Littlejohn v Hamilton
[2010] TASSC 4
•24 February 2010
[2010] TASSC 4
COURT: SUPREME COURT OF TASMANIA
CITATION: Littlejohn v Hamilton [2010] TASSC 4
PARTIES: LITTLEJOHN, Adrian James
v
HAMILTON, Garry
FILE NO/S: LCA 275/2009
DELIVERED ON: 24 February 2010
DELIVERED AT: Hobart
HEARING DATE: 30 October 2009
JUDGMENT OF: Porter J
CATCHWORDS:
Criminal Law – Particular offences – Child pornography and child exploitation material offences – Evidence and procedure – Possession of child abuse and bestiality products – Knowledge of presence of images on computer – Evidence of access to computer by others and large scale downloads by defendant – Deleted images where not retrievable by defendant – Whether magistrate could have been satisfied of possession.
R v Porter [2006] 1 WLR 2633; Clark v R (2008) 185 A Crim R 1, referred to.
Aust Dig Criminal Law [2631]
REPRESENTATION:
Counsel:
Applicant: G A Richardson
Respondent: M M G Miller
Solicitors:
Applicant: G A Richardson
Respondent: Tasmania Police Legal Services
Judgment Number: [2010] TASSC 4
Number of paragraphs: 47
Serial No 4/2010
File No LCA 275/2009
ADRIAN JAMES LITTLEJOHN v GARRY HAMILTON
REASONS FOR JUDGMENT PORTER J
24 February 2010
Introduction
After a hearing before a magistrate, the applicant was found guilty of one count of possessing a child abuse product, and one count of possessing a bestiality product contrary to the Classification (Publications Films and Computer Games) Enforcement Act 1995, ss74(a) and 74(b), respectively. The applicant has moved to review those findings. The offences were alleged to have been committed on 30 June 2005, the day on which computer hard drives were seized by police at the applicant's home.[1] The complaint was dated 4 October 2005 but for some reason the hearing did not commence until 28 June 2007, and occupied four days. Regrettably, these days were spread out over 15 months, with the magistrate's written reasons being handed down on 23 February 2009.
[1] The Act was amended with effect from 1 August 2005, by the repeal of s74(a) and the addition of s74A — possession of child exploitation material.
The particulars of the first count were that the applicant on the date alleged possessed "child abuse products, namely approximately 2,500 computer images and 100 computer videos classified as child abuse products". The second count was that on the same day he possessed "bestiality products, namely approximately 24 computer videos classified as bestiality products". I was told by counsel for the applicant that in relation to each count, the possession of at least one image which described the conduct set out in the definitions of "child abuse products" and "bestiality products", meant that the hard drive on which the image was located became a relevant "product".[2] However, I can find no reference to this proposition at the hearing; the relevant images were referred to as alleged "products" of the two different types.
The motion to review
[2] The definitions at the time were:
The notice to review contains one ground which asserts that there was no evidence upon which the magistrate could be satisfied beyond reasonable doubt that the applicant was in possession of either a child abuse product or a bestiality product on 30 June 2005. "Further and better particulars" were provided of that ground. Those particulars are in the following terms:
"1That the evidence did not exclude beyond reasonable doubt that illegal images had been transmitted to the Applicant's computer without the Applicant's knowledge.
2The evidence did not establish beyond reasonable doubt that illegal images had been [sic] deleted and were only capable of being accessed by specialist equipment not available to the Applicant and therefore not in the legal possession of the Applicant."
The issues raised are ones of fact and relate to the question of the applicant's knowledge of the presence of at least one offending image of each type on any of the hard drives seized by police, the point being whether others had placed the material on his computer or he had unwittingly downloaded it. There is a further point (notwithstanding the wording of par2 of the particulars), as to whether the evidence established that at least one offending child abuse image had not been "deleted" by the applicant from his computer. For reasons which become clear, the applicant does not put this argument in relation to the bestiality material. It was common ground at the hearing that once an image had been deleted it remained on the hard drive for a time at least, and was not capable of being "retrieved" without the use of a specialist law enforcement program which was not available to the applicant. It was accepted that this was the applicant's understanding. On this motion, the applicant needs to show that in respect of each count, upon the evidence the magistrate acting reasonably, could not have been satisfied beyond reasonable doubt of his guilt. (I do not think that any authority now needs to be cited for that proposition.)
An overview of the case
The evidence established that police officers conducted a search of the applicant's home at Smithton on 30 June 2005 pursuant to a search warrant. A computer tower, an external hard drive and a number of floppy disks were seized. The computer components were sent to forensic services. A report was later received from the computer forensic section which detailed what had been on the hard drives. It emerged that there was a total of four hard drives, each of which had been divided into three partitions. The officer in charge of the investigation authorised the arrest of the applicant and advised him to contact her when he wished to be interviewed, but no such contact was made.
Amongst the exhibits was a CD which contained a number of separate items found on the applicant's hard drives. These included folders containing twelve "child abuse" videos, eight "bestiality" videos, copies of an internet "favourites" folder and the internet "history" folder, one (plainly) child abuse image in PDF format entitled "Lolita", and three large PDF documents containing still images, along with folder and file information. These documents were part of a report furnished by forensic services. Printouts of the PDF documents were tendered as three separate exhibits. The total number of images in these exhibits is 682. The prosecution asserted that the "child abuse" videos and 594 of the still images amounted to child abuse products. It was submitted that the remainder of the still images were arguably so. Of the eight "bestiality" video segments, all were said to fall within the definition. It was admitted on the part of the applicant that the alleged bestiality products came within the definition, but it was left to the magistrate to determine whether at least one of the alleged child abuse products fell within the definition.
