R v Sexton

[2018] SASCFC 28

SUPREME COURT OF SOUTH AUSTRALIA

(Court of Criminal Appeal)

R v SEXTON

[2018] SASCFC 28

Judgment of The Court of Criminal Appeal

(The Honourable Chief Justice Kourakis, The Honourable Justice Peek and The Honourable Justice Nicholson)

1 May 2018

CRIMINAL LAW - PARTICULAR OFFENCES - OFFENCES AGAINST DECENCY AND MORALITY - CHILD PORNOGRAPHY AND CHILD EXPLOITATION MATERIAL OFFENCES

APPEAL AND NEW TRIAL - APPEAL - GENERAL PRINCIPLES - RIGHT OF APPEAL - WHEN APPEAL LIES - ERROR OF LAW - PARTICULAR CASES INVOLVING ERROR OF LAW - FAILURE TO GIVE REASONS FOR DECISION

Appeal against conviction imposed in the District Court for four counts of Obtaining Access to Child Pornography, five counts of Aggravated Obtaining Access to Child Pornography and one count of Possessing Child Pornography. The circumstance of aggravation alleged was that the children depicted in the material were younger than 14 years of age.

On 31 August 2011, the appellant’s house was searched by detectives from the Sexual Crime Investigation Branch.  The appellant was not at home at the time.  Electronic devices were seized, including three computer towers, one laptop and four USBs. They contained the material the subject of the charges, or, on the prosecution case, demonstrated that the appellant, and not someone else, had viewed or otherwise manipulated that material.

It was accepted that the material found on the appellant’s devices subject to the charges was child pornography pursuant to s 62 of the Criminal Law Consolidation Act 1935 (SA). The substantive issue at trial was whether it was the appellant who accessed or took possession of the charged items of child pornography which were on his various devices. The Trial Judge found in favour of the prosecution and accepted the above contention.

The appellant appeals both the conviction and sentence that:

1.      The verdicts are ambiguous and/or uncertain.

2.      The Learned Trial Judge (LTJ) erred as a matter of law in failing to provide adequate reasons for her decision.

2A.    Alternatively as to ground 2, the LTJ erred as a matter of law in failing to –

2A.1.   consider and make findings separately in relation to each element in issue in respect of each count on the information;

2A.2.   identify how the expert evidence related to the issues that arose in respect of each count and have regard to that evidence in relation to the discharge of the burden of proof;

2A.3.   have adequate regard to the defence case and the potential explanations for the circumstances relied upon by the prosecution, in the accused’s record of interview and in his evidence in respect of the elements in issue in respect of each count; and

2A.4.   have adequate regard to the lay witness evidence in respect of proof of the elements in issue in respect of each count.

3.      The LTJ erred in her directions as to the burden and standard of proof and its application to the evidence.

4. The LTJ erred in admitting the evidence of discreditable conduct contrary to the provision of section 34P of the Evidence Act 1929 (SA).

4A. Alternatively as to ground 4, the LTJ erred in her directions as to the permissible and impermissible use of discreditable conduct and failed to comply with section 34R of the Evidence Act 1929 (SA).

5.      The LTJ erred as a matter of law in her approach to the charged counts in that her Honour had regard to and made findings based on all of the evidence led in relation to both the charged and uncharged acts as a single body of evidence.

Held, per Kourakis CJ (Peek and Nicholson JJ agreeing), dismissing the appeals against both conviction and sentence:

1.      The rejection of the various hypotheses advanced by the appellant was expressly explained by the Trial Judge and, even in the absence of the Trial Judge’s express explanation, was adequately explained by her Honour’s circumstantial reasoning (per Kourakis CJ (Peek and Nicholson JJ agreeing) at [211]).

2.      There is no obligation to give reasons on a matter which as not in issue in the trial (per Kourakis CJ (Peek and Nicholson JJ agreeing) at [215]).

3.      In regards to the onus of proof and alleged self-analysis by the Trial Judge of the reasonableness of the possibilities consistent with a finding of innocence, it is not necessarily an error of law to contrast a reasonable doubt with any doubt (per Kourakis CJ (Peek and Nicholson JJ agreeing) at [227]).

4.      The directions given by the Trial Judge correctly stated and applied the onus of proof and correctly considered whether the whole of the evidence proves guilt, notwithstanding the defence evidence and argument (per Kourakis CJ (Peek and Nicholson JJ agreeing) at [226]).

5.      The Trial Judge correctly identified the burden of the discreditable evidence conduct.  The infelicity of expression does not constitute error (per Kourakis CJ (Peek and Nicholson JJ agreeing) at [246]).

6.      The Trial Judge’s reasons show that the discreditable conduct evidence was not used impermissibly. There has not been a substantial miscarriage of justice by reason of the abbreviated warning (per Kourakis CJ (Peek and Nicholson JJ agreeing) at [249]-[250]). 

7. In sentencing against the higher maximum of ten and seven years, the Trial Judge erred in misapplying the term “subsequent offence” as taken from s 63A(1)(b) of the Criminal Law Consolidation Act 1935 (SA) (per Kourakis CJ (Peek and Nicholson JJ agreeing) at [252]).

8.      Accepting the error of law and exercising the sentencing discretion afresh, a lesser sentence is not imposed by this Court (per Kourakis CJ (Peek and Nicholson JJ agreeing) at [259]).

Criminal Law Consolidation Act 1935 (SA) s 63A(1)(a), s 63A(1)(b); Criminal Law (Sentencing) Act 1988 (SA) s 18A; Evidence Act 1929 (SA) s 34R, referred to.
Martin v Osborne (1936) 55 CLR 367; The Queen v Dookheea (2017) ALJR 960; R v MJJ; R v CJN (2013) 117 SASR 81; R v C, CA [2013] SASCFC 137, applied.
R v Sexton [2016] SADC 155; AK v Western Australia (2008) 232 CLR 438; R v Keyte (2000) 78 SASR 68; R v Schultz (2016) 126 SASR 476; Perara-Cathcart v The Queen (2017) 91 ALJR 411; Fleming v The Queen (1988) 197 CLR 250, discussed.
R v Hissey (1973) 6 SASR 280; R v Straffen [1952] 2 QB 911; Harriman v The Queen (1989) 167 CLR 590; R v Golubovic [2016] SASCFC 144; R v Ball [1911] AC 47; R v Armstrong (1990) 54 SASR 207; Hoch v The Queen (1988) 165 CLR 292, considered.

WORDS AND PHRASES CONSIDERED/DEFINED

"subsequent offence"

R v SEXTON
[2018] SASCFC 28

Court of Criminal Appeal:  Kourakis CJ, Peek and Nicholson JJ

1. KOURAKIS CJ:  After a trial by judge alone in the District Court, the appellant was convicted of four counts of Obtaining Access to Child Pornography[1], five counts of Aggravated Obtaining Access to Child Pornography[2] and one count of Possessing Child Pornography.[3]  The circumstance of aggravation alleged was that the children depicted in the material were younger than 14 years of age. 

   [1] Contrary to s 63A(1)(b) of the Criminal Law Consolidation Act 1935 (SA).

   [2] Contrary to s 63A(1)(b) of the Criminal Law Consolidation Act 1935 (SA).

   [3] Contrary to s 63A(1)(a) of the Criminal Law Consolidation Act 1935 (SA).

2. On 16 June 2017, the Judge imposed one sentence for all of the offending pursuant to s 18A of the Criminal Law (Sentencing) Act 1988 (SA). The Judge sentenced the appellant to three years and six months imprisonment and fixed a non-parole period of one year and nine months imprisonment. The sentences were backdated to commence on 18 May 2017. The Judge declined to suspend the sentence or to order that the appellant serve the sentence on home detention.

3. The appellant appeals against his conviction.  Shortly before the hearing of the conviction appeal, the appellant also applied for permission to appeal against the sentence.  The question of permission was referred to this Court to be determined contemporaneously with the conviction appeal.

4. At trial, the prosecution case at its most simple was that the appellant had used a peer to peer program called ‘LimeWire’ which connects computers through internet service providers to download and view the material the subject of the charged offending.  The prosecution adduced evidence from experts in the operations of computers and peer to peer programs which proved that the appellant’s devices were used to access and download a large body of child pornography including the material which was the subject of the charges. 

5. The appellant gave evidence on his trial.  He testified that he did not use his devices to access or download the material discovered on them.  He claimed that either:

   ·his devices were contaminated with the material from his work on other people’s devices in the course of his business as a computer technician;

   ·family and friends who used his devices inadvertently introduced it; or

   ·his devices were infected by software known as malware, viruses or remote access trojans which either loaded the material onto his devices or allowed unknown persons to remotely use his devices for that purpose.

6. In his final address the appellant’s counsel limited the defence explanation for the presence of the child pornography on the appellant’s devices to the last mentioned one.

7. The Trial Judge found beyond reasonable doubt that the frequency, duration, nature and pattern of use of the devices to access the pornographic material excluded any reasonable hypothesis other than that the appellant knowingly used his devices for that purpose.

8. The appellant appeals to this Court against his conviction on the following grounds:

   1.The verdicts are ambiguous and/or uncertain.

   2.The Learned Trial Judge (LTJ) erred as a matter of law in failing to provide adequate reasons for her decision.

   2A.Alternatively as to ground 2, the LTJ erred as a matter of law in failing to –

   2A.1. consider and make findings separately in relation to each element in issue in respect of each count on the information;

   2A.2. identify how the expert evidence related to the issues that arose in respect of each count and have regard to that evidence in relation to the discharge of the burden of proof;

   2A.3. have adequate regard to the defence case and the potential explanations for the circumstances relied upon by the prosecution, in the accused’s record of interview and in his evidence in respect of the elements in issue in respect of each count; and

   2A.4. have adequate regard to the lay witness evidence in respect of proof of the elements in issue in respect of each count.

   3.The LTJ erred in her directions as to the burden and standard of proof and its application to the evidence.

   4.The LTJ erred in admitting the evidence of discreditable conduct contrary to the provision of section 34P of the Evidence Act 1929 (SA).

   4A.Alternatively as to ground 4, the LTJ erred in her directions as to the permissible and impermissible use of discreditable conduct and failed to comply with section 34R of the Evidence Act 1929 (SA).

   5.The LTJ erred as a matter of law in her approach to the charged counts in that her Honour had regard to and made findings based on all of the evidence led in relation to both the charged and uncharged acts as a single body of evidence.

9. Ground 1 has been abandoned.  Permission to appeal was refused by a Judge of this Court on grounds 3 and 4 but the application has been renewed before this Court.

10. I would dismiss the appeal on ground 2 and 2A.  Even though there may have been an innocent explanation for some of its individual strands if they had stood alone, the combined force of the circumstantial evidence proved the offences beyond reasonable doubt.  The Trial Judge’s reasons adequately explain why her Honour was satisfied that the evidence disproved the proffered explanation that child pornography was downloaded or accessed by an unknown person using the appellant’s devices remotely through a remote logon.  A particular of that complaint made in oral submissions, namely that there was no evidence to support the finding that the offences were aggravated, must also be dismissed.  At trial the appellant conceded the issue that it was apparent on the face of the material that the children depicted were younger than 14 in order to avoid the material being placed before the Trial Judge.

