of Exhibit 14. These are difficult to read screenshots of the Gateway computer. He stated that the Gateway computer was wirelessly connected to the HP Slimline computer.

[439] During the execution of the search warrant, the HP Slimline computer was disconnected by the police. This led to the Gateway computer displaying an error message. The error message was essentially, that the Gateway computer could not play the video (The Simpsons) that it was being asked to play.

[440] He then explained that this error message shows that the Gateway computer was connected to the HP Slimline computer and that the Gateway computer was not connected to the iCan computer as suggested by the police. To try to explain it another way, he stated that the HP Slimline computer was streaming a video of “The Simpsons” to the Gateway computer, so when the HP Slimline computer was unplugged, the Gateway computer sent an error message stating that it was trying to connect to the Slimline computer. The Gateway was not connected to the iCan computer.

[441] He therefore states, that while the police say the Gateway computer was connected to the iCan computer, that was not the case, because the Gateway computer was connected to the Slimline.

[442] All three computers, the Gateway, Hewlett-Packard Slimline and iCan were connected to each other over the LAN. Although the Gateway computer could access the iCan computer, it never did because that is not how they used it. They used their system, such that media was being pulled off of the Slimline computer and sent to the Gateway computer and then the Gateway computer was sending the media to the monitor. The Slimline computer stored all the media that they wanted. There was no video or media on the iCan computer for viewing.

[443] When asked how his preceding answers assisted his defence he stated:

1. The police said that the HP Slimline computer was locked and needed a password, that was not correct.

2. The police said that computers cannot be accessed while they are locked, however when a computer is hooked up to a LAN it can be accessed whether it is locked or not.

3. From the post search pictures it can be seen that the HP Slimline computer was connected to the Gateway computer. If the HP Slimline computer was locked, the Simpsons would not have been showing. Since it was showing, the Slimline computer was not locked.

4. The Slimline computer was 100% not locked and even if it was (which is denied) the Slimline could have been accessed over the LAN.

[444] Ex. 18 contains six images and one email as follows:

1. This is a selfie taken by the accused using a mirror in his bedroom on Silverbirch on May 11, 2017, with his Galaxy S7 phone. On the upper part of the phone he stated that the circular shaped camera lens is approximately in the middle of the phone, while the small rectangular cut-out to its left, contains a flash, along with infrared and redeye sensors.

2. The top of this image shows what he described as the red “love me” case that was purchased by a friend of his and he obtained it on October 12, 2016. The accused’s hand appears in the image

3. Page 3 shows an image of a BB Z10 cell phone. The accused commented that the location of the camera lens is very different from the location of the camera lens on the Galaxy S7.

4. Page 4 is a copy of a police photograph taken of the accused’s Samsung S7 phone. It is not a mirror reflection and shows the camera lens in the upper centre of the phone with the small rectangular sensors cut-out to the right of the camera lens.

5. Image 5 is captured from a video depicting the accused and his daughter on her birthday on March 6, 2017. It was taken by S.H. and no iCan computer is visible in the image, part of which was taken in his daughter’s bedroom.

6. Image 6 in printed form is essentially illegible. Apparently, the upper image is of a monitor connected to the iCan computer which had been formatted with Windows 10. The lower picture is a picture of a 32 inch Samsung TV, showing the HP Slimline being formatted with Windows 10. At the time, which the accused believes to have been March 22, 2017, he was reformatting his five computers.

7. This is a copy of an email from Samsung, stating that the Samsung Galaxy S7 cell phone was released in Canada on March 11, 2016.

[445] Images 1–6 above are from the accused’s Galaxy S7 cell phone. The video was taken from S.H.’s S7 cell phone. The accused was present for all the photographs except items 3, 4 and 7.

[446] Exhibit 19 is a video of the accused and his daughter interacting on her birthday on March 6, 2017. It was taken by S.H. in their apartment and no iCan computer is seen in his daughter’s bedroom.

Cross-Examination of The Accused

[447] The Crown took the accused through his formal and informal training in computer technology. He took three years of courses on computer technology in high school and in addition did a tremendous amount of self learning before he got a job at RIM. He stated that he can take a computer completely apart, fix it if necessary and put it back together. In addition, he has proficiency in several computer languages which allows him to write and design software. When he was at RIM, the company allowed employees to take whatever training they wanted, both in class and online. He took full advantage of those opportunities. He was at RIM in 2009 when RIM’S fortunes were waning and since he was not overly busy, he was able to take more and more training courses.

[448] He testified that firewalls are pretty basic, and he knows all about them and a lot about viruses. He testified that he has enough knowledge to be able to hack into other people’s computers and to write viruses, but he has never done so.

[449] He agreed with the suggestion that security was a very important part of BB’s business model. He stated, that while there, he applied for a patent for a security code he had invented. He sat in on meetings with the security design team which he was part of. He further testified that RIM liked several of his ideas. The training he received at RIM was at a very high level and he got several certifications internally at RIM.

[450] In addition to his tech job at RIM, he ran a company called SE-TECH which was basically himself making money fixing computers for other people.

[451] He testified that after S.H. got a free download of X-Ways, he was able to “crack” into the X-Ways website and get the product key. He was able to obtain the full X-Ways product without paying for the product. He stated that he knows where on the website the product key/license would be kept.

[452] He testified that S.H. downloaded the free product off the website to her phone and then he put it on the Acer computer. This computer could be connected to the Internet and was used by S.H. He indicated that he was aware that the Acer laptop could access the Internet.

[453] He testified that when the screen lit up on its own as testified to previously, it was because S.H. had been using the Acer laptop in their bedroom. He then unplugged the modem from the electrical wall receptacle.

[454] While he said he was concerned about security in 2009 after he had been charged as a result of allegations from J.W., currently he was more concerned about the security on his phone because he used his computer mostly for watching media. He stated that he would modify his firewalls from time to time, but most of the time they were in standard mode.

[455] After he told the Court that he had a GPS on his phone and used it to play Pokémon go, he was taken through various questions and answers he had given to the police on June 2, 2017 (Ex. B, P. 10) where he stated:

I protect my ass every direction you go. I have follow GPS, I have everything because I am tired of being blamed for shit I don’t fucking do. And now, now again, here I am, standing – fucking locked up and I do not know why or how this could have come.

[456] He stated that on his phone he takes his security seriously and has set the phone up so that he can record each phone call, so as he put it, he could protect his ass. He stated that he records every phone call 24/7.

[457] With respect to whether or not he installed a GPS program to play Pokémon go, he stated that his phone comes equipped with a GPS and it is set to record and keep track of everywhere he has been and that it operates 24/7. He further stated that he has an app on his phone called GPS Spoof. He stated this app could be set to make it impossible for someone to triangulate where his phone is, however, he said he has never used it for that purpose.

[458] He was then asked about his Rogers IT issues with respect to fake accounts and large charges that he previously testified to. He stated that he installed a call recording app on his phone and recorded all phone calls with Rogers, because of the runaround he seemed to be getting from Rogers.

[459] He stated that he also recorded all emails between himself and Rogers on his phone. None of the phone calls or emails between the accused and Rogers were produced for the Court.

[460] He was then asked questions about his second interview with the police on August 17, 2017. (Ex. C)

[461] He testified that someone had taken over his emails and changed all his passwords so that he can no longer access them. He also stated that S.H. had some access to this information but failed to provide the emails to him. He never stated what steps he undertook to try to get the information from S.H. or to try to get S.H. to get the information from a third party.

[462] With respect to being unable to access the above information or his emails, he told the Court that his passwords are not very sophisticated, which the Court assumes, means it would be easier for someone to hack into his email account. He also stated he is lazy when it comes to passwords.

[463] He said part of the problem is that he gave a computer away and left a password or passwords on it. He said he gave it to a friend but did not say who the friend was.

[464] In further testimony he said that it must have been somebody who used the computer at J.W.’s place. Therefore, it appears that he gave a computer to his ex-wife, J.W. He also told the Court that when he is in love, he gives his passwords to the person he is in love with.

[465] He testified that it was very difficult to get an email account back once it has been hijacked. He did not state what efforts he had made to do so.

[466] He then told the Court that he was once on the sex offender registry, (SOR) however, he got off it and also got custody of his daughter.

[467] He also stated that he did not have Internet access in 2014.

[468] The accused was then asked about his use of the name criza. He acknowledged that he had used the name somewhat extensively but stated that he is not the Russian website “criza person”, although the name he used and the one on the website are spelled the same. He stated he made the name up in his teens and that it was a nickname for him for a long time. He further stated that C.C. knew that Criza was a nickname for him.

[469] Criza80 is simply the same name with his birth year tacked on. Criza27 was another variation that he used for his Xbox account. He added the number 27, because when he tried to set up the account, the name Criza had already been taken. He acknowledged that he also used the name when he was a DJ and on his Facebook account.

[470] The accused was then asked questions with respect to his August 17, 2017 police statement to Detective Shipp. At a portion of the statement he states that every phone call that comes in is recorded and that he protects his ass in every direction. (Ex. B, P.10) No such phone calls were produced for the Court.

[471] At page 11, the accused stated he does not use criza for anything. When asked to explain the discrepancy, he answered that he does not use it anymore because it is tarnished and when he gets out of prison Criza will be gone from everywhere, including his car.

[472] He further stated that the only criza name he uses with the number is his X-Box Criza27, (Ex. B, P.11)

[473] He stated that he had access to three email accounts which, using initials only where appropriate, were SE0@Gmail.com, S-J@Hotmail.com, and chopper80@msn.com. He lost access to the first two email addresses after his arrest in June 2017 and has been unable to use the third one since March or April 2017.

[474] In addition, since June 2017, he has been unable to access his Facebook, Instagram and YouTube accounts, etc. He stated that all his passwords were autosaved in his phone which the police seized. He further testified that S.H. tried whatever passwords he or she thought would work, to no avail.