Although lengthy, and I will later have to examine some of the evidence in greater detail, it is convenient to repeat much of the magistrate's summary of the material, about which there is no dispute:
"Constable Kevin Clayton was the principal prosecution witness. …His duties in forensic services included the examination of electronic items that may store data such as computers. ... Constable Clayton took over from Constable Wright, the officer who had sent the original report to Constable Bain. He was asked to go over Constable Wright's work.
Constable Clayton gave evidence of a particular piece of software and how that software enables the search of a computer and the preparation of a report as to the results of that search. He said that the report would include the full path of any relevant file including the drive on which the file is stored, the folder and the name off actual file. The report also includes the date and time and access dates. He said that he had read Constable Wright's report and compared it with the hard drive. He verified that the images, multi media files and video files located by Constable Wright were actually sitting on the hard drive.
A disc was produced and tendered which contains a number of images and videos alleged to be child abuse products and of bestiality products that were found on the defendant's computer. Printouts of various images were also tendered into evidence. Constable Clayton gave evidence of the information printed above each image and explained each entry. He said that there were 4 hard disc drives. The information provided also indicates the particular hard drive where the image was located.
Constable Clayton gave evidence about the 'last access' date could indicate the date when the file had been swept by an anti virus programme. It could also indicate that it had been accessed on that date by someone using the computer. He said that the images which were tendered as P3, P4 and P5 were spread over a number of hard drives. They were not all located in the one folder. He said that there were a substantial number of folders. One search folder was named 'porn'. Another was named 'no porn in here'. Some of the folders had female names.
Constable Clayton also examined the internet history on the hard drive. That history shows dates and times and the particular web sites accessed by the user. One 'folder.doc' was also located stored on the hard drive. Similarly he produced a document entitled 'favourites' which was print outs of websites found stored on a hard disc drive. He explained how this was a list of internet shortcuts or web page shortcuts. This printout was tendered (P6) and it is self evident that it provided links to a large number of pornographic websites. Some of which would appear to relate to young females. A further document was tendered which comprised a further breakdown of the favourites list and is much more extensive.
Constable Clayton also gave evidence about computer networking. He explained how it was possible to permit access to your own computer by others in general or in a more limited way. He agreed that it was technically possible for others to place material on to your own computer by way of adding or deleting files. He gave evidence that his examination of the 4 hard drives revealed approximately 240,000 images. A large proportion of these images involved adult people but others depicted children. Young children engaged in sexual acts either alone or in company with other children or with adults. Constable Clayton said that these images were located with a number of different folders on various hard drives.
Constable Clayton was cross-examined about his knowledge of LANS or local area networks. He agreed that a person participating in a LAN can have access to another person's computer on a read only or read write basis. He agreed that read only means a person can look into another's computer and transfer material from another computer. It was put to him that read write access allows someone to not only look into another person's hard drive and copy from that hard drive but also transfer material onto another's hard drive. He agreed with that proposition but suggested that it was somewhat of a generalisation. He also agreed that if someone was running a D++ programme on their computer and was on a website on the internet then anyone else, anywhere in the world who were running the same programme and was similarly connected could transfer any file they wished from their computer onto the other computer and vice versa.
Mr Richardson also questioned Mr Clayton about the term 'leeching'. [sic] This process involves accessing another computer and taking everything on it indiscriminately. It was also put to Constable Clayton that the words 'file created' referred to the date that the file was created rather then the date that the file was put on to the computer and that movement of it from one computer to another is simply a transfer. Constable Clayton did not agree with that proposition.
Constable Clayton agreed that the 4 hard drives had been partitioned into 12 each containing a number of folders. It was put to him that if a particular folder was accessed then the access date would be the date the folder was accessed as distinct from the date a particular image was viewed. Constable Clayton said that there would be 2 dates created one for the folder and one for the image. He was referred to a number of images in P3 which showed the last access date and time as exactly the same. This was correct but many images in that exhibit have different last access dates. Constable Clayton did not agree with that proposition."
The magistrate omitted from this summary, reference to Const Clayton's evidence concerning whether the EnCase report distinguished between images which were on the hard drive in the ordinary sense, and those which remained on the hard drive after having been deleted. This is a little surprising given that this issue was at the heart of a submission of no case to answer made at the close of the prosecution case, and was the subject of closing submissions. In any event, although I will later examine this evidence in greater detail, Const Clayton said that it could not be determined upon the EnCase report whether a particular image "was one of the deleted ones resurrected by the program or it was actually still in its original form on the hard drive". He later said that "There are deleted folders with images in them, yes. Deleted images, yes." He said that he could not remember without going through them whether any of the relevant images were "in the deleted folders".
The applicant gave evidence before the magistrate. In relation to the operation of LANs, he said that "You can set your downloads through a program DC++ and that will automatically download them or you can sit at the hard drive where people can put stuff onto." He said that about a month before the police visit he had attended a LAN in Launceston over a period of two days. He said that he had "leeched" a substantial quantity of information (in the order of 400 gigabytes); that is, he accessed another or other computers and downloaded the material. His case was that he had not knowingly and intentionally placed child abuse material on his computer. He said that he had found such material and "on each and every occasion" he had deleted it immediately. He said that he had not ever knowingly and intentionally placed bestiality material on his computer and had not ever found such material on his computer. (That is why the deletion issue only arises in relation to child abuse material.) When it was sought to clarify his position in relation to the child exploitation material, he said that he no knowledge of it and was suggesting that others had placed it on his computer without his knowledge or permission.
