CHAPTER 2: DIGITAL FORENSICS

2:10 Cell Phones

R. v. Nkemka, 2013 CarswellOnt 9739 (Ont. S.C.J.)

Crown Expert: Salvatore Iaccio

Crown Expert: Aaron Neufeld

Nkema was charged with sexual assault. At the time of the incident Nkema was driving a taxi. C, the victim, was intoxicated by alcohol, and was placed in Nkema’s taxi by a friend. C fell asleep in the taxi. When C woke, the taxi was stopped and Nkema was “hovering over her and digitally penetrating her vagina with two fingers” [at para. 2]

At trial the Crown tendered the expert evidence of Salvatore Iaccio who was qualified to provide opinion evidence in the interpretation of cell phone records and the operation of wireless networks.

The Court summarized Mr. Iaccio’s evidence as follows:

He provided records in response to a production order with respect to Ms. C.’s cell phone number, 647-773-3382, which he then reviewed and extracted data from. He requested data concerning all calls made on that cell phone or received by that cell phone on November 7, 2010. He produced a spreadsheet entitled “Customer Usage Report with Towers”. It sets out whether or not Ms. C.’s cell phone was the originating phone or the receiving phone, the duration of the call, the nature of the event; namely whether it was voice or text, and the cell tower used to receive or send the call. [at para. 15]

Of note is that courts in Ontario have repeatedly held that this type of evidence is not actually expert evidence and is in fact be the kind of information a court can take judicial notice of. See for example R. v. Figliola, 2012 ONSC 4486 (Ont. S.C.J.) at para. 36; R. v. Ranger, 2010 ONCA 759 (Ont. C.A.) at para. 16; R. v. Hamilton, 2011 ONCA 399 (Ont. C.A.) at paras. 259. 277 and 279, leave to appeal refused 2012 CarswellOnt 10888, 2012 CarswellOnt 10889, [2011] S.C.C.A. No. 547 (S.C.C.), leave to appeal refused 2012 CarswellOnt 10890, 2012 CarswellOnt 10891 (S.C.C.), leave to appeal refused 2012 CarswellOnt 10920, 2012 CarswellOnt 10921(S.C.C.), leave to appeal refused 2012 CarswellOnt 10892, 2012 CarswellOnt 10893 (S.C.C.).

The Court did not have much use for Mr. Iaccio’s evidence and found that because the sectors of the cell sites were “significantly large” they did not sufficiently assist in pinpointing locations of the phone in question. [at para. 15]

The Crown also tendered the expert evidence of Mr. Aaron Neufeld. He was qualified to give expert evidence “in the area of wireless communication of information and control of messages to and from mobile devices or assets and in this case superficially the GPS system installed” in Nkema’s taxi. [at para. 78]

Mr. Neufeld’s evidence was summarized as follows:

Mr. Neufeld explained that the GPS sends certain information automatically every five minutes. The GPS chip in the device uses satellite time. The time on the Event Detail spreadsheet is when the message is received and Mr. Neufeld testified that the times set out in his report could be off by five seconds if there is a poor cell message which delays the system receiving the information. If the time recorded is off the satellite time by more than ten seconds the entry is highlighted. Mr. Neufeld testified that there were no highlighted entries for the material time and so I conclude that the times in his report are accurate for my purposes. [at para. 80]

Ultimately the Court acquitted Nkema of the charge.

R. v. Bourdon, 2016 CarswellOnt 15058 (Ont. S.C.J.)

Crown Expert: Detective Constable Frawley

Bourdon subject to a Long-Term Supervision Order [LTSO] for a period of eight years and three months. Once of the conditions of the LTSO was that Bourdon possess a cell phone only in accordance with terms of the LTSO:

Possession of a cellular telephone will be permitted providing it does not have the capability of taking photographs, and providing it is used with a plan that provides detailed monthly billing in order that your parole supervisor can monitor your calls.

Bourdon was charged with 12 breaches of the terms of the LTSO including the cell phone condition. Bourdon plead not guilty and mounted a Charter challenge to the manner in which police gathered the evidence against him. The Charter issue was resolved in favour of the Crown and the evidence admitted at trial: R. v. Bourdon, 2016 CarswellOnt 5173 (Ont. S.C.J.)

