R. v. Clayton, 2012 ABQB 196

Court of Queen ’ s Bench of Alberta Citation: R. v. Clayton, 2012 ABQB 196 Date: 20120323 Docket: 100455716Q1 Registry: Calgary Between: Her Majesty the Queen Crown - and - Daniel James Clayton Accused Editorial Notice: On behalf of the Government of Alberta identifying information has been removed from this unofficial electronic version of the judgment. _______________________________________________________ Reasons for Judgment of the Honourable Madam Justice K.M. Eidsvik _______________________________________________________ Introduction and overview

[ 1 ] Mr. Clayton is charged with possessing, distributing, and accessing child pornography between June 1, 2009 and April 16, 2010 contrary to sections 163.1 (3) , (4) and (4.1) of the Criminal Code . [ 2 ] Mr. Clayton was tracked down by undercover police officers from Toronto and Edmonton. These officers made contact with a computer user named “Intotaboo” in late 2009 and early 2010. This user shared child pornography with these officers through a peer to peer web program. It was determined that “Intotaboo” was using three different IP addresses which were attributed to Mr.

Clayton’s home and work servers. [ 3 ] Mr. Clayton’s computer, and one he had given to his girlfriend, were seized and forensically searched. Both contained child pornography in the form of images and a video. Much had been deleted but was still located on the hard drive. The chats with the officers, but not the images that were sent to them, were also found. There was no dispute that the images and video fit the definition of child pornography as set out in the Criminal Code . [ 4 ] Mr.

Clayton testified and vehemently denied any knowledge of the child pornography found on his and his girlfriend’s computers (the latter of which he had given to her). He called alibi witnesses to show that he could not have been on his computer when certain chats were found to have occurred. He also called expert evidence to show that it was possible that a hacker was responsible for the images found on his computer. [ 5 ] Whether Mr. Clayton should be acquitted or be found guilty of the charges is pretty straightforward, although the analysis is rather complicated. I must determine firstly whether I believe Mr.

Clayton that he had no knowledge that there was child pornography on his computers, if I do, then I must acquit him. If not, then I must determine whether his evidence and that of his witnesses raises a reasonable doubt about his guilt, because if it does, then again, I must acquit him. Finally, even if I do not believe him or there is no reasonable doubt raised by the Defence evidence, then I must still review whether the Crown has proven all of the elements of the three charges beyond a reasonable doubt as having been committed by Mr.

Clayton based on all of the evidence. [ 6 ] In order to analyse these issues I shall start by reviewing what was found on the computers to put the Defence evidence in context. Thereafter, I will review the expert evidence on the issue of the virus found on Mr. Clayton’s computer and its potential effect. I shall then review Mr. Clayton’s evidence and also that of his alibi witnesses. I will review the alibi evidence by date of the alleged alibi involvement along with the other evidence led by the Crown and Defence. Finally, I will summarize my findings of whether I believe Mr.

Clayton, whether the Defence evidence raises a reasonable doubt, and whether the Crown has proven the elements of the charges beyond a reasonable doubt of Mr. Claytons’ guilt. Material found on the computers [ 7 ] Two MacBook Pro computers were seized from the accused. One was seized from the condo he shared with his girlfriend, LM (referred to at trial as police exhibit 16 and referred to in this judgment as “M.s’ Mac”) and the other was seized from Mr. Clayton’s vehicle (referred to at trial as police exhibit 24 and referred to in this judgement as “Clayton’s Mac”).

Firstly, I will deal with the more general information about what was found on the computers and how they worked. Then, I will deal with the virus that was found on Claytons’ Mac and its possible effects. Clayton’s Mac [ 8 ] Cst. Sloan of the Calgary Police Service gave testimony about the forensic work he did on the computers to find this material. He was able to determine that there was one user of Clayton’s Mac, Daniel Clayton, and it was password protected.

The Crown and Defence also called other experts about what was on the computer - I have integrated their evidence below. [ 9 ] Clayton’s Mac contained hundreds of child pornography images, a child pornography video, and files and folders including 213 chat logs on a peer to peer sharing site called Gigatribe. These items were found in both the allocated and unallocated space on the computer. “Allocated space” refers to the documents available on the computer, whereas “unallocated space” refers to deleted but not erased documents from the hard drive.