I will return to the magistrate's summary:
"The defendant … said that he bought his first computer in 1995 and had been actively involved in them since that time. He makes, sells and repairs computers and had been doing that since 2002. He has also been actively involved as a computer gamer since 2000. He went on to explain the practice of computer gaming. A gamer is a person who gets on his computer, logs on to a network or the internet for the sole purpose of playing games against other competitors. He said that this could involve playing against one person or up to 20,000 people in a reserve playing against each other. He gave some examples of how this works. He said that people usually hook up their computers into a network or log on to the internet and play games against each other in that way. Hence are called local area networks or LANS. He said that the largest number of people he had personally been involved with in this game play was 800 to 1000 at a LAN in Melbourne. He produced a number of photographs of these sessions. He said that all the computers are connected to each other.
The defendant gave evidence of the two types of access namely read only and read write. He said that read only access allowed a person to view files, access files and transfer files from another computer to their own computer. This can be done without the knowledge of the person who's computer is being accessed. He said that read write access when enabled allows a person to view files on another computer, transfer them and also transfer files on to that other computer. Again this can be done without the knowledge of the person who's computer is being accessed.
The defendant gave evidence that from the year 2000 onwards he had read/write access enabled on his computer and that since that time he had attended LANS at Smithton, Burnie, Launceston, Hobart and Melbourne and had achieved a high level of proficiency as a gamer in that time to the extent where be had represented Tasmania at the Australian championships in 2001 and 2002.
The defendant said that off the 5 computers in his home the police seized the one that he used exclusively for LANS. He said that this computer contained a programme know as DC++ which is a peer to peer file sharing programme that enables people on the internet with the same programme to look at your computer and copy from it or on it. He agreed that there were 4 hard drives on his computer which had been partitioned into 12 separate drives. He explained how he went about deleting unwanted material from his computer. He was aware of the programme EN Care referred to by Constable Clayton and knew that it was a programme used to retrieve deleted files from hard drives. His understanding was that the programme was only available to law enforcement agencies.
The defendant gave evidence that he attended a LAN in Launceston about 1 month before his computer was seized. The LAN went for 2 days. He said that he leeched about 400 gigabytes of material onto his computer over that 2 day period. He explained how he had received a private message from one of the LAN administrators at that meeting. He said that the message was words to the effect of 'dude that kind of shit will get you kicked out of here' He said that he did not know what the administrator was talking about so he asked and got a message back to the effect that 'kiddie porn will get you kicked out of the LAN' He checked the image in questioned and found that it was a image of a clothed woman lying on a couch. He said the title of the image was '14 year old lesbian' but that the woman appeared well over 18. He responded to the administrator and told him that he had leeched the folder and would delete it which he then did.
The defendant was asked to give his understanding of certain terms. He said that 'last accessed' refers to the time and date that the active file was last assessed either by a user or by a programme. He said that access would be by an anti virus programme or by someone on the network accessing the file. He said that it did not necessarily mean that it was the last time a person looked at a file. As to the expression 'file created' he said that that meant the actual date that the file was created and he did not necessarily agree with Constable Clayton's evidence that it meant the date on which the file went on to the computer or save on a particular date on the computer. He described how he had tested this by transferring a game from his main computer to a new laptop and the file created date retained the same date and time stamp that was on the main computer. He then went on to give evidence that the date could reflect the date it was transferred on to a second computer. In effect, it could be either. He also gave evidence as to the effect that a computer's clock settings might have on this date.
…
Mr Littlejohn said that he had never knowingly or intentionally placed child abuse material on his computer. He said that he had at times found such material on his computer and had deleted it immediately. He said he had never knowingly or intentionally place bestiality material on his computer or found such material on his computer."
The magistrate went on to note aspects of the cross-examination of the applicant. Later in these reasons I will refer to relevant parts of the applicant's evidence. For present purposes, it can be noted that the magistrate said that he found the applicant's responses to a number of questions to be unsatisfactory, deliberately obtuse and evasive. The magistrate said that the applicant's responses to many questions were that he did not recall matters that he might have been expected to recall if he were being truthful. The applicant was not accepted as a witness of the truth and the magistrate expressed a preference for the evidence of Const Clayton wherever there was any conflict.
The magistrate's reasons
The magistrate said that he could not accept the submission that the relevant material could have been recovered from deleted files; "There was no cogent evidence to support such an assertion." His Honour said that the file creation dates did not lend support to the applicant's evidence that the child abuse material had been downloaded onto his computer at a LAN approximately one month before the seizure by police. The magistrate went on to say that he accepted the prosecution's submissions that the applicant's evidence was generally unconvincing, there being a number of his assertions which were highly improbable, and also a number of significant conflicts in his evidence. The magistrate said that he was puzzled by the applicant's evidence that he only used the seized computer at LAN sessions and used his laptop computer for internet access, and noted that under cross-examination he said that the computer was used as a server for the DC++ software and, on occasions as an internet computer. The magistrate also expressed his agreement with the following part of the prosecutor's written submissions (omitting transcript references):
"The defendant initially suggested that he gave unrestricted access to other persons to all parts of the computer except for the boot drive, where the computer's operating programs were installed. Later, during cross examination in relation to Exhibit P9 (copies of the DC++ and E Donkey[[3]] software from his computer), the defendant suggested that access was restricted to designated folders. When pressed further in cross examination, the defendant suggested that access was restricted to the designated folders but users of the software could download to other areas of his computer. Later still in his evidence, the defendant suggested users of the DC++ and E Donkey software could download to any location on his computer other than the boot drive. The defendant finally agreed that users of the software could only download to nominated folders. He suggested however, that the settings of the software may have allowed broader access on occasions prior to the computer being seized. It is submitted that the defendant's conflicting evidence concerning the DC++ and E Donkey software reflected the fact that he was taken by surprise by the tender of Exhibit P9, the contents of which conflicted with his earlier evidence."