At trial Detective Constable Frawley of the Kingston police, was qualified as an expert in computer forensic examination and cell phone examination and analysis. The officer’s expertise was not contested by the defence.

Detective Constable Frawley examined four cell phones, two of which belonged to Bourdon and two which belonged to the Ms. B, an acquaintance of Bourdon who testified at trial. Bourdon’s cell phones were searched pursuant to a warrant whereas Ms. B’s phones were searched with her consent.

One of the two phones, Bourdon had in his possession, was authorized in accordance with the terms of the LTSO, the other however was not. Detective Constable Frawley testified that the phone had a SIM card and that:

The SIM card permits access to the Internet. The telephone number for the phone is one of the characteristics of the SIM card. This SIM card could be used in another phone with the same carrier, in which case the 0801 phone number would then be attached to the new phone. This phone could acquire video and pictures. It could access the Telus version of the Internet including Google search and Facebook. It could also do text messaging and multimedia messaging, which would include text as well as pictures and videos. [at para. 89]

Detective Constable Frawley concluded that Ms. B’s iPhone and Bourdon’s unauthorized phone communicated through messaging, pictures and videos.

At the conclusion of the Crown’s case, Bourdon conceded that this body of expert evidence made out the cell phone breach counts in the indictment.

R. v. Cawthorne, 2015 CarswellNat 1361 (Can. Ct. Martial App. Ct.), reversed 2016 CarswellNat 3179, 2016 CarswellNat 3180 (S.C.C.)

Crown Expert: Not Identified

Ordinary Seaman Cawthorne was convicted by a general court martial of one count of possession of child pornography and one count of accessing child pornography.

The allegations came to the attention of the authorities when Cawthorne was on exercise near Hawaii. Two days after leaving, an iPhone was found by another seaman and in an effort to figure out who the phone belonged to, he accessed the contents. On the phone he saw an image of a man having sex with a child and he immediately brought the phone to a superior officer. Investigation revealed that the iPhone belonged to the Cawthorne.

Cawthorne admitted to accessing pornography on his iPhone but not child pornography. He testified that he had been downloading pornography of teenage, but legal girls, for a number of years. Cawthorne:

testified that he would search ‘teenage girls’, access a website that contained an image board of the type of images he was interested in, and then he would download the entire thread of images. He testified that he did not review each image as they were downloading and had not reviewed any of the child pornography images found on his phone. [at para. 3]

Cawthorne appealed the conviction. The majority of the Court Martial Appeal Court granted the appeal and ordered a new trial. In so doing, the Court reviewed the expert evidence as follows:

An expert witness called by the prosecution testified that images are numbered sequentially when they are stored in an iPhone. He had examined the appellant’s iPhone and found that there were gaps in the numbering and therefore concluded that some images were missing. [at para. 6]

Defence argued on appeal that the prosecution’s closing submissions which encouraged the panel to draw an inference that where a picture was missing, the user had deleted it, was a violation of the rule in Browne and Dunn.

The Court rejected this submission and held:

The expert evidence which allowed the inference that Ordinary Seaman Cawthorne had deleted some pornographic images from his iPhone was led by the prosecution long before Ordinary Seaman Cawthorne was called upon to present his case, or to lead evidence himself. The appellant had the opportunity of cross-examining the expert, the opportunity of leading expert evidence of his own, and of testifying himself in relation to the obvious inference that could be drawn from the expert evidence. [at para. 10]

In dismissing this ground of appeal, the majority held that there was no unfairness in suggesting that the appellant was the most likely person to have deleted the images. [at para. 15]

2:20 Cell Sites

R. v. Duncan, 2015 CarswellOnt 19868 (Ont. C.A.)

Crown Expert: Kristi Jackson

Duncan and his co-accused were convicted of a number of offences related to trafficking of drugs and firearms. The Crown alleged that Duncan was the ringleader of the group. As a result, Duncan was sentenced to 15 years in custody.

