Computer Expert Witness
Graham Dilloway CITP MBCS
Computer Expert Witness

Chartered IT Professional and Member of British Computer Society

Listed in Register of Expert Witnesses


Member of the Academy of Experts


View Graham Dilloway's profile on LinkedIn

Appeal Judgements and Evidence of Indecent Images of Children

Specific Evidence is Crucial

I have worked many cases where the prosecution has been dropped because the specific evidence of, for example, a deliberate act is not present.  I have worked an Appeal where the Crown Court Trial heard no evidence regarding a deliberate and knowing act.  I have worked cases where the Prosecution have had to revise the Indictment because the original Indictment was not supported by the evidence.  In one case, three unsupported Indictments were produced before a fourth and final version matched the evidence.

It is crucial that the evidence is examined by a computer expert witness instructed by the Defense to ensure the correct interpretation of that evidence.

Making and Possession of Indecent Images of Children

The Protection of Children Act 1978 creates the offence of making an indecent image of a child.  An image is a photograph or pseudo-photograph.  A pseudo-photograph is something that has been made to appear to be a photograph.  An example of a pseudo-photograph might be a photo of a woman's face added to a photo of a child's body.  The definition of what it is to make an indecent image has evolved and now includes a variety of actions.

The Criminal Justice Act 1988 creates the offence of possession of an indecent image of a child. An image is, again, a photograph or pseudo-photograph.  The definition of what it is to possess an indecent image has been increasingly strictly defined.  The exact circumstances of each indecent image are important to possession and a computer may contain some pictures that are "in possession" and other pictures that are not "in possession".

Indecent images includes photographs and movies.

Appeal Court Judgements

It is my understanding, from consulting with lawyers in many cases involving indecent images of children, that various Appeal Court Judgements affect the use of evidence in these cases:

Making and Possession of Files in Temporary Internet Files or Cache

Web browser software is used to view web pages from the Internet. Typically, everything that is displayed on screen by web browser software is also automatically stored on the hard drive of the computer. The jargon is that browser files are stored in the “cache”.

The widely used web browser from Microsoft is Internet Explorer that automatically stores files in a folder called Temporary Internet Files. Other browser software including, for example, Firefox, Opera and Safari, also automatically stores files.

I rarely see evidence to suggest that people are aware of the existence of the cache and the files that are stored there. Few people would be able to locate the cache and view its content.

It is my understanding that the Atkins judgement requires knowledge and that few people could be convicted of possessing or of making images that are found in the cache (often the Temporary Internet Files folder).

Making and Possession of Thumbnails and Pictures Created Automatically

There are many software programs that can display the pictures stored in a folder. The software creates and displays a gallery of small pictures on a computer screen. The gallery might show a dozen or more small pictures that have been created automatically by the software to be displayed in the gallery. These small pictures are often referred to as thumbnails.

Typically the small pictures or thumbnails are created automatically by software and stored on the hard drive of the computer. Most people do not know that thumbnails images are created automatically and stored on the computer.

It is my understanding that the Atkins judgement requires knowledge and that few people could be convicted of possessing or of making images that are thumbnails that have been automatically created by software.

Making Indecent Images by Displaying on a Computer Screen

I have seen cases where the content of the cache has been used as evidence of making an indecent image of a child on the screen of a computer. The Jayson judgement says that making an image on a computer screen is an offence.

I might search the Internet for hotels using web browser software. The software might display a list of hotels from a search website such as Google. I might click on one of the items in the displayed list and the browser software would display a page for a particular hotel.

Everything that is displayed on the screen of my computer is automatically stored in the cache. Examination of the files in the cache would show a file containing a list of hotels that had been displayed on screen as the results of the search. The examination would also show a file containing details of a particular hotel that had been displayed on screen as the web page for that hotel.

The time that the search results file was created would be the time that the search results list was displayed on screen. The time that the hotel file was created would be the time that the hotel web page was displayed on screen.

The creation times of the files might be seconds apart and would support an argument that the web page was displayed as a result of clicking on an item in the results page.

I have seen cases were files recovered from the web cache have shown that explicit text on a web page was clicked to cause the display of a subsequent web page that included an indecent image of a child. It has been argued that these cache files are evidence of “making” an indecent image of a child.

Files in Named Folders

I have seen cases were indecent images and movies of children are stored in folders and the names of the folders suggest that the folders were created by a user of the computer.

There might be folders on a computer with the names “Pictures” or “My Received Files”. These folders have often been automatically created by software.

Folders with names such as “Nasty Pics” or “Porn” are very likely to have been created by a user of the computer. I have worked cases where the Prosecution have argued that a defendant must have known that indecent images were in a folder because the defendant must have created and named the folder.

A named folder containing twenty pictures that are all indecent images would be compelling evidence for the Prosecution. A named folder containing 1,000 pictures of which twenty were indecent would be less compelling. The Defence might argue that the indecent images were copied to the folder unknowingly as part of a large batch of legal material.