[3] The applicant's evidence was that eDonkey was another peer to peer file sharing program.
The magistrate found that the images which were asserted to be child abuse products fell within the applicable definition, as did the bestiality material. His Honour's reasons conclude with the following statements:
"It is clear from all the evidence that the defendant used his computer to access various pornographic websites on the internet. The names of many of these sites are suggestive of them containing child abuse material. The defendant denied that he had downloaded the offending material from the internet. He may well have done and leeched some of it as well but whatever the situation I am satisfied that he knew it was there. On the evidence there were hundreds of thousands of images on the computer and I cannot find he knew all of those were there. However, the prosecution has established this beyond a reasonable doubt in relation to the relevant images produced at hearing.
I find both counts of the complaint proved."
The parties' submissions
As previously noted, it is the question of the applicant's knowledge of the presence of any offending image on the computer hard drives which is the central issue. It will be recalled that the applicant maintained before the magistrate that:
· he had not knowingly or intentionally downloaded any child abuse or bestiality material;
· he had "leeched" a large quantity of material whilst participating in a LAN about a month before the police seizure;
· he was alerted to the presence of a pornographic image possibly involving a young teenage girl, which he immediately deleted;
· at other times he had found what appeared to be child abuse material but he had deleted it all immediately.
There are two aspects of the applicant's argument that the evidence could not reasonably support findings of guilt. The first is that the evidence could not have satisfied the magistrate that the applicant knew that any offending material was on a hard drive. It was submitted that the applicant's evidence that others had placed images on his computer without his knowledge had not been rejected, nor had his evidence that he had deleted objectionable material when he became aware of it. As to the child abuse product count, it is further argued that the evidence did not enable any distinction to be made between images which had been deleted and those which had not. The EnCase program of course, was able to detect on a hard drive and reproduce, images which had been deleted, but the evidence did not differentiate between the two.
Accordingly, to the extent that the applicant might have known of the presence of offending child abuse material at some stage, it could not have been established, so it was argued, that he did not delete it. On that basis, he could not be said to have been in possession of it. As to this point, the applicant relied on R v Porter [2006] 1 WLR 2633. That case relates to an offence of possession of child abuse material or similar, the relevant provision having been interpreted as proscribing only intentional or knowing possession. There was no suggestion before the magistrate that s74 of the Act should be interpreted as an absolute offence with no mental element.
The facts in R v Porter as to deletion were basically the same as in this case. Images had been deleted by having first been placed into the recycle bin, with the recycle bin then being emptied. It was accepted that the defendant had no means to retrieve or review the deleted images. The Court of Appeal held that if a person could not retrieve or gain access to an image, he had put it beyond his reach and no longer had custody or control of it, and so could not be said to be in possession. It was a matter of fact whether the images were beyond the person's control. Porter's case was considered in Clark v R (2008) 185 A Crim R 1 and said to be "persuasive". Assuming an offence is one of intentional possession of particular material, the situation where that material consists of deleted images seems to be as follows:
· the prosecution would need to establish knowledge that a deleted image remained on the hard drive and was capable of being retrieved;
· possession in the sense of physical custody or control cannot exist where the person does not, at the relevant time, have the means to retrieve or gain access to a deleted image;
· accordingly, even where a person knows of the existence of a deleted image on the hard drive and that there are means by which that can be accessed, without having those means there is no actual possession;
· whether the means are available to the particular defendant is a question of fact.
The two cases which I have cited were put to the magistrate, and there was no argument in that court, nor before me, that the propositions derived from them did not apply in this case. I have already noted the agreed position at the hearing that the applicant did not, at the least, have the software to enable the retrieval of deleted images.
The respondent's argument is that whether or not the applicant had downloaded it or placed it on the hard drives himself, the entirety of the evidence, including that of the applicant himself, was sufficient to establish that he was knowingly in possession of relevant material. As to the deletion issue, it is argued that Const Clayton's evidence established that a number of child abuse images had not been deleted. Much was made of statements by Const Clayton to the effect that relevant material was "sitting on the hard drive".
The evidence
Of course, the whole of the evidence will need to be considered but there are three particular factual issues which are relevant to the applicant's arguments, and which I will examine first. They are:
· the meaning of the "file created" date as shown on the EnCase report;
· the meaning of "file modification" as shown on the EnCase report;
· the location of relevant images on the hard drive; that is whether it could be determined that they had not been deleted;
File created date
The conflict between Const Clayton's evidence and that of the applicant is detailed in the magistrate's summary of the evidence which I have set out above. Const Clayton's evidence was that the date "shows the actual date and time that that particular file was created at the location it's now stored in". He gave an example of writing a document and storing it onto a floppy disk. Its creation date would be the date on which it was written, but if then saved to a computer, the creation date would be the date of it being physically saved at the location on the computer. The applicant said that the file created date usually meant the date that the actual file was created. He said that Const Clayton's evidence that it was the date the file was saved onto the computer was "not necessarily the case". The effect of his evidence, using an example of a transfer of a file from his main computer to a laptop, was that the date could mean the date on which the file was saved on the main computer, or it could mean the date on which it is saved to a second computer.
