Commonwealth DPP and Palliser Ruling No. 4
[2015] VCC 1455
•12 February 2015
| IN THE COUNTY COURT OF VICTORIA | Revised Not Restricted Suitable for Publication |
AT MELBOURNE
CRIMINAL DIVISION
Case No. CR-12-01102
| Commonwealth Director of Public Prosecutions |
| v |
| Kenneth Palliser |
---
JUDGE: | Cannon | |
WHERE HELD: | Melbourne | |
DATE OF HEARING: | 2 February 2015 | |
DATE OF RULING: | 12 February 2015 | |
CASE MAY BE CITED AS: | Commonwealth DPP and Palliser Ruling No. 4 | |
MEDIUM NEUTRAL CITATION: | [2015] VCC 1455 | |
REASONS FOR RULING
---
Subject: CRIMINAL LAW
Catchwords: Ruling – Previous Interlocutory Application Leave to Appeal - Admissibility of tendency and coincidence evidence – Similarity of conduct in 2006 and 2010
Legislation Cited: Evidence Act 2008
Cases:William Small (a pseudonym) and The Queen [2014] VSCA 269R
Ruling:Prejudicial nature of 2006 conduct outweighed by its probative value – Crown entitled to use such evidence – Parties to agree on approach to adducing evidence of 2006 offending - Appropriate jury directions to be given
---
APPEARANCES: | Counsel | Solicitors |
| For the Crown | Mr C. Mandy | Commonwealth DPP |
| For the Accused | Mr K. McDonald | Michael Gleeson Lawyers |
HER HONOUR:
1 Following a decision of the Court of Appeal on an interlocutory appeal by defence and cross-appeal by the Crown, in respect of my ruling of 30 July 2014, concerning the admissibility of tendency and coincidence evidence, amended applications in respect of each, were filed by the Crown. Amended outlines of submissions were provided by each of the parties, and I heard argument from Mr Mandy for the Commonwealth Crown and Mr McDonald for defence on 3 February 2015.
2 On 30 July last year, I had ruled that evidence of the accused's admitted conduct in 2006 whereby over the course of about ten days, he distributed over 450 hard copy images of child pornography to various stores in Melbourne, could be used by the prosecution as tendency evidence to help prove that it was the accused who distributed child pornography via Facebook and a computer virus in 2010, which gives rise to Charges 1 to 5 before me. I refused the Crown's application to use the evidence as coincidence evidence as I took the view that the use of the evidence in this second way would be confusing to the jury.
3 My present ruling ought be read in conjunction with my previous ruling, although allowing for some differences in the tendency and coincidence notices, which are now before me.
4 It is helpful to first look at what the Court of Appeal said about my previous ruling - see William Small (a pseudonym) and The Queen [2014] VSCA 262R
5 At Paragraph 4, the Court said, "The appeals were allowed as a consequence of a material factual error in the trial judge's reasons. Had the facts been as the judge found them, we would have affirmed the ruling that the evidence was admissible as tendency evidence.” [4]
6 At Paragraph 16, their Honours said, "During the oral hearing before this Court, it became clear that the provenance of the images, the subject of the charges, had not been accurately stated to the trial judge. The error arose because of confusion as to the source of the images and their relation to the totality of the images found on the accused's computer. Though there were images found on the accused's computer devices that were downloaded from the LS site, we were informed by the Crown that it was not possible to say that the particular images transmitted over Facebook when using the virus, the subject of Charges 1 to 5, were downloaded from the LS site or were some of images that the accused had downloaded from the LS site at the time of the 2006 offending. In relation to the images actually distributed, all the Crown could say was that the images were of the same type as those used in the 2006 offending, being 'pre-pubescent young girls posing in elaborate ways in distinctive costumes.’” [16]
7 At Paragraph 17, the Court said that, "If the images, the subject of Charges 1 to 5, had been from the same series as those used in the 2006 offending, the evidence of the 2006 offending would clearly have had significant probative value relevant to the issue of the identity of the offender.”
8 The Court did not go on to consider arguments concerning the admissibility of coincidence evidence or my ruling in that regard.