[ 10 ] Again there was no issue that the images were child pornography - I reviewed the images and I agree that they fit the definition in the Code . They are mostly of naked young girls posing in sexual ways with their legs spread open or bending over, young naked boys in various poses, acts of vaginal and anal intercourse and attempted intercourse on young children by adult males (mostly only the penises are in the photographs) including on some babies, and oral sex of every combination. There were a few pictures of children bound by rope or other binding agent with their legs spread apart.

These hundreds of young victims were not identified but for the most part their faces were identifiable. The children were of many ethnic origins. [ 11 ] Two of the same child pornography photos found on Clayton’s Mac were also found on M.s’ Mac. One was of a young girl’s vagina and the other of oral sex being performed on a female child of 1 or 2 years old. [ 12 ] The user of Clayton’s Mac used an aMSN program to gather and send child pornography. Cst.

Sloan described this program as “a free open source MSN clone (instant messenger) which has all of the features of MSN messenger like chat logging, file sharing, display pictures and webcam support.” He found numerous thumbnail photographs of images that were sent and received through this program. He found 246 sent photos, 69 of which were child pornography images, and many of the accused. He also found 94 received images, 3 of which were child pornography with the rest being images of other people and other sexual content. [ 13 ] Cst.

Sloan was able to date the times a child pornography picture was sent and when it was received via the aMSN program since it was still in allocated space on Clayton’s Mac. The first image was sent June 1, 2009 and the last on March 7, 2010. The images were sent or received on 17 other dates in June, July, August, September, and October 2009, then in February and March 2010. These photos were now only in a thumbnail size. [ 14 ] Other computer experts determined, and I accept, that if a photo was sent using aMSN there was no way of telling if it was actually accepted as received by the other user.

Similarly, with respect to the 3 photos received, one cannot tell if they were accepted - as an image will appear on the computer whether it is accepted or not. [ 15 ] The aMSN program on Clayton’s Mac was password protected and it did not have an automatic remembering password function enabled. Anybody with access to Clayton’s Mac could also access the aMSN program with their own password and if they sent or received any photos, thumbnails would be left on Clayton’s Mac. There would be no way to tell which user was responsible for those photos.

The aMSN program was not available in “stealth” mode - so that it would appear in some way on the screen any time it was being used. [ 16 ] The other main program that had been installed on Clayton’s Mac was a French peer to peer program called Gigatribe. It became available for Mac computers on December 4, 2009, and the first chat found on Clayton’s Mac is dated December 8, 2009. It was via this program that the undercover officers chatted with “Intotaboo”, the name of the Gigatribe user on Clayton’s Mac. [ 17 ] A new user of the Gigatribe program has to create a user name and password.

The program is a free download but a premium version is available for a low monthly charge of about $5.00. The first month is free for the enhanced version. There are 700,000 plus “cracked” versions as well but they are not as stable. The legal program could not work in stealth mode, although it is possible that a cracked or modified version could. Mr.

Clayton’s credit card statements showed that the card had incurred approximately $5.00 payments to Gigatribe for the months of January, February and March 2010. [ 18 ] The program on Clayton’s Mac had crashed many times, indeed over 151 times according to the Defence computer expert Mr. Vaselenak. The last crash was on April 12, 2010. The program was not on Clayton’s Mac when it was seized April 15, 2010, but many of the chats could still be found in unallocated space. [ 19 ] The Gigatribe chats dealt with trading child pornography.