The cross-examination of the applicant as to this point can be summarised as follows:
· the applicant confirmed that he did not agree with Const Clayton's evidence that "file created" reflected the date and time when the file was physically saved at the particular location, and said that "it could be" the situation that was the date that the file was actually created;
· when pressed as to this, the applicant referred to the example of having transferred a folder from his main computer to his laptop which retained the same file date that it was created on the main computer;
· he agreed that it would "normally be the case but not necessarily", that the file created date was the date that it was created in its present location, but said he was not able to recall how many occasions on which that had not been the case: "The one that I have an example of before was one and other I just — I can't recall";
· the applicant agreed that at least in the great majority of cases when images are downloaded from the internet or transferred from another computer, the date created would be the date downloaded or saved on the new computer "… but not all the time";
· when asked what would the date represent in the event that a file had a date other than the date it was actually saved in its present location, the applicant said that "It could be when the file was created or when the file was modified or changed." He said "created" meant when the actual file was created in the sense of being made on the other computer.
A tabulation of the file creation dates shown in the three PDF exhibits dealing with the child abuse material shows two dates in July 2004, one in October 2004, and 19 dates between 13 January 2005 and 27 May 2005. The file creation dates for the eight bestiality videos are 2 October 2004 (2), 4 April 2005 (5) and 29 January 2005 (1).
File modification
Const Clayton's evidence was as follows:
"Q Right, thank you. The last written indication?
AShows that the – when that particular file has been written to, so it's some sort of change has taken place.
QSome sort of change, and what sort of change might that be?
AMaybe a file name change, you've added an extra character or something similar to that.
QIf the image were modified in some way would that also - - -
AThat would also reflect in the change.
QWhat about the next bank of information entry modified?
AEvery entry modified, again that's when some form of change has taken place with the actual image, you may change it from say a colour image to a black and white image or something similar.
QSo, what's the distinction between last written and entry modified?
AWhen you modify the actual entry you've actually physically changed something, last written you can actually say that – you could open it up and then save it again as the same file name but that's when it was last written when you've actually opened it, even if its got the same file name."
In cross-examination, the applicant agreed that modification involved some form of change to the image, in the sense of actual physical change. A further table submitted by the prosecution showed that all of the images which were the subject of the first table (which detailed the alleged offending material, and arguably offending material), were modified on 28 May 2005. These modifications seem to have been mostly carried out over a short space of time in the morning and again later in the afternoon. They do not all bear the one exact time. I have previously noted that the applicant accepted Const Clayton's definition of modification, but did not provide any explanation as to how such modifications might have occurred without human intervention.
In response to the applicant's argument before the magistrate as to the deletion issue, the prosecution made a further written submission to the effect that if there was a reasonable doubt about possession on 30 June 2005, the applicant could properly be convicted on the basis of his possession on 28 May 2005, "the variance in dates being a variance in particulars falling within the scope of s31(1) of the Justices Act 1959"[4]. It was submitted that the variance could not have caused the applicant any prejudice in the conduct of his case as the prosecution was conducted on the basis that the images were in the applicant's possession at all times after the file created dates.
The deletion issue
[4] (1) An objection shall not be taken or allowed to a complaint in respect of —
The starting point is what may be made of Const Clayton's evidence about the location and state of material which was detected, to use a neutral term. His initial evidence as to where various images may have been located or the status of those images was alluded to by the magistrate in his reference to material "just sitting on the hard drive". The complete passage of evidence is as follows:
"Q Constable, before the break we were talking about the EN-Case and software and you explained to his Honour that enables you to capture an image of the entire hard drive, does the software also have some search capability?
AYes sir. The software itself is a – what we call a tool and it has a number functions within the software that allows you to perform searches, filter out items so you can concentrate on a particular avenue of examination, it allows you to view files in their raw format or their standard format.
QAnd is it particularly useful in locating images that might be on a hard drive?
AIt is particularly useful in looking and searching for images, there's a number of ways in which these items can be viewed and the software has a function where you can actually thumbnail an image that may be stored on a particular item that you're looking at so if it was a hard drive with an operating system for example you would be able to see every singe image, icon that resides on that hard drive.
QAnd does the software enable you to produce a report containing images of interest?
AIt can. The whole function of EN-Case would be to go through images, what we call a bookmark, what you're interested in, that bookmark then can be exported out as a report showing the image and details about the image.
QAnd is it also – can it also be utilised to identify the location of a particular image or images on a hard drive?
AYes. In a production of the report when you've established the items that you're interested in, the full path of where that particular file whatever it may be will be included in the report, so you will know what drive it's stored on, what folder it's stored on and the name of the actual file itself.
QRight. And does it also provide information as to the history of the item as to when the file might have been created for example?
AYeah, and again part of that report will include date and time stamps of (inaudible) date, access date.
QNow, this was originally former Constable Wright's file?
ACorrect.
QYes. When you examined the file and the – did it contain a report of the nature you've just discussed?
AEvery case that we do that a case file is produced that houses all the relevant reports and documents in relation to the case, there was a subject report that Constable Wright had produced that I read in part of that review.
QYes. And have you taken – have you compared that report with the hard drive at all?
AI have. The report indicated that there was a – that Constable Wright had located a number of images and multi media files or video type files. I actually verified that what Constable Wright had located was actually just sitting on the hard drive." [My emphasis]
Precisely what Const Clayton meant by "just sitting on the hard drive" was not explored. It may well be that he meant to convey that the images were on the hard drive, not having been deleted. This interpretation is the one contended for by the respondent. It has some attraction to it as matter of ordinary language use. However, deleted images remain on the hard drive; it is the access to them which is, at least initially, removed by the deletion process. After the above exchange, there were several further references to documents, folders, images and items (including the child abuse and bestiality folders, and the "Lolita" image), being found, located or stored "on the hard drive". Const Clayton said that he had verified that some folders existed, and that he had checked a number of images to satisfy himself "that they appeared" and that he had "confirmed their existence". In cross-examination, Const Clayton agreed that there were in fact millions of images "on the hard drives" along with hundreds of movies. It must be said though, that none of this really provides a completely clear insight into what Const Clayton meant, having regard to the context in which he was speaking.