[475] He then stated, that up until 10 months ago, which would be approximately June or July 2020 when he got incarcerated, S.H. had access to his emails.

[476] With respect to his rented storage lockers, he testified that the items were moved from Space at Hand to U-Haul in late 2016. As far as he knows all the items are still there and the rent is being paid.

[477] Ex. 20 is four pages long containing two images of the accused. In the upper left-hand corner on page 1 it reads, “iMGSRC.RU me” and “more photos from criza”. The image on page 1 is of the accused holding a BB cell phone at Overlea Drive. At the bottom of the image which appears on page 2, the file name IMG_20140521_161241.jpg appears. The middle number is the date of May 21, 2014.

[478] In the image on page 3, the accused is holding a cell phone in a red case. At the bottom of the image the following appears, “Resized_20161026_195051.jpeg”. Again, the middle number represents the date October 26, 2016.

[479] On page 4 it indicates “iMGSRC.RU - photo host proudly online since 2006”. The accused testified that the date has nothing to do with him and means that the website has been running since 2006.

[480] With respect to his employment at RIM, the Crown suggested that his employment file was still there, and that it lists him only as a warehouse operator and does not say anything about working on software development.

[481] He stated that he has an email which shows what he did at BB and that he invented software known as BB link. This email was not produced in Court. He essentially said that RIM screwed him out of his patent, and he sought legal advice about suing them. At this point his lawyer objected to further questions, claiming solicitor client privilege with respect to any intellectual property lawsuit and the matter was not pursued.

[482] He reiterated what he had said before about his knowledge and abilities with computers and particularly cell phones. In a condescending manner, he indicated that he didn’t need degrees or diplomas and that, essentially his courses and self study were all he needed. He confirmed what he had said earlier about helping design software for Q2 and Toyota.

C.C. - Complainant

[483] He confirmed that he had taken intimate images of C.C. and that they were organized when taken and kept in a folder. He further confirmed that C.C. knew of every photo he took and that each photo would have been automatically saved by his BB cell phone.

[484] He admitted that some of the folders in his BB cell phone had the hidden attribute switched on. He denied putting any of C.C.’s images on any device other than his cell phone.

[485] S.E. was cross-examined with respect to a statement he gave to the police on August 17, 2017. (Ex. C) On that date he told Shipp that the pictures of his exes were in his daughter’s computer which would have been the iCan computer. In answer to the statement and questions from the Crown, he stated he thought there were two or three hard drives and the images were on a broken hard drive and that the hard drive crashed and he does not have it anymore.

[486] He stated he was upset at the breakup with C.C. and wanted her back. He said she played him like a fool. She told him they would work things out and begged him to move to B.C. He was also upset because their breakup hurt his daughter.

[487] At the same time, he denied being angry or hating C.C. and stated he loved her despite their quarrels.

[488] He admitted contacting her employer in B.C., stating to the employer that C.C. was a drug user. He said, he foolishly thought that if she got fired, she would come back to Ontario and they would get back together.

[489] The accused was then asked questions about five pages of emails that were marked as Ex. E for identification. On page 5 there is an email dated December 1, 2014, which on the face of it looks like it came from C.C. and went to her employer “GEN-NHQ Internet”. The subject is CTP–15, which refers to C.C. The email plainly states that C.C. uses marijuana and drives to and starts work while she is high. The email states that the writer has hidden his identity.

[490] An email concerning C.C. consuming drugs was also sent on December 11, 2014, like the previous email it indicates that it came from C.C. This email had an attachment which is shown on page 4. The attachment is a picture of C.C. and she looks like she is high. This photo is one that the accused admitted to taking earlier in his testimony.

[491] At the bottom of page 2, spilling onto page 3, is an email sent on May 8, 2014. This email was sent from “criza [mailto:chopper80@msn.com]”. It was also sent to C.C.’s employer. On page 3 of Ex. E it reads:

comments: Why are drug test not mandatory? This system just hired a person who is a heavy marijuana user, completed training at the RCMP in Regina and is now stationed at Kent institution. Yet not one drug test was issued. Is this not a criminal offense? CPT 15–c.coon

[492] The accused denied having anything to do with this email but acknowledged that he knew the information contained within it.

[493] The Crown suggested that the accused and C.C. had discussed whether or not C.C. had had to have any drug testing in her new position.

[494] A reply was sent to criza i.e. chopper80@msn.com from GEN-NHQ Internet, also on May 8, 2014. The accused denied sending or receiving either of the emails and stated that he did not have access to chopper80@msn.com in May 2014.

[495] At the bottom of page 1 in Ex. E, is an email dated May 21, 2014, however, rather than being from criza [mailto:chopper80@msn.com], it appears to come from an email address containing the full name of the accused such that it would read “SE [mailto:chopper80@msn.com]” where SE stands for the initials of the accused.

[496] The accused denied sending this email but agreed that a user can change the name. He admits sending one email from SE0@gmail.com which was similar in content because it talked about drug use. While he admits he sent one email, he denied sending or receiving any of the emails set out in Ex. E.

[497] He does however acknowledge that he knew a lot about the process correctional officers had to go through to be hired.

[498] The accused was next taken through parts of his second police interview which occurred on August 17, 2017. (Ex. C) What he said on page 57 was:

Oh, I am not that stupid. Yeah. Like, she is a correctional officer and, yes, I did already try to ruin her, her career but I did that by messaging the actual correctional facility, saying, like, how is it you guys allow potheads - because she would smoke weed, right? And it turns out that you guys do not get drug tested. I did not know that. So I was like, wow. Interesting. That was – that was the little bit of hatred I had for her. It was – it was not really for her, it was for the job. I figured if she lost her job, she would come back home. And so I went at her through her job and then they stopped replying.

He stated that he had hatred for her job and certainly not for her.

[499] He agreed that he said the following in the interview at page 133:

Yeah. And asking about me. And then on top of that, like I said, I went after her job. I went after her job. I messaged her job. I sat there and said, why is it that you guys are employing fucking people that do use drugs? Why don’t you drug test? That’s all I ever did. That’s all the extent was for the hatred to get to her. And then when she sent me the email saying that she will never talk to me again, blah, blah, blah, blah, blah, and we cannot be friends, blah, blah, blah, blah, blah, going on a fucking whole (indiscernible) email. I realized I fucked up and I left it.

[500] He explained that he really wanted her fired, but out of love and stupidity. He wanted her back and was not thinking clearly. He suggested that what he did was indicative of his love for her and that he was not out to hurt her.

[501] He acknowledged that he wrote his email after C.C. had come home from Regina, left for B.C., left her iCan computer for him and arranged for him to take over her lease.

[502] The accused stated that C.C. did not want to go to B.C. and wanted to work at the Grand Valley prison for women in Kitchener. C.C. never said this and was not asked if that was what she wanted to do.

[503] The accused did not have an answer for what C.C.’s chances would be like to obtain a job anywhere with Corrections Canada if she was fired for illegal drug use on the job.

[504] The Crown suggested that how he was treating C.C. in these emails, is how he treated her before she left for B.C. The Crown further suggested that the accused then went on to post C.C.’s intimate photos on the Internet which he denied.

M.A. – Complainant

[505] He essentially gave the same evidence about M.A., that he gave with respect to C.C.

[506] He then took the Court back through how he would upgrade the media card on his phone, stating that, that was the only time he ever put the images of C.C. or M.A. on a computer. He further stated that he deleted the images from his computer immediately after transferring the images to a larger media card which he then placed back in his phone.

[507] He denied the suggestion that he knew the images of M.A. were on his computer. He stated he kept the images on his phone in a folder labelled “sexy”.

[508] He acknowledged the relationship with M.A. was secret and no one knew about it and that he could have exposed the relationship, but he stated he would never do that. He acknowledged that he had the technical ability to post photos on the Internet.

[509] He further acknowledged that he did not have a good relationship with his biological father. He denied that his poor relationship with his biological father led him to plan to threaten to expose M.A., because he never threatened to expose M.A. until August 2017, when he wanted their sexual relationship to stop and she would not agree to stop it.

[510] The accused was also reminded of and shown excerpts from his police interview on August 17, 2017. (Ex. C) After being reminded by Shipp that one of his charges was for threatening to tell the family about their relationship he responded:

But I thought I deleted those. We started talking. I promised her I deleted them … And then she just dropped me like a sack of shit. And then I got upset and I threatened her with the pictures and then last year, we talked and I got rid of the pictures. I swear I did. I swear I did it. I got rid of them. Unless they’re on that fucking stupid fucking phone. (Ex. C, P. 69-70)

He stated that he did not recall saying the above.

[511] With respect to a question of whether or not he held the intimate pictures essentially over M.A.’s head he responded”

I wanted somebody to talk to. I get into a mood and I get into a depressed state and…. Was gonna send them to my dad because my dad took off on me. My dad does not want anything to do with me. And it is a great way for me to hurt my dad. (Ex. C, P. 74-75)

… Well, it was not about really – well, for me, it was not about sex with her. Well, no, I cannot say that either, though. I do not know how to describe it because I do not like it but at the same time…

[512] With respect to, who contacted whom, when the accused had a construction job on Shantz Hill, his answer set out at Ex. C, P. 72 was:

I was working on Shantz Hill so I messaged her. I said, hey, I am working by you. And she said, what, you are afraid to come by? So I did. I went over. And we did not do anything, we just talked. Then Friday when I went I over there, it was we talked, beer, beer, talk, beer, beer, and then one thing just led to another.

[513] The accused testified that the last time they had sex was in August 2017, he told M.A. he did not want a sexual relationship with her anymore and that if she continued to insist on having a sexual relationship, he would tell his father.

General

[514] The accused stated that he knows his computers were hacked in 2018, but he was never able to “crack” the virus because he did not have the Internet then. Crack used in this sense was never defined. The accused went on to state that he could not capture or isolate the virus and he could not capture the IP address from which the virus came. He stated that the virus was on the Acer laptop.