11. I would refuse permission on ground 3. It is not arguable that the Trial Judge ignored the appellant’s testimony and his proffered explanations when considering whether or not the prosecution had proved the offences beyond reasonable doubt or that her Honour otherwise misapplied the onus of proof.

12. The evidence of the existence of other files which had contained child pornography was plainly admissible. I would refuse permission on ground 4. 

13. The Trial Judge’s directions on the permissible and impermissible uses were sufficient to comply with s 34R of the Evidence Act 1929 (SA) (the Evidence Act). No other error of law or miscarriage of justice has been established. I would dismiss ground 4A.

14. This was a case in which the circumstantial evidence was cross-admissible as between all counts. The counts could not sensibly be considered in isolation from each other or from the evidence of the creation and use of other files containing child pornography which were not the subject of a charge. I would dismiss ground 5.

15. The appellant appealed against his sentence on the grounds that it was manifestly excessive and that the Judge erred in declining to suspend it.  The Director of Public Prosecution conceded that the sentencing discretion miscarried for another reason, namely that the Trial Judge referred to the wrong maximum penalty.  Nonetheless I would dismiss the appeal against sentence because the sentence imposed is not more onerous than the sentence I would impose.

    Glossary of terms

16. I have included items from the glossary of terms, as utilized by her Honour Judge Davison, in order to properly convey the meaning of technical phrases throughout this judgment.

    ‘Botnet’

    A large number of computers which have all been compromised with the same malware which sits in the background and is not visible to the user of the computer. The person who is running the botnet will issue commands to all of the bots to do something e.g. spam emails that are sent from compromised computers.

    ‘Child Protection System (CPS)’

    A tool developed that identifies any internet protocol address that use file sharing programs to share with other computers, that identifies child pornography. The tool is able to narrow the search down to different jurisdictions, for example, South Australia.

    ‘Cyber worm’

    Malware designed to infect a computer and then propagate itself and then infect other computers connected to that computer. In effect, it worms its way through a network.

    ‘Firewall’

    Software which examines network traffic, usually the focus is on incoming traffic to a computer. If the traffic is not expected or set by the software to be blocked it won’t allow that traffic through to the computer.

    ‘Folder’

    A container where files can be placed into.

    ‘Google Picasa’

    A software that allows a user to search through a hard drive and index photographs and video files that are on there so a user can view them.

    ‘Hard drive’

    Hardware found in a desktop, tower or laptop that is required to make the computer work. There can be a number of hard drives located in a computer device. This is part of the computer on which data or information is physically stored.

    ‘JPEG’

    A commonly used method of lossy compression for digital images, particularly for those images produced by digital photography. (Google search)

    ‘Link file’

    A shortcut file created by the Windows operating system which when a file is accessed, Windows will create a reference to it which will show the original path for the file.

    ‘Malware’

    Software, commonly termed as viruses or trojans, which can come into a computer through a network or USB or another sort of device connected to a computer.

    ‘Operating system’

    What a user would use to be able to do things on a computer. It is found on a hard drive or USB which is plugged into a computer. Examples include Microsoft Windows or Apple Macintosh.

    ‘Peer to peer (P2P) file sharing’

    Through the network users can use software to make data and files available for other users. Users share files amongst themselves through a network. When a file is placed into P2P software it divides the file up into small pieces and collates a value for the whole file and then as the file is shared amongst other people the other peers also make that available. If a person downloads the file it may take one piece from one computer and another piece from another computer and assemble it onto the computer itself. Any sort of electronic file can be shared for example, pictures, videos or documents.

    ‘‘Play’ list file’

    Relates to a Windows media program that keeps a record of a video file that has been played. The ‘Play’ list keeps a listing of files that have been played on the computer.

    ‘Ransomware’

    A version of malware which is designed to encrypt a user’s data, it may be a folder or an entire drive or devices connected to a computer and demand a ransom to provide a password to unencrypt the data that has been corrupted.

    ‘RAT’

    Remote access Trojan.

    ‘Remote Access Software’

    Allows another person over a network to remotely access another device or other computer connected to a network.

    ‘Router’

    A networking device that forwards data packets between computer networks. Routers perform the traffic directing functions on the Internet. A data packet is typically forwarded from one router to another through the networks that constitute the internetwork until it reaches its destination node. (Google search)

    ‘Secure has algorithm (SHA value)’

    Used when P2P software is searching for and compiling the composite pieces which make up the file to keep track of the pieces it has and the pieces it requires to complete the file. The file would list information such as how many chunks are there for the file and how much the file is overall. A value is calculated from the data so it knows when the file is downloaded correctly.

    ‘Spyware’

    A piece of computer code which is designed to look at what you’re doing and reflect that information to whoever is running the malware. For example, tracking every website someone has viewed.

    ‘Thumb drive’

    A USB stick.

    ‘Trojan’

    Termed from the trojan horse story which in relation to computer software it is software that appears to be one thing but has something else within it which isn’t apparent to the user.

    ‘URN’

    Uniform Resource Name (URN) is the historical name for a Uniform Resource Identifier (URI) that uses the urn scheme. A URI is a string of characters used to identify a name of a web resource. (Google search)

    ‘ZZZ.ZZZ files”

    These files relate to potential use or erasing of cleaning software.

    Background

17. On 31 August 2011, the appellant’s house was searched by detectives from the Sexual Crime Investigation Branch.  The appellant was not at home at the time.  Electronic devices were seized, including three computer towers, one laptop and four USBs.  Of those devices, the following are particularly relevant:

    ·a computer tower (the Moebius), which was connected to the monitor in the appellant’s study and was powered on and operating at the time of the police search.  The Moebius contained two hard drives, ‘HD1’ and ‘HD2’;

    ·another computer tower (the AMR);

    ·a laptop;

    ·a Kingston USB. 

18. I will refer to those devices collectively as the appellant’s devices.  They contained the material the subject of the charges, or, on the prosecution case, demonstrated that the appellant, and not someone else, had viewed or otherwise manipulated that material. 

1. The charges laid against the appellant and the particulars of that offending were as follows:

   1Obtaining Access to Child Pornography – On 10 March 2010 at Reynella, the appellant, intending to obtain access to child pornography, obtained access to child pornography;

   2Aggravated Obtaining Access to Child Pornography – On 13 February 2011 at Reynella or Seacliff Park, the appellant, intending to obtain access to child pornography, obtained access to child pornography, knowing that the victim of the offence was under 14 years of age;

   3Aggravated Obtaining Access to Child Pornography – On 13 February 2011 at Reynella or Seacliff Park, the appellant, intending to obtain access to child pornography, obtained access to child pornography, knowing that the victim of the offence was under 14 years of age;

   4Obtaining Access to Child Pornography – On 13 February 2011 at Reynella or Seacliff Park, the appellant, intending to obtain access to child pornography, obtained access to child pornography;

   5Obtaining Access to Child Pornography – On 21 February 2011 at Reynella or Seacliff Park, the appellant, intending to obtain access to child pornography, obtained access to child pornography;

   6Aggravated Obtaining Access to Child Pornography – On 21 February 2011 at Reynella or Seacliff Park, the appellant, intending to obtain access to child pornography, obtained access to child pornography, knowing that the victim of the offence was under 14 years of age;

   7Obtaining Access to Child Pornography – On 21 February 2011 at Reynella or Seacliff Park, the appellant, intending to obtain access to child pornography, obtained access to child pornography;

   8Aggravated Obtaining Access to Child Pornography – On 21 February 2011 at Reynella or Seacliff Park, the appellant, intending to obtain access to child pornography, obtained access to child pornography, knowing that the victim of the offence was under 14 years of age;

   9Aggravated Obtaining Access to Child Pornography – On 28 February 2011 at Reynella or Seacliff Park, the appellant, intending to obtain access to child pornography, obtained access to child pornography, knowing that the victim of the offence was under 14 years of age;

   10Possessing Child Pornography – On 31 August 2011, at Seacliff Park, the appellant possessed child pornography knowing of its pornographic nature. 

2. It was accepted that the material found on the appellant’s devices subject to the charges was child pornography pursuant to s 62 of the Criminal Law Consolidation Act 1935 (SA) (the CLCA).[4]  It follows that the substantive issue at trial was whether it was the appellant who accessed or took possession of the charged items of child pornography which were on his various devices. 

   [4]    R v Sexton [2016] SADC 155 at [5].

   The prosecution case at trial

3. It was the prosecution case that the appellant had used software called ‘LimeWire’, a program which initiates peer to peer (P2P) file sharing, to download child pornography.  Exhibit P1 listed the particular files on the appellant’s devices which were identified by the prosecution witnesses as containing child pornography.  Count 1 charged accessing a file fully downloaded and contained on HD2 in a folder called ‘Fonts/ LimeWire 2’.  Counts 2 through to 9 charged accessing child exploitation material contained on HD2 in a folder which was generated by LimeWire and labelled ‘Incomplete’.  While it was accepted that the appellant had not completely downloaded these files, it was alleged that he had used a function in LimeWire to preview them.  Count 10 was the sole possession charge and related to a file located in a folder on HD 1 of the Moebius called ‘nasa/space/satrn’.  The file had been named ‘keep1.avi’.

4. The prosecution also led evidence of the creation of other files on the Moebius with names which were suggestive of child pornography.  These files were contained in a range of locations on the Moebius computer.  Evidence of files with names suggestive of child exploitation material was also found on the Kingston USB.  Forensic analysis of the appellant’s devices revealed only the file names of and not their content because certain programs had been used to overwrite the files.  The laptop appeared to have a suggestive file name in an historical playlist on windows media player.  The AMR computer also contained a file which was found on the Moebius.

   The defence case at trial

5. It was the appellant’s contention that he did not download nor view the child pornography that was found on his devices.  The defence posited the hypothesis that the appellant had unintentionally downloaded malware computer programs.  It was also put that the malware may have been introduced accidentally into his computer in the course of his computer business and dealing with his client’s computers.  Malware is software, designed by persons for the purpose of disrupting the computer operations of others.  It was the appellant’s case at trial that the malware downloaded the child pornography onto his devices without his knowledge.  Ultimately the explanation on which the defence relied was that the downloaded malware allowed another person to remotely access the appellant’s devices to download and view the child pornography remotely from the safety of his device, or possibly for the purpose of framing the appellant.

   Detection and seizure of the appellant’s devices

6. The prosecution called Detective Sergeant Matthew David Lyons from the Special Crimes Investigations Branch (SCIB).  He described the online investigation tool used by police known as the Child Protection System (CPS).  The material can only be shared if the computer holding the material is connected to the internet when a request for that material is made by another internet protocol (IP) address.  The CPS identifies the IP addresses of computers which are using file sharing software to share child exploitation material.  Devices which are not connected to the internet cannot be detected by the CPS.  The CPS alerts police when child pornography is being shared from a particular IP address.

7. An Internet Service Provider (ISP) can identify the person to whom a particular IP address is allocated at a particular time allowing the SCIB to determine who held an IP address at the time that the CPS detected its use to exchange exploitation material.

8. On 31 August 2011, having determined that the appellant was the holder of an IP address detected by the CPS as being involved in the exchange of child pornography, the SCIB conducted a search of his home for the relevant devices.