Having said that, there are two particular parts of Const Clayton's evidence which I think have significance to the debate. In my view, putting these two parts alongside the other evidence I have noted, reasonably and without any undue strain, gives rise to the conclusion that unless otherwise specifically stated, material found or located and verified as being "on the hard drive" was readily accessible as distinct from deleted and having to be retrieved by use of the particular software program. The first part is that Const Clayton said that the favourites folder "was stored on a hard disk drive"; a little later he said that the "Is Deleted" part of the report indicated that the folder was "still current on the system, it has not been deleted". The second part of his evidence relates to his own use of the EnCase software to examine files on the four hard drives. The evidence is as follows:
Q… Did you detect a number of images stored on the hard drives?
AI did.
QAnd indeed a large number of images?
AA very large number of images.
QAre you able to recall the number of images in broad terms stored on the hard drives?
AAcross all 4 hard drives it was just over 240,000, that includes images stored as in [sic] and the ones that are for all intents and purpose deleted.
QRight. Now, what – some of those images you've checked against the parts 1, 2 and 3 of the image documents and confirmed their existence?
AThat's correct.
QRight. Did – in your examination did you access images of what appeared to be young children?
AYes.
QThat weren't within those 3 reports?
AYes I did.
QIndeed young children engaged in sexual acts?
ACorrect." [My emphasis]
I have already provided a short summary of Const Clayton's evidence as to the deletion issue itself, but I think it will pay to set it out in its entirety. I would first note that as to the child abuse material, the EnCase reports as to each image contain information under the following headings:
[File] Name
Filter
File Type
Last Accessed
File Created
Last Written
Entry Modified
Logical Size
Physical Size
Full Path
Further, in one of the exhibits (P3), "File Category" appears under "File Type". In the other two exhibits (P4 and P5) the notation "Is Deleted" [sic] appears instead of "File Category", but in neither exhibit is there any information next to the notation. As will emerge from Const Clayton's evidence, "Is Deleted" is a question which can be set up to be answered by the program. Const Clayton explained that as to the two exhibits, the facility was established in the program, but it had not been activated.
As to deletion, the following exchange occurred in examination-in-chief:
"Q And then there are words Is deleted, what does that indicate?
AAgain you can set certain parameters within EN-Case to show whether a particular file has or has not been deleted and there a number of other options that you can invoke.
QSo, you recover deleted documents with the programme, is that right?
AI hate the word recover but it is possible to see items that have been deleted.
QAnd how are they recovered, do they remain on the system or if they've been deleted how are they recovered?
AWe're getting into a bit of a technical are sir but if I may, when you actually delete for example a file on a computer you don't actually delete it, you're basically only deleting the in dates or catalogue reference to that file so the space that that file may take up now becomes available for other things, but the actual data, the original data is still sitting there.
QDoes it remain on the system forever or?
AIt will remain on the system until something over writes it.
QAnd when did that occur?
AWhen the operating system determines it wants to use that particular space." [My emphasis]
The matter was pursued in cross-examination, with Const Clayton being asked what the notation meant. The exchange is as follows:
"Q Okay. But does that mean that the images that we see in P4 and P5 had in fact been deleted?
AIt doesn't state so I can't answer the question.
QIt doesn't say?
AIt doesn't say that – there's nothing there that would tell me whether it is or is not deleted.
QWhat I'm wanting to know from you, does that mean that that image had in fact been deleted and was recovered - - -
ANo. .
It's a heading that can be added in, and if the image is or is not deleted it would say next to that heading, it will say yes or no (inaudible).
…
QWell, how do we know whether these were deleted images that were resurrected, I know you don't like those words but that's the only colloquial word I can think, or they were actually there, that's what I'm trying to get at?
AThe one you refer to with the caption is deleted - - -
QYeah.
A- - - was entered by the report generated from EN-Case set by Christopher Wright as to what headings he wanted in his report.
QThere's no – the programme hasn't told us whether the answer is yes or no?
ACorrect.
QOkay. Well, if the programme hasn't told us how does His Honour know whether an image he's looking at in P5 for example was deleted and you've told us that EN-Case can resurrect or retrieve an image believed to have been deleted, that's a starting point?
AThat is correct.
QOkay. If the question is asked by the programme, was this one deleted or not and you can say yes or no, the question is asked but no-one's given the answer, how does His Honour work out from that information that you know, picking – what's the first one, yeah it is, just the first one, the first one, it says is deleted, no answer, so it doesn't say yes it was, it doesn't say no it wasn't?
AThat's correct.
QHow does His Honour work out from looking at that was this a deleted one which the EN-Case programme managed to retrieve or it was actually on the hard drive in its original form, I know that's not a - - -
CORAM:They're all the same Mr Richardson, none of them have got anything next to the words is deleted.
MR RICHARDSON: Yes Your Honour, but can I just – if you look at P3 - - -
CORAM:I mean those words don't appear in P3.
MR RICHARDSON: That's right.
CORAM:Yes, I know that.
MR RICHARDSON: Now, I understood the witness to have said to us and I hope - - -
CORAM:They only appear in P4 and 5 because Mr Wright put them in there I suppose.
MR RICHARDSON: Because someone asked the question, that's right. And he said that the programme could tell us yes or no, it doesn't or it hasn't. So, what I'm trying to obtain from the witness is information as to how then does the person looking at that report know whether the image had been deleted or not because there is no answer from the programme?
MR CLAYTON: That's correct, you can't tell for whatever reason that I am not aware of, somebody hasn't set the parameter for it to show that.