[515] Since he is in jail, he does not know where the Acer laptop is and suggested the Crown ask S.H. He then went on to state, but the “stuff” is on an external hard drive, it may be in storage, if so it would be at U-Haul and S.H. has access to U-Haul.

[516] Since he has been locked up for approximately 250 days, he is not sure how his relationship is with S.H. at the present time.

Images from the River Videos

[517] Exhibit 21 contains 29 pages of images taken from the River Videos.

[518] In general, the accused stated, that he, Z.N., Z.N.’s children, who were 9 and 12 at the time, his 6 year old daughter and the unidentified girl in the blue bikini were there on that date during the filming of the River Videos. His daughter and the unidentified girl were catching crayfish.

[519] Other than himself, his daughter and the unidentified girl in the blue bikini, no one else appears in the videos. He was unable to say whether Z.N. was beside him during the filming of the River Videos on the date in question.

[520] In response to questions from the Crown and using the page numbers from Ex. 21, the accused acknowledged the following with respect to the following images:

1 - The unidentified female child is wearing blue Crocs.

3 - The picnic table is visible but no people or anything on the picnic table are visible.

4 - In one picture, a truck and trailer are visible. No people are visible except, it appears that a girl’s hair is in the bottom right-hand picture of one of the images.

6 - A picture of the accused’s foot in a sandal is visible, in addition he is right-handed, and a beer bottle is in his right hand. The photographs suggest that the device taking photographs was very close to the accused.

7 - No one other than the two girls are seen on the shore in the background of these photos.

9 - A beer bottle appears to be on the ground and the legs of a young girl appear in the lower photo, but no other people are depicted in the images.

11 - No people are visible in the two pictures on this page, which shows part of the shoreline of the river.

12 - No people are visible in the two pictures on this page, which show more of the shoreline than the picture on page 11.

13 - The top photo is essentially a closeup picture of the accused’s nose while he is bent over. If the accused was not taking the video, whoever took the picture would have had to have been exceptionally close to the accused. Notwithstanding this fact, the accused states that he does not know who took the video from which this image is taken.

16 - Is another picture of shoreline which does not have any people in it.

17 - The bottom picture shows part of the river bottom and the shadow of an unidentified person. The arm of this unidentified person is partially extended and appears to be holding a cell phone. The accused denied that it was his shadow.

18 - This page contains two pictures similar to the picture on page 17. The shadow of a cell phone can again be seen at the end of a partially extended arm and in the bottom photo, there is a right hand which is holding a small rock. In addition, the accused said the shadow shows there is another person there. In addition, he stated BlackBerry did not take clear pictures or videos.

23 - There are two photos on this page. The accused acknowledges that the shorts in the picture are his. Therefore, the shadow seen in the pictures would be of the accused. The background of the pictures is of the river bottom. The placement of stones and what appears to be some type of brick are the same configurations of stones as can be seen in the pictures on pages 17, 18, 19, 20, 21 and 22. The accused suggested that the shadow of the object at the end of the left arm is too large to be a cell phone

24 - This is a picture of the accused’s shorts and his right hand with nothing in it.

25 - These pictures contain photographs of parts of the bodies of the two girls but no other people.

26 - The top picture is similar to the pictures on page 25. The bottom picture also contains the nose of the accused who is bent over very near the unidentified girl. Whoever took this video would have been exceedingly close to the accused and in fact the picture appears to have been taken from underneath him.

27 - No people are seen on the shoreline or at the picnic table in these pictures.

[521] The Crown suggested that the accused is taking the videos because he is never in them. This suggestion was denied by the accused.

[522] The accused denied:

1. that he was criza on iMSRC.ru,

2. having any knowledge of iMSRC.ru,

3. making any comments about any photo on iMSRC.ru,

4. making the River Videos,

5. unzipping the Zo Lekker file,

6. knowing there was any child pornography on any of his devices. He further stated that if he knew there was child pornography on his devices, the police would never have found it.

7. posting intimate images of C.C. or M.A. on the Internet,

8. harassing C.C., a means of a pattern of behaviour that would make her nervous and harassed.

[523] At the end of the accused’s case, the Crown elected not to call any reply evidence.

The Accused’s Summation

Count 1 - Did Access Child Pornography - s.163.1(4.1)

[524] The accused denies accessing the iMSRC.ru website in any way and at any time. Notwithstanding that his image appears on the website under the name Criza, he did not post the image, nor did he make any of the comments attributed to Criza. It is his opinion that someone took his photo off social media and put it on the website.

[525] The accused also disputes that the eight images identified by Detective Shipp fall into the category of child pornography. All of the children depicted in the images are clothed and the Criza comments and the comments of others, do not turn them into pornography.

[526] The accused challenges the authenticity of the comments posted by Criza which are accompanied by an image of the accused. The entries show access dates from late 2014 to the beginning of 2016. The phone held by the accused in the image is clearly a Galaxy Samsung S7, which did not come out until March 2016 and so could not be in a picture that was posted in 2014. The accused submits, that there is no explanation for this and must cause concern as to the authenticity of the image, which is a central piece of evidence used to link the accused to the iMSRC.ru website.

[527] Although the defence cannot explain this, he submits that he does not have to. The accused testified there were so many crizas, that he had to call himself criza27 on his Xbox account. None of the postings on iMSRC.ru referred to criza27.

[528] The phone in the photograph on page 1 of Exhibit 18, is clearly a photograph of a Galaxy Samsung S7 phone in a red case. If you go to Exhibit 3 in the computer and expand the entries on the iMSRC.ru website, it is obvious that it is the same photograph. Therefore, it is unexplainable how this 2016 photograph somehow found its way to iMSRC.ru website in 2014.

[529] The accused submits that under this charge, knowledge is an essential element of accessing child pornography. He relies on two cases, R. v. Freire, Mendes and Simmons, 2019 ONSC 6305 at paras. 43-39 and R. v. Simpson, 2020 ONSC 7862 at paras. 159-165. In the Simmons case at paras. 163, 164 and 165 the Court stated:

[163] There are 3 specific charges here: possession of child pornography, accessing child pornography and making the video of child pornography available.

[164] On the charges of possession, R. v. Midwinter[49] is the controlling decision. At paras12-14 the Court of Appeal instructs that…

14 The requirement of knowledge encompasses two elements: the accused must be aware that he had physical custody of the thing in question and must be aware of what the thing is: Morelli, at paras 16. Possession requires knowledge of the criminal character of the item in issue: Chalk, at para 18. Where the material in question reposes in an electronic file, the court may draw inferences about an accused’s knowledge from the circumstantial indicators such as ownership, access to and usage of the computers on which the files are stored: …

[165] Control means power of authority over the thing, whether exercised or not, but a finding of guilt requires the accused to knowingly acquire the underlying data files and store them in a place under his or her control. He must be aware that he had physical control of those files and he must be aware of what they compromise.[50] He must also know that the files he possesses are criminal in character.[51] Chalk, also confirms, however, that I am permitted to draw inferences about the accused’s knowledge of the circumstantial evidence that the electronic files present, such as ownership, access, and usage of the computer files on which those files were storage.[52]

Count 2 - Surreptitiously Recording CC - s. 162(1)

[530] The accused testified that all the images of C.C. were taken by her and sent to him or were taken by him with her knowledge and consent, with the one exception of the bathroom photo of her sitting on the toilet which she did not consent to have taken.

[531] C.C. was unable to say which photographs were taken with her consent and which ones from her point of view were not. Two of the images are of C.C. in a Regina bathroom wearing a towel, and the accused wasn’t even there. The second photo shows C.C. exposing her body to the camera. Her explanation that she is somehow trying to record her size is ridiculous, since the first photo has her completely wrapped in a towel and does not show her size or physique in any way.

[532] The photos from Regina are obviously sent with consent. The accused testified that C.C. was always aware of when photographs were being taken and also from the circumstances in which they were taken, it is obvious that they certainly were not being recorded surreptitiously.

[533] The accused relies on the Ontario Court of Appeal case of R. v. Trinchi, 2019 ONCA 356 where the Court stated the following at paras. 46 and 47:

[46] I am satisfied the ordinary meaning of the word “surreptitiously” does include intent as part of its meaning. A person who observes or records with the intention that the subject not be aware that he is doing so, is attempting to avoid notice or attention. Moreover, I consider M.E.N.’s articulation of the mental element to be apt. The mental element required by the word “surreptitiously” in s. 162(1) is the intent the subject not be aware that she is being observed or recorded. In a prosecution under s. 162(1), the Crown may prove the accused acted surreptitiously by proving that he observed or recorded the subject with the intention that she be unaware he was doing so.

[47] In a case in which the accused testifies, the termination of his mental state may depend chiefly on whether he is believed or not. Where the accused is not believed or does not testify, his state of mind may be based on evidence of the secretiveness or stealth, or may be inferred from the relevant circumstantial evidence. Evidence that the complainant did not consent and was not aware the accused was recording her will be relevant circumstantial evidence. This, together with evidence that supports a finding the accused knew, or was wilfully blind, the complainant was unaware he was recording her, may well provide a compelling basis for the inference the accused intended the complainant remain unaware of his action. Also, as with inferring intent for any crime, the law presumes that a person intends the ordinary consequences of his voluntary acts.

Counts 3 and 4 - Did Make Child Pornography - s. 163.1(2) & s. 162(1)

[534] Although the accused admits he was there with his daughter and an unknown child when the video was made, he denies making the video and says someone else must have made them, but he does not know who. He points to the still images in Exhibit 21 and says the angles of the shadows are all wrong for him to have been the photographer.

[535] Although Constable Loschmann gave his opinion that the accused took the videos, his evidence should be disregarded on this point since he was not qualified to give such an opinion and there is nothing in his background which gives him any expertise in determining where or how images of videos and photographs are taken.