9. After the appellant’s devices were seized, he was interviewed by Detective Sergeant Lyons and Detective Brevet Sergeant David Fitzgerald (Detective Fitzgerald) on 2 September 2011.  The video recording of that interview was received into evidence.  The appellant denied that he had accessed and shared child pornography.  He said that his computer was accessible to visitors to his house and identified some of them.  The appellant also told police that he had repaired his friends’ computers and in so doing had connected them to his wireless network. 

10. Detective Fitzgerald was the exhibits officer on the day of the search of the appellant’s premises and he seized, tagged and labelled the ACER computer tower and the Moebius.  Four thumb drives, the AMR computer tower and a laptop were also seized.

    Forensic analysis of the appellant’s devices

11. Detective Fitzgerald gave evidence about the CPS.  He had viewed child pornography from time to time in the course of his employment for the purpose of categorizing the child exploitative material.  He explained that there were a number of terms commonly associated with online child pornography including:

    ·PTHC – an acronym for ‘pre-teen hard core’.  Otherwise ‘preteen’ would just be searched with other descriptors;

    ·‘Little Lolita’ followed by a number depicting the age of the child and the term ‘yo’, meaning ‘years old’;

    ·‘R@y Gold’ with the addition of a file extension or other search term, which referred to a ‘big purveyor’ of child pornography in America known as Mr Gold;

    ·Girls’ names. 

12. Detective Fitzgerald examined the material contained on the appellant’s two tower computers in late 2012 and found a number of items containing child pornography on the Moebius computer.  Those items were provided to Mr Darren Paul Quick, a digital forensic investigator and former electronic evidence specialist with the Electronic Crime Section, who produced an evidentiary disc.  The remaining electronic devices were analysed between December 2012 and June 2013. 

13. On his second examination Detective Fitzgerald located again the material identified in the first examination and produced Exhibit P1.  A third analysis was undertaken in May and June 2013, in an attempt to locate deleted material. 

14. Mr Quick also gave evidence.  Between 2007 and 2016 Mr Quick was employed as an electronic evidence specialist with the Electronic Crime Section at SAPOL.  He undertook forensic analysis of the devices seized from the appellant’s house. 

15. The following explanation of the operation and forensic examination of computers is taken from the evidence of Mr Quick.

16. Mr Quick testified that the operating system for the Moebius was contained on HD 2, and that the operating system set up the user’s accounts on the computer.  Mr Quick explained that there were two user accounts on the Moebius, the first was the standard account with Windows, called the Administrator account, and the second was called ‘Mine’ which was a local user account with administrative access.  Mr Quick was not able to say whether either of the accounts was protected by a password. 

17. Mr Quick explained that on a simple examination of electronic devices, an investigator can use and see the files accessible by the operator of the computer but can discover additional information about those files by using special software.

18. A forensic investigator undertakes a physical examination of the device, photographing and documenting its physical features, before removing the hard drives and connecting them to the investigator’s hardware in order to make a forensic copy.  The electronic files are classified according to their file type which in turn allows the investigator to apply various filters.  The software used for that purpose indexes what is on the drive and makes a reference to the file type and location of the original file which has been copied without changing it. 

19. A minor proportion of the data called up by the referencing software was not visible to the original user.  For example, the original user cannot access the thumb cache database.  The thumb cache database keeps information about the original dates and locations of files for the purpose of internal referencing by the Windows operating system.  Mr Quick explained thumb cache files as follows:

    AWithin a computer that’s running a Windows operating system there’s various versions of that but they have a thumb cache storage so as a user looks at pictures within Windows File Explorer it keeps a small version of that picture in a thumb cache database.  I had an investigation that involved thumb cache files so with other people at Uni we researched what other information there was within Windows operating systems in relation to those thumb cache images to be able to show more information about those picture files if the original file had been deleted.

20. A forensic examination of a hard drive will reveal the operating system and other software which has been used on the computer.  Mr Quick explained that files are stored on the hard drive by file name and file extension.  The file extension gives an indication of the type of file. For example, the file extension ‘.JPG’ indicates an image.  However, the file extension may not always give an indication as to the file type.  For example, the extension TMP signifies that the file is a temporary one, but the file could be a picture file or video file. 

21. Forensic software also compiles a ‘master file table’ which shows all the file names and extensions on the computer.  A master file table is not accessible to a lay user of a computer. 

22. When a user of a computer deletes a file, for instance by pressing the delete key on a keyboard or by selecting the file and then clicking the ‘delete’ option, only the reference to the file is removed to the recycling bin (which can then be emptied).  Even though the reference to the file has been marked and flagged as deleted, the file remains on the drive.  Software is available which erases or removes the file itself by, for example, overwriting the actual file location.  In this case the file is ‘erased’ rather than ‘deleted’.  Forensic software can reveal whether and when software of that kind has been used.

23. Peer networks allow data and files to be shared between internet users using peer to peer (P2P) software without necessarily going to a single location.  A peer network has many users sharing many files amongst themselves through a network.  Mr Quick explained further:

    A…when a file is placed into peer-to-peer software it divides that file up into small pieces and it collates a value for the whole file and then as the file is shared amongst other people the other peers also make that available.  So, when it becomes dispersed across thousands of other computers, when a person -  if a person chooses to download the file it may take one piece from one computer and another piece from another computer and then assemble it onto the computer itself.  So it can be spread across a myriad of other devices.

24. To be available for P2P file sharing, a computer must be turned on, and have P2P software installed.  The software can be downloaded by conducting a Google search for, and then visiting, the software’s specific website. 

25. The brand names of different versions of P2P software include ‘LimeWire’, ‘FrostWire’ or the ‘Gnutella network’.  P2P software prompts users to choose the folder locations on their computers they wish to share.  Files in that folder can then be accessed on the P2P network.  P2P software allows for the interruption of connections.  If a connection drops out, the software continues to run and resumes downloading when the connection is re‑established.  Any kind of electronic file can be shared, including photos, videos or documents. 

26. P2P programs continue to run when minimised.  They do not need a large centralised server because every user’s computer acts as a mini-server.  The user’s computer usually transfers data in the background whilst other programs are operated. 

27. P2P software identifies the individual pieces of the file and puts them together, through a transmission network by using a ‘SHA1 Value’.  SHA is the acronym for Secure Hash Algorithm.  SHA produces a unique value for files uploaded onto the P2P network.  In that way, the P2P software can compare the downloaded data with the SHA1 value to monitor the file download until it is complete. 

28. LimeWire was eventually replaced by P2P software branded as FrostWire.  FrostWire and LimeWire have similar functionality. 

29. A user who clicks into a P2P program is presented with a search tab.  Screen shots of FrostWire search tabs were received into evidence as Exhibit P11.  FrostWire largely mirrors the user interface of LimeWire.  FrostWire has a search bar with an autocomplete function in the top left of the screen.  Once terms are entered into that bar, the top half of the screen displays a list of the matching results.  The lower half of the screen shows any file transfers or downloads which are taking place.  The top half of the screen which shows the search results also shows the number of ‘seeds’ for the file selected.  Seeds are the peers who are making the selected file available.  The more seeds there are, the faster the file is downloaded.  The time taken to download a file also depends on the file size, the chunks of data made available, and other variables.  If there are no seeds listed then the user may click on an icon which allows the download to proceed as seeds become available.  The results portion of the window also displays an icon representing the file FrostWire expects will be downloaded (for example a video or an image would have different icon).  The file bears the name given to it by the first person who has uploaded the file into the P2P program.  It also shows when the file first became available to share on that P2P network.  The bottom half of the screen shows information relating to the files that the user is downloading including, again, the name of the file and the progress of any files that are being downloaded. 

30. Incomplete downloads may still be viewed.  FrostWire allocates a location and quantum of memory for the file, and builds the file in that location from the chunks of the file downloaded from different seeds.  If enough of the file has been built, the user can view parts of the download by double clicking on the file which then plays until the viewing software reaches an empty spot.  LimeWire, on the other hand, creates a folder in the user’s folder structure named ‘incomplete’. Once the files are completed they are moved by the software from that folder into another folder such as ‘My folders’ depending on the version of Windows on the computer and on whether the user has changed LimeWire’s default settings by opening LimeWire’s settings.

31. Further, Mr Quick testified that he first produced forensic copies of the hard drives HD1 and HD2 in the Moebius computer and made them available to Detective Fitzgerald for him to identify files of interest. 

32. Mr Quick testified that the XP version of the Windows operating system was installed on HD 2 and that HD 1 was used for storage.  HD 1 was contained in an external caddy which meant that it could be removed from the computer without undoing any screws.  The operating system was set to Central Australian Standard Time.  Mr Quick explained that there was an offset of potentially 20 minutes between the computer’s time and the actual time because the computer’s clock was not as accurate as the internet time. 

33. Mr Quick testified that he produced reports for all of the files selected by Detective Fitzgerald and copied them to a disk.  Those files were recorded on a spreadsheet which was received as Exhibit P1.  The information in Mr Quick’s reports included:  the file name, file path, whether the file was deleted or not, the created modified and accessed dates, the file size and the file type. 

34. Exhibit P1 was a tabular A3 sized report generated by specialised software which displayed information relating to the files on HD 1 and HD 2.  Each row of the spreadsheet within Exhibit P1 related to a file which was the subject of a charge.  The columns of Exhibit P1 showed the following information relating to each file:

    ·The ‘Full Path’ of each file.  The first part of the full path being the NUIX reference.  The second part of the full path showed the file path on the forensic image from which the folder structure and location of the file can be determined.

    ·Whether the charged material had been duplicated and where the duplicate file was located within the computers folders.

    ·The file type. Each file was either an ‘AVI Multimedia File’, ‘MPEG Video File’, or ‘JPEG/JFIF Image’.

    ·The date and time the file was created.  When a file is created on a hard drive, for example by saving a document it records a ‘created time and date’.  If a file is ‘imported’ i.e.  downloaded from the internet or copied from one device to another, the file created date records when the file is placed on the latter device.  The file created time and date is retained even if it is moved around within the same hard drive.  Whether or not that created time and date is retained or given a new time and date when a file is moved to another medium depends on the operating system.  When a file is duplicated, the ‘File Created’ date on Exhibit P1 records the created time of the first file and not the duplicate.

    ·The ‘File Modified’ date and time.  A word document may be modified by opening and typing in the document and then saving the document.  The ‘File Modified’ date is the date of that modification.  If the document is only read then the modified date would not change.  Pictures or videos would be modified if they were edited or changed, or if some of the metadata within those files is changed.

    ·The ‘File Accessed’ date and time.

1. Mr Quick explained the information on P1, by using, as an example, the first row entry in that exhibit.  The ‘Full Path’ for that file is recorded as of ‘/2012-187 10/12-A71787-10 PC HD1/12-A71787-10 PC HD1.E01///7-5-10/D/D/nasa/satrn/keep1.avi’.  That ‘Full Path’ information shows that the file was contained on HD 1 of the Moebius.  The file was duplicated onto HD 2 of the Moebius.  The Full Path for the duplicate is recorded as ‘/2012-187 10/12-A71787-10 PC HD2/12-A71787-10 PC HD2.E01//nasa/space/satrn/keep1.avi’.  From that path it can be discerned that the file was stored on HD 2 and in a folder called NASA, and a series of subfolders called ‘Space’, then a folder called ‘Satrn’.  The use of astronomical names for the folders in HD 2 is significant because of the appellant’s admitted interest in the subject.  The file itself is named ‘keep1.avi’.  The extension .avi indicates that the file is a video.  This particular file was therefore kept on both hard drives of the Moebius.  The difference between the two folders was that on HD 1 the file structure commenced with a folder ‘7-5-10’ and on HD 2 the file structure commenced with the folder name ‘NASA’.