Inaccurate Indictment

The Indictment is amended in more than half of the cases that I see that involve charges related to indecent images of children.

It not unusual for Counts charging possession of indecent images to refer to multiple images including images that are in the Temporary Internet Files or images that were automatically created by software. It is unusual to see evidence to show that the Defendant knew that these files were on the computer. I recommend that the Indictment should be checked by an expert witness to ensure that the Counts do not exaggerate the serious of the offenses by, for example, overstating the number of indecent images.

The Atkins Judgement requires knowledge of “possession” and, typically, an Indictment will need to be amended to files that have been automatically created.

File Sharing Software

File sharing software allows people to share files on their personal computer with others via the Internet.

File sharing software is, perhaps, most commonly used to share music but is also used to share recordings of television shows and movies. Legal pornography can be downloaded using file sharing software. Indecent images of children can be obtained using file sharing software and this can happen purposefully and by accident.

The sharing software allows for searching the Internet using search terms. A person might enter the word “Queen” to search for music by the band Queen. It is likely that the list of results from this search would include many files containing Queen songs. The list of results is also likely to include movies and pictures of various monarchs.

The content of a file is not always obvious from the text in the list of search results. The labelling of the files that are available for sharing is not always accurate. It may be, for example, that a file might be labelled as containing one Queen song but actually contains a different Queen song.

I have seen cases were searches for legal material (often legal adult pornography) have resulted in the accidental downloading of indecent images of children.

Searching the Internet

I have worked a case were the defendant admitted to searching for pornography and to downloading all of the pictures and movies found by the search. A tiny proportion of the downloaded material were indecent images and movies of children. The defendant deleted the indecent material immediately after it was downloaded.

At Trial, the Prosecution accepted that there had been no intention to obtain indecent images of children. The Prosecution also accepted that the indecent images had been deleted at the earliest opportunity.

However, the evidence showed that the exact same search term had been used a second time after the the first use of the search term had resulted in the un-intended downloading of indecent images. The defence barrister advised that the second use of the search term fell foul of Harrison v R [2007] and recommended a guilty plea.

The judge accepted that the defendant had not intended to obtain indecent images of children and had deleted the indecent images at the earliest opportunity and the sentence was a Conditional Discharge. There was no mention of an Offenders Register.

Deleted Files

Typically, the report of a police examination of a computer will list all of the indecent images found during the examination.  Usually, the list in the police report will include indecent images that have been deleted.  Most people have never attempted to recover deleted files and do not have the knowledge needed to locate and recover deleted files.

I often see that people have been charged with "possession" of indecent images when the images are deleted files.  I would expect that the Defence would be able to challenge a charge of "possession" of deleted indecent iamges.

Windows includes a Recycle Bin that holds files after they have been "deleted".  Files in the Recycle Bin can be fully deleted or recovered to their accessible state.  Indecent images found in the Recycle Bin might be subject to charges of "possession" of indecent images.

Appeal Court Case

I was asked to review the testimony in a Crown Court Trial as part of the preparation for an Appeal.

I examined the transcript of a Trial for the "making" of indecent images of children.  I found that the Trial heard no testimony or other evidence to show that the images were deliberately and knowingly made.  In discussion with the Counsel preparing for the Appeal, we agreed that a computer expert witness instructed by the Defense should have prepared a report and met with the police computer examiner before the Trial.  We also agreed that the meeting between computer experts would probably have reached a list of "points we agree on".  That list would have shown the lack of evidence regarding a deliberate and knowing act and the prosecution would have been dropped before Trial.

Summary – Devil in Details

There is a lot of pornography on the Internet. There is also, sadly, a lot indecent images of children on the Internet. Anyone who seeks pornography is at risk of finding images of children.

Over the years, the courts have refined the definition of making an indecent image of a child and the definition of possession of an indecent image.  An expert witness can help to ensure that the evidence is consistent with these definitions.

It is essential that the details of the evidence are examined. Graham Dilloway is an IT and computer expert witness and is well qualified to examine evidence.

References

R v Bowden [2000] 2 All ER 418

http://www.bailii.org/ew/cases/EWCA/Crim/1999/2270.html

Atkins v DPP; Goodlands v DPP [2000] 2 Cr App R 248

http://www.bailii.org/ew/cases/EWHC/Admin/2000/302.html

R v Westgarth Smith; Jayson [2002] EWCA Crim 683

http://www.bailii.org/ew/cases/EWCA/Crim/2002/683.html

R v Porter [2006] EWCA Crim 560

http://www.bailii.org/ew/cases/EWCA/Crim/2006/560.html

Harrison v R [2007] EWCA Crim 2976

http://www.bailii.org/ew/cases/EWCA/Crim/2007/2976.html