[536] He further submits that the concept of the angle of the photograph that Loschmann refers to, does not justify the conclusion that the accused is holding the camera. The accused submits that a simple review of the photographs shows that he could not have been holding the camera and taking the picture at that point in time.

[537] He also denies putting the images from the River Videos on his phone or any of his devices.

[538] The accused’s explanation for how the videos got on his devices, is that they must have been placed there when someone put the Lexar thumb Drive with the River Videos on it into his computer.

[539] The accused submits that the trier of fact can accept all, some or none of the evidence of any witness including the accused. He asks this Court to accept his evidence or at least have a reasonable doubt about it. He further submits that possession is an essential element of making child pornography.

[540] Even if the Court concludes beyond a reasonable doubt that the accused made the River Videos, he still submits that the River Videos themselves do not reveal a sexual purpose. He submits, such a finding would be required for the Court to convert what on its face appears to be an average recording of an average family outing, into child pornography or to make it surreptitiously.

[541] Here, the accused also relies on the two cases, R. v. Freire, Mendes and Simmons, 2019 ONSC 6305 at paras. 43-39 and the Ontario Court of Appeal case of R. v. Trinchi, 2019 ONCA 356 at paras. 46 and 47.

Count 5 – Make Available Intimate Images Without Consent – s. 162(1)

[542] The accused denies making the intimate images of M.A., C.C. or the images of the unidentified girl in the River Videos available to anyone. He denies placing any images on the ImgSrc.ru website or anywhere on his devices other than the one they were recorded on.

[543] Furthermore, he denies hiding them in any way on any device. The files were not hidden by him as described by Constable Loschmann. In addition, while the files may have been hidden, they were not inaccessible. While Loschmann used the analogy of the Rolodex, the accused submits a more appropriate analogy would be that of a filing cabinet.

[544] Anybody can hide things in a filing cabinet, including the primary and other users or anybody else. Things can be put in a filing cabinet very easily without the knowledge of the owner of the filing cabinet. This is not the case, where there existed some kind of lock, either in real terms or figuratively.

[545] The defendant submits he is very computer literate and very much aware of how his devices operate. He raised the possibility of a computer virus importing the images found on his devices from ImgSrc.ru without his knowledge.

[546] He gave evidence of a viral attack on an unrelated computer in 2018 as proof that viruses can take over a person’s computer. He disputes Loschmann’s analysis of computer technology when he said no viruses could be placed on his computer.

[547] The accused notes that the command function on the computer, firewall settings and other virus control protocols can be disabled, either permanently or temporarily and not detected later.

[548] It is the accused’s position that viruses can and do attack computers in spite of antiviral programs being installed. He further submits that there are many ways in which the offending images could be removed from the recording device and placed on his devices without his knowledge.

Count 6 – Extort Sexual Favours from M.A. - s. 346(1.1)(b)

[549] The accused denies extorting sexual favours from M.A. at any time during their relationship.

[550] He submits that for the purpose of this charge, a WD analysis is required. He submits a different analysis should be applied to the charges of possession, as opposed to the charges involving M.A. and C.C. He further submits that each Count in the indictment must be considered individually and that one Count does not corroborate another Count.

[551] To bolster this submission, he relies on the Ontario Court of Appeal case in R. v. Howe, 2005 CanLII 253 and in particular, paras. 43–45.

[552] With respect to M.A., her evidence is vague, uncertain and contradictory. She could not indicate what the threats actually were, when they were made, how they were made or how they were conveyed. There were allegedly phone calls, text messages and other forms of communication, but none were produced at trial. It is the accused’s position that they were not produced because they simply never existed.

[553] M.A. had a strong reason to invent her story. She sent highly sexualized photos to her stepson, the accused, and maintained a sexual relationship with him while she was living with his biological father.

[554] The accused submits, M.A. needed a way to explain her behaviour when shown the explicit photographs by Detective Shipp, which she did not know Shipp had, prior to attending for her interview. During the course of the trial, M.A. maintained that her relationship with the accused occurred after her relationship with the accused’s biological father had ended. She wanted to portray herself in a more positive light by suggesting that there was no betrayal of any sort of family relationship given her relationship with the accused.

[555] Her cross-examination at trial, with respect to the evidence she gave at the preliminary inquiry, made it absolutely clear that her relationship with the accused commenced before the end of her relationship with the accused’s biological father, by about two or three years.

[556] Her stories at the preliminary hearing and at the trial were completely different and therefore her evidence is both incredible and unreliable.

Count 7 - Possession of Child Pornography – S. 163.1(4)

[557] The accused submits that his defence to this particular charge has already been explored in his other submissions, particularly Counts 1, 3 and 4

[558] In short, the accused denies knowingly possessing child pornography on any of his devices.

Count 8 - Breach of Recognizance – s. 145(3)

[559] The accused assumes this charge relates to the allegation, that he was in possession of a cell phone which was connected to the Internet, when Detective Shipp seized the phone on August 17, 2017.

[560] There is no evidence before the Court that he used a computer connected to the Internet. The accused testified that the phone he had on August 17, 2017 was not connected to the Internet.

[561] It was the accused’s belief that he was entitled to possess the device he possessed on August 17, 2017, pursuant to the terms of his recognizance.

[562] On his original release on June 3, 2017 there was a discussion about his need to use a cell phone for work purposes. He was told this was okay. That evidence has not been contradicted in any way.

[563] The accused submits that a breach charge is a full Mens Rea offence and that mistake as to the terms of his recognizance offers a defence. He relies on para. 4 of the Supreme Court of Canada decision in R. v. Ziora, 2020 SCC 14 which reads:

[4] I conclude that the crown is required to prove subjective mens rea and no lesser form of fault will suffice. Under s. 145(3), the Crown must establish that the accused committed the breach knowingly or recklessly. Nothing in the text or context of s.145(3) displaces the presumption that Parliament intended to require a subjective mens rea. Further, this intention is supported by this Court’s jurisprudence on the interpretation of the breach of probation offence, the consequences of charges and convictions under s. 145(3), the role of s. 145(3) within the constitutional and legislative’s scheme of bail, and the practical operation of the bail system. A subjective mens rea standard for breach under s. 145(3), like Parliaments recent amendments to the bail scheme, keeps the focus on the individual accused where it belongs.

Count 9 – Criminal Harassment – s. 246(2)

[564] The accused denies any contact with C.C. which could justify the conclusion that she was harassed. He also denied being reckless as to whether or not she was harassed or feared for her safety.

[565] He admits to his relationship with C.C. and admits sending a single email to her employer.

[566] Several emails that were sent to C.C.’s employer, were shown to him in cross-examination (Ex. D) and he denied sending any of them. The accused submits that these emails show the ease with which other persons can acquire his personal information, including his name and his DJ name criza and send information out, which looks like it comes from him.

[567] It is abundantly clear on C.C.’s evidence alone, however, that she was never in any sense afraid for her safety as is required by section 264(2). C.C. never indicated she was in any fear for her safety at trial. The email she sent to the defendant in December 2014 (Ex. 17), contains no suggestion that she was fearful in any way.

[568] The first time she decided she was fearful was at the preliminary inquiry in 2019. The accused submits that the evidence for this charge must demonstrate that C.C. was harassed and also that she feared for her safety. For this proposition he relies in part on para. 142 from the case of R. v. Udowicz 2021 ABPC 41 which reads:

[142] A similar but distinct offense is created under section 264(2). That offence, unlike the offense created by section 372(3), does not require proof of a specific intent to harass. It requires only that the Crown prove that the conduct set out in s. 264(2) (which includes repeated communications) was engaged in by the accused without lawful authority and “knowing that another person is harassed or recklessly as to whether the other person is harassed” by the conduct. However, section 264(2) requires the Crown to prove that the complainant feared for his or her safety or the safety of anyone known to them. Under section 372(3), the Crown is not required to prove fear for safety which is consistent with the fact that the actual harassment need not be proven under section 372(3).

Browne v. Dunn [1893] J.C.J. No.5

[569] The accused submits that what is referred to as a rule in Browne v. Dunn is a guideline not a rule. He further submits that there were no violations of the rules/guideline here or if there were, they were extremely minor and unworthy of consideration.

[570] In addition, the accused submits that the rules/guideline should not be applied to witnesses giving expert or technical evidence.

The Crown’s Summation

Counts 1 and 5

[571] To find the accused guilty on Count 1 (accessing child pornography) and Count 5 (distribute intimate images), this Court would need to conclude that the accused was the ImgSrc.ru Criza and that he accessed child pornography and posted intimate images of either C.C., M.A. or both women on that website.

[572] The identification of the accused as Criza, includes, but is not limited to the following evidence from Shipp, Loschmann, C.C. and the accused.

[573] From the testimony of Shipp we learned:

1. Production order results provided the accused’s IP addresses over the relevant period of time, which matched where the accused resided.

2. The profile picture on ImgSrc.ru, which was taken by the accused, was located on his devices.

3. Social media checks revealed overlapping areas of identification including the accused’s car, social media accounts and emails.

4. Criza is connected to the Region of Waterloo and the St. Jacobs Farmers’ Market (Ex.4, P. 13).

5. Criza posted albums and images of J.W., M.A. and C.C., all former girlfriends/lovers.

6. Seven devices owned by the accused had material on them consistent with the ImgSrc.ru user Criza.

[574] From Loschmann, we know forensically that the accused’s devices accessed ImgSrc.ru. We also know the IP addresses of the devices and the LAN.

[575] C.C. testified that the accused went by the nickname Criza and used it as usernames for his Microsoft and Xbox.