2. Mr Quick explained that because the Moebius was running on the Windows operating system, the file created time recorded in P1 could depend on whether the file was created or moved:

   AYes, depends if a file is copied to a location or if it’s moved to a location and the way - say if it’s copied it will produce, it will store some of the information, if it’s moved it will do it slightly differently.  So it can be hard to say if it was specifically created at that specific point in time or if when it was copied or moved, depending how it was done, but a computer doesn’t necessarily keep a record of whether something was copied or moved.  A copy means it has two copies, whereas if it’s moved it will make a copy and then delete the original one.  But it doesn’t keep a record if something’s been copied there or if it’s been moved there or if it’s been imported there from the internet necessarily, by the file system or the operating system.

3. The ‘File Modified’ column records the time that a file on the computer is changed.  The action noted as a modification depends on the type of file.  For example, typing in and saving a Word Document changes the file modified time.  Mr Quick agreed that doing no more than clicking on a file or running a virus scan may be recorded as the file being modified.  Mr Quick also agreed that the ‘file modified’ date could record either when a file was moved within a system or imported from a different system.

4. The ‘File Accessed’ column records the time that the file is opened, but not necessarily changed.  Running a virus scan over computer files may also be recorded as accessing them. 

5. The ‘File Size’ column of P1 records the total size of the file, and in respect of partially downloaded files, indicates the size of the file when completely downloaded.  Of the 10 files listed in Exhibit P1, eight of them, being the second to the ninth files listed, were held in an ‘incomplete’ folder. 

6. Mr Quick was cross-examined on the times recorded in Exhibit P1.  He explained that the time zone, and whether there was an offset for daylight saving time was controlled within the operating system.  He said that the ‘File Created’ time is effectively the date and time that the data arrives onto the drive.  He agreed that the ‘File Modified’ time was when the data had been opened, moved or otherwise accessed.  He said that he would not draw any conclusions from the fact that the created and accessed times were the same for the first entry on P1 because:

   AThe settings are like the date time information, isn’t necessarily updated immediately or later in relation to some of the fields.  So, the file access time and date setting is deemed to be less important within an operating system.  So it may not be updated if the file activity has occurred.  Whereas the file created time and date is usually updated or recorded when the entry is first made.  So, I usually refer to the file created date in conjunction with the other dates just to get a feel for what activity has taken place.  One date being different from another doesn’t necessarily mean a particular activity has occurred.

7. Mr Quick gave evidence that the ‘File Accessed’ times on 13 February 2011 recorded in the second, seventh and eighth rows of P1 ‘may or may not’ mean that each file was accessed at that time.  Using the example of the second row of P1, Mr Quick explained that he looked at the ‘File Created’ date and ‘File Modified’ date ‘in conjunction’ with each other:

   AUsing that example it tells me the potential file created date was 13 February, which may have been at another location and then it’s potentially when it was copied to that location on 21 February, when the file modified date has been changed.  As I previously said, the different dates and times will be updated depending on how a file is moved to a location.  So depends, the file system and operating system where it came from and the file system and operating system where it goes to as to which date and time is updated and which date and time is brought from the original source.  So, without knowing where it has come from it would be difficult to say if the file created date has been created at the time the file was moved to that location or it has brought the original file created date with it.  It is correct, depending on the source, as to whether it brings the original file created date with it or it creates a new file created date when it is copied to that location or moved to that location.

8. The ‘File Accessed’ and ‘File Modified’ dates may be the same for any number of reasons, including that the file:

   ·may have been accessed, but the file accessed date was not updated;

   ·times may have been brought in with the file, when it was transferred onto the computer; and

   ·might have been accessed at the same time as it was created. 

9. Mr Quick gave evidence that on the second review, Detective Fitzgerald also requested information on files of interest found on the Kingston USB. 

10. Mr Quick conducted a third review of the devices in May or June 2014.  The purpose of the third examination was ‘to examine what other information may have been on the computers in relation to the files that Detective Fitzgerald had selected.’ Mr Quick used a different software called EnCase on this review, whereas during the previous reviews Detective Fitzgerald had been using a software called NUIX.  It was Mr Quick’s testimony that EnCase has greater capabilities than NUIX as it allows the user to see raw data for each file as well as the ability to both recover deleted files and look further into the files.

11. Mr Quick compiled a ‘timeline’, which he prepared by isolating a list of relevant files which had been created on all of the devices that he had examined.  That timeline was admitted as Exhibit P13.  To construct Exhibit P13, Mr Quick produced a spreadsheet referring to all of the files of interest on those devices. 

12. Those files were selected by reference to files which Detective Fitzgerald had selected, the times associated with those files, and also by executing a keyword search over the files contained across the devices.  The keywords that Mr Quick searched for were ‘Lolita’, ‘Preteen’, ‘PTGC’, ‘LimeWire’ and ‘FrostWire’.  Most of the file names contained words suggestive of child pornography. 

13. The files listed in Exhibit P13 are colour coded.  The blue entries were located in Google Picasa log files or within reports that were created from Google Picasa log reports.  Mr Quick explained that Google Picasa is a program which allows a user to search through his or her hard drive and to index the photographs, pictures, and videos on that hard drive to facilitate access to, and viewing of, them.  Google Picasa created an index of the pictures and videos contained in the hard drive and stored them in what is known as a thumb index.  It is an index of thumbnail images and references to file names and file details.  Mr Quick explained that the blue files record of when the relevant software, being Google Picasa, was used to look at the files with those names. 

14. The dark red entries in P13 were files selected by Detective Fitzgerald.  Files shaded a lighter colour of red are the ‘ZZZ.ZZZ’’ files which appeared to have been subjected to an erasing or cleaning software program.

15. Files shaded purple derived from a ‘link’ file.  A link file is a shortcut file created by Windows, which when clicked on will take you to the original file.  The pathway contained in P13 is the pathway to the original source for the link file. 

16. Files marked in green were taken from a ‘playlist’ file.  The playlist files contained information about videos which had been played using Windows’ media program. 

17. The remaining balance of the entries were coloured black.  The black files were ‘other’ types of files contained in the time line derived from the EnCase forensic software. 

18. The columns of Exhibit P13 contained various pieces of information about the files.  The first column showed the ‘Name’ of the file (in some instances this was the file path).  The second column showed the ‘Files Extension’.  For example, files marked as .exe are executable programs, .mp3 are audio files, .dll are dynamic link library files which operated within the Windows operating system, .jpg are JPEG picture files.  EnCase automatically populated the third column for the ‘File Types’ such as those just mentioned.  The next column, ‘File Category’, broadly classified the files according their category irrespective of the particular type of file.  For example, JPEG images were called a ‘picture’.  From time to time in the ‘Description’ column, files were marked as either ‘deleted’ or ‘overwritten’, or both.  Mr Quick explained that ‘deleted’ files could still have some data present on the drive.  A ‘Deleted’ entry on that column would mean that the file has been marked as deleted from a desktop browsing session and so the user may or may not have been able to see the presence of that file,  but an entry may have been in the recycling bin for that file.  A file which was marked as ‘Overwritten’ would have been completely or partially overwritten.  A file marked as ‘Invalid Cluster’ referred to the fact that the file might have become so corrupted that the EnCase software could not read where the original file was located. 

19. Counsel for the appellant cross-examined Mr Quick on the difference between formatting, wiping, erasing and deleting files.  Mr Quick explained that formatting a drive did not necessarily erase the information.  Rather, the information in relation to where it is kept on the drive may be changed but the content of the file is not necessarily altered. 

20. The next column was entitled ‘Is Deleted’ and the entries were either ‘Yes’ or ‘No’.  If the file was marked as ‘no’ under this column, then the user would be able to view the file. On the other hand, where the file was marked as ‘Yes’, the file might still be able to be viewed because it might be available from the recycle bin.  If the file had been emptied from the recycle bin then the user would not be able to view it. 

21. The next four columns in P13 were labelled as follows: ‘Last Accessed’, ‘File Created’, ‘Last Written’ and ‘Entry Modified.’ The ‘Last Accessed’ column contained the same information as the time and date the file was accessed, as appeared in Exhibit P1.  Further, the ‘File Created’ column in P13 aligned with the ‘File Created Date and Time’ in P1, and the ‘Last Written’ column was the same as the ‘File Modified’ column in P1.  However the ‘Entry Modified’ column of P13 indicated when the entry in the master table relating to that file had been modified.  Exhibit P1 also showed the ‘File Created Date and Time’ which was when either the file was created, copied or downloaded to that location, the ‘logical size’ which was the size allocated for the file, and the ‘full path’ which was the folders and subfolders in relation to the file.  The preceding information in the full path varied between P1 and P13 because the alphanumeric identifiers of the file path differed as between the NUIX and EnCase systems. 

22. The final column in Exhibit P13 is entitled ‘Is Overwritten’.  That column indicates whether the file has been overwritten, rather than simply marked as deleted, as recorded in the ‘Is Deleted’ column.

23. Before setting out Mr Quick’s testimony on some of the entries in P13, it is convenient to refer to Exhibit P7 which comprised a bundle of hard copy printouts of emails found on the appellant’s email account.  Mr Quick testified that he was unable to say which device was used to send the emails comprising Exhibit P7, which were extracted from the Moebius computer using his forensic software tools.  Moreover, a user could access their email account by going to the ISP’s web address as that would function in the same way as if the user had sent an email from their email provider application on their desktop computer.  The functions offered by the ISP’s web address would vary depending on their user interface.  The importance of the emails contained in P7 lies in the temporal proximity between the sending of the emails and the dates and times of the activities on files logged on P13 which could be inferred had contained child pornography.

24. The appellant accepted that from time to time he used the iPrimus email account from which the emails in P7 had been sent.  He testified that he had email software on a number of his devices.  He said that he could not say from which device he had sent the emails comprising Exhibit P7.  He testified that he also sent emails from his iPrimus account when he was away from home.

25. Moving back to the entries in Exhibit P13, entry 14 was a ‘thumbindex’ report and showed that a video file had been played or engaged with on 4 February 2010 at 10.01 pm using the viewing platform ‘Google Picasa’.  The file name of entry 14 was indicative of child pornography.  Mr Quick testified that generally when software was used to play videos, the name of that video would be apparent to the user.

26. The names of the files referred to in entries 15 to 25 of Exhibit P13 also suggested that they contained child pornography.  The software indicated that they were viewed using Google Picasa between 11.51 am and 10.19 pm on 13 February 2010.  Those files were both images with the suffix ‘.jpg’ and movies and videos with the suffix ‘.avi’.

27. Entry 32 of Exhibit P13 was created on 10 March 2010 at 11:06 am and was located in a folder which was named ‘LimeWire 2’.  That folder was contained within the Fonts folder.  Mr Quick explained that it was not usual for LimeWire’s software to create a folder at that location.  He said that this entry shows that the user created a folder at 11.06 am through Windows or some other software.  The file paths indicated that there was a folder called ‘LimeWire 2’ on both HD 1 and HD 2 of the Moebius.  There was therefore activity relating to both of those folders on 10 March 2010. 