9 Bearing in mind the helpful remarks from the Court of Appeal concerning the admissibility of tendency evidence, I now turn to the amended applications brought by the Crown. Each of the notices record the same facts in issue as the previous notices, that is the identity of the transmitter of child pornography in respect of Charges 1 to 3, and the identity of the person who modified data held in a computer in respect of Charges 4 and 5. Essentially, the issue is the same in respect of each of the Charges, which Mr Papas appeared to acknowledge at the time that the original tendency and coincidence submissions were made.
10 The amended or revised application for tendency sets out that the tendency sought to be proved is the tendency of the accused to use his computers and computer expertise to access child pornography, including from the LS series of images and to distribute that child pornography to innocent and unwilling recipients, including children, with the intention of confronting as many people as possible with those images. Each notice goes on to say that the features of the 2006 offending, as seen in the agreed police summary and record of interview, are ‘identical’ to features in 2010.
11 The notices refer to Annexure D, which contains a table pointing to evidence of similarity, as between the 2006 offending and that with which the accused is charged, which occurred in 2010. This table of similarities is also relied on by the Crown in respect of the amended coincidence application. As I understand the Crown's position so far as coincidence is concerned, it is submitted that the features of the admitted offending of the accused in 2006 are so similar to those of the offending in 2010, that it is improbable that they occurred coincidentally - that is, it is improbable that the accused committed the 2006 offences, but then someone other than the accused committed the 2010 offences.
12 The similarities referred to in Annexure D are said to be the following:
13 (i). That in each instance, the computers used by Mr Palliser were used to distribute the child pornography. The accused admitted to this insofar as the 2006 offences were concerned and the Crown would call expert evidence and invite inferences to establish that the Myki virus and Facebook postings originated from the accused's computers. This aspect is disputed by defence, who say that there is no evidence that the accused use to access a Facebook account and that his browser history does not reflect this. Further, the accused denies that there is any link between his computers and the dissemination of the Myki virus.
14 (ii). In each instance, a level of computer expertise was involved, although, I understand that the Crown conceded defence's point in argument, that a considerably greater degree of expertise was required for the development of the Myki virus and its dissemination than what was used by the accused in respect of his admitted offending in 2006, which involved simply cropping and resizing images. The notice also records that in 2006, the program ‘PaintShop Pro’ was used to resize and manipulate images and that updated versions of these were found on the accused's computers in 2010, along with images from the LS models series. Defence say the ‘Paintshop Pro’ program is a common one and does not reflect any particular expertise or anything that is remarkable insofar as similarities are concerned.
15 (iii). The third similarity referred to in Annexure D, is that in each instance, the accused had accessed child pornography which was evident from his admissions regarding the 2006 offending and from the fact that SGL images and a variety of LS images were found in the accused's computers in 2010.
16 (iv). That in each case, images from the LS series were accessed. This was admitted by the accused in 2006 in his record of interview and a number of images from the LS series were found in a number of locations on the accused's computers, including within the Myki joke and Myki screensaver applications in 2010. The Crown was unable to advise me whether police seized and destroyed all computers and items containing child pornography in the accused's possession in 2006, although it would be surprising if this had not been done. Defence says that as the actual material from 2006 had not been retained, the most the Crown could say is that the labels used for the images in 2006 sounded like those labels in the 2010 offending and that the material in each instance was child exploitation material. I pause to observe that this is understating the evidence in respect of 2006. Whilst the images of what was found in 2006 are no longer available, the accused told police in his record of interview at that time that he had accessed the ‘Tera- news’ website to obtain images from the LS Models series. Descriptions of the images he distributed at that time were consistent with this series of child pornography, a series which was no longer being produced after 2004, although this did not prevent distribution by those already in possession of images from this series before production stopped. Further, the Crown would adduce evidence that in 2010 in the accused's wallet, amongst other things, was a password for the ‘Teranews’ website, which Mr McDonald seemed to say was a different password to the one the accused had used to access the website in 2006.