[576] We also know from the admissions of the accused that:

1. He is known as Criza.

2. He had gone by Criza for years and made up that unique moniker as a blend of two rap names.

3. He had someone make a Criza decal which he put on his car and which is still there.

4. He knew C.C. worked at Kent prison in B.C., which is relevant since the ImgSrc.ru albums of intimate images of C.C. are named “CPT-15 Correctional Officer at Kent Prison BC”

5. M.A. is his stepmother, which is also relevant considering the ImgSrc.ru album of her is named “Step”.

[577] The accused is the creator and operator of the ImgSrc.ru user Criza. A visual representation of evidence which demonstrates some of the overwhelming circumstantial evidence from the police investigation which connects the accused to Criza, is at Ex.4, P. 77.

Circumstantial Evidence

[578] In a case based on circumstantial evidence, the Court must be satisfied beyond a reasonable doubt that guilt is the only reasonable conclusion on the evidence.

[579] When drawing inferences from circumstantial evidence, it is crucial to look at the entire constellation of relevant evidence.

[580] When determining whether guilt is the only reasonable conclusion, a Court must consider “other reasonable possibilities” that are inconsistent with guilt. However, the Crown is not required to “negate every possible conjecture”. Alternative inferences inconsistent with guilt cannot be based on speculation and cannot be premised on unreasonable possibilities.

[581] The Crown submits, that the defence evidence is nearly entirely speculative and unreasonable, which can not and should not raise a reasonable doubt.

Count 1 – Accessing Child Pornography

[582] Proof of this offense requires the accused to be the user Criza on ImgSrc.ru, that he accessed the eight images testified to by Shipp and that they are child pornography.

[583] The Crown has adduced evidence establishing the accused as Criza, Shipp detailed Criza’s accesses to those photographs and exhibits 3-A and 4 establish the accused’s guilt on this Count beyond a reasonable doubt.

Count 2 - Voyeurism (C.C.)

[584] The elements of this offense are, that a person makes a visual recording/image of a person who is in circumstances, that give rise to a reasonable expectation of privacy, such as when the person is in a place where they would reasonably be expected to be nude, to expose genitalia, anal regions or breasts or to be engaged in explicit sexual activity, and the recording is done for the purpose of observing or recording the person in such a state or where the recording is done for a sexual purpose.

[585] The accused agrees that he took the photographs in set 4 of Ex. 3-E as well as a photograph of C.C. seated on a toilet.

[586] C.C. clearly had a reasonable expectation of privacy given her location in her bathroom and bedroom, as well as her state of undress in the bathroom and the sexual activity taking place in the photographs in set 4.

[587] C.C. was clear in her testimony and unshaken on cross-examination, that she did not consent to those photographs being taken. The accused conceded C.C. did not consent to having her photograph taken while seated on the toilet. Her displeasure at this photograph being taken, can be seen on her face in the picture.

[588] Under this section, pursuant to s. 162(7)(b), the accused’s motive for taking the pictures is irrelevant.

Count 3 - Make Child Pornography

[589] The essential elements here, are that the accused created the film and the definition of child pornography includes a film where “the dominant characteristic of which is the depiction, for a sexual purpose, of a sexual organ or the anal region of a person under the age of 18”.

[590] Here we have a series of recordings of an unknown female child. The filming repeatedly focuses in on and zooms in on her genitalia and anal regions, basically to the exclusion of whatever else is going on. (Ex. 3C)

[591] The evidence proves beyond a reasonable doubt that the accused created this series of videos on August 31, 2014. The accused is the only adult present in the videos and concedes he is holding a phone in his left hand. There are no other persons viewable at any point, even when the videos briefly show areas of the park some distance from where the videos are being taken. No other person is ever spoken to, mentioned or viewed.

[592] The accused acknowledged being there, and that his feet, shorts, right hand and face appear in the video.

[593] The accused gave unconvincing evidence on this point. He stated that he has a suspicion of who took the videos and claimed that the park was packed that day. He never identified who he thought might have taken the videos and notwithstanding some video of the shoreline, no other people appear in the videos.

[594] The angles that the accused is captured in, include from above his feet, under his chin and up his nose, as well as close up shots of his shorts. Any person who might have been filming the accused from these angles would have had to have been, practically speaking, directly on top of or directly underneath the accused. These angles could not be achieved by a person who is directly next to the accused. No one speaks to the mystery person or says their name and no part of their body is ever seen.

[595] The shadow of the accused’s left hand is visible in several shots and he is holding a cell phone. The accused agreed that was the case.

Count 4 – Voyeurism

[596] The elements of this offense have been dealt with in Count 2. It is alleged that the accused, in addition to creating child pornography, is also guilty of voyeurism in relation to the child captured in the River Videos.

Count 5 – Make Available Intimate Images

[597] The essential element of this offense is that the accused “knowingly published, distributed, transmitted, sold, made available or advertised intimate images of a person, knowing that the person depicted in the image did not give their consent to that conduct, or being reckless as to whether or not that person gave their consent to that conduct.

[598] The accused possessed intimate images of both M.A. and C.C. Both ladies testified that when they sent some intimate images to the accused, they were not to be sent to anyone else.

[599] The accused, as Criza, posted intimate images of both M.A. and C.C. on the ImgSrc.ru website. He then segregated them into different folders by name. One folder was “CPT–15 Correctional Officer at Kent Prison BC”. One folder was password protected and one was not. Another album named “Step” was password-protected.

[600] Shipp testified that Criza placed the albums into the categorization “nudity”.

[601] The folder “CPT–15” contained intimate images of C.C. (Ex. 3E) while the folder “step” contained intimate images of M.A. (Ex. 3D). Both ladies denied giving any consent for the intimate images to be shared or published.

[602] Ex. 17 is an email from C.C. to the accused and his response. This exhibit corroborates C.C.’s testimony and clearly illustrates her lack of consent.

[603] In addition, an inference can be drawn with respect to the accused’s response to C.C., which was to the effect that the images are his, so “no legal action can be taken”. This reply gives rise to the inference, that the accused felt entitled to use the images of C.C. that he possessed, in any way he wished and with impunity.

Count 6 – Extortion (M.A.)

[604] Essentially, to be convicted on this Count, the Crown has to prove that the accused, without reasonable justification or excuse and with intent to obtain, in this case sex, did so by threatening to expose their sexual relationship to his family and in particular his biological father, with whom M.A. was residing.

[605] When M.A. tried to break off the intimate relationship, the accused threatened to expose her relationship and share the intimate photographs he had with others. She testified, that the threats from the accused overbore her free will and as a direct result of those threats she continued to have a sexual relationship with the accused that she did not want.

[606] Contrary to his evidence in-chief, the accused agreed on cross-examination, that he extorted M.A. in 2017. The accused indicated he could not testify as to what he had done in 2017, due to the s. 276 ruling made previously by this Court. That ruling in no way barred the accused, from stating that he threatened M.A. in 2017, with the exposure of her intimate photographs.

[607] Even though Count 6 refers to the year 2015, the date in an indictment is not an element of the offense. [s. 601(4.1)(a)] In addition, the Crown relies on the Ontario Court of Appeal case of R. v. S.M. 2017 ONCA 878, where the Court stated the following at para. 20:

[20] The trial judge erred in law requiring the Crown to prove beyond a reasonable doubt that the offenses occurred within the timeframe alleged in the indictment. The error was crucial. The trial judge expressed concerns about the reliability of E.M.’s evidence. The concerns were based in part on her clearly erroneous recollection of when the offenses occurred. The trial judge did not, however, come to any conclusion as to the reliability of E.M.’s evidence, but instead wrongly decided the case on the ground that the Crown failed to prove beyond a reasonable doubt that the offense occurred within the timeframe alleged in the indictment. It may well be that a trial judge would find E.M.s evidence sufficiently reliable to satisfy the Crown’s burden of proof. There must be a new trial on all charges.

Count 7 – Possession of Child Pornography

[608] On this charge, the Crown is required to prove that the accused knowingly possessed material which fit the definition of child pornography.

[609] Shipp testified to the volume of child pornographic material on the accused’s devices. (Ex. 3, Ps. 60 & 77)

[610] The River Videos at Ex. 3C have been characterized as child pornography by Shipp. Ex. 6 lists every file name and file path for each piece of child pornography material located on the accused’s devices.

[611] Loschmann testified regarding the location and file path of these items. Many of them were in convoluted file paths, with intentionally misleading filenames such as “virus files” which contains the hidden file “bean”, which in turn contains photographs of C.C. The file “new folder 2” contained a child pornography collection. The hidden “zo lekker” file contained a volume of child pornography. These file folder names were user created. (Ex. 9, Ps. 84-103)

[612] The hidden nature of these files suggests an attempt by the accused, who was the owner and user, to conceal these images and videos.

[613] The location of these files, which were near folders such as “AE’s School picks 2012 – 13” indicate that the accused used this area’s computer and would have known the files were there.

[614] Loschmann testified about the multistep process, that a user must undertake to unzip a compressed file, namely the ‘zo lekker’ file, which contained a volume of child pornography. Loschmann testified that this process is undertaken by the user and does not happen automatically.

[615] Loschmann also testified regarding “carved files” and explained they may have been files deleted by the user. This demonstrates both knowledge and control of those files.

[616] The organization, categorization, renaming files, moving files, hiding files and creating a folder structure, are all relevant considerations which demonstrate that the accused knew what was contained within the files.

[617] The accused had possession of the files, knowledge and control of the underlying data files and the ability to copy, delete and move files. Evidence that the accused downloaded a file such as “zo lekker” is evidence of control.

Count 8 – Fail to Comply with the Recognizance

[618] For this Count, the Crown must prove that the accused was bound by an undertaking or recognizance and that he did not comply with the conditions of same, without a lawful excuse.

[619] The accused’s recognizance (Ex. 2) clearly states at term 6, “do not possess or use any computers or any other device that has access to the Internet or other digital network”. Shipp testified, that on August 17, 2017, when he arrested the accused, the accused had in his possession a cellular telephone that had access to the Internet and a digital network.