QOkay. So, in relation to all of the images then in both because the question wasn't asked in P3, so obviously we don't get an answer, the question was asked in P4 and P5 but no answer is there, in relation to all of those I take it it follows that if I picked any one and held it up you would not able to say I look at that and I can tell you that that was one of the deleted ones resurrected by the programme or it was actually still in its original form on the hard drive?
AFrom the report, no.
QOkay. What would you have to do, go and look at the computer?
ACorrect."
The issue was taken up in re-examination:
"Q And my learned friend put to you that if he pulled up any particular image out of these reports you wouldn't be able to say whether it was a deleted one or not?
AFrom the report?
QYes.
ANo.
[OBJECTION TAKEN]
MR MILLER: Yes, I'll explain it before I answer [sic] the question Your Honour. My learned friend asked a general question in relation to any specific image, in his evidence in chief he gave evidence to the effect that he had compared at least a number of the images appearing in these exhibits with a copy of the hard drive and located them on the hard drive, it – in my submission that – his answer to my learned friends question created some doubt as to that, I was seeking to clarify as to whether any were located in a deleted folder as distinct from in situ.
……
MR MILLER: Now, you've heard that exchange Constable, you gave evidence this morning of having conducted a verification to whatever extent of a number of the images in the exhibit with the copy of the hard drive to satisfy yourself as to the accuracy?
MR CLAYTON: That's correct.
QDid you locate any of the images that you examined in the deleted folder?
AThere are deleted folders with images in them, yes. Deleted images, yes.
QAny of the images that you examined or sought to locate on the hard drive, were any of them in the deleted folders?
AI can't remember without going through them, yeah there's just too many, too many images to remember.
QOkay." [Emphasis added]
In relation to this point, it also should be noted that images said to constitute child abuse products were located in different partitions in different hard drives. Two folders containing relevant images were in one partition of one hard drive, two folders were in another partition of a second hard drive, another folder was in one partition of a further hard drive, with two further folders being in separate partitions of the same hard drive. One hard drive had particular significance, in that the partition in which the folder was located contained, on the applicant's own evidence, the computer's operating systems, and was protected so as not to be shared with anyone else.
Further relevant evidence
Additional aspects of the applicant's evidence, some of which were noted by the magistrate and which I have not otherwise mentioned, are as follows:
· as to the expression "last accessed", the applicant agreed that the date could indicate the date an antivirus program had scanned the computer, but agreed that all files scanned would then have the last date and he would not expect them to have varying dates. He agreed that such a situation would suggest that particular files had not been "swept";
· he said that you could identify who was offering to share material in a LAN because the program listed all the participants. He said that by clicking on their name you could see what files they had to share. The magistrate noted that this seemed to be somewhat inconsistent with the concept of indiscriminate sharing, which the applicant had previously described;
· the applicant was asked about the identity of the administrator of the LAN, who had drawn his attention to the offensive image on the computer, but he said he could not recall that person's name;
· the applicant agreed that there were thousands of images of adult pornography, saying that he had put them on his computer for other people to share in a LAN but could not recall whether those images were put into named files;
· he would not agree that his computer was very well organised (a point objectively borne out by the evidence of the folder/sub-folder system in place), but conceded that it was organised "in some fashion";
· in cross-examination he was referred to the favourites folder, with a number of listed sites being pointed out to him, it being put to him that he had saved these sites to his computer. There was evidence of folders containing content downloaded from these websites. The applicant said that he did not recall them being saved but did not know how else they could have got there. The magistrate found these answers to be unsatisfactory and evasive;
· the internet history evidence in fact shows access to, in the space of a few days before seizure, a considerable number of websites with names very suggestive of child abuse material. Some of these names correspond with names in the favourites folder. The magistrate noted the applicant's inability to explain why the history would have recorded such access.
Resolution of the motion
There was common ground at the hearing as to the applicable law. In order to find the applicant guilty of both counts, the magistrate had to be satisfied beyond reasonable doubt that the applicant knowingly possessed at least one image of the relevant type; that is, child abuse or bestiality. As to the first count, having regard to the evidence as to the deletion and retrieval of images, including of course the evidence as to the unavailability to the applicant of the retrieval program, the magistrate had to be satisfied beyond reasonable doubt that at least one of the child abuse images had not been deleted.
I think that it is convenient to deal with the deletion issue first. Counsel for the respondent accepted that the prosecution was not able to establish whether any particular image said to be a child abuse product, had or had not been deleted. However, the respondent submits that the evidence established that an unspecified number of the images had not been deleted. It will be recalled that the magistrate rejected the submission that all relevant images could have been recovered from deleted files, on the basis that there was no cogent evidence to that effect. It was however, as I have noted, for the prosecution to prove that at least one offending image of each type had not been deleted. It must be said that to that extent, the magistrate may have misconceived the proper approach to the issue.
It is correct to say that the evidence does not enable a determination to be made of whether any particular image had or had not been deleted, but the question is whether it was open on the evidence to conclude that at least one had not been deleted. I have already expressed a view that the magistrate was entitled to treat Const Clayton's evidence as establishing that when he referred to a folder or image as being "on the hard drive" it meant that the image was accessible in the ordinary way. In my view there is more. Const Clayton's response to the question of whether he had found any of the images that he examined or sought to locate on the hard drive, had been in deleted folders, was that he could not remember without going through them. He said there were too many images to remember. It might be reasonably expected that if no child abuse images had been in a readily accessible state and had been deleted, he would have remembered.