17 (i-vii): In relation to the final three similarities listed in Annexure D, I propose to bunch these together. The Crown says that in each instance, the child pornography was distributed to innocent (as in unsuspecting or unsolicited, and unwilling) recipients, including children, with the intention of confronting as many people as possible with those images.
18 The Crown refers to the accused's offending in 2006, where he distributed over 450 images of child pornography to various stores in Melbourne, and the events of 2010 where there was a posting of links and images to Facebook, to The Sydney Morning Herald and CamCo. Defence say that while Mr Palliser's offending in 2006 involved product contamination offences that involved leaving images in shop items where members of the public would be expected to find them, the mode of distribution in 2010 was markedly different and is said to have involved personal links between the victims and the accused. Defence say that the two events are not similar at all, that they have significant differences and the only thing that they have in common is that they both involve child pornography.
19 Further, defence says that the accused does not admit that his intention in 2006 was to confront as many people as possible and defence argues that this is a retrospective rationalisation of the offending to bolster the Crown's case in respect of the 2010 offences alleged against the accused.
20 The Crown has obtained some further evidence in respect of the aspect of my last ruling where the Court of Appeal held that a material error had been made. The Crown obtained a statement from a Jordan Hunt, from the E-Crime Squad, dated 29 September 2014. Mr Hunt says in that statement that the LS Models news group operated between 2001 and 2004 and featured a particular style of child pornography featuring pre-teen and teen girls posing, usually with elaborate makeup and costumes in a photo-shoot type setting, with detailed backdrops and apparently professionally shot. The sequences of images each commence with a child who is fully clad in a costume and it shows her gradually disrobing with the images becoming increasingly explicit. He said that often there would be 100 or more images in any given sequence.
21 I understand that the LS Model series, as I said, stopped being produced in 2004; but, as I have previously said, this would not prevent images from the series being disseminated by those who already had them before they stopped being produced.
22 A sample from three such sequences was tendered on the application and is Exhibit B. The first page (which as I understand in the materials is page 6 of 219) shows a girl wearing an elaborate costume, appearing in slightly different poses from one frame to the next on this page, against a photo studio type background of a still life painting of fruit. The second page, page171 of 219, shows a different and younger child wearing a purple hat, a short top and brief shorts in slightly different poses from frame to frame, apparently against the same backdrop or at least a very similar one as the child depicted on page 1. (When I say page 1, I am referring to the exhibit pages).
23 On the third page of the exhibit (page 120 of 219) there is a child, perhaps the same child as the one posing on the second page. These images show the child posing at the beach in a fairly brief floral outfit, wearing flowers in her hair. Again, she is in slightly different poses from one image to the next.
24 Each of the girls is heavily made up and appear to be taking part in a professional type photo shoot, as Mr Hunt says. The images were taken from the accused's antique black tower PC on Hard Disk Drive 1. There are 50 or 60 images that follow those tendered, with the child in each case gradually disrobing and with the images becoming more explicit.
25 The images tendered and those that followed each of these in their respective sequences are identified by Mr Hunt, who says that he is familiar with the style and content of the LS series or LS models images, as he has encountered these many times in the course of analysing over hundreds of computers and hundreds of thousands of images. As I understand the position, ‘LS Models’ is akin to a brand name of some organisation which apparently produces a particular style of child pornography previously described.
26 Mr Mandy told me that LS Models produced hundreds of different sequences of images in the particular style to which I have just referred. Mr Hunt says in his statement (to which I have been referring) that he recognised many of the images located across the exhibits analysed, as ‘LS Series/Models’ images. Further, he says that the file naming conventions for ‘LS Series/Models’ images changes based on the series or collection they are related to. He then referred to the file naming convention which involved a reference to the collection, then series, then image number, then ending in the letters ‘jpg’. Therefore, he said an image from the LS Girls Collection would have a name similar to ‘LSG-28-036.jpg’. I understood this to be an example for the purposes of explaining what he meant.
27 Mr Hunt observed that the author of the virus in the present case had renamed a variety of child exploitation material, with a designation ‘SGL1-45’, apparently suggesting that the virus author had jumbled letters associated with the LS Models series in renaming his files. He said that he recognised some of the images in the ‘SGL’ sequence as being LS Models images, namely ‘SGL23’, (although, I believe he meant SGL43) ‘SGL44’ and ‘SGL45’. He recognised these as he had seen images from these same series in many other investigations.