28. Entry 34 of Exhibit P13 was the subject of count 1 on the information.  It related to a file called ‘Real.dll’ which was contained in the ‘LimeWire 2’ folder of HD 2.  The ‘File Created and ‘Last Accessed’ times were both 8:36 pm on 10 March 2010 and the ‘Last Written’ modification was recorded on 6:41 pm on the same day.  Exhibit P7 included an email sent on the appellant’s iPrimus account at 5.27pm on that day.  That file, being entry 34, was also included as row 10 on Exhibit P1 which was the table of items that had been identified by Detective Fitzgerald.  Both Exhibit P1 and entry 35 of P13 showed that the file had been duplicated onto HD 1 of the Moebius.  On HD 1, the name of the file was indicative of child pornography.  Mr Quick opined that the file either may have been downloaded to one hard drive and then copied to the other hard drive, or may have been backed up from one hard drive to the other.  He noted that the time entry for the file on HD 2 showed that it had been created 39 seconds before HD 1 but cautioned that the times may have been set differently on those hard drives.  The ‘File Created’ time recorded on HD 1, reflected in P13 of the file ‘Real.dll’ was the same ‘File Created’ time recorded on HD 2, reflected in P1 of the file ‘LimeWire 2’. 

29. Entry 36 was called ‘15-3-10.fkc’, and was created on 15 March 2010.  Mr Quick explained that ‘.fkc’ files were log files of a backup program, the file lists, file names and entry numbers demonstrating that a backing up process occurred of the files. When the backup takes place, files are copied from one location to another time. Although that file was contained on HD 1, that did not necessarily mean that HD 1 itself had been backed up.  Mr Quick explained that there was not much evidence from which to infer whether this back up process was automated or not on the appellant’s computer. 

30. Entries 37 and 38 in P13 were video files which were the subject of count 10 on the information.  They were created at 2.40 pm on 19 March 2010.  They correlate to the first row entry on Exhibit P1.  Entry 37 was contained on HD 2 and entry 38 was contained on HD 1.  On both hard drives the files were in the folders ‘nasa\space\satrn’ and the file was called ‘keep1.avi’.  An email was sent on the appellant’s iPrimus account at 12.46 pm on the same day, being 19 March 2010.

31. Entry 41 is a folder created in the ‘Documents and Settings\Mine\My Documents LimeWire’ path which Mr Quick said explained showed that LimeWire had been engaged with at various times on 12 April 2010. 

32. Entry 47 was in green font which denoted that it was a playlist file.  It contained a ‘T-’ at the start which was indicative of use by LimeWire or FrostWire.  The filename was indicative of child pornography.  Mr Quick gave evidence that the information in Entry 47 meant that on 21 April 2010 at 9.06 pm a video file of that name was played on the laptop that police seized at the defendant’s house (Exhibit BS9).  While Mr Quick testified that the video was not present on the laptop when he examined it, the reference in the file path to the ‘F’ drive was suggestive that a USB or portable hard drive was connected to the laptop to play the video.  Emails were sent on the iPrimus account between 9.19 pm and 9.24 pm on that day.

33. Entries 60 and 61 also related to the laptop.  These entries were named as ‘ZZZ.ZZZ’’.  Mr Quick noted that these entries related to the potential use of erasing or cleaning software.  Mr Quick explained that the cleaner or other erasing software can be run to remove entries in relation to web browsing history as well as to remove and overwrite files as well as folders, file names, and any entries that made in a master file table.  Mr Quick explained that this process was identified in approximately 14,639 entries. 

34. Entries 62 to 130 on HD 2 ranged from 12.29 pm to 2.12 pm on 16 January 2011.  The file names were all indicative of child pornography and also contained the ‘T‑’ prefix which indicated that they had come from P2P software.  All of the files had been marked as deleted and could therefore not be accessed by ordinary computer commands.  However, Mr Quick extracted the file names from the master file table by using the EnCase software. Mr Quick was able to ascertain that each of the files had been previewed, and most were videos.  Previewing a video allows the user to see a snippet of the video file but does not necessarily result in the downloading of the file.  LimeWire can be used to download all or some of the multiple search results or to preview multiple results.  In order to conduct a preview, the user first conducts a specific search, selects multiple results and then clicks to preview them all.  Files may be previewed without clicking each file individually. 

1. On clicking the play button on the interface for FrostWire, the user can hear or see the file.  The prefix ‘preview’ meant that the file may have been previewed either on this, or a different, computer. 

2. Mr Quick testified that it was only possible for previews of the type seen in P13 to have dropped into the hard drive if the user had conducted a search for them.

3. Entries 131 to 168 showed that there was activity on the HD 2 between 4.38 pm and 6.59 pm on 13 February 2011.  Entry 146 refers to an ‘incomplete’ folder which was played using Google Picasa.  Within that folder there were a number of other files, the first of which was entry 149 and had a file name indicative of child pornography.  There were another 22 video files contained in the incomplete folder.  Emails were sent on the appellant’s iPrimus account between 12.45 pm and 1.51 pm on that day.

4. Entry 157 was the subject of count 2.  That file was in the incomplete folder on HD 2 and had a ‘T-’ prefix indicating P2P software.  The file was created on 13 February 2011 at 5.58 pm and modified on 21 February 2011 at 12.47 pm and had a name indicative of child pornography.  In Mr Quick’s opinion that entry represented a partial download from LimeWire.  Emails were sent on the appellant’s iPrimus account between 8.55 am and 10.33 am, and at 4.09 pm on 21 February 2011.

5. Entry 159 was the subject of count 3.  That file also had a ‘T-’ prefix.  The remainder of the name was indicative of child pornography.  It was a ‘MPEG video file’ and had been created on 13 February 2011 at 5.58 pm and then modified on 28 February 2011 at 5.39 pm.  The file was contained in an ‘incomplete’ folder on HD 2.  Emails were sent on the appellant’s iPrimus account at 1.18 pm and 1.20 pm on 28 February 2011.

6. Entry 171 was the subject of count 4 on the information.  That file also had a ‘T-’ prefix, and a name indicative of child pornography.  It was created on 13 February 2011 at 7.03 pm and modified on 28 February 2011 at 4.34 pm.  Entry 171 was also contained in an ‘incomplete’ folder on HD 2.

7. Entry 191 was the subject of count 5.  That file was a video located on HD 2.  It was, in Mr Quick’s opinion, partially downloaded using LimeWire.  That file also had a ‘T-’ prefix, and a name indicative of child pornography.  It had been downloaded on 21 February 2011 at 11:25 am and was modified on 21 February 2011 at 11:54 am.  Emails were sent on the appellant’s iPrimus account between 8.55 am, and 4.09 pm on 21 February 2011.

8. Entry 193 was the subject of count 6.  That file was also a video and was also located in the incomplete folder on HD 2.  It had a ‘T-’ prefix and the remainder of the name was indicative of child pornography.  It had been created on 21 February 2011 at 11:41 am and was modified at that same time. 

9. Entry 196 was the subject of count 7.  That file was also a video and was also located in the incomplete folder on HD 2.  That file name commenced with a ‘T-’ prefix and the remainder of the file name was indicative of child pornography.  It had been created on 21 February 2011 at 11:42 am and was modified at the same time.

10. As I earlier observed, emails were sent on the appellant’s iPrimus account between 8.55 am – 10.33 am and 4.09 pm on 21 February 2011.

11. Entry 197 was the subject of count 8.  It was also a video file and was also located in the incomplete folder on HD 2. Within the title for that file were the words ‘PTHC Thai’.  That file had been created on 21 February 2011 at 11.43 and was modified on 28 February 2011 at 5.53 pm.

12. Entries 199-212 showed that Google Picasa had been used to view files between 3.16 pm and 4.37 pm on 28 February 2011.  As I earlier observed, emails were sent on the appellant’s iPrimus account at 1.18 pm and 1.20 pm on 28 February 2011.

13. Entry 214 was a video which was the subject of count 9.  Its name was indicating of child pornography and also contained a ‘T-’ prefix.  It too was contained in the incomplete folder on HD 2 of the Moebius.  It was created on 28 February 2011 at 5.13 pm and was modified at 5.37 pm on the same day. 

14. Entries 213 and 215-222 were videos with names indicative of child pornography, and also contained a ‘T-’ prefix. The files were created and last modified between 5.10 pm and 6.07 pm on 28 February 2011.   

15. Entries 223 and 224 record that erasing or cleaning software had been used on HD 2 between 3.17 pm and 3.47 pm on 17 March 2011.  While Mr Quick did not count the number of files that were erased in that particular period, his count revealed that between 27 November 2008 and 17 March 2011, 91,419 files had extensions like ‘ZZZ.ZZZ’’ indicative of being affected by erasing software on HD 2.

16. Entries 230 to 257 related to the Kingston USB.  These picture files were created on 9 July 2011, and had file names indicative of child pornography.  The files were deleted and overwritten and so were not available to Mr Quick at the time that he analysed the appellant’s devices.  However, he was able to discern the file names from the record contained on the master table. 

17. According to Mr Quick, entries 258 to 262 indicated that FrostWire had been used on HD 2 on 24 August 2011. 

18. The final entry on Exhibit P13 is entry 263.  That entry was an executable program called GuitarPro 6, stored on the Kingston USB, and was used to overwrite the files described in entries 230 to 257.  The ‘File Created’ date for GuitarPro 6 was 30 August 2011 at 1.49 pm, the day before police searched the appellant’s premises.

19. Mr Quick gave evidence that as part of his analysis he attempted a ‘SHA1 value matching exercise’.  Mr Quick explained that he first searched across all drives for any recorded SHA values that were associated with the term ‘URN SHA1’, because LimeWire stores its SHA1 values with the reference URN SHA1.  HD 1 of the AMR contained 21 files that had a match to URN SHA1.  HD 2 contained 1,460 matches for the term URN SHA1.  Mr Quick merged all the matches into a single document.  He then compared the SHA1 values to SHA1 values that were stored in the Child Exploitation Tracking System (CETS) database for previously identified child exploitation material.  Mr Quick found many matches which were recorded on the four pages of the spreadsheet marked as Exhibit P15.  Despite the appellant’s submissions to the contrary, Mr Quick’s evidence was that all of the entries in P15 were files found on the appellant’s devices with SHA1 values which matched values recorded on the CETS. It was tacitly accepted at trial that even though the files were not viewed by Mr Quick, the files recorded on the CETS system did contain child pornography. Mr Quick’s evidence was received without objection and no submission that the CETS database contained files with something other than child pornography was ever put.

20. Exhibit P15 contained information about each match in a numbered column, with a designated row for each match.  The ‘Source’ column indicated which of the search devices triggered the match.  The ‘SHA1’ column contained the SHA1 value for that file.  Next, the ‘CETS’ column recorded the categorisation of the child pornography within the CETS system.  The next column, entitled ‘LimeWire SHA1(32)’, contained the same information as in the ‘SHA1’ column, but the number was stored in a different format.  The final column was entitled ‘folder path and filename where present.’ Mr Quick testified that once a match was recorded he searched the relevant device to locate the associated file name and file path for the matching file.  Mr Quick testified that if a file was listed in P15, it had, at one point, commenced downloading to either of the two devices. 