As part of the investigation, police intercepted a number of calls between Duncan and his associates which revealed that Duncan and his crew were packaging drugs for shipping within Canada. One particular intercepted call became the source of a significant amount of information relied on by the police. The call was, what is commonly referred to as, a pocket dial. It captured several parties discussing the weight of pills, wrapping and packing the drugs for shipment. [at para. 54] That pocket call and others intercepted communications all originated from a location by a particular tower. The Crown theory was that the location was Ross’ apartment.

At trial, the Crown called Kristi Jackson, an employee of Rogers Communications, as an expert on the location of cell phone use and cell site information. Ms. Jackson testified that calls made from Duncan’s girlfriend and co-accused, Joanna Ross’ address would hit off a particular sector at a particular cell tower. Ms. Jackson also testified that the calls “could have come from anywhere within the tower’s catchment area”. [at paras. 6 and 58]

One of the grounds of appeal was that the trial judge misdirected the jury with respect to the expert cell tower evidence. [at para. 12]

Duncan took issue with the judge’s summary of the expert evidence and in particular that the trial judge should have told the jury that the pocket call could have come from anywhere within a much larger catchment area. The trial judge referred to these calls as the 780 calls, which defence argued was improper. The Court held that:

The short-hand reference to the three calls in question as “the 780 calls”, when put in the context of the charge on Kristi Jackson’s evidence, did not suggest to the jury that they should assume the calls originated from 780 Eglinton. Rather, the instructions are clear that it was for the jury to determine whether or not the evidence as a whole established that the calls in fact came from 780 Eglinton.

In other words, and as the trial judge advised the jury, if the calls originated from 780 Eglinton, then in all likelihood the cell tower at Eglinton and Old Forest Road would handle the calls, given that it was the closest cell tower to that address. The repeated use of the word “if” in relation to the call location makes this clear.

While referring to the calls as “the 780 calls” was not the best way of describing the calls in question, in the context of the entire charge, this shorthand does not give rise to a reversible error. [at paras. 66-68]

2:30 Video and Photographs

R. v. Andalib-Goortani, 2014 CarswellOnt 13171 (Ont. S.C.J.)

Crown Expert: Tracy D. Peloquin

Defence Experts: Martin Musters and John Sandeman

Babak Andalib-Goortani was a Toronto Police officer who was charged with assault with a weapon. There was a picture of the alleged assault.

The picture was posted anonymously. The Crown sought to rely on the picture. Andalib-Goortani objected.

The Crown called an expert, Tracy D. Peloquin, a civilian member of the OPP. The court qualified Peloquin as a “Certified Forensic Video Analyst and a Forensic Identification Analyst”. The court held she was “well qualified to provide an opinion on the authenticity of the photograph”. The court summarized her evidence as follows:

Ms. Peloquin located the image on the website noted above. She “captured” the image and examined it with a number of different types of software. This is explained in her comprehensive report, which was filed as an exhibit.

Ms. Peloquin stated that the image was largely stripped of its metadata (i.e., data concerning the type of camera, focal length, lens type, etc.). She said that this likely happened when it was uploaded to the site, a common feature of many websites. She was also certain that the image had been cropped (i.e., reduced in size) when it was uploaded. As Ms. Peloquin concluded in her report:

The JPEG evaluation software (JPEGsnoop) concluded that the image had been processed and/or edited. There are a number of reasons why this result may have occurred:

(1)    The image had been altered or manipulated using some form of editing software.

(2)    The resizing/cropping of the image in the internet posting stage or at another time was read as a manipulation which indeed it would be.

(3)    Due to the lack of metadata, exif data and hex information due to the image’s origin, the evaluation software was not able to come to a reliable and robust conclusion.

Additional information would be of assistance to further authenticate the questioned images such as an image audit trail, original recording camera/recorded media, camera operator or any witnesses to the image being taken.

[Emphasis added.]

[. . .]

Towards the end of her examination-in-chief, Ms. Peloquin said that, if someone did alter the image, they would have to be possessed of strong knowledge of the relevant software to do so without being detected. Mr. Black picked up on this cross-examination. Ms. Peloquin agreed that she was unable to say that the image had not been altered; all she could say was that there was no evidence it had been altered. For example, she could not say that the face of the police officer in the photo had not been changed or that the distance between the officer and the complainant had not been adjusted. Ms. Peloquin agreed that it is impossible to determine whether the image originated from a digital or analog device, or whether it is a still shot taken from a video. Moreover, Ms. Peloquin testified that there is no way to determine how many computers or websites the image has been uploaded to and downloaded from. She was able to locate the image on ten different websites. [paras. 10-11 and 14].