28 These images (SGL43, SGL44, SGL45) were tendered and are Exhibit C. They depict a female's exposed genitalia with ‘SGL44’ showing the child's face as well. From my own observation, the child is heavily made up and has her hair done in a similar ringlet fashion to the children on the first two pages of Exhibit B. Upon careful viewing, it appears that the backdrop for the first image is at least very similar to the ones seen in the first two pages of Exhibit B.
29 ‘SGL44’ and ‘SGL45’ are of a young girl posing against a studio style pink backdrop, and in the third image, she has pink pearls or beads around her middle finger, not dissimilar to those worn by the young girl who has beads around her wrist on the second page of Exhibit B. Indeed, to my observation, the facial features of the child in Exhibit C are very similar to those of the child on pages 2 and 3 of Exhibit B.
30 Mr Hunt went on to say that he recognised a number of other images from the virus images, being ‘SGL24’, ‘SGL25’, ‘SGL26’, ‘SGL28’, ‘SGL29’, ‘SGL32’, ‘SGL41’ and ‘SGL42’, as being LS Models images, based on the content being similar in the way that it is elaborately staged, with the costuming and the sexually suggestive poses.
31 As I understand the Crown's position, they could point to 11 images in the virus, which came from the LS Models series. They could point to images found on the accused's computer which came from the LS Models series, and they could point to one image on the virus that came from precisely the same sequence, as one of those found on the accused's computer in 2010.
32 The Crown argues that in light of the accused's admissions to police in 2006 in relation to that offending, that he had used images from the LS Models series, images consistent in their description with the types of images identified by Mr Hunt as being from the LS Models series, which were found in the accused's computer, and in the virus in 2010, the evidentiary position was in fact, as I found it to be in my previous ruling. Mr Mandy submitted that whilst he could not say that the self-same images in 2006 were those used or found on Mr Palliser's computer in 2010, he could say that these images came from the same source, in that, in each instance, they were images which were from the LS Models series.
33 The Crown also relies on further statements from Mr Hunt and Mr Hastings in respect of the uniqueness of Mr Palliser's conduct in 2006 and of the conduct in question in the present case, insofar as the distribution of child pornography to unsuspecting members of the public is concerned. The portent of that evidence, although there are some hearsay aspects to some of it, is that Mr Palliser's conduct in 2006 is unique and that the dissemination or attempted distribution of child pornography in a virus, which occurred in 2010 is also unique, at least insofar as cases here are concerned.
34 Although Mr Mandy placed some reliance on the first four similarities listed in Annexure D, and he relied on these in combination with all similarities listed, he submitted that it was the final three features, which were significantly unique and distinctive. That is, the offender's conduct and purpose in each case. He submitted that in 2006 and 2010, the offender's purpose was to randomly distribute images of child pornography to as many members of the public as possible and that this was so remarkable and unusual that the Crown principally relied on this similarity in support of its applications.
35 Mr Mandy submitted that if he had to prefer one application over the other when pressed by me, he would be submitting that the coincidence application would be preferable in order to rebut Mr Palliser's explanation in his record of interview that his computer must have been hacked. I must say that I found this rather surprising in view of the fact that Mr Mandy's arguments before me on the last occasion were principally in respect of tendency, although again, I pressed him on this occasion. Certainly, the Court of Appeal's focus was on tendency in their decision, although no doubt this is because there was no need to deal with the Crown's cross-appeal in view of the Court's findings.
36 In any event, Mr Mandy submitted that in this case it was difficult to untangle coincidence from tendency reasoning and referred to some draft directions prepared by him, which he said was an attempt to put together the two forms of reasoning in such a way that would not be confusing to a jury.