A user could allow an invited contact (another user of the program) to view his pornography and then it could be downloaded by the other user over the Net by giving them the appropriate password. [ 20 ] Sgt. Wickens of the Edmonton Police Department made contact with Intotaboo on December 15 and 16, 2009 and again on March 4, 2010. They chatted and a folder called “Family” was made available to the Sergeant, using an undercover name, by Intotaboo sending him his password. The detective downloaded a number of child pornography photographs from Intotaboo’s computer. He

captured an IP address and the address came back to Mr. Clayton’s residence and his work IP address on a different occasion. [ 21 ] Sgt. Wickens noted that on the 15 th of December Intotaboo had 360 files available, and on December 16th he had 460 - so that 100 new files had been obtained overnight. Indeed reviewing the chat logs that were entered as an exhibit, numerous chats were noted between Intotaboo and “famlygirl1007", “sheriXdress”(a user also caught and convicted), “hussyfan57", and “123-MOM-321", discussing whether they had “young to trade”. [ 22 ] Det.

Krawszyk of the Toronto Police Service chatted with Intotaboo on January 22, 2010 and February 7, 2010. He was given a password so that he could download material from Intotaboo. He viewed the Intotaboo material that was made available to him and showed it in Court (both officers took digital pictures of their computer screens of the material sent to them by Intotaboo and the CDs were entered as exhibits) .

The material included four 2 to 5 minute movies involving child pornography (this was admitted and was obvious from the short clips played in the courtroom) and many thumbnail child pornography photographs. [ 23 ] The photos and movies that were sent to the officers were no longer on Clayton’s Mac when it was seized. It was explained that once a photo is deleted it goes into unallocated space and then it can be overwritten randomly as the computer requires space.

The chats that were made were still on there however, as were many keywords present that showed that files associated with them had been present on the Mac at some point (such as “TheFam1H.wmv” found in the Gigatribe download file path and “!New!(pthc)Christina 11 yo...”, etc.). [ 24 ] The Gigatribe chats occurred between December 2009 and April 2010. There were 213 chat logs found - a separate log is created for each Gigatribe user and can include several different chats at different times - so it means that Intotaboo chatted with 213 persons over those months on 79 different days (creating 55 different logs).

Upon close review, however, there were 34 different days that Intotaboo sent material as opposed to received material. Each user has his own password and can pass on a password to others to allow them access to their material. [ 25 ] There were 1879 unique child pornography images found in the unallocated space (out of a total of 1946 child pornography files). These images only reflect the larger sized images. There were 2611 images found that were of thumbnail size. Cst. Sloan opined that 80 percent of those in his view were of child pornography. There were also another 500 photographs of Mr.

Clayton, some of which were duplicates, found in unallocated space. [ 26 ] Clayton’s Mac also contained many folders of material - personal and work related - these were either manually organised or done so by the computer automatically. There were also many emails sent and received through a program called Entourage. Finally, there was evidence that material had been backed up on to an external hard drive (a Mac Portable HardDrive) but this external hard drive was never recovered. [ 27 ] Mr.

LaFontaine, a computer expert called by the Crown in rebuttal, was able to determine that Clayton’s Mac had accessed the Internet at various Internet IP sites including three from Mr. Clayton’s home: CasaDanLeah, dannyboy, and DanielLeah, which were all password protected, his workplace Regus Meeting Rooms, and multiple public Internet sites like hotels, coffee shops, restaurants, the Calgary airport, etc. M.s’ Mac [ 28 ] M.s’ Mac was previously owned by Mr. Clayton and was given to his girlfriend when he bought a new computer, Clayton’s Mac.

Thirty-four pictures were found in unallocated space that the police determined to be child pornography. There was no dispute on this issue. Having reviewed them I am satisfied that they fit the definition of child pornography under the Code . All but two were of naked young girl’s vaginas posing in sexual ways. The other two appeared to be very young naked boys. There were also several pictures of Mr.

Clayton in the unallocated space. [ 29 ] In addition, there was evidence on M.s’ Mac of Internet searches made about the availability of Gigatribe for Mac computers and an attempt to download the program unsuccessfully. Further, as noted above, two of the same child pornography photos found on

M.s’ Mac were also found on Clayton’s Mac. Computer forensic evidence - the virus [ 30 ] I heard computer forensic evidence from five different witnesses: Cst. Graeme Sloan, called by the Crown in direct, Dr. Thomas Keenan, a professor from the University of Calgary and Mr. Gerald Vaselenak, called by the Defence, and Mr. Allan Lafontaine and Cst.