Peloquin’s opinion from her report was that the image showed “no artifacts that can be a result of being added or manipulated with an image-editing program” [para. 12].

The defence called two experts. One was Martin Musters. The court qualified Musters as an expert in computer forensics. While Musters lacked the training of Peloquin, he had “over 35 years” of practical experience [para. 15]. The court summarized the evidence of Musters as follows:

Mr. Musters was asked to provide an opinion on whether the image has been altered, and to comment on Ms. Peloquin’s report. Similar to Ms. Peloquin, Mr. Musters was concerned about the lack of metadata. As he said in his report, “[t]he removal of the metadata results in many uncertainties about the provenance of this photograph and it makes it difficult to draw conclusions.”

As in Ms. Peloquin’s report, Mr. Musters’ report discussed the easy availability of Photoshop, a program used to edit photos. Mr. Musters noted that, if a photo has been modified with Photoshop, and then uploaded to a website, evidence of the alteration would be removed when the image is stripped of its metadata.

Mr. Musters testified that the dpi (dots per inch) of the photo is 300. At the time of the G20 Summit in 2010, a typical camera would take a photo at a value of 72 dpi. Based on this observation, and running the image through a forensic program called FOURMatch (a program developed by a company in the field of image validation), Mr. Musters concluded:

In our opinion the absence of metadata is indicative that the photograph was uploaded to Facebook at some point in its life cycle. The fact that the dpi of [the image] is 300 on the www.G20justice.com site points to it being altered manually with a photo editing software before it was posted to that website.

Based on our analysis, we can conclude that this image . . . was processed/edited with a software program, likely one of the ones listed by FOURMatch.

We support the “Verdict” of FOURMatch which states “that the file has been changed, though the amount of change is unknown.

Mr. Musters elaborated on his opinion during his testimony. In addition to noting the unusual dpi feature of the image, he said that the image taken from the website was 61.2 kb in size. Mr. Musters testified that, in the unlikely event that the photo was taken with a camera set to 300 dpi, the size of the photo would have been far larger than 61.2 kb. This led him to conclude that the image taken from the website is not the original photo from the camera. Furthermore, Mr. Musters testified that it is possible to alter facial hair on an image and not see any forensic abnormalities. In short, Mr. Musters said that one could make changes to facial hair with Photoshop and not leave any evidence of having done so because Photoshop does a “really good job” of editing without detection because it blends colours to make it look as if no alternations have been made. [paras. 16-19].

Notably, the court discussed the challenge to Musters’ credentials. Musters “acknowledged that he had only testified on six occasions, and never on the issue of digital imaging. However, he said he has been consulted many times about digital imaging, within the broader framework of his work in computer forensics. Mr. Musters admitted to not having had the benefit of the formal training achieved by Ms. Peloquin, but relied on his extensive 35 years of practical experience” [para. 20].

The defence also called John Sandeman. The defence sought to qualify him as an expert on “tampering”. After cross-examination by the Crown, the court concluded that Sandeman was not sufficiently qualified to provide an opinion [para. 22].

In the end the court refused to admit the photograph as it had not been properly authenticated.

R. v. Apetrea, 2016 CarswellAlta 2353 (Alta. C.A.)

Crown Expert: Ms. Hak

Apetrea was one of two men convicted of a series of masked robberies that took place over a three week period. The sole issue at trial was the identity of the robbers. Apetrea appealed his conviction. One of the grounds of appeal was that the trial judge erred in admitting the expert evidence by failing to conduct a proper analysis of the admissibility of Ms. Hak’s evidence.