37 On the question of evidence linking the accused with the Facebook account of the false identity Annette Vanderson, (to which I might refer from time to time as the false Facebook account)- that is, the identity who distributed the virus link, Mr Mandy submitted that the accused personally knew one of the Facebook friends, Mr Clarke, and the other Facebook friends were from the same school as this person. I understand that the Crown would adduce evidence from Mr Clarke that the accused would regularly service his computer and that he had recommended and installed virus protection on Mr Clarke's computer. I understand from the Crown opening that they allege that an IP address, which was owned by the accused, was associated with the false Facebook account. They allege that one of the IP addresses, which the Crown allege relates to the fictitious Facebook account is registered to the accused's housemate, Mr Hutchinson, who is now deceased. There is no suggestion from defence that Mr Hutchinson, who was in his late 70s, on my calculation or perhaps early 80s, at the time of the alleged offending, may have been responsible for it.
38 I bear in mind that there is no onus of proof on the accused, but the evidence linking Mr Hutchinson's computer with the false Facebook account, if accepted, would tend to militate against the accused’s suggestion in his record of interview that he had been hacked into and set up.
39 Mr McDonald submitted that the accused's level of computer expertise ought not be assumed to be as high as the Crown asserted. He submitted that the Crown had also made assumptions about the level of security that the accused had on his computers and the stage at which security measures had been put in place. He submitted that it remained to be seen as to whether the Crown could adduce evidence to live up to the assertions it made about such matters and therefore the foundation for the reception of tendency and coincidence evidence was uncertain.
40 Ultimately, the accused's ties to or lack of ties to Facebook, his level of expertise and level of computer security at all relevant times in 2010 will be matters for the jury as will the various pieces of evidence upon which the prosecution relies, to link computers within the accused's house with the conduct comprising Charges 1 to 5. However, as presently advised, there is certainly evidence linking computers and equipment in the accused's household with the false Facebook account and with the virus. Of course, the question of whether the distribution of child pornography originated from the accused's house will be an essential consideration for the jury based on all of the evidence before it. Whilst the Crown points to a number of links and will invite inferences in this regard, I am not prepared to assume one of the very things that the Crown will need to prove insofar as asserted similarities are concerned. However, it can be said that in 2006, the accused used his computer to disseminate child pornography, albeit in a fairly basic and mechanical manner and in 2010, there is evidence which links computers in his household with the dissemination of child pornography.
41 I accept that the level of expertise required to produce and distribute the images in 2006 was far cruder than that used in 2010 to post child pornography on Facebook pages and distribute a virus containing child pornography. However, it is relevant that as at 2010, the accused operated a computer service and repair business and that he had 40 years of experience in this area when interviewed by police. Also, evidence is expected to be given that he had access to an extensive array of computer equipment and part of his business involved the creation and sale of software. Evidence would be adduced to invite the inference that he was security conscious when it came to computers and possessed some sophisticated software including cryptography, which he had evidently used for his own devices to some extent. Now, defence say that the software was not sophisticated and it ought not be assumed that the accused did have the necessary skills required to have engaged in the 2010 offending. However, at the very least, there is evidence which the Crown would adduce, that the accused had a level of knowledge and skill which was superior to the average computer user and that he was concerned with computer security.
42 Whilst the skills required for the 2006 offending were far exceeded by those involved in the offending in 2010, the accused's level of computer expertise is a relevant consideration when determining the Crown's applications - not so much as a similarity, but as part of the evidence which would be led by the Crown. This is because ‘significant probative value’ does not have to be evaluated in a vacuum. It can be evaluated having regard to other evidence adduced, or to be adduced, by the parties seeking to rely on tendency or coincidence evidence.
43 Defence submitted that the only similarity between the 2006 and 2010 offending was that they both involved child pornography, but there was nothing beyond this. Similarly, all things considered, evidence of the 2006 offending did not meet the test of ‘significant probative value’ and ought not be admitted as tendency or coincidence evidence. In essence, they submitted that all that was sought to be led was broad propensity evidence or ‘rank propensity’ evidence, as it is sometimes called.
44 I refer to and adopt, without repeating them, the relevant principles of law which are contained in my previous ruling in this matter.
