Email Regarding Sentence Hearing

I exchanged emails with a man that was facing an imminent sentence hearing.  It was my understanding that there was uncertainty regarding the exact events that had caused indecent images of children to be on the computer.

From: Graham Dilloway <email>
Sent: 03 October 13:51
To: 'D
Subject: RE: Advice on challenging e-crime evidence in court

Mr D

Indecent images can be on a computer without any deliberate attempt to obtain such images by a user
of the computer. The Prosecution must show that images were on a computer as a result of knowing
and deliberate action to prosecute.

There is a Court Judgement that says unambiguously that there needs to be evidence of a deliberate act
of possession or of making. The Judgement is at …

http://www.bailii.org/ew/cases/EWHC/Admin/2000/302.html

Pop-up web pages are well known. The pages pop-up on the screen without any deliberate act by the
user of the computer. Many web sites include pop-up web pages that carry advertisements. Most web
browser software includes an option that can be ticked to prevent pop-up web pages.

Pornography web sites are well known users of pop-up web pages (including pop-ups that circumvent
pop-up prevention). The user of a computer has no control of the content of a pop-up web page. It has
been accepted by police computer examiners in other cases that pop-up web pages could be the source
of unintended indecent images found on a computer.

A user of file sharing software such as Limewire relies on other file sharing software users to create and
to label the material that is being downloaded by the file sharing software. The great majority of file
sharing software users are engaged in anonymous copyright theft. Users of file sharing software cannot
not be relied upon to accurately label the material that they make available for download. A file sharing
software user might download a file expecting to hear Beatles songs and would be disappointed to hear
songs by the Rolling Stones.

Those who distribute pornography using file sharing software are likely to be the most unreliable of all
file sharing users. It is entirely possible for a computer to use file sharing software to download a file
expecting to find legal adult pornography and for that file to include indecent images of children. It has
been accepted by police computer examiners in other cases that file sharing software could be the
source of unintended indecent images found on a computer.

I have seen cases were images found in the “swap file” were included in evidence. Simply stated, an
image would have been in the swap file if the computer had been processing the image in the hours (or,
maybe, days) before the computer was seized. I have never seen a case were the police were able to
say what processing of the image had occurred for an image in the swap file. It is my firm view that
nobody should be prosecuted for images found in the swap file because it is not possible to say exactly
why those images were in the swap file. An image (or images) may have been in the swap file as a result
of, for example, a pop-up web page.

Police computer examiners describe deleted files as being in unallocated space. A deleted file (a file in
unallocated space) would not be visible to a typical user of the computer. A deleted file (a file in
unallocated space) would not be accessible by a typical user of the computer. I cannot recall that I have
ever seen a case where someone has been successfully prosecuted for possession of deleted files. It is
my understanding that the Atkins Judgement requires a person to know that they have possession of a
file and a typical person does not know that they have possession of a deleted file (a file in unallocated
space).

It is my understanding that the Atkins judgement requires a person to deliberately cause an indecent
image to be stored on a computer to prosecute a charge of making. I would expect the Prosecution to
show the act that caused a file to be on the computer. The Defence might say that a file is inadvertently
on a computer due to a web page pop-up if the Prosecution are unable to show the act that caused a file
to be on the computer.

Anything that I say here should be treated with caution because I am not a lawyer and I do not have full
knowledge of your circumstances …

But …

If the only evidence is evidence of a file (or files) in the swap file and evidence of files in unallocated
space …

And …

There is no evidence regarding, for example, the names or creation dates of files.
There is no evidence of, for example, Google searches or Limewire searches.
There is no evidence regarding the web browser history showing visits to, for example, web sites that
display indecent images of children.
There is no compelling evidence to show the actions (such as mouse clicks or typing) that caused the
indecent images to be on the computer.

Then … the absence of evidence of a deliberate act may prevent a successful prosecution.

Please note that there are factors that are outside the remit of a computer specialist including the
impact of any admissions or other remarks made in interview.

Additionally, there may be those who take the view that 69 images is too many to have been acquired
by accident. This may be a matter of context and may require consideration of the total number of
images on the computer (legal and illegal) and the number of legal pornographic images.

It is my understanding that a Newton hearing is where a Judge hears evidence and then states the
sentence that would be given if the plea was Guilty. The implication of this is that a Defendant has the
opportunity to plead Not Guilty after a Newton hearing.

The police computer examine might be at the Newton hearing. The police computer examiner might
answer “Yes” if asked …

Can web pages pop-up when browsing a web site?
Do pop-up web pages display, for example, advertisements that may be of no interest to the computer
user?
Could a pop-up web page include unsolicited material?
Can pop-ups avoid measures intended to prevent their display?
Do pornography websites use pop-ups?
Could an unsolicited pop-up include an indecent image of a child?
Could an indecent image of a child from an unsolicited pop-up be found later in the swap file or in
unallocated space?

Are most of the files that are distributed using file sharing software such as Limewire created by the
users of the file sharing software (for example, do file sharing users copy songs from their CDs onto their
computers to allow sharing)?
Are many file sharing software users engaged in anonymous copyright theft?
Are file sharing software users likely to sometimes incorrectly label the files that they share (for
example, by labelling a file as a Beatles song when it is not a Beatles song)?
Are file sharing software users that use file sharing to distribute pornography likely to sometimes
incorrectly label the files that they share?
Could an unsolicited indecent image of a child be included in a file obtained using file sharing software
and labelled as containing legal material?
Could an indecent image of a child from an incorrectly labelled file sharing file be found later in the swap
file or in unallocated space?

I am not a lawyer and cannot give you legal advice. I would be happy to discuss the evidence in your
case with your lawyer or with you. I can take a call at any time.

Regards

Graham Dilloway
Expert Witness