[620] In addition, Shipp observed the accused accessing the Internet on the device directly prior to arresting him. Shortly after seizing the phone, the phone was updating itself using cellular data which needs an Internet link. Shipp further testified that the phone had a symbol on its home screen indicating that it had data. He was able to make Internet searches and update the weather network, all of which require data and access to the Internet.

[621] The accused testified in an inconsistent manner regarding the cell phone and whether it had the ability to use data. First, he claimed it had a “data block” which meant that it was completely unable to access the Internet. Next, he amended that to say, he could send and receive photographs. Next, to explain how this could happen while having no data, he testified that his phone would sometimes allow small bits of data, before blocking something which required the Internet. He also agreed his cell phone could get the weather network.

[622] The accused indicated that the MMS system which allows him to send and receive pictures and video from S.H., requires some data. He testified that for some reason, he personally does not consider it data. He further stated that the weather app could update via the Internet.

[623] The accused then claimed, when he realized that his phone had Internet access, he called Rogers and “freaked out” on them. He testified that every once in a while, the Internet would mysteriously turn on. He further testified, that on its locked screen, the phone would update the time, date, temperature and weather details. It is a Crown submission that the phone could only do this because they had Internet access. No other explanation was given.

[624] The accused’s testimony is internally inconsistent and makes no sense. If the phone had a data block, it would have no ability to connect to the Internet or send or receive data, even the accused acknowledged that data would be required to send and receive images and videos over the MMS system.

[625] The accused’s dramatics when describing his discussions with Rogers, after he found out that his phone was connected to the Internet, means that the accused was aware his phone was connected to the Internet. The accused is very tech savvy and would know instantly that his phone would be connected to the Internet when he saw applications update and was sending and receiving images and videos with S.H.

[626] In addition to Shipp observing the accused using the Internet via his phone on August 17, 2017, Shipp further observed the accused’s cell phone using the Internet to update and provide Internet search options for the user while it was in his custody.

Count 9 – Criminal Harassment (C.C.)

[627] The essential elements of this charge require the Crown to prove that:

1. the accused engaged in threatening conduct, and that C.C. was harassed,

2. the accused knew that C.C. was harassed, or he was reckless or wilfully blind as to whether she was harassed, and

3. C.C.’s fear was reasonable in all the circumstances.

[628] C.C. testified that the accused contacted her repeatedly, with upsetting and accusatory communications, before and after their breakup, resulting in her having stress and fear. She told the Court, that she repeatedly told the accused to stop contacting her and that their contact was one-sided, initiated almost entirely by him.

[629] She felt nervous about being too firm with him in the early part of 2017, because he was residing in her home with her dog and all her belongings, while she was in Regina. She attempted to keep the peace, because she feared he would damage her belongings or do something to her dog.

[630] She did not provide the accused with her B.C. address because she found his behaviour to be unpredictable and the thought of him knowing where she lived made her uncomfortable and fearful.

[631] C.C. testified, that she was alerted to an issue concerning the accused reaching out to her employer in B.C. The accused denied sending the emails contained in exhibit D, however, he acknowledged that the person sending emails was named both ‘criza’ and ‘SE’ and also used one of the accused’s email addresses chopper80@msn.com. The accused claims that he did not have access to the chopper80@msn.com email address.

[632] Notwithstanding his denial with respect to the Ex. D emails, the accused did acknowledge, that like the unknown sender of the Ex. D emails, he did send an email to C.C.’s employer spreading allegations of her drug use and trying to get her fired.

[633] Once C.C. broke up with him, he decided to get her fired from her new employment in B.C, so she would return to Ontario and make up with him. He basically testified, that the Court should see his actions as a demonstration of his love for C.C.

[634] When C.C. testified, that she learned the accused had posted intimate images of her on the Internet, she made a police report and sent him an email confirming that he did not have her consent to post any photographs or any information about her. (Ex. 17)

[635] Despite her crystal-clear instruction to the accused, not to reply to the email, he responded several days later, including stating that he knew a girl in Chilliwack who knew her. This was concerning to C.C., because she had not told the accused that she was living in Chilliwack.

[636] C.C. described her relationship with the accused as full of fighting and suicidal threats by the accused. Along with his erratic behaviour, it left her feeling that she had to escape the relationship. Given the history of the relationship and the circumstances of this behaviour, C.C.’s fears were reasonable.

The Crown’s Submissions on the Evidence for the Defence

[637] The defence opted to call evidence but only called the accused.

[638] The defences put forward by the accused appear to be:

1. Counts 1 and 5 - that he is not the Criza on ImgSrc.ru.,

2. Count 2 - that C.C. consented to all the photographs taken of her,

3. Counts 3 and 4 - that he did not create the River Videos,

4. Count 6 - that he did not extort M.A., despite threatening her with the release of her photos in 2017,

5. Count 7 - that he does not know how the large volume of child pornography got onto his various devices,

6. Count 8 - that his cell phone had data block, but allowed a small amount of data through, and that his cell phone was not using the Internet,

7. Count 9 - that he did not behave in a threatening manner towards C.C.

The Rule in Browne v. Dunn

[639] The Crown submits that the defence breached the rule in Browne v. Dunn.

[640] The defence did not put the suggestion to Loschmann, that any device seized from the accused was set up in “God mode” or that any of the devices had Windows 10 Pro N installed as their operating system.

[641] The defence did not give C.C. the opportunity to respond to the accused’s assertions, that she gave him the iCan computer tower or that her previous boyfriend made modifications to it. She was also not asked whether their breakup was precipitated by an argument over the accused’s jealousy, when he viewed a photo of her dancing with other men or that she was violent towards him.

[642] The Crown relies on the Ontario Court of Appeal decision in R. v. Vassel, 2018 ONCA 721, where the Court stated the following at para. 128:

Compliance with the rule in Browne v. Dunn requires a cross examiner to confront the witness with matters of substance, not inconsequential detail, on which the cross-examining party seeks to impeach the witness and call contradictory evidence: Quansah at para. 81. When it is apparent from the tenor of counsel’s cross examination of the witness that the cross examiner does not accept the witness’ version of events, the confrontation is general and known to the witness, and the witness’ view on the contradictory matter is apparent, specific confrontation of a witness is not always necessary: Quanash, at para.82.

[643] Based on the above, the Crown is seeking to have adverse inferences drawn against the accused’s evidence.

The Crown’s WD Analysis

[644] The Court should reject the accused’s denials of the commission of the offenses for the following reasons:

1. The accused’s evidence was self-aggrandizing and defied common sense and logic in several areas,

2. The accused’s evidence continuously changed throughout his testimony,

3. The evidence of the supposed hacking in 2018 on a different computer, cannot be a defence to any of the charges on the indictment,

4. The accused was evasive, argumentative and a wholly uncooperative witness,

5. The Rule in JJRD.

[645] If the Court rejects the evidence of the accused, finding that it cannot be believed, nor raises a reasonable doubt, then the Court must analyse whether the Crown has proven its case beyond a reasonable doubt.

[646] Under the third branch of WD, the Crown submits the Court should accept the version of events provided by C.C. and M.A. for the following reasons:

1. M.A.’s evidence corresponds with the accused’s evidence and his police statement reguarding the extortion,

2. The accused corroborates areas of M.A.’s testimony,

3. C.C.’s evidence was straightforward and was corroborated by external evidence,

4. C.C. had no motive to lie and remained unshaken in her cross- examination,

5. The evidence of C.C. and M.A. was cohesive and accorded with common sense,

6. They were excellent witnesses who testified in a straightforward and clear manner, despite testifying about difficult and highly sensitive issues.

[647] In addition, the Court should accept the evidence of the four WRPS officers:

1. Shipp is an ICE investigator who provided clear methodical evidence of the extensive police investigation,

2. Loschmann is an experienced cybercrime investigator, who conducted a forensic analysis of all the devices in this case and provided coherent evidence-based testimony, regarding the devices and the data obtained from them,

3. Silva was the lead of the cybercrime branch of the WRPS at the time the search warrant was executed,

4. Bowden provided evidence regarding the location of the devices in the accused’s residence,

5. Moore testified in a straightforward manner regarding the arrest of the accused.

[648] S.E.’s evidence should not raise a reasonable doubt. He was a difficult witness whose evidence was internally inconsistent and frequently changed, sometimes in the same answer. His evidence was self-aggrandizing and defied common sense and logic in several areas.

[649] He consistently over exaggerated his skills and employment and used technological lingo as a shield to aid his answering of simple questions. Some examples are as follows:

1. While employed in the warehouse at RIM he had access to training courses which he could attend at the warehouse on company time, despite not being employed in any capacity that would use those skills. He claimed this was true even when there was no warehouse work to be completed.

2. Despite having no formal training in technology or computer science, he was promoted to the software design team, which was responsible for the security software on the new BlackBerry phones at the time.

3. He claims to have been so proficient at software design and coding, that he wrote a patent for software later used by BlackBerry. He conceded in cross-examination, this was not accurate.

4. When asked for names of co-workers on his team and despite the team allegedly working in that specific field for a significant period of time, he had trouble remembering any names and claims that the education and schooling in computer science, of team members never came up.

5. When asked about co-workers and managers in cross-examination, he testified that he knew Jim Balsillie and Mike Lazaridis the co-founders of RIM. When the accused changed his answer on a manager’s name from Lewis to Lawrence and was asked why, he became angry at the questioning and claimed that this was so long ago, he should not be expected to remember.

6. Also, in cross-examination, his supposed job in the software and security area morphed into a dual role, which also saw him in charge of an inventory system in the warehouse, something he had not mentioned in direct examination.

7. When asked about the training he completed, his answer was, back then not everyone got a certificate for everything. Despite this, he testified that he did receive grades to his email, but he was locked out of that RIM email. Later the accused claimed in cross-examination that he had an email to substantiate his employment which was “in the courtroom” but it was never produced.