45 Having heard the further submissions from each of the parties and having considered the further statements and other evidence to be adduced by the Crown bearing in mind the Court of Appeal remarks and decision in this matter, I remain of the view that the conduct of the accused in 2006 and the purpose which could readily be inferred from it, and the conduct and inferable purpose of the offender in 2010, were remarkably similar, distinctive and unusual, notwithstanding that the mechanisms for distribution were different. In the circumstances, that difference is a rather superficial one in my view. Despite the different mechanisms of distribution, the events of 2006 and 2010 have a stronger link to each other than merely involving the subject matter of child pornography. The conduct is not identical, as the prosecution contends in its submissions, but in each case, the conduct manifested a purpose of distributing child pornography to numerous, unsuspecting, unsolicited members of the public, including children.
46 It is not to the point that the characterisation of the charges in 2006 did not involve an express intent to do so. Such an intent is clearly discernible from what was done by Mr Palliser. I reject defence's argument that the purpose to be inferred is simply a retrospective spin on what was done at the time.
47 Further, in each case, images from the LS Models series were used. This included one image found in the virus from the same sequence which was found on the accused's computer at that time. Whilst it appears from Mr Hunt's most recent statement that the LS Models series may not be uncommon (as he has seen images from this series on numerous occasions in other investigations), the presence of these images on the accused's computer in 2010, and in the virus, and in view of his admitted use of this series of images in 2006 from a website called ‘Teranews’, a new password for which he had in his ewallet in 2010. In view of these matters, I regard this as an important similarity. It is also relevant that he apparently still had access to child pornography in 2010, including from the LS Models series.
48 Further, on the basis of evidence expected to be given from experts in this case, there are links between computers in the accused's home and the Myki virus, and between the accused and one of the recipients of child pornography through Facebook. It may be that the intended audience in respect of the 2010 offending was a little more targeted initially than that in 2006, but I do not see that as a difference of much substance. There was a potential for the 2010 material to reach numerous members of the public, albeit through cyberspace, as opposed to people in shopping centres.
49 I do not regard the use of ‘PaintShop Pro’ as a material similarity, due to the fact that this is a legitimate program, apparently freely available, that the accused used in 2006. The fact that he had such a program in 2010 takes matters nowhere. I did not understand the Crown to be saying that they can point to the utilisation of this program in the creation of the virus or in the sending of images of child pornography to Facebook pages, which is the subject of Charges 1 to 5 before me.
50 Whilst it may be that there is a paucity of Facebook data to be found on the accused's computers or equipment, there are features of the accused's admitted offending in 2006 and the offending in 2010, which against a background of other evidence in this case reflect a distinctive underlying unity or pattern of such a nature that it amounts to ‘significant probative value’ for the purposes of the admissibility of tendency and coincidence evidence. To be clear, those features are those set out in Paragraphs (iii) to (vii) of Annexure D, attached to each of the amended notices.
51 As I said in my last ruling, the prejudicial nature of the 2006 evidence is obvious; but the probative value of it substantially outweighs such prejudice. As I have said in my previous ruling, directions will be given in respect of the ways in which the evidence can and must not be used -- directions which I would expect the jury to follow.
52 I am still of the view that the prosecution does not need both uses of the evidence, but having reflected on s.135(b) of the Evidence Act 2008 (hereafter “The Act”) and indeed s.136, I am of the view that I ought not invoke either of those provisions. Indeed, on reflection, s.135(b) of the Act deals with evidence rather than directions.
53 I am of the view that the Crown is entitled to use the evidence in each of the ways agitated for, although I would ask that they reconsider whether they really need to. As I previously said, the police summary of 2006 ought be modified in such a way that it accurately reflects the previous offending and in fairness, it ought be kept to the bare essentials of the offending in 2006 and the fact that the accused admitted to this. Unless defence would see the need to refer to an extract from the record of interview as a matter of balance, I would have thought it unnecessary for all of it, or even any of it, to be led, if an agreed approach to the 2006 evidence could be achieved. I would hope that the parties can reach agreement in this regard, but if they cannot, I shall rule on this aspect in due course.
54 In my view, tailoring of the evidence in relation to 2006 in the way that I require, will help limit the prejudice attached to such evidence.
0