Further, it seems to me that the applicant's arguments focus exclusively on Const Clayton's evidence and do not take into account the totality of the evidence at the hearing upon which the magistrate was entitled to rely; that of course includes the defendant's evidence and what the magistrate made of it. Regard should be had to the evidence of the applicant. I do not lose sight of where the onus lay, but in cross-examination he was asked to clarify his position as to the presence of the child abuse material on his computer. His explicit answer was that others had placed it on his computer. Whilst he said that he had deleted all that he had found, it is plainly implicit from his stated position that he was not asserting that all of the large amount of alleged child abuse material had been detected and deleted by him. For those reasons, I reject the applicant's submissions as to this point.
Before proceeding further, I would observe that this is not an appeal by way of rehearing and that as a matter of practicality, where the decision of a magistrate substantially depends on the credibility of witnesses, a reviewing court will rarely overturn it: Wood v Smith 39/1991; Phillips v Arnold [2009] TASSC 43 per Crawford CJ at [46]. At the same time, I should note that a rejection of a defendant's evidence does not of itself lead to an acceptance of the prosecution case, and to proof beyond reasonable doubt: Henderson v Richardson (1996) 5 Tas R 375 at 384. Turning then to the "knowledge" argument, this was not a case in which evidence of custody provided sufficient evidence of possession. The applicant's knowledge of the items had to be inferred from the surrounding circumstances: Williams v R (1978) 140 CLR 591 per Aickin J at 610. It was something which had to be inferred from the totality of the evidence, including that of the applicant.
It must be accepted that the magistrate did not deal in any great detail with the issue of how the material came to be on the applicant's computer, or his evidence of deletion of child abuse material from time to time. It may be strictly correct to say that the magistrate did not expressly reject the applicant's evidence that others had placed the material on his computer through file sharing programs. The magistrate expressly noted that the file creation dates did not lend support to the applicant's evidence that the material had been downloaded effectively without his knowledge, at a LAN shortly before the police search. His Honour accepted that the applicant may have "leeched" some of the material, but said that he had also downloaded some of it himself. Whether other persons had placed material on the computer was not specifically addressed, but in the circumstances, there was no real need to do so.
The ultimate question was not so much as how the material came to be on the computer; it was whether the applicant knew of its presence. The applicant's evidence as to this was rejected. I have set out a number of the magistrate's observations concerning the applicant's evidence. Generally, it would seem that his Honour was influenced by his "generally unconvincing" evidence which included "a number of highly improbable" assertions. Clearly, the magistrate was also influenced by the contents of the applicant's favourites folder, and what is shown by his internet history. Both provided evidence of a strong interest in pornographic websites, a number of which appeared to relate to young females.
As to the applicant's evidence of periodic deletions, here again, there was no compelling need to deal with the issue. On one view, an acceptance of the proposition that the applicant had deleted child pornography from time to time, of itself does little to advance his case, but in any event, it should be treated as a part of his explanation. On that basis, having regard to the magistrate's comments as to the applicant's credibility, which objectively cannot be said to be unreasonable, and having regard to his concluding comments, it is clear that there was an implied rejection of the applicant's evidence concerning deletion.
The magistrate's findings as to the applicant's credibility are fundamental and important to this review process. They are not expressed to be based on demeanour and there is no challenge to them. Looking objectively at the evidence, the magistrate's comments and findings do not appear unreasonable. The parts of the evidence and the magistrate's reasons which I have set out reveal the factors which influenced the decision. In my view, having regard to the findings as to the applicant's credibility, and to all of the evidence, the magistrate could, acting reasonably, have come to the conclusions to which he did. Without purporting to advance an exhaustive list, I think that the particularly cogent matters are as follows:
· the applicant's conflicting and unsatisfactory evidence of the use of his computer and the nature and extent of the access provided to others by virtue of the DC++ and eDonkey software;
· the resolution of the "date file created" debate in favour of the prosecution and the consequences for the applicant in terms of when the material was placed on the computer;
· this rejection of the applicant's evidence as to leeching a significant quantity of material and a LAN shortly before the police seizure, raises significant doubts as to his assertion other persons from time to time placed the material on his computer, and supports the inference of guilty knowledge;
· the location and organisation of the various folders and sub-folders, the contents of the favourites folder, and the nature of the recent internet history.
Moreover, the fact that all the child abuse images were, for some reason, modified on the same day (28 May 2005) is of much significance. The applicant agreed as to what the entry meant. For there to have been no offending material on the computer on 30 June 2005, other than that which could only be retrieved by use of the special program, it would mean that many hundreds of images had been deleted over a period of one month. That was not the applicant's evidence, and it supports the inference that at least some of it was present on 30 June 2005, together with the further inference that the applicant knew of its presence.
Lastly, at least as to the first count on the complaint, the submission made to the magistrate and repeated in this Court as to an alternative basis for conviction has much merit, although I do not need to formally determine it. I think that the magistrate could have been well satisfied beyond reasonable doubt that all the relevant images were intentionally possessed by the applicant on 28 May 2005, the day on which they were modified. The magistrate did not see a need to deal with this submission either, but if there be any doubt as to the integrity of the findings of guilt as to possession on 30 June 2005, there can be no such difficulties with findings of intentional possession of relevant images on 28 May 2005. The variance between the date alleged in the complaint of 30 June 2005, and 28 May 2005, fell within the provisions of the Justices Act 1959, s31(1)(b), and the magistrate would have been entitled to convict on that basis.
For those reasons, the motion is dismissed.
"'bestiality product' means a publication, film or computer game that depicts in pictorial form bestiality;
'child abuse product' means a publication, film or computer game that describes or depicts a person (whether engaged in sexual activity or otherwise) who is, or who looks like, a child in a manner that is likely to cause offence to a reasonable adult."
(a) an alleged defect therein, in substance or in form; or
(b) a variance between it and the evidence in support thereof.
2
0