At trial the Crown sought to qualify Ms. Hak as an expert in forensic video analysis. The purpose of the expert evidence was to explain:

(. . .) how certain video recordings may or may not accurately capture the reality of the event being recorded due to the limitations of the recording system, and to compare the various items seized with items depicted in the videos. The Crown sought to introduce evidence to show “that to rely on certain discrepancies between the video and the items found with Mr. Apetrea as something that raised a reasonable doubt about his guilt might be in error”. [at para. 4]

A voir dire was conducted with respect to Ms. Hak’s qualifications and the trial judge was satisfied that the Mohan criteria had been satisfied. The Court held that:

Ms. Hak had practical training, experience and study, and possessed skill and knowledge that went far beyond that of the ordinary layman. Expert opinion was relevant since it would allow the trier of fact to view and interpret what was being shown on the video, and would assist the trier of fact in understanding that what was being depicted in the video may or may not accurately portray what was occurring at the time. The trial judge noted that any potential prejudicial effect of Ms. Hak’s testimony, and the strength or quality of her opinion, would come out in evidence and could be fully tested in cross-examination. [at para. 5]

Ms. Hak testified about different aspects of the video recordings. Her evidence was summarized by the Court of Appeal as follows:

For example, she explored why, when comparing an image captured on video and the physical item, the colours may appear different. She also testified about the importance of relying on points of comparison that cannot vary; focusing or the writing and designs on the front and back of the two hoodies and the stripes on the running shoes. Her opinion was that she could not say that the seized items, being the hoodies, footwear, and baton, were the items captured on the videos. She concluded that the hoodie with the distinctive logo, the baton and the shoes “could not be ruled out as being one and the same”. [at para. 6]

The Court of Appeal found no error with the trial judge’s decision to admit Ms. Hak’s evidence on the basis of its necessity. On appeal, however Apetrea also argued that Ms Hak lacked impartiality and independence as required by the Supreme Court of Canada’s decision in White Burgess Langille Inman v. Abbott and Haliburton Co., 2015 CarswellNS 313 (S.C.C.) which had not yet been released at the time of Apetrea’s trial.

The Court of Appeal held that although the trial judge had not had the benefit of the Supreme Court’s decision “there was however, evidence and argument before the trial judge on the important requirement of impartiality.” [at para. 12]

First, the Court of Appeal held that “[w]here a person works is not the key determinant”: R. v. Soni, 2016 CarswellAlta 1432 (Alta. C.A.) at para. 14.

Second, the Court of Appeal ruled that the focus must be on “the substance of the proposed evidence” and whether the proposed expert “is able and willing to carry out his or her primary duty of providing an objective assessment, using independent judgement, uninfluenced by who has retained him or her.” [at para. 15]

The Court held that Ms. Hak’s evidence did not warrant exclusion on the basis of lack of impartiality or independence.

Lastly, Apetrea argued that Ms. Hak exceeded the scope of her expertise by opining about the items seized by police and comparing them to the video. The Court of Appeal rejected this argument as well, not because it was without merit but rather because the trial judge had clearly reviewed the videos and items and drawn his own conclusions. The Court of Appeal held that:

[e]ven accepting, without deciding, that Ms. Hak’s evidence of comparing the articles seized with ones in the videos may have crossed the line and exceeded her, or any expertise, she could only say that the articles seized could not be ruled out as the articles in the video. This is not strong probative evidence. The judgment demonstrates that the trial judge reviewed the videotaped evidence, drew his own conclusions, and did not place weight on Ms. Hak’s comparison evidence. He found, based on his own observations, a high degree of similarity between items in the videos and the seized items. The trial judge found that the evidence captured on the surveillance videos and the camera of a citizen who filmed one of the robberies did not permit an absolutely certain conclusion that a particular weapon, piece of clothing, or footwear caught on camera was the precise item seized from the appellant and the stolen SUV. The quality of the video was lacking and surveillance equipment has inherent limitations.

However, the trial judge reviewed the unchangeable markings on the hoodies, baton, and running shoes and found it “mind-boggling” to conclude that the similarities could be the product of coincidence. He concluded that the only rational explanation was that Mr. Apetrea was in possession of the stolen SUV, which contained only his own property or property he had from participating in a robbery. As such, there is no prejudice from any of this evidence. [at paras. 18-19]

2:40 Computers

R. v. M.M., 2018 CarswellOnt 10597 (Ont. S.C.J.)

Crown Expert: Detective Constable Dan Zuliani

MM was charged with a number of sexual offences perpetrated against the 11 year old daughter of his fiancé.