[650] While the Crown agrees that there is no burden on the accused in this case, there is no corroboration of any kind to substantiate the accused’s evidence. This lack of corroboration includes:

1. Emails from Rogers confirming there were multiple accounts in his name,

2. An email “in the courtroom” which could substantiate his assertions with regards to RIM,

3. Witnesses such as S.H. and Z.N. who had been present for certain events, and

4. The 4 TB hard drive which contained the supposed 2018 virus.

[651] The accused claimed he could not produce the material because he was incarcerated. However, the accused was on bail for over two years and on bail secured by either S.H. and/or Z.N. Of note, the accused was on bail during the pretrial motions, and during the period of time he claims to have been hacked in 2018.

[652] In relation to the virus on the hard drive, in direct examination the accused testified that he knew it was an important piece of evidence and secured it for that reason, yet in cross-examination he stated, that the virus was on a valuable large storage hard drive and he decided that he was not going to give that to the police. The Crown submits that this makes no sense whatsoever but is consistent with the accused not having any corroborative evidence at all.

[653] To be clear, the Crown does not suggest that there is any evidentiary burden on the accused, however, the Court is entitled to consider the lack of corroborative evidence for the accused who has testified that multiple pieces of corroborative evidence exist, when it comes to evaluating the accused’s evidence.

Creator of the River Videos

[654] Another area that illustrates that the accused’s testimony defies logic, are the River Videos. The accused acknowledged that he is in some of the videos and was there at all times, in fact he is captured by both audio and video. He claimed to have a suspicion about who recorded the videos, but then said he did not know. He claimed that Z.N. and his kids were present and that the park was full of people and that the unknown child’s parents were present at some point in time, however he conceded that there was not another person to be seen anywhere in the videos.

[655] He acknowledged in cross-examination, that the angles that the videos were taken from, would require the person taking the videos to be very close to him and at times directly under his nose or chin. When pressed about who this person could be, the accused departed from his previous testimony regarding Z.N., and his children, or other people and simply stated he could not recall if Z.N. was there or not. Ultimately, the accused could provide no evidence about who this mystery person taking the video was. That makes no sense given the space that the videographer would have had to occupy.

[656] Reviewing the videos, it can be seen in video number 3 that the videographer pauses while the accused puts down his beer and then moves forward towards the water and the camera enters over the water. The Crown submits, any suggestion that another person is present and recorded in the videos defies logic and common sense.

[657] There is not a single shred of evidence that another person was present. The accused is simply attempting to distance himself from the culpability of creating child pornography, through a dishonest account, that there was another person doing the recording.

Evidence Related to the Accused’s Security Systems on Seized Devices

[658] The accused began his evidence claiming a great deal of technical skill in relation to computers and software. He advised that he worked on a feature on the BlackBerry phone that would make it more secure. In direct examination he said that a password is like the front door of the house and he would not give that information out.

[659] The accused agreed to be truthful in his police interviews and told Shipp, that he was security conscious and had an application on his phone that recorded his whereabouts, an application that recorded all of his phone calls and that he maintained good control of his social media accounts. This would make perfect sense and be consistent with a person who was involved in the world of hi-tech security, as the accused testified he was.

[660] Loschmann testified, that the accused’s devices had multiple firewalls enabled, remote desktop disabled, and up-to-date antivirus software installed. This is all consistent with the accused being concerned about security and taking protective actions to keep his devices secure.

[661] On cross-examination however, the accused attempted to distance himself from those security settings, claiming that despite having the settings enabled, he was not concerned about a hack, because he would be able to see it happen and then he could deal with it.

[662] Obviously, this is untrue and also preposterous. The accused tried to insinuate and insert the possibility of hacking or malicious software on his devices throughout his evidence. As was pointed out to him in cross-examination, even on his own evidence, if he was hacked to pre-2018, he was entirely unaware of it and in fact, could deal with it. The accused’s bravado in this area, is in the Crown’s submission, simply designed to try to introduce reasonable doubt.

[663] Loschmann was cross-examined at length about the possibility that a virus, even an undetectable virus, could have been present on the accused’s devices. He was totally unshaken in his evidence, despite multiple years of combing through the devices in significant detail, there was not a single piece of evidence to suggest any hacking or the presence of any malicious software. Loschmann pointed out that in the years since the seizure of the devices, virus scanning software had gained additional information about viruses and even using updated forensic virus scanners, there was no evidence of any malicious software or viruses on any of the devices. Any suggestion to the opposite is simply speculative.

[664] In cross-examination, the accused backtracked on his claims of technological prowess when convenient. To summarize, he would have the Court believe that in his early years he was extremely proficient with technology and trained on the latest technology and security, then he became in his words “stupid,” during the period when the offences were committed, and then, by 2018 he wants us to believe that he is again very proficient because he wants the Court to accept his hacking theory. This is ridiculous and speaks to the obvious contortions the accused is prepared to go through in his evidence, to try to avoid responsibility.

The Accused’s Access to Email Addresses

[665] The accused testified at various times about his email addresses and in particular SE0@gmail.com and chopper80@msn.com. The evidence about his timing of access to these addresses continuously changed and was always vague without dates or any corroboration.

[666] Of note, the accused agreed that on December 22, 2014, he received an email on his chopper80@msn.com email from C.C. He responded to this email using his SE0@gmail.com account, so therefore at this point in time he had access to both of these email accounts. C.C. testified that the accused used both of these emails during their time together, which predates the December 2014 date.

[667] However, when it became convenient for the accused, due to an email account being linked to an offense, he would claim that he lost access to that account. Despite his self-admitted extensive technological expertise, he could never explain why this occurred. When pressed on how someone with his high level of computer knowledge could be locked out of their own email accounts, the accused’s evidence began to swirl into various claims.

[668] Those claims included that:

1. His passwords are/were of poor quality, despite him testifying that they were a random assortment of letters and numbers,

2. He thought he had given away a computer while logged into his email,

3. His devices had been “taken over”,

4. He shared his passwords with S.H. and others,

[669] The Crown submits that none of these claims are believable and are simply an obvious attempt to distance himself from his email accounts when advantageous to do so.

[670] When confronted with the emails to C.C.’s employer (Ex. D), the accused claimed he was not the author of those emails, despite having a high degree of knowledge about C.C., a photograph of C.C. that the accused was in possession of, and the email originating from chopper80@mns.com. This is the same address where he received the December 2014 email from C.C.

[671] At the same time, the accused testified that he was locked out of the chopper80@mns.com email account, but had access to the SE0@gmail.com account and sent a similar email to C.C.’s employer from that email instead.

[672] He also testified that it would be foolish to record passwords anywhere, so he had not done so, yet later he testified that he had his passwords saved in his phone.

[673] The accused’s evidence with respect to access to his emails morphed at various times. In direct examination, he testified that he lost access to his RIM account as a reason that he could not provide items. Later, he testified that he forwarded himself some items from the RIM account but could not access the receiving account either.

[674] Still later, he said he had no access to the email addresses and claims they had been hijacked. Subsequent to that statement, he stated that his accounts had been taken over by his wife, S.H., and that he provided her with a password.

[675] On another occasion, he stated that S.H. had succeeded where he failed in accessing his accounts. This not only defies logic and common sense, it is hearsay since S.H. was not called to testify.

Breakup With C.C.

[676] In direct examination, the accused claimed there was a plan for him to move to B.C. with C.C. The plan was thwarted because he was on the sexual offender registry. He claimed that C.C. broke up with him over that, however this was denied by C.C.

[677] Later in his evidence, the accused changed his story and said that in fact the breakup was precipitated by him viewing a photograph of her out with friends, which included a man and that a fight over his jealousy resulted in the breakup.

[678] Notably, this was never put to C.C. in cross-examination but is much more consistent with C.C.’s characterization of the accused, as a jealous and controlling partner who did not want her to be out without him.

The 2018 Computer Hacking

[679] Whether or not this event happened, the hacking of a different computer in 2018, has no relevance to the current charges.

[680] There has been no evidence to connect this event to the offences before the Court in any way, and in fact there is direct evidence, grounded by data before the Court, that there is no evidence of hacking on any of the devices which are germane to this case.

[681] Additionally, there is no evidence apart from the accused’s testimony that this event ever took place. This is so, despite him testifying that S.H. was present and that he captured the virus on the hard drive which he has in his storage locker. This story is an obvious fabrication and ought to be rejected entirely. Even if not rejected entirely, it cannot form the basis for any defence on any of the charges.

Issue Regarding the Phone in the Profile Photo for ImgSrc.ru

[682] The defence is attempting to suggest that the profile photograph of the accused with the red phone case is the only profile photo ever used by Criza on ImgSrc.ru. Therefore, the defence is attempting to suggest, that since the phone with a red case was purchased by the accused after Criza was active on ImgSrc.ru, that the accused cannot be the Criza on the ImgSrc.ru website.

[683] That is entirely false. Shipp testified that a user on ImgSrc.ru can upload a photo of their choosing and make it their profile photograph. ImgSrc.ru was viewed by Shipp, who captured the screenshot of what the Criza looked like at that time, with the red phone case. It does not mean that the only photo ever used by Criza is the one where he is holding a phone with a red case.

[684] It is certainly open to the Court, to find that the user Criza updated his profile photograph at some time after getting the Galaxy S7 phone and the red case, and before Shipp viewed the profile on ImgSrc.ru.

[685] In fact, Ex. 20 demonstrates that there is another photograph of the accused on ImgSrc.ru in the Criza photographs. In that photograph posted prior to the profile photo with the red cell phone, the accused is holding one of his previous BlackBerry phones. The date visible directly under the photograph, is May 21, 2014.

[686] Also, of note, is the quality of the photograph taken with the accused’s BlackBerry phone. It is a good quality photograph, which directly contradicts the accused’s claim that his BlackBerry did not take good photographs.

The Video of the Accused and His Daughter – Ex. 19

[687] The defence filed this video in an attempt to demonstrate that the iCan computer tower was not in the child’s room on that date. There is no magic, as to what room in the home the iCan computer tower was in. Where it was in the home is completely irrelevant.

