Definition of Indecent Image Offences

Evidence on Computers

The law and the courts recognise that it is possible to access indecent images of children without intending to look at or save the images.

A police examination might find indecent images of children on a computer even though the computer has not been used in a deliberate attempt to obtain indecent images.  It is the specific evidence found on a computer that shows how that computer might have been used ...

• How many images were found? Where were images found?  What are the file names of images?  Which folders contain images? 
• At what time where images created?  Were images created in a single block at a single time?  Were images created at intervals of a few moments during a period of minutes or hours?
• Has web page text been found?  Does web page text indicate searches or other access to indecent images?
• Have web browser history records been found and do the history records show visits to web sites with names that are suggestive of indecent images of children?
• Is file-sharing software on the computer?  Has search text been found for file-sharing software?  Do file-sharing searches indicate searches for indecent images of children?

Every case is different and examination of the details in the evidence is important.  It might be that access to indecent images will be assumed based on little more than the name of the folder that contains the images.

Making Indecent Images

Examination of a computer may indicate the actions performed with the computer.  For example, the examination might find traces of two web pages that were displayed on screen where the interval between the display of each page is only a few seconds.  It might be argued that these web page traces are evidence that the first web page was clicked to cause the second web page to be displayed.

Actions that might be prosecuted as making an indecent image of a child include ...

• Clicking on a web page that shows unambiguously that an indecent image will be displayed on screen as a result of that click.
• Clicking on an unambiguous web page to cause a picture or movie, or a file containing many pictures or movies, to be saved on the disk of the computer.
• Typing an unambiguous word or phrase into an Internet search and causing indecent images of children to be displayed in search results on the computer screen.

Actions that will not be prosecuted as making an indecent image might include ...

• Searching for legal pornography and causing unwanted child images to be displayed on the computer screen.
• Clicking on some text or a picture that does not refer to images of children and causing unwanted child images to be displayed on the computer screen.
• Using file-sharing software to search for legal pornography and downloading a file that includes images of children.

Possession of Indecent Images

Charges of possessing indecent images are often based on the idea the person using the computer "must have known" that the indecent images were on the machine.

Evidence that might indicate guilty knowledge of indecent images includes ...

• Indecent images in files with names that clearly show the nature of the file's content.
• Indecent images stored in folders with folder names that clearly show the nature of the folder's content.
• Indecent images of children stored in folders with other material that has undoubtedly been stored by a person using the computer such as, for example, personal photos taken by the person using the computer.

Findings that are likely to be unreliable evidence of possession of indecent images might include ...

• Indecent images saved in a web browser cache (temporary Internet files) without the knowledge of the person using the computer.
• Indecent images of children that are in a folder (or folders) among other pornographic material and may have been downloaded and stored unintentionally with the other pornographic material.

Possession of Extreme or Prohibited Images

It is a crime to posses images that are "extreme" or "prohibited".  Extreme images might include pornography involving animals or violence.  Prohibited images might include cartoon drawings of children that do not involve any actual persons.  The evidence that might support the offences of possession of "extreme" or "prohibited" images is likely to be similar to the evidence for possession of indecent images of children.  There is no crime of making "extreme" or "prohibited" images.

Definition of Indecent Image of a Child

It is my understanding that the law does not define an indecent image of a child.  The decision that an image is a child under the age of eighteen (or not) and the decision that an image is indecent (or not) is left to the jury in a trial.  There is usually a consensus among the prosecuting and defending lawyers before any trial regarding the nature of the images that are to be evidence and it is often not necessary for the images to be seen during the trial.

Knowing and Deliberate Act

In summary, to be guilty of a crime, the law requires that we do something deliberately and that we know that we are doing it. Pictures of child abuse on a computer may not be evidence of making or possession of indecent images of children.  There needs to be evidence of a knowing and deliberate act.

Example of Evidence in Indecent Image Case

I received an email from Mr D saying that he was in the midst of criminal court proceedings.  I have no way of knowing the truth of Mr D's situation.  In his email Mr D said that indecent images had been found on his computer.  He said that the images had been downloaded unintentionally as part of a larger batch of material obtained by file sharing.  Mr D said that he had promptly deleted the images.

My email in reply ...

Mr D

I would expect that the police have produced a report listing the pictures that were found during their
examination.

The police report will show information about each file including the name of the file, the folder that
contains the file, the date and time that the file was created and other information. Typically, my first
task in any case is to review the police report and to write a description of the report to detail
everything that that can be known from the content of that report.

Every case is different. My review of the police report in a case might say that the police have not found
evidence to show what was done by the user of a computer that caused pictures to be on that
computer. It is my understanding that a prosecution requires evidence to show what was done.

My review of a police report might show that the evidence is consistent with an explanation given by
the user of a computer.

It has been my experience that evidence from computers is misunderstood by lawyers (and, sometimes,
by police officers) and that misunderstandings can lead to charges that are not supported by evidence.

My own view is that there is often something to be gained by the defence if evidence is examined by a
computer specialist.

I am not a lawyer and cannot give you legal advice. I would be happy to discuss the evidence in your
case with your lawyer or with you. I can take a call at any time.

Regards

Mr D replied in another email saying that all of the images in his case hid been in "unallocated clusters" or in the "swap file".

My email in reply ...

Mr D

Indecent images can be on a computer without any deliberate attempt to obtain such images by a user
of the computer. The Prosecution must show that images were on a computer as a result of knowing
and deliberate action to prosecute.