21. The significance of the matching of a great number of files that had names indicative of child pornography with LimeWire files known to contain child pornography extends beyond proof of the contents of those files before they were overwritten.  It also supports the drawing of the inference that the other files with names indicative of child pornography also contained that material.

22. Moving to Mr Quick’s evidence on cyber security, Mr Quick explained that a firewall was software which examined network traffic, usually focussing on incoming traffic.  If the traffic was not expected, or the user had set the software to block that traffic, then the firewall would not allow the traffic to come through the computer.  On the other hand, Mr Quick said that an antivirus program, which often accompanies firewall software on a computer, will not necessarily stop the traffic, but will examine the traffic which comes through to determine whether it matches information contained in its database.  He explained that it was best to have both an antivirus and a firewall on a computer, but neither were infallible in terms of preventing viruses or unexpected connections.

23. Mr Quick explained that malware was a generic label which covered a vast range of program types designed to do various types of things, and included “viruses” and “Trojans”.  Mr Quick explained that a Trojan is ‘software that appears to be one thing but has something else within it which isn’t apparent to the user’.  He agreed that it is designed to look like a legitimate piece of software but could have a sinister purpose, for example monitoring a user’s keystrokes. Mr Quick agreed that P2P networks could be used to distribute Trojans and that they could be distributed in zip files, or compressed music.  A file extension may purport to be an MP3 but still be a Trojan.  A Trojan might also be designed to allow remote access and a Trojan of that kind is commonly known as Remote Access Trojan (RAT).

24. A RAT may also be known as a backdoor virus.  He explained that the owner or user of a computer affected by a virus of that kind may or may not be aware of its presence, as the virus is designed to be unnoticeable.  Mr Quick agreed that backdoor viruses could be transmitted by P2P networks. 

25. Mr Quick said that he made no note of finding malware when he made a forensic copy of the material on the appellant’s devices.  He said that had a finding of malware occurred, he would have made a note of this. He scanned that forensic copy over a period of years, so it was possible that malware that would not have been possible to detect at the time of seizing the computer would be detected later, because the virus definitions were updated.  He agreed however that he could not exclude the presence of malware.  Mr Quick agreed that P2P networks were vulnerable to malware.

26. In addition to firewalls and antivirus programs, Mr Quick said that a router could also operate as a line of protection against malware, depending on the type of the router. 

27. Mr Quick testified that he had never seen instances of malware embedded in the actual LimeWire program.  Rather, he had seen instances where LimeWire was used to download programs which contained malware.  He said that malware usually infects and spreads itself through a range of computers and that he had not seen malware specifically designed to infect a particular IP or computer.

28. Mr Quick was asked in cross-examination to comment on the possibility that malware had infected the appellant’s devices:

    QIn terms of your analysis of those files and, indeed, in the context of the entirety of your analysis, I take it that you cannot rule out the possibility that those files were automatically downloaded because the subject computer Moebius BS8 was infected with Malware that made it operate as a botnet, part of botnet, is that the case.

    AI didn’t see signs of Malware infection when I was doing my analysis.

    QGiven your earlier answers in terms of the fact that antiviral software is not infallible and you can’t exclude the possibility that those LimeWire files were not downloaded as part of Malware transmitted on the LimeWire peer-to-peer network.

    AThere may be a small possibility.  It may be technically possible but unlikely.

    QI will take that suggestion to you one step further and again in relation to rows 2 to the end on P1, that you can’t rule out the technical possibility that those LimeWire files were automatically downloaded as part of Malware embedded in the peer-to-peer software where they have appeared to be an apparently genuine download such as an MP3 file or others.  That is, it is a trojan Malware.

    AIt may be technically possible but I haven’t seen signs of LimeWire with Malware within it.  I have seen signs of LimeWire downloading Malware but that wouldn’t be contained within the LimeWire software.

    QThen I suggest that to you, that these rows relate to files that were downloaded via LimeWire, is that correct, LimeWire I should say.

    AIt appears to be, yes.

    QApparently were stored in a LimeWire default folder ‘Incompleted’, is that correct.

    AYes.

    QSo these are files that are using the LimeWire peer-to-peer network to be downloaded, is that correct.

    AIt appears to be, yes.

    QSo I am suggesting that you can’t rule out the possibility that they have downloaded automatically based on Malware that was also downloaded within the peer-to-peer network.

    AThat may be possible, yes.

29. Mr Quick also gave the following answer in relation to a question about whether malware could have downloaded the child pornography:

    QSo in relation to those files where the master file table has recorded them as being deleted, you cannot exclude the possibility that those files were downloaded via a peer-to-peer network as a result of malware activity on the computer at the time.

    AIt may be technically possible, but unlikely.

30. It is trite but nonetheless necessary to observe that Mr Quick’s repeated concession that even though improbable, it remained possible that malware had caused the child pornography to be downloaded.  This was general in nature and did not proceed from an analysis of the combined weight of all of the evidence of the computer operations in question.  That evaluation of the evidence for the purpose of determining that ultimate question was the responsibility of the Judge.

31. Indeed in re-examination, Mr Quick qualified the above concession by explaining that it was unlikely that malware was responsible for the presence of the child pornography and the creation of the many other files because of the times indicated by the dates associated with the files he had marked.  He said that ‘there was some user activity involved in downloading and reviewing files’. He agreed that his opinion about the user activity was informed by the sequence of date and time entries and the commonality of the location of the material.  He placed importance on the circumstance of activity across multiple hard drives, a laptop and a USB device, in discounting malware as an explanation. 

32. In re-examination, when Mr Quick said that he had never seen malware create entries relating to the viewing of files on Google Picasa, he also said that he was not aware of any malware which could create entries like that.  He was not aware of malware which could create the back-up log file that was in Exhibit P14.  He also testified that he had never seen an example of malware propagating child pornography.

33. Mr Quick also agreed that it was not common for files with media file extensions to contain malware.

    Lay evidence

34. The prosecution called a number of witnesses who had lived in or had been frequent visitors to the appellant’s homes.  They testified that they had used his Wi-Fi or computers to study, to play games and to link to social media platforms.  They were not warned by the appellant to stay away from any folders or programs.  They saw other people use the appellant’s computers.  One witness testified that he had used a P2P network over the appellant’s internet connection.

35. The prosecution also called a customer of the appellant’s computer business.  He took his computer to the appellant’s home to have it worked on.  He had used the appellant’s computer on some occasions and had downloaded music on it.  None of the witnesses ever saw anything inappropriate whilst using the appellant’s devices.  None of them knowingly downloaded pornography or viruses.

    Agreement on content of files

36. It was an agreed fact that the material in the files the subject of counts 1-10 was child exploitation material.  The appellant’s counsel informed the Judge:

    …in relation to agreeing that all of the material the subject of counts 1-10 is in fact child exploitation material.  I tell your Honour I haven’t viewed it and I know that the two solicitors before my current solicitors had viewed it.  I just need to very quickly check with [Mr S] whether we can agree that fact.  Obviously I’m reluctant to do it because I haven’t seen it.

37. The Trial Judge questioned how the age of the depicted children was to be proved on those counts in which the aggravated offence was charged.  Counsel submitted that Detective Fitzgerald’s testimony together with P1 satisfied the element of aggravation of the relevant offending. 

38. Counsel and the Trial Judge then had the following exchange:

    HER HONOUR:   Do you have a disk with the material on it 1-10?

    MS MATTEO:    No, I don’t because I agreed with those acting for [Mr S] previously that these could be agreed.

    MR JOLLY:That is confirmed.  I accept what my friend says.  I have seen notes that Mr Redmond made with respect to it.  Obviously it is not something that I -

    HER HONOUR:   I mean, short of there being actual agreement of each of the elements relative to the nature of the material being child pornography and the age and the category in which it sits according to the scale, then I will permit the prosecution to simply tender, subject to any objection have you, of course, the disk containing the materials and then I will make my own assessment.

    MR JOLLY:It is not a controversial issue, it is not a contentious issue.  Obviously I don’t want to blurt something out without making 100% certain.  That will take me 30 seconds and then my friend doesn’t need to trouble herself with having to submit a disk.

    HIS HONOUR:    You will need to both carefully craft that agreed fact so that it covers all aspects of that.

    MR JOLLY:And all counts.

    HER HONOUR:   All counts and all aspects of the elements of the offence in relation to it.

    MR JOLLY:Yes.

    HER HONOUR:   How long do you want? Until 11.15?

    MR JOLLY:I just need, as I said, a couple of minutes with [Mr S].  I will give a nod to my friend, who can be assured of that and the crafting can then occur.

39. When the matter resumed, counsel for the respondent informed the court that there were two facts admitted by the appellant pursuant to s 34 of the Evidence Act 1929 (SA):

    1The material the subject of counts 1-10 as described in the ‘full path’ column of Exhibit P1 is child pornography. 

    2The child pornography material the subject of counts 2, 3, 6, 8 and 9 depicts a child or children under the age of 14 years engaging in sexual activity.

40. On admission of these facts the prosecution did not tender an electronic copy of the contents of the files found on the subject of the charged counts.

    The defence case

41. The appellant gave evidence.  At the time of trial he was 63 years old.  He said that he lived at Reynella between 1999 and early 2011, he then moved to Seacliff Park in about March 2011 and left that house in March 2013. 

42. He worked as a sole trader in the sale, installation and maintenance of computers and networks.  He performed that work on site and would also take his client’s computers home to his office.  The appellant testified that in the course of his work he dismantled computers and would network his client’s hard drives to his own network either through a cable or wirelessly.  He performed this work at both Reynella and Seacliff Park.  He also transferred data between his own computers using various storage devices as well as the network itself. 

43. The appellant testified that he assembled the AMR computer.  It had two hard drives, one contained the operating system and some media and music, the other was given to him by his father’s friend and contained a compilation of movies.  It was his main computer.  The appellant explained that the setup of the AMR was the same at both residences.  It did not require a password to be accessed, and the computer was always connected to the internet.

1. In the trial, the evaluation of the cross-admissible evidence of charged and uncharged acts of the creation and use of the pornographic files, all of which was admissible on every count, would necessarily result in a conclusion either that no charge was proved beyond reasonable doubt or that every charge was proved beyond reasonable doubt.  The process by which interlocking circumstantial evidence may manifest both its relevance and cogency only when it is seen as a whole is well understood.  When viewed as a whole a body of circumstantial evidence may achieve strong probable force even though its individual components are tenuous or even ‘colourless’. Indeed, the relevance and degree of cogency may only be revealed when circumstantial evidence is evaluated in that way.

2. In this case the Judge’s circumstantial reasoning properly addresses the combined force of the circumstances surrounding the frequent, regular and protracted course of creating and using the pornographic files in the way described by Dixon J in the last sentence of the passage from Martin v Osborne cited above.  The repetition of that process with respect to each count would have detracted from, and not improved, an understanding of the Trial Judge’s reasons.  There were no peculiarities, other than the circumstance of aggravation common to counts 2 to 9, in any one of the individual counts which demanded separate attention.