Douglas Kraan, called by the Crown in rebuttal. [ 31 ] The main topic of concern was the security issues of the two Macs in question, whether they had been infected by a virus, and what that virus did, or could have done to Clayton’s Mac. [ 32 ] The position of the Crown in argument was that only Clayton’s Mac had any evidence of a virus and that M.s’ Mac had none.

With respect to the virus, put in simple terms, it infected the computer briefly, but in particular, did not execute any backdoor access that would have allowed a hacker to take control of the computer and put the pornographic material that was found on it there. [ 33 ] The Defence position on this issue was that Clayton’s Mac was infected with a virus and it is not possible to say now whether or not a backdoor access was put on the computer which could have allowed a hacker to place pornographic material on it.

The Defence agreed that M.s’ Mac was virus free, but pointed out that it too may have been vulnerable to attack. The Defence contends that this possibility should raise a reasonable doubt as to whether Mr. Clayton is guilty of the charges. [ 34 ] Cst. Sloan did two separate virus searches on the two computers shortly after they were seized using the “iAntivirus” and “ClamXav” antivirus programs and found that they showed no infections. Some 18 months later, Dr. Keenan and Mr. Vaselenak, who were working as a team, did virus scans with different programs and found two viruses on Clayton’s Mac and none on M.s’ Mac.

Advised of this information, the police witnesses did several more different scans with other programs. Cst. Sloan found the infected files using the Norton Antivirus program but again four other programs did not detect the virus. Cst. Kraan testified that about half of the antivirus programs he ran found the infection. No viruses were found on M.s’ Mac. [ 35 ] The experts explained that sometimes some programs cover different viruses and that sometimes with newer viruses it takes the antivirus programs some time to “catch up” so to speak.

This explains why some but not all of the programs detected the infections in particular and why Cst. Sloan did not initially find the viruses. [ 36 ] With respect to the 2 viruses, one infected Clayton’s Mac on October 22 nd , 2009 and one on November 3 rd , 2009 at 1:34:35 p.m. All experts agreed that the October virus never executed. There was some initial disagreement as to whether the November virus executed, but ultimately both sides agreed that it executed to a certain degree.

The question was whether it executed to the point that it may have put something on it, such as backdoor access where a hacker could control the computer. No expert found anything such as a backdoor or any other evidence that a hacker had ever controlled the computer. [ 37 ] Cst. Sloan was of the view that this virus was a “Trojan” virus in that it was not the initial virus that was of concern, but the malicious code that it would then try and download. In this case the initial virus would go out to the Internet to get more code and then download that.

Here however, he was of the view that nothing further was downloaded - the scans found nothing else. He based his opinion on the fact that the virus accessed the computer and saved as a file at the same time - he felt that it would take longer to execute a file. Finally, his research suggested that the Trojan would only work on a windows based computer and was not executable on a Mac. [ 38 ] In his research, Cst. Sloan imported the virus into a virus database website “VirusTotal” - it called the file a name: “Java/selace”. Typically, this type of file would attempt to download and install malware on the computer.

It is a type of Alureon file that only works on windows computers. It is in a family of data-stealing trojans, which amongst other things may allow an attacker to transmit malicious data to the infected computer. But in his view this did not happen here. [ 39 ] Dr. Keenan and Mr. Vaselenak, the Defence computer experts, agreed with some but not all of what Cst. Sloan opined about. The scope of their expert testimony was to check into security issues on the Macs, not to explain whether and how the pornography found on the computers got there. Dr.

Keenan is a professor from the University of Calgary with 30 years of experience in computer

science and in particular in the area of computer security. He worked in conjunction with Mr. Vaselenak who works more in the area of hands on computer support and programming. [ 40 ] Dr. Keenan used a different research tool than Cst. Sloan to investigate the effect of the virus in question. He used the SOPHOS website which described this particular virus as a type of Trojan that would search out and drop a payload “which can be customised depending upon the attacker’s choice but that typically is a backdoor.” The payload being referenced is found in the code that it drops. [ 41 ] Dr.