In a pre-trial motion the Crown sought to have Detective Constable Zuliani qualified as an expert in computer forensics and specifically about the extraction and analysis of data he performed on an Xbox gaming device.

The victim reported that MM would use the Xbox to view pornographic videos which he forced her to watch prior to sexually assaulting her. As a result of this information the Xbox was provided to Detective Constable Zuliani for a forensic examination.

The officer’s findings were summarized by the Court as follows:

Detective Constable Zuliani has prepared a Forensic Examination Report. The report is divided into two parts:

(1)    Pornography Sites Visited: “This section of the examination details all browsing history located that was pornographic in nature”; and

(2)    Search Queries: “this section shows activity through Xbox 360 Internet Explorer in relation to internet searches . . . I have displayed all the search artifacts located and highlighted those consistent with pornography queries.”

The report outlines 86 sites visited and 96 queries. Among the titles of the videos and queries are phrases that refer to father, fellatio, and step-daughter performing oral sex.

Of the 86 sites with the tag “pornography sites”, there are 35 entries referring to oral sex, 3 referring to stepdaughter, and 4 to teen.

In the “queries” section of the report, there are nine searches with the word “Pontiac”, three with the words “nursing jobs”, and one with “stepdaughter” and “stepfather” and oral sex, and two others referencing oral sex.

The applicant requests that the Forensic Examination Report be admitted into evidence insofar as subject-matter in the following areas:

i.       Oral sex;

ii.      Step-daughter;

iii.    Step-father;

iv.     Teen;

v.      Pontiac; and

vi.     Nursing. [at paras. 50-54]

During the voir dire MM conceded that the officer was a properly qualified expert however he sought to restrict the scope of the officer’s evidence to: searches with the term ‘blow job’ in their title and searches and websites that included the words Pontiac or Nursing. [at para. 55]

The Court concluded that the officer was a properly qualified expert and would be permitted to offer evidence about the entirety of his forensic work on the Xbox. The Court found that to:

artificially restrict the admissibility of portions of the report as suggested by the respondent would result in an incomplete, possibly misleading, and sanitized version of the report. The term “blow job” is too restrictive and does not accurately reflect the other qualifiers used either in the queries, or in the titles of the sites visited. [at para. 78]

Moreover, the Court concluded that the:

inability of the expert to determine dates and times relating to the queries and the sites visited, and thus, assist in identifying the individual who made the queries and visited the sites, is a matter which will go to the weight to be attributed to the report, and not to its admissibility. [at para. 73]

R. v. Trautman, 2015 CarswellAlta 1632 (Alta. Prov. Ct.)

Crown Expert: Allan J. Fontaine

Trautman entered pleas of guilty to possession of child pornography and making available child pornography. An agreed statement of facts was read into the record and filed as an exhibit. Trautman had signed the agreed statement of facts and was assisted by legal counsel who confirmed that he had done a plea inquiry with his client.

Findings of guilt were made and a pre-sentence report was ordered along with a risk assessment report.

On the next court date, legal counsel for Trautman withdrew and with the assistance of new counsel Trautman sought to strike his pleas of guilt.

Trautman testified on the application to strike his pleas of guilt and in light of that evidence the Crown called the expert evidence of Mr. Lafontaine.

Mr. Lafontaine’s evidence was summarized by the Court as follows:

From Mr. Lafontaine’s testimony I conclude that Mr. Trautman installed a program on his computer known as CCleaner for the purpose of eradicating evidence that showed he had searched for child pornography.

Notably, the settings of the CCleaner installed on Mr. Trautman’s computer were aggressively designed to overwrite data three times. This is notable because the Integrated Child Exploitation Unit that employs Mr. Lafontaine overwrites this type of data only once.

Mr. Trautman’s attempt to hide this activity in this manner is strong evidence that he knew those illicit materials were on his computer.

Mr. Lafontaine’s opinion that Mr. Trautman’s computer searches were geared toward child pornography was not contradicted by any other expert opinion. I accept his evidence on that issue.