[688] In the video, there appears to be only one bed in the bedroom along with a small fridge. When the Court reviews the photos taken by Silva, before, during and after the search (Exs. 13, 14 & 15) it can be seen that the child’s room then, had two beds and the fridge has been removed. As well, the iCan computer tower is in the child’s bedroom at the time the Silva photos were taken.

The Accused was an Evasive Argumentative and Wholly Uncooperative Witness

[689] The accused’s testimony was rambling, unfocused and revealed a person who is not willing to take responsibility for even the most obvious things.

[690] He ran afoul of both the s. 276 and the alternate suspect rulings made by this Court following the pretrial motions in this matter, despite there being objections on both fronts.

The Accused Added Unprompted, Negative Information About C.C. and M.A.

[691] The accused took several opportunities to smear and denigrate both C.C. and M.A., despite his comments not adding anything of any evidentiary value to his answers and not being responsive to the question. Examples of this include:

1. Claims of drug use by both M.A. and C.C., which were notably never put to either witness in cross-examination,

2. That C.C. was abusive to the accused which again was not put to C.C. in cross-examination,

3. That C.C.’s father showed up to meet with the accused with a gun, this was also not put to C.C. in cross-examination,

4. That M.A. raped the accused, which is an exceptionally offensive breach of this Court’s s. 276 ruling and should be entirely disregarded.

The Accused Revealed a Pattern of Blaming Others

[692] It seems the accused refuses to take responsibility for anything. Time and time again, the Court heard about how he had been illegally terminated due to someone else’s actions, illegally evicted, falsely accused, unfairly duped and denied employment insurance benefits unjustly, etc.

[693] Even when he behaved incredibly poorly and attempted to have C.C. fired after she had completed three months of intensive training, he brushed it off and characterized it, as a small mistake he made, in the name of love. He tried to minimize his actions stating that they were not vindictive but were acts of love.

[694] He was fixated on J.W. time and time again, invoking her name when pressed for an answer. He would revert to blaming J.W. in roundabout ways with no corroboration or evidence whatsoever. Again, this was contrary to the ruling of this Court following the alternate suspect application, where numerous witnesses were called, and this Court determined that the application did not meet the legal threshold to go forward and it was dismissed. The Crown submits that this is another example of the accused grasping at straws to distance himself from the offences he is so clearly responsible for.

[695] The accused laid much of the blame for many of the issues in his life on women. He repeatedly said that he “was played”, painted himself as a dupe to lying women, claims to have lost all his belongings to J.W. who treated him poorly and claimed that when he is in love he trusts the woman too much. This is again one of the tactics of the accused, to try to shift responsibility from himself to the women in his life.

The Accused is a Poor and Uncooperative Witness

[696] In cross-examination he had to be asked multiple times to answer simple questions. He would constantly direct questions back to the Crown and would insinuate that he was too smart for the questions being asked, of note, he advised the Crown that it was important to “keep in mind while speaking to him that he was very smart”.

[697] He would constantly go off on tangents about side issues that had nothing to do with the question. When refocused he would often claim that he had answered the question or complain about having to answer the question.

[698] He was extremely defensive, often adding strange commentary where it was not needed. An example was, after some back-and-forth about whether he attended any conferences in computer science, he ranted about, “how good parents” do not leave their families to go to conferences. This illustrates the way that the accused attempts to insulate himself from an answer that he does not want to provide or perhaps that he perceives would be unhelpful to his defence.

[699] On more than one occasion he disputed the question could be put to him and refused to answer, until the Court either directed him to answer or posed the question itself.

[700] He presented as a rude, dismissive, argumentative and uncooperative witness, who could not, or would not, focus evidence to the questions being posed and had a dedicated pattern of blaming everyone around him for his problems.

[701] At one point, he embarked on what can be characterized as an angry monologue, invoking his childhood, his ex-wife J.W., his criminal record, claims that Shipp said he was mentally ill (which he did not) and all manner of other external forces, that he indicated were responsible for his charges. Again, none of this was responsive to the question posed to him.

The Rule in JJRD

[702] Finally, even if the Court is unable to reject the accused’s evidence on its own merits, the Court should still reject his evidence based on a considered and reasoned acceptance of the evidence of the Crown. The reasons for the following section that justify an acceptance of the Crown’s evidence beyond a reasonable doubt, under the third branch of WD, function equally as a justification to disbelieve the accused’s denials. The Ontario Court of Appeal in R. v. JJRD, 2006 CanLII 40088 (ON CA), [2006] O.J. No. 4749 at para. 53 stated:

53 The trial judge’s analysis of the evidence demonstrates the route he took to his verdict and permits effective appellate review. The trial judge rejected totally the appellant’s denial because stacked beside A.D.’s evidence and the evidence concerning the diary, the appellant’s evidence, despite the absence of any obvious flaws in it, did not leave the trial judge with a reasonable doubt. An outright rejection of an accused’s evidence based on a considered and reasoned acceptance beyond a reasonable doubt of the truth of conflicting credible evidence is as much an explanation for the rejection of the accused’s evidence as is a rejection based on a problem identified with the way the accused testified or the substance of the accused’s evidence.

Conclusion

[703] There are significant reliability and credibility concerns in relation to the evidence of the accused and it should be rejected. He is a poor witness who gave evidence that defies common sense and logic, evidence that consistently changed, and it should not rise to a reasonable doubt in these cases.

[704] The Crown submits that it has proven all of the offenses beyond a reasonable doubt.

Summary and Findings

[705] I do not intend to spend hours reading my entire judgment, which of course forms part of the formal trial record. I will now read into the record a summary of the evidence and my findings based upon all of the evidence.

[706] The preceding 705 paragraphs contain the evidence given by the witnesses. For the most part I have categorized the evidence by witness name and then by direct, cross- examination and reply evidence. I have further tried to sub categorize the evidence of each witness by issue, for example by computer device.

[707] At the start of my full judgment I have included an index.

[708] At the end of my judgment I have attached appendices which include a:

A. Timeline,

B. Glossary of Computer/Software Terms, and

C. List of Exhibits.

[709] There is a warning at the start of my judgment which reads:

By Court Order, there is a ban on publishing any information which could identify a victim, a person under 18, or the accused, in any document or transmitted in any way, except through the use of their initials. Failure to comply is punishable by summary conviction.

[710] Before reading my summary, I have duplicated para. 2 of my judgment which reads as follows:

Because of the sensitivity of the evidence involved in this case, the Court has used initials when referring to all parties involved in the allegations. Also, sometimes people used their first names or short forms of their first names on email addresses or for usernames. That makes some of the email addresses look unusual, however for the sake of anonymity I have used initials throughout. I have used the following initials to represent the following people:

S.E. - is the accused, I have also referred to him as the accused,

A.E. - is the accused’s daughter,

S.H. - is the accused’s current spouse,

C.C. - is a former girlfriend of the accused,

J.W. - is a former spouse/girlfriend of the accused,

M.A. - is the accused’s stepmother,

D.L. – is the accused’s biological father,

Z.N. - was a surety for the accused,

[711] The nine counts of the indictment in summary form, allege that the accused:

1. did access child pornography, contrary to s. 163.1(4.1), between December 13, 2014 – January 3, 2016,

2. did surreptitiously record C.C., contrary to s. 162(1), between January 1, 2011 – December 31, 2014,

3. did make child pornography, contrary to s. 163.1(2), on or about August 31, 2014,

4. did surreptitiously record an unidentified female, contrary to s. 162(1), on or about August 31, 2014,

5. did make available intimate images without consent, contrary to s. 162(1), between November 4, 2014 – July 13, 2017,

6. did without excuse and with intent to obtain sexual intercourse, induce M.A. by threats, contrary to s. 346(1.1)(b), between January 1, 2015 – December 31, 2015,

7. did have in his possession child pornography, contrary to s. 163.1(4), on or about June 2, 2017,

8. did fail to comply with the terms of his recognizance not to possess or use any device connected to the Internet or digital network, contrary to s. 145(3), between July 9, 2017 – August 17, 2017,

9. did threaten C.C., contrary to s. 264(2), between January 1, 2011 – December 31, 2014.

[712] The accused pled not guilty to all nine Counts.

[713] There is no serious disagreement between the parties over what the Crown must prove beyond a reasonable doubt, in order to obtain a conviction on any one Count.

[714] For the most part, the accused denied the allegations raised by the Crown. The accused denied:

1. That he ever accessed or even knew about the ImgSrc.ru website.

2. That he was the same person, as the person using the name Criza on the ImgSrc.ru website.

3. That he posted any images on that website.

4. That he made any comments on any images posted on that website.

5. That the eight images identified by Detective Shipp are child pornography.

6. That he made the River Videos.

7. That he ever put the River Videos on his phone or any other of his devices.

8. That the River Videos are child pornography.

9. That he ever took photos of M.A. or C.C. without their knowledge and consent with the exception, on the issue of consent, of the one photo of C.C. sitting on a toilet seat.

10. That he made intimate images of M.A., C.C. or the unidentified girl in the River Videos, available to anyone.

11. That he hid any of the subject images or videos, in any way, on any device.

12. That he extorted sexual favours from M.A. or

13. That he harassed C.C. in any way.

[715] In addition to the above 13 denials, the accused testified that:

1. Some unknown person took his image, which has been referred to as the “Criza Image”, off of social media and put it on the ImgSrc.ru website. They did this in an effort to make it look like he was the one accessing the website. To put it another way, that he was being framed by some unknown person.

2. Some unknown and undetected computer virus, without the accused’s knowledge, somehow took over his computer and imported the offending material onto it.

Count 1 - Did Access Child Pornography – s. 163.1(4.1)

[716] The accused denied knowing about or ever accessing the ImgSrc.ru website. He testified in part that it could not have been him, because comments on the website