Keenan opined that a virus can do a lot in one second. Here, he and Mr. Vaselenak determined that the virus had attempted to build a URL so that it could go to the Internet and get more code. Mr. Vaselenak only deciphered a part of the code - to the point where the virus was attempting to go out to the Net. They opined that there is no way to know now what it obtained from the Internet, but that a backdoor could have been implanted on Clayton’s Mac considering what this virus typically did. This would have allowed a hacker to control the computer remotely. Mr.

Vaselenak demonstrated in Court how this could be theoretically possible. [ 42 ] The fact that no backdoor was found on Clayton’s Mac was explained by the fact that a hacker could have also put on a program that would remove all of its traces. It does this so that it cannot be tracked back to its own Internet protocol address. [ 43 ] Mr. Vaselenak did not do any simulation or testing of the code in question to see what in fact happened here on Clayton’s Mac because, in their view, you needed to know the state of the computer when the virus attacked - without this there was no point. [ 44 ] Dr.

Keenan also testified that normally a Trojan would do its dirty work quickly and that the majority of viruses work to steal personal information or proprietary commercial information. Neither he nor Mr. Vaselenak had ever encountered in their work a hacker who had planted or used a computer to place child pornography - although Dr. Keenan dug up a couple of newspaper articles that he said had referenced this happening somewhere in the world. [ 45 ] Cst. Kraan was called by the Crown as a rebuttal expert witness to Dr. Keenan and Mr. Vaselenak. Although not nearly as experienced as those two, Cst.

Kraan had taken very specific courses on decompiling viruses and worked in that field for the police. He uploaded the code in question and decompiled it in order to test what it could do. In his opinion, based on his testing, the virus itself had a programming error in it, a bug, so it could not execute past the very initial stages and this was fatal to the virus continuing to infect the Mac - it simply stopped. Accordingly, in this case, no backdoor access could have been put on Claytons’ Mac that would have allowed a hacker access to it.

He opined that the testing of the specific code in question showed that the virus failed after its initial stages, and accordingly it was irrelevant, in this specific case, what the state of the computer was at that stage. [ 46 ] Cst. Kraan distinguished what he did to what Dr. Keenan and Mr. Vaselenak did by pointing out that they did not look at the specific code in question that closely but rather spoke in generic terms about what that type of virus can typically do. Indeed when pressed about the content of the whole of the code in front of Mr.

Vaselenak, he conceded that he had not looked at all of it, nor had he tested it, because he felt that he did not have enough information. [ 47 ] I recognise that Dr. Keenan and Mr. Vaselenak are very experienced in the computer science field, but in the end I accept Cst. Kraan’s opinion.In my view, since the Defence experts did not test the specific code in question to analyse if indeed the virus could have made it out to the Internet to get the backdoor program that it “typically” gets, their opinion is limited to generalities. Indeed, it is interesting that Dr.

Keenan’s view is that the virus was “attempting” to get more data - Cst. Kraan’s view is similar since he says that the virus program had a bug in it that did not allow it to get past that “attempting” stage. [ 48 ] In sum, on the whole of the expert evidence before me, I am persuaded that the virus that was on Clayton’s Mac did not allow a backdoor access so that a hacker could have controlled his Mac as of November 3, 2009. [ 49 ] I now turn to Mr. Clayton’s testimony.

Mr. Daniel Clayton’s testimony [ 50 ] Mr. Clayton testified in his own defence. He denied ever accessing or possessing any child pornography and stated that he had no idea how the material found on his Mac or M.s’ Mac could have found its way there. He also testified about several occasions when he stated that he did not have access to his Mac when Gigatribe chats were recorded on it. [ 51 ] Mr. Clayton was born November 24, 1981, so he was 29 years old on the date of the alleged offences. He lived in Calgary during the time in question in 2009 - 2010 with his girlfriend, Ms.

Ms, in a condominium in the beltline area of Calgary. He ran a business out of an office he rented in a shared office facility in Bankers Hall in downtown Calgary. He was in the risk advisory security service business with a public relations and communications arm that was run by one of his partners. This involved hours in the office, work from home from time to time, courses that he taught, and some travel. [ 52 ] Mr. Clayton had been in the British army and had a BSc in criminal justice and an MBA in risk management. Upon cross- examination, Mr.