I also accept Mr. Lafontaine’s evidence that, in his opinion, the collection of child pornography found on Mr. Trautman’s computer could not have occurred accidentally. That opinion was not contradicted by any other expert opinion, and it is consistent with the admissions made by Mr. Trautman to Detective Brooks. [at paras. 88-92]

Ultimately the Court denied Trautman’s application to strike the guilty pleas.

R. v. Bools, 2015 CarswellOnt 13800 (Ont. S.C.J.), affirmed 2016 CarswellOnt 10846 (Ont. C.A.)

Crown Expert: Constable Kevin Shaidle

Defence Expert: Brian Cole

Bools was charged with possessing and accessing child pornography as well as making child pornography available.

At trial the Crown tendered the expert evidence of Constable Kevin Shaidle who was qualified as an expert in the field of forensic computer analysis. The officer testified that he found evidence of child pornography on the three hard drives he analyzed.

His evidence was summarized by the Court as follows:

He found no evidence that an outside party could have accessed the computer or downloaded the images of pornography. He concluded that Mr. Bools was the user Zaibatsu and the user Quarantine. He found images of pornography, including two that had been recently viewed, as well as other questionable imagery in these files. The officer confirmed that the Bearshare program would have access to the files on both hard drives.

His investigation was initially conducted by copying all the data to create a virtual machine copy of everything on the computer, down to the last byte. The process provides an objective picture of the entire computer contents. His actions cannot affect or change the file content.

Constable Shaidle did a virus check and found four malicious software programs. In his opinion, the user had already quarantined two of the viruses. He found no evidence that a virus could have downloaded these images onto the computer. [at paras. 67-69]

Mr. Cole was qualified as an expert and was called by the defence. Mr. Cole’s evidence, in part, was summarized as follows:

He found a number of serious viruses on the drives.

( . . . )

His conclusion was that the viruses did not appear to affect the core operating system, but rather peripheral files. There did not appear to be any specific security threats present that would “facilitate unauthorized external control of the computer via its internet connection.” His conclusion was the same as the police’s conclusion in this regard - that this was not a case where an external person accessed the computer and downloaded the child pornography on to it.

He could not conclude where the child pornography files had come from (whether they were downloaded from the Internet, copied from an external source, etc.)

It appeared to Mr. Cole that these files were collected and indexed into a logical hierarchy under the default Windows folder entitled “My Pictures,” as opposed to automatically being stored by a program in some general “download” directory.

He confirmed that the user would have to create the folders and organize the files in the folders. [at paras. 82-87]

The Court found that the Mr. Cole’s evidence supported the evidence of the Crown expert. [at para. 91]

Ultimately Bools was found guilty of all of the charges before the court. These conclusions were based largely on the expert evidence.

R. v. Cockell, 2013 CarswellAlta 603 (Alta. C.A.), leave to appeal refused 2013 CarswellAlta 2004 (S.C.C.)

Crown Expert: Constable John Hancey

Cockell was convicted after trial of 11 charges relating to luring by a computer system, sexual assault, sexual interference, abduction, possession of child pornography and making child pornography. He appealed the convictions. One of the grounds of appeal related to whether the luring occurred by means of a computer system as required by s. 172.1(1) of the Code.

Constable Hancey was qualified as an expert in the forensic examination of computers and other digital storage devices, and regarding computer evidence. The expert’s evidence however was limited to the metadata of the pornographic images found on Cockell’s Blackberry. The evidence was relevant to situating one of the victim’s ages at the time the photographs were taken. Constable Hancey was not asked about whether a Blackberry was or contained a computer system. Notwithstanding this gap in the evidence the trial judge convicted Cockell of the offence of luring.