   Ground 3 – Onus of proof

3. The appellant’s complaint is that towards the conclusion of the reasons, the Trial Judge rejected the appellant’s evidence and put it to one side before proceeding to consider whether the prosecution evidence proved that the competing innocent explanations for the appellant’s devices having engaged with child pornography were implausible.  The appellant contends that his testimony ought to have been considered in combination with all of the other evidence for the purpose of evaluating whether the prosecution had negatived all rational hypotheses consistent with innocence.  The appellant relies on the judgment of Vanstone J in R v Schulz:[27]

   Much depends on the structure of the summing up and the way in which the Judge discusses the defence case.  If there is a reference to the possibility of ‘accepting’ the defence evidence, then plainly the full spectrum of other possibilities must be put as well.  However, it would appear to be a better course to simply direct the jury to consider the defence evidence, direct them as to proof of which element is put in issue by it, and instruct them that the question for decision is whether, on the whole of the evidence, and notwithstanding the defence evidence and argument, the prosecution case has been proved.

   [27] (2016) 126 SASR 476 at [35].

4. The appellant also complains that the Trial Judge approached the determination of the case on the basis that the appellant bore an onus of identifying or demonstrating a reasonable possibility consistent with innocence on the evidence.

5. It is important to start by observing that the Trial Judge expressly and correctly directed herself on the onus of proof in general terms early in her summing up.[28]

   [28]   R v Sexton [2016] SADC 155 at [18].

6. The paragraphs of the summing up impugned on this ground are:[29]

   [260]The main issue is the question of whether the activity that has been detected on the four electronic devices could possibly have occurred other than by the positive activity of the accused and in particular by the operation of malware or virus’. Both agreed that malware can take the form of botnets, spyware, Trojans, backdoor viruses, worms and ransomware. It can infect an electronic device by various operations including emails that contain executable software, clickbait and P2P networks. The manner in which it is seen depends upon the purposes of the criminal enterprise and what the hacker is trying to achieve. Mr Kernick agreed that in most cases the purpose of malware is to hijack the computer to use as the hacker wishes whilst not being detected. Of course in most cases there needs to be a reason to do this either to benefit the attacker or harm the network or the victim.

   …

   [273]The accused participated in a record of interview with the police and gave evidence in this trial. It is important to bear in mind in assessing the evidence and the out of court statement of the accused that he is not required to prove anything at all. Importantly, he is not required to provide any explanation for material that may be upon his computer or has been in the past upon his computer. Of course if he does provide an explanation then that is a matter to take into account in assessing whether the prosecution have proved any or all of the charges beyond reasonable doubt. His explanation may cast doubt upon this in which case he is entitled to be acquitted in relation to the charges that have not been so proven.

   [274]The accused was on notice when he attended at the police station in relation to the nature of the inquiry. He was aware that computers had been removed from his premises. He was told at a very early stage in the formal record of interview that the police suspected that he had accessed and shared child pornography from a computer. The accused immediately began suggesting to the police that others were either setting him up or had misunderstood and misinterpreted a situation that occurred sometime before. He continued with these explanations despite the fact that the police told him that the information they had was not from a human source but rather from computer generated material.

   [275]In the course of this trial, all the explanations that he proffered to the police have been full explored. As I will come to, I do not find any of the explanations to be reasonably possible. Similarly, on the evidence that the accused gave in this court, his explanations and his denials are rejected by me. He was an unconvincing witness. I was not impressed by his explanation that he is essentially such a smart man that he would have been able to cover his tracks sufficiently if he had engaged in this type of behaviour. It is interesting to note that on the evidence presented to me whoever was engaging in this behaviour was in fact trying to cover their tracks by deleting material, moving material onto external hard drives, and in the case of the Kingston USB (BS12) overwriting all the material with the GuitarPro6 program.

   [276]I am satisfied that the accused although he thought he could cover his tracks and although he thought he had the capacity to outsmart or outwit the forensic technology now employed by the police he was simply not capable of doing so. As I have said earlier I bear in mind that there is no obligation on the accused to disprove these allegations. The onus remains at all times upon the prosecution to prove the charges beyond reasonable doubt. I do not find the evidence of the denials of knowingly accessing or possessing child pornography reasonably possibly true. I do not accept his explanations for the evidence of engagement with child pornography reasonably possibly true. In short I do not find him to be a credible witness in relation to these matters.

   [277]In making these findings I have taken into account all the evidence that has been given by the experts, the civilians and the inferences to be drawn from the material that has been presented to me. I have considered all the arguments put by both the prosecution and the defence in relation to each of the aspects of the trial. I have considered the evidence of the accused and his explanations. I have borne in mind the onus of proof and the burden of proof.

   [29]   R v Sexton [2016] SADC 155 at [260], [273]-[277].

7. The appellant contends that the Trial Judge’s self‑direction in [273] might not have been heeded.  Her Honour’s statement must of course be accepted on its face. 

8. The directions in [277] of the Trial Judge’s reasons correctly states and applies the onus of proof and proceeds in accordance with the stricture in the cited paragraph from R v Schulz[30] to consider whether the whole of the evidence proves guilt, notwithstanding the defence evidence and argument.

   [30] (2016) 126 SASR 476 at [35].

9. The appellant also complains that the Trial Judge engaged in self-analysis of the reasonableness of the possibilities consistent with a finding of innocence suggested by the evidence by rejecting the “possible explanations” given by the appellant because they were not “reasonably possible”.[31]  The Trial Judge’s use of the phrase ‘reasonable possibility’ instead of ‘hypothesis’ is of no consequence.  The Trial Judge was doing no more than referring to the reasons for doubt, or innocent hypothesis, advanced by the defence before recording her conclusion that she was nonetheless satisfied beyond reasonable doubt of the appellant’s guilt.  In any event it is not necessarily an error of law to contrast a reasonable doubt with any doubt.[32]

   [31]   R v Sexton [2016] SADC 155 at [291].

   [32]   The Queen v Dookheea (2017) 91 ALJR 960 at [37].

10. Permission to appeal on this ground should be refused.

    Ground 4 – Admission and use of discreditable conduct evidence

11. The prosecution provided a notice of intention to adduce discreditable conduct evidence for the purposes of s 34P(4) of the Evidence Act 1929 (SA). The discreditable conduct was identified as the viewing of child pornography using Google Picasa software, accessing, previewing or downloading audio‑visual material containing child pornography from file sharing software, and possession of audio-visual files containing or referring to child pornography other than the charged acts. The notice identified the witnesses from whom the evidence would be adduced as Mr Quick and Detective Fitzgerald. The permissible uses identified for the purposes of s 34P(2)(b) were:

    ·demonstrating a particular interest on the part of the appellant in possessing child pornography;

    ·proving that the appellant was knowingly in possession of the material the subject of the charge or performed the charged acts of accessing the material; and

    ·proving that the appellant was at the relevant times the user of the Moebius computer.

12. The burden of the discreditable conduct evidence was to prove that the appellant personally performed the computer operations that led to the creation and subsequent use of the pornographic files.  If the appellant performed those operations, there was no real dispute that he knew that he was accessing, or in possession of, the pornographic files. 

13. There could be no occasion to use the evidence of the creation or use of any particular pornographic file for the propensity use identified in the first dot point above.  The prosecution did not have any more evidence on any one particular count, or uncharged occasion, of the creation or use of the pornographic files that the appellant was the operator of the Moebius computer than on any of the other occasions. The prosecution were therefore never in a position to argue, from a proved particular occasion or occasions of the creation or use of a pornographic file, that the propensity thereby disclosed proved the creation or use of the pornographic files on the other occasions.

14. The prosecution case critically depended on drawing an inference of guilt from the strands of circumstantial evidence set out in [206] above, and relied on improbability reasoning.

15. The prosecution case was that that evidence rendered the hypothesis that malware, and a RAT in particular, was responsible for the engagement of the appellant’s devices with child pornography improbable.  The appellant’s counsel well understood that improbability reasoning was the real purpose of the tender of the discreditable conduct evidence when he submitted, in argument on the admissibility of that evidence, that:

    What the Crown is going to have to do is prove beyond reasonable doubt that [Mr S] and no-one else as a reasonable possibility obtained child pornography, viewed child pornography and possessed child pornography.

    Counsel’s identification of the true burden of the discreditable conduct evidence was plainly correct.  Only once the appellant was shown to have performed all of the computer operations, and to therefore have knowingly created and used or have been in possession of the pornographic files, could any question of his predisposition and the use of the evidence for that purpose arise.  In this case, the evidence probative of any individual count could not be differentiated from the evidence probative of any other, and thus the use of the discreditable conduct evidence could not be used as evidence of predisposition.

16. In the course of the prosecution submissions the improbability purpose was properly identified.  The prosecutor submitted that the issue to which the discreditable conduct went was ‘who engaged this material’ and identified the other fact in issue as ‘the intention of that person who engaged with that material’.  In an exchange with the Trial Judge, the prosecutor identified the use of the evidence to prove the appellant’s possession of the pornographic files as opposed to some ‘accidental’ use.

17. However, the prosecutor also foreshadowed the use of the material to:

    … present a picture of a user who has an interest in child pornography material and that goes to both identity and intention. It presents a picture of a user who has the capability and the know how to access material of this type and to attempt to disguise or delete or override the presence of it on his computers.

18. That submission correctly described the ultimate ‘picture’ which would emerge, but only if, and when, the very many instances of the creation and use of the pornographic files on the appellant’s devices excluded any hypothesis other than that the appellant performed the computer operations in question.  However, in practice an occasion to reason from propensity was unlikely to ever arise in the trial of the appellant.

19. Insofar as the admissibility of the evidence is concerned, the Trial Judge’s reasons for admitting the evidence are not determinative.  On an appeal, it is the legal conclusion reached by the Court of Criminal Appeal on the probative force of the evidence which determines whether an error of law was made in its admission.[33]

    [33]   R v MJJ; R v CJN (2013) 117 SASR 81 at [16] (Kourakis CJ) and [236] (Vanstone J).

20. In R v C, CA I explained the way in which s 34P regulates the admissibility of discreditable conduct evidence as follows:[34]

    The mischief to which s 34P(3) of the Evidence Act is directed is the risk that the tribunal of fact, whether a judge or jury, will be distracted by the impermissible use of evidence if that use cannot be sufficiently differentiated from its permissible use. The uses referred to are forms of reasoning. Section 34P of the Evidence Act prohibits reasoning that a person who has engaged in discreditable conduct is, by reason of that bare fact alone, more likely than not to have committed the offence.  Put another way, it is impermissible to reason that a person who has engaged in any form of discreditable conduct is likely to have a predisposition to commit the crime charged whether or not, as a matter of human experience, there is any probative connection between the conduct and the crime by way of predisposition or proclivity.  I will refer to the impermissible reasoning as ‘bad person’ reasoning.

    The permissible forms of reasoning allowed by s 34P of the Evidence Act are, speaking broadly, twofold.  First, if the discreditable conduct evidence is strongly probative of the existence of a behavioural proclivity to engage in conduct of the kind charged whenever an opportunity arises, it is permissible to use that evidence as an item of circumstantial evidence indicating guilt.[35]  The second form of reasoning is improbability reasoning which has a probative force independent of any proclivity.  The improbability can arise from a wide range of circumstances and in many different ways.  Common examples include ‘cauliflower ear’ similarity in modus operandi,[36] coincidental presence or involvement in the place or circumstances of the crime for which an innocent explanation is improbable,[37] and the improbability of complainants independently fabricating similar accounts.[38]

    [34] [2013] SASCFC 137 at [75]-[79].

    [35]   R v Hissey (1973) 6 SASR 280; R v Ball [1911] AC 47.