Clayton was questioned about whether his MBA degree was obtained at the University of Calgary (“U of C”) or at Canterbury Christ Church University in England. In fact, he obtained his degree in England, not the U of C. However, he had a C.V.on his Mac that showed that his degrees were both from the U of C. When asked about this in cross, Mr. Clayton stated that he was in the process of getting his degrees “recognised” by the University of Calgary when he was arrested and although this C.V. document may have that on his Mac, he had never sent it out .

This answer was shown to be contradicted thereafter when the Crown produced a C.V. that was published on the LinkedIn website - a business networking website - with Mr. Clayton’s MBA noted as being awarded by the U of C. [ 53 ] Mr. Clayton described the way that he used his Mac. He stated that he had a password on it. He used it both at his office and his condo - transporting the laptop back and forth. He would often leave his Mac open on his desk at his office when he went out for a coffee or something. He had a password for his aMSN program. He did not give his passwords out to anybody including his girlfriend.

He never lent his computer out to anyone. [ 54 ] At home he used his Mac on the kitchen counter and on the couch sometimes sitting next to his girlfriend and watching television. His girlfriend sometimes used his Mac to check out movies for instance and when he taught courses from time to time, students had access to his Mac to check out a map or something like that. [ 55 ] Mr. Clayton indicated that he had purchased his Mac at a Best Buy store at Deerfoot Meadows in June 2009. It was in a glass cabinet in the correct box with a big yellow label on it.

He was told that it was a refurbished unit and that it was $300 cheaper than a new one. Since he was just starting his new company and they were “basically boot-strapping it” it made sense to buy a cheaper refurbished unit. He gave his old Mac to his girlfriend and also indicated that prior to that he had owned a windows computer that had been stolen in February 2009. [ 56 ] To put this evidence in context, the Defence had elicited testimony from Cst. Sloan that it was possible that there might be material on a refurbished unit, bought say at a Best Buy store, that the new user would not know about.

Also, as noted above, the earliest date of the child pornographic material that was found on Clayton’s Mac was June 2009. As well, interestingly, Mr. Clayton’s girlfriend had already testified that she was given M.s’ Mac by Mr. Clayton in June, or even July, 2009 after he had purchased his new Mac. [ 57 ] Accordingly, it came as somewhat of a surprise when a receipt was produced by the Crown that in fact Clayton’s Mac, a MacBook Pro, had been purchased, brand new, on April 3, 2009 for $ 2,149.00 plus GST at Market Mall in the Apple Store. When Mr.

Clayton was faced with this receipt he answered that he had bought another computer in June 2009 and was confused. This other computer was never mentioned in his testimony or otherwise by any other witness. Nor was any other computer found. [ 58 ] Mr. Clayton said that he never noticed any unusual activity on his Mac other than one printing problem he had had in January 2010. He did acknowledge however that he had a number of computer crashes on it but did not state that he ever brought it in for service or repair. It is to be noted that Mr.

Vaselenak testified that Clayton’s Mac had crashed over 150 times which he said is very unusual for a Mac. [ 59 ] Mr. Clayton stated that he had only changed the time on his Mac once, while he was in Vancouver, and never again. Upon

[ 59 ] Mr. Clayton stated that he had only changed the time on his Mac once, while he was in Vancouver, and never again. Upon cross examination, the Crown asked if he had not changed it on other occasions such as when he had travelled to Winnipeg and to Haiti. She asked “When did you go to Haiti ?” and Mr. Clayton answered “I don’t remember the exact date. I would have to look back at my records. It was just after the earthquake.” He continued that it was likely at the end of the summer 2009 and that he was there for “Just two days”. Later on the subject came up again and this time the Crown advised Mr.