There is a Court Judgement that says unambiguously that there needs to be evidence of a deliberate act
of possession or of making. The Judgement is at …

http://www.bailii.org/ew/cases/EWHC/Admin/2000/302.html

Pop-up web pages are well known. The pages pop-up on the screen without any deliberate act by the
user of the computer. Many web sites include pop-up web pages that carry advertisements. Most web
browser software includes an option that can be ticked to prevent pop-up web pages.

Pornography web sites are well known users of pop-up web pages (including pop-ups that circumvent
pop-up prevention). The user of a computer has no control of the content of a pop-up web page. It has
been accepted by police computer examiners in other cases that pop-up web pages could be the source
of unintended indecent images found on a computer.

A user of file sharing software such as Limewire relies on other file sharing software users to create and
to label the material that is being downloaded by the file sharing software. The great majority of file
sharing software users are engaged in anonymous copyright theft. Users of file sharing software cannot
be relied upon to accurately label the material that they make available for download. A file sharing
software user might download a file expecting to hear Beatles songs and would be disappointed to hear
songs by the Rolling Stones.

Those who distribute pornography using file sharing software are likely to be the most unreliable of all
file sharing users. It is entirely possible for a computer to use file sharing software to download a file
expecting to find legal adult pornography and for that file to include indecent images of children. It has
been accepted by police computer examiners in other cases that file sharing software could be the
source of unintended indecent images found on a computer.

I have seen cases were images found in the “swap file” were included in evidence. Simply stated, an
image would have been in the swap file if the computer had been processing the image in the hours (or,
maybe, days) before the computer was seized. I have never seen a case were the police were able to
say what processing of the image had occurred for an image in the swap file. It is my firm view that
nobody should be prosecuted for images found in the swap file because it is not possible to say exactly
why those images were in the swap file. An image (or images) may have been in the swap file as a result
of, for example, a pop-up web page.

Police computer examiners describe deleted files as being in unallocated space. A deleted file (a file in
unallocated space) would not be visible to a typical user of the computer. A deleted file (a file in
unallocated space) would not be accessible by a typical user of the computer. I cannot recall that I have
ever seen a case where someone has been successfully prosecuted for possession of deleted files. It is
my understanding that the Atkins Judgement requires a person to know that they have possession of a
file and a typical person does not know that they have possession of a deleted file (a file in unallocated
space).

It is my understanding that the Atkins judgement requires a person to deliberately cause an indecent
image to be stored on a computer to prosecute a charge of making. I would expect the Prosecution to
show the act that caused a file to be on the computer. The Defence might say that a file is inadvertently
on a computer due to a web page pop-up if the Prosecution are unable to show the act that caused a file
to be on the computer.

Anything that I say here should be treated with caution because I am not a lawyer and I do not have full
knowledge of your circumstances …

But …

If the only evidence is evidence of a file (or files) in the swap file and evidence of files in unallocated
space …

And …

There is no evidence regarding, for example, the names or creation dates of files.
There is no evidence of, for example, Google searches or Limewire searches.
There is no evidence regarding the web browser history showing visits to, for example, web sites that
display indecent images of children.
There is no compelling evidence to show the actions (such as mouse clicks or typing) that caused the
indecent images to be on the computer.

Then … the absence of evidence of a deliberate act may prevent a successful prosecution.

Please note that there are factors that are outside the remit of a computer specialist including the
impact of any admissions or other remarks made in interview.

Additionally, there may be those who take the view that 69 images is too many to have been acquired
by accident. This may be a matter of context and may require consideration of the total number of
images on the computer (legal and illegal) and the number of legal pornographic images.

It is my understanding that a Newton hearing is where a Judge hears evidence and then states the
sentence that would be given if the plea was Guilty. The implication of this is that a Defendant has the
opportunity to plead Not Guilty after a Newton hearing.

The police computer examiner might be at the Newton hearing. The police computer examiner might
answer “Yes” if asked …

• Can web pages pop-up when browsing a web site?
• Do pop-up web pages display, for example, advertisements that may be of no interest to the computer
  user?
• Could a pop-up web page include unsolicited material?
• Can pop-ups avoid measures intended to prevent their display?
• Do pornography websites use pop-ups?
• Could an unsolicited pop-up include an indecent image of a child?
• Could an indecent image of a child from an unsolicited pop-up be found later in the swap file or in
  unallocated space?
• Are most of the files that are distributed using file sharing software such as Limewire created by the
  users of the file sharing software (for example, do file sharing users copy songs from their CDs onto their
  computers to allow sharing)?
• Are many file sharing software users engaged in anonymous copyright theft?
• Are file sharing software users likely to sometimes incorrectly label the files that they share (for
  example, by labelling a file as a Beatles song when it is not a Beatles song)?
• Are file sharing software users that use file sharing to distribute pornography likely to sometimes
  incorrectly label the files that they share?
• Could an unsolicited indecent image of a child be included in a file obtained using file sharing software
  and labelled as containing legal material?
• Could an indecent image of a child from an incorrectly labelled file sharing file be found later in the swap
  file or in unallocated space?

I am not a lawyer and cannot give you legal advice. I would be happy to discuss the evidence in your
case with your lawyer or with you. I can take a call at any time.

Regards

I cannot know Mr D's true situation nor the full extent of the evidence in his case.  It may be that something had gone horribly wrong if he was being prosecuted based only on evidence from deleted files and from the swap file.

I do not know what role, if any, a computer expert witness had in this case.