    [36]   R v Straffen [1952] 2 QB 911.

    [37]   Martin v Osborne (1936) 55 CLR 367; Harriman v The Queen (1989) 167 CLR 590; R v Armstrong (1990) 54 SASR 207.

    [38]   Hoch v The Queen (1988) 165 CLR 292.

21. In this case, the probative value of the evidence of the creation and use of the pornographic files on the appellant’s devices substantially outweighed its prejudicial effect and was admissible to exclude the hypothesis that a person other than the appellant was responsible for the engagement with child pornography on the appellant’s devices.  It is also proved that the appellant knowingly accessed and was in the possession of the pornographic files in the charged counts.  Moreover, the use of the discreditable conduct evidence as a foundation for improbability reasoning is completely separate and distinct from any impermissible use and from any permissible propensity use.  On proof that the appellant was knowingly in possession and had knowingly accessed the pornographic files in the charged and uncharged counts, a propensity to view child pornography was disclosed but there was, in effect, no further work for the discreditable conduct evidence to perform, a conclusion of guilt already having been reached.

22. In her reasons, the Trial Judge described the proposed use of the discreditable conduct evidence as follows:[39]

    It was submitted that the particular issues at trial of which the evidence has strong probative value are, in relation to counts 1-9 on the Information:

    1Whether the accused in fact obtained access to child pornography;

    2Whether he obtained access to child pornography intending to access material of that type; and

    3In the case of charges of aggravated obtaining access to child pornography, whether he knew that the victim of the offence was at the time of the offence under the age of 14 years.

    In relation to count 10 on the Information, it is submitted that the evidence has strong probative value, in particular in relation to whether the accused was knowingly in possession of material of that type.

    It was submitted that evidence of substantial participation in the process of obtaining access to child pornography via the internet can support an inference of continued or ongoing participation in a way which is analogous to indicia of ongoing participation in a drug trade. I accept that submission.

    [39]   R v Sexton [2016] SADC 155 at [22]-[24].

23. The Trial Judge’s description in those passages is at least broadly consistent with an improbability use of the discreditable conduct evidence.  The Trial Judge later continued:[40]

    The issue in relation to this trial is whether the accused in fact obtained access to child pornography and if he did whether he intended to access material of that type.  In addition to this in relation to count 10, the issue is whether the accused was knowingly in possession of material of that type. The fact there may be an ongoing and sustained course of conduct in relation to behaviour of the same type over a number of years and across a number of different devices has strong probative value in relation to these issues. Further, I am satisfied that the probative value of this evidence substantially outweighs any prejudicial effect it may have on the defendant given the nature of this trial and the nature of the material that is to be led in any event. The evidence relating to each of the charged acts and the uncharged acts and the timing of those events along with the manner of the access is relevant to the consideration of each of the counts on the Information. As I have said, I am satisfied that the probative weight of the evidence, for the purposes I have identified, substantially outweighs any prejudice that could arguably flow from it.

    That passage does not identify whether the Trial Judge had in mind an improbability or proclivity use of the evidence. 

    [40]   R v Sexton [2016] SADC 155 at [31].

1. Towards the conclusion of the Judge’s reasons, when setting out findings of fact, her Honour made the following observations:

   [281]The prime source of this material is P2P networks and the material is generally in the form of JPEG and AVi files.

   …

   [287]There is positive evidence that there is child pornography of a similar or the same nature across the four devices. The defence argument is that there is a possibility that during the course of the accused’s work he backed up a client’s hard drive and that transferred the material to his devices. I reject this argument. To accept it as a reasonable possibility would mean that the four quite separate devices could at different times become infected by malware at the hands of a third party. That in the circumstances of this case is implausible when all the evidence and the reasonable inferences from that evidence are considered.

   [288]I am satisfied that the prosecution have proved the discreditable conduct beyond reasonable doubt and that it is relevant to each of the charged acts, I have not used it for impermissible purpose. I am satisfied that it clearly demonstrates a disposition on the part of the accused to obtain access to and possess child pornography on an ongoing basis. Further it demonstrates a system by which the accused would preview, download including to portable hard drives, delete and cleanse devices and conceal his offending.

   [289]The charged and uncharged acts give rise to such a system that I can exclude the rational hypothesis as suggested by the defence that something or someone other than the accused is responsible for the activity as detailed in the forensic analysis of the devices in the possession of the accused – namely the MOEBIUS with HD1 and HD2, the AMR computer, the laptop and the Kingston USB.

2. Her Honour excluded the hypothesis that the pornographic files were unwittingly loaded onto the appellant’s devices when backing up data from the appellant’s devices because of the improbability that they would be filed on four separate devices.[41]  The Trial Judge also excluded the hypothesis that any person other than the appellant created and used the pornographic files because of the systematic use described by experts.[42]  Paragraphs [287] and [289] employ improbability reasons and do not rely on propensity or proclivity.[43]

   [41]   R v Sexton [2016] SADC 155 at [287].

   [42]   R v Sexton [2016] SADC 155 at [289].

   [43]   R v Sexton [2016] SADC 155 at [287] and [289].

3. However the Trial Judge’s reasoning in [288][44] expressly refers to the evidence demonstrating a disposition to access child pornography.

   [44]   R v Sexton [2016] SADC 155 at [288].

4. The appellant argues that it is not clear from the Trial Judge’s reasons whether the evidence was admitted, and then used, as a foundation for improbability or propensity reasoning.  Looked at in isolation, her Honour’s reasons at [288] refer to both an improbability reasoning use and a propensity use of the discreditable conduct evidence.  However, the Trial Judge’s reasons as a whole show that the verdicts were reached by applying improbability reasoning to the very many occasions on which pornographic files were created or used on the appellant’s devices and the time sequence of that use.  Even though the Trial Judge referred to propensity reasoning in a single sentence of [288], her Honour did not deploy reasoning of that kind to link the discreditable conduct evidence to her intermediate and ultimate findings of fact elsewhere in the reasons.

5. Accordingly, the reference in [288] of the Trial Judge’s reasons to proclivity is mere surplusage.  The Trial Judge correctly identified the burden of the discreditable evidence conduct in [289] of the reasons.  The infelicity of expression in [288] of the Judge’s reasons does not constitute error.  Permission to appeal on this ground should be refused.

   Ground 4A – Directions and s 34R

6. Section 34R of the Evidence Act 1929 (SA) provides:

   34R—Trial directions

   (1)If evidence is admitted under section 34P, the judge must (whether or not sitting with a jury) identify and explain the purpose for which the evidence may, and may not, be used.

   (2)If evidence is admitted under section 34P and that evidence is essential to the process of reasoning leading to a finding of guilt, the evidence cannot be used unless on the whole of the evidence, the facts in proof of which the evidence was admitted are established beyond reasonable doubt, and the judge must (whether or not sitting with a jury) give a direction accordingly.

7. The requirements of s 34R of the Evidence Act are mandatory.[45]  However, the High Court held, by majority, in Perara-Cathcart v The Queen[46] that the obligation applies only to improper uses which are in issue in the trial and to impermissible uses which the jury might be inclined to adopt.[47] 

   [45]   R v Golubovic [2016] SASCFC 144 at [86].

   [46] (2017) 91 ALJR 411.

   [47]   Perara-Cathcart v The Queen (2017) 91 ALJR 411 at [62], [66], [91], [162].

8. As has been seen, the Trial Judge expressly proclaimed that she had not used the discreditable conduct evidence for an impermissible purpose.  The Trial Judge reminded herself of the prejudicial effect of discreditable conduct evidence.[48]  Her Honour might have made those warnings clearer by expressly eschewing what may be described as “bad person” reasoning.[49]  However, it is clear from the Trial Judge’s reasons as a whole that her Honour warned herself against such reasoning.

   [48]   R v Sexton [2016] SADC 155 at [30].

   [49]   See R v C, CA (2013) SASCFC 137 at [76].

9. In any event in this case, in which the trial was by Judge alone, the Trial Judge’s reasons show that the discreditable conduct evidence was not used impermissibly.  There has not been a substantial miscarriage of justice by reason of the abbreviated warning.

10. Even though the Trial Judge did not expressly refer to the impermissible uses which were eschewed,[50] it is plain from her Honour’s reasons that the discreditable conduct was used circumstantially to exclude the possibility that another person or malware had taken control of the appellant’s devices to download, view or access the pornographic material.  There was no occasion for concern that the Trial Judge may have relied on a general propensity. 

    [50]   R v Sexton [2016] SADC 155 at [288].

    Sentence

11. The Trial Judge sentenced the appellant on the convictions for aggravated obtaining access to child pornography on counts 2 to 9 and for possessing child pornography on count 10 on the basis that they were subsequent offences for the purposes of the penalty provision of s 63A of the CLCA. Even though it was not the subject of a ground of appeal, the Director of Public Prosecutions (the Director) recognised that the Trial Judge had erred in doing so. The words “subsequent offence”, when used in a penalty provision, have a special meaning as a matter of settled construction. A subsequent offence is one committed after a conviction for an earlier offence. Plainly enough, the appellant was only convicted of count 1 after the commission of the subsequent offending. Accordingly, the Director concedes that in sentencing against the higher maximum of ten and seven years, the Trial Judge erred. It therefore falls for this Court to consider whether it would have imposed any lesser sentence.

12. The appellant’s offending occurred over a period of 18 months. It was committed in the context of persistent and frequent viewing of child pornography. The access was obtained through software which allowed others to share the files downloaded by the appellant. It is not necessary to repeat the many statements of this Court about the importance of general deterrence in sentencing for offences of this kind in order to protect children in Australia and elsewhere from being subjected to abuse so that these images can be produced.

13. I acknowledge that the appellant has done much good in his life. His minor offending that occurred a long time ago can be disregarded. The appellant has cared for and protected his own children from the harshness of their mother. He has cared for his elderly parents. He has helped others and has earnt the strong loyalty of close friends.

14. He completed tertiary studies as a mature age student and skilled himself to provide technical support for computers through his own business. In all of this the appellant has battled a range of physical and mental illnesses.

15. Unfortunately, offending of this kind is all too often committed by persons who do not have a record of serious prior convictions but who suffer character or developmental flaws which attract them to material of this kind.

16. It must be understood that their crimes are not victimless and that behind the electronic images is real suffering by vulnerable children.

17. Importantly, the appellant, who is plainly an intelligent man skilled in the use of information technology, has shown no contrition and has accepted no responsibility for his offending.

18. The appellant is not entitled to a sentence reduction for pleading guilty as was the case in many of the comparable cases relied on by his counsel. The appellant must be sentenced on the basis of the images found on his devices. However, the number of images found is not necessarily a sound basis on which to distinguish the factual circumstances of one case from another. On the one hand many images may be downloaded by the click of a key, but on the other hand many images may be deleted by some offenders before apprehension. Most importantly the failure of the appellant to accept responsibility gives little confidence of self‑motivated change. Accordingly personal deterrence is also relatively important. Accepting the error of law identified by the Director and exercising the sentencing discretion afresh, I would not impose a lesser sentence.

    Conclusion

19. I would dismiss both the appeal against conviction and sentence.

20. PEEK J:   I would dismiss both appeals.  I agree with the reasons of the Chief Justice.

21. NICHOLSON J:   I agree that both appeals should be dismissed for the reasons given by the Chief Justice.