Clayton that the earthquake was in January 2010 and asked whether that helped in terms of when Mr. Clayton had travelled to Haiti. Mr. Clayton replied: “As I said, I would have to go back into my records and check.” [ 60 ] Finally, referencing an email that Mr. Clayton had produced, the Crown came back to the Haiti trip whereupon Mr. Clayton indicated that he actually had not been to Haiti and that he had misunderstood the question. An email dated March 1, 2010 was put to him where he had written: “I was in Haiti a few weeks ago in response to the earthquake. Not a nice place to be.” Mr.

Clayton answered that it was “his company” that had gone, not him. [ 61 ] Ultimately, Mr. Clayton refused to budge on the issue about changing the date on his computer (which had led to the Haiti interchange). This is odd since his Mac was set to Saskatchewan time and according to the computer experts would not automatically change with time changes, so that he must have had to change the time on his Mac in early spring 2010 since it was on the correct time when it was seized in April 2010. [ 62 ] Mr. Clayton stated that his home Internet had had some issues. His Internet provider was TELUS.

He stated that his home Internet was not password protected until March 10, 2010 when TELUS replaced his router. However, as noted above, according to the police computer expert, Mr. LaFontaine, his home Internet was indeed password protected as far back as June 28, 2009 (on the CasaDanLeah Internet network site). [ 63 ] Mr. Clayton was asked about the $5.00 Gigatribe charges that showed up on Mr. Clayton’s TD visa card statements of January, February and March 2010. Mr. Clayton indicated that he did not notice these charges because they were less than $100.

He also pointed to a couple of other charges he says that he did not notice such as a RBC insurance entry and a charge for Norton antivirus which he no longer had on his computer. Finally, he pointed out that his windows computer had been stolen in February 2009 and that he had had personal information on it. [ 64 ] Mr. Clayton spent a great deal of time in his testimony on evidence dealing with situations where he stated to the court that he could not have been on his Mac. At this point however, instead of dealing with Mr.

Clayton’s evidence for each of these days in one block, I will deal with his evidence, along with the evidence of his alibi witnesses, and the other pieces of evidence that were led such as emails, entry logs to the condo and office, and personal documentation such as receipts etc., on a day by day basis. Alibi evidence [ 65 ] Mr. Clayton testified about several different days that he stated he did not have access to his Mac and accordingly could not have chatted on Gigatribe as alleged, or on aMSN on one occasion. [ 66 ] To put Mr.

Clayton’s alibi evidence in context, it bears repeating that the Crown alleged that Mr. Clayton had put child pornography on M.s’ Mac when he was using it (pre April or June 2009), and that he had started accessing, distributing and possessing child pornography on Clayton’s Mac using the aMSN program commencing in June 2009 and then using the Gigatribe program as well commencing in December 2009 up to the time that the computers were seized. Although all of the dates of use are not known since the unallocated documents are undated, the Crown led evidence alleging that Mr.

Clayton was using his Mac 17 different days on aMSN and 34 days on Gigatribe. [ 67 ] In addition to his own evidence, the Crown called two of the witnesses who gave alibi evidence in part for the Defence, Leah McInnnis, Mr. Clayton’s girlfriend, and Sarah Dawley, Mr. Clayton’s business partner. Ms. Ms gave evidence about 6 different occasions that she said that Mr. Clayton was not on his computer. Ms. Dawley gave evidence about the day after Mr. Clayton’s arrest. Ms. Elissa Carpenter, a CTV reporter, was called by the Defence about two different meetings she had with Mr. Clayton when he was not on his Mac.

Defence also called a fellow instructor and a student who were on a course with Mr. Clayton in early February, Mr. George Garai and Mr. Aziz Khadem.

[68] The other information that was led by the Crown to rebut the alibi evidence was the door key fob logs for the condo that Mr.Clayton and Ms. Ms lived in. A manager of the condominium project gave evidence about how to read these logs. Both Mr. Clayton andMs. Ms had a key fob and would use them to come in various entrances and up the elevator.

Of course they might have been let in or outat certain times by others and this would not be recorded, and they could go out without using a key fob at all if they left from the lobby.Accordingly, this evidence was very useful, but not infallible, in terms of determining if Mr. Clayton or Ms. Ms were home at