This the Court of Appeal found to be in error:

In summary, the only reliable evidence in relation to the means of communication relating to the luring counts was the appellant’s text messages to DP from his Blackberry. There was no reliable evidence that any of the parties’ exchanges by computer, before they started text messaging, was for the purpose of facilitating one of the predicate sexual offence referred to in s 172.1(1)(a), (b) or (c) of the Criminal Code. There was no expert evidence as to the exact nature of a Blackberry, nor which showed it contained computer programs or other data, and that pursuant to those computer programs performed logic and control or any other function. It was an essential element of the offences under s 172.1(1) of the Criminal Code which the appellant was charged with, that he communicated with DP by means of a computer system, an element which the Crown was required to prove beyond a reasonable doubt; see R. v. Legare, 2009 SCC 56, [2009] 3 S.C.R. 551 (S.C.C.) at paras. 36-37. [at para. 68]

Of note, Parliament sagely amended the luring offence in July 2012 and removed the requirement that the offence be perpetrated via a computer system and instead enacting that the luring take place via telecommunications. [at para. 67]

2:50 High Tech

R. v. Moazami, 2014 CarswellBC 2691 (B.C. S.C.)

Crown Expert: Detective Shook

Moazami was charged with 36 counts of sexual assaults and human trafficking related offences against 11 victims between the ages of 14 and 19 years old.

At trial, the Crown sought to present evidence of Facebook communications between various victims and the accused. There was evidence that Moazami used a number of different Facebook accounts. In a voir dire to determine the admissibility of the Facebook evidence Det. Shook was permitted to give expert opinion evidence on the: “Function of Facebook as a social media portal and the interpretation of Facebook account record.” [at para. 20]

Det. Shook’s qualifications as an expert in this area were admitted by the defence. The Court summarized some of Det. Shook’s evidence as follows:

(. . .) he testified that to establish a Facebook account that provides a person with the ability to send messages via the Internet to other Facebook members, a person must provide Facebook with a name, email address and password. While the name can be fictitious, Facebook must be able to verify both the email address and the password by requiring the new member to confirm that the email has been received at the conclusion of the account setup process. Each account is given a unique identification number referred to as a “User ID”. While the display name can be changed by the member at any time, the User ID remains the same regardless of any display name change and until the account is completely deleted from Facebook. Once an account is established, the member can only access their account by logging into the Facebook website with their unique email address and password. Members of Facebook can send text messages to each other as long as their security settings do not block a member’s account. Once sent, a message cannot be retrieved or deleted by the sender (in the recipient’s account) and a copy of the message is recorded in the sender and the receiver’s account. The message identifies the sender by display name and, if the display name is changed, Facebook automatically updates all of the messages between users.

Detective Shook used a computer software program to capture and copy all of the Facebook messages between the complainants J.C.H., S.W., C.B., J.C., H.W., and S.K. and Mr. Moazami. The complainants provided their email addresses and passwords to the detective or were present and logged into their accounts while he captured the relevant screens containing Facebook messages. In his search of the Facebook records, Detective Shook identified an account with User ID 100000124084362 with display names of Sammy Kronic, Bob Kandy, and Ai Singh.

(. . .)

Detective Shook also applied for disclosure of two Facebook accounts held in the U.S. through the Mutual Legal Assistance Treaty. The application for User ID 100000306354885 produced evidence that the display names for the account were Ashley Kun, John Criski and Nile Mile. [at paras. 20-22]

Ultimately the Court concluded that the messages were admissible. This was one of several rulings in relation to Facebook messages in this trial. The judge summarized the various rulings as follows:

The defence objected to the introduction of Facebook messages that purported to be conversations between Mr. Moazami and the individual complainants. As a consequence, all evidence related to these disputed Facebook messages was heard in a voir dire. At the conclusion of the complainants’ testimony, with the exception of J.C., I heard submissions from the Crown and defence regarding the threshold admissibility of the Facebook messages. Regarding the threshold admissibility of the Facebook messages between J.C. and Mr. Moazami, I concluded there was sufficient evidence that it was Mr. Moazami who sent these messages to J.C. to meet the threshold test for admissibility and, further, that the probative value of the evidence outweighed any prejudicial impact on Mr. Moazami’s defence. I ruled that messages from J.C. to Mr. Moazami were only admissible to understand the context of his messages and not for the truth of their contents. Further, in R. v. Moazami, 2013 BCSC 2398 (B.C. S.C.), I ruled that all of the remaining Facebook records sought to be admitted into evidence by the Crown were admissible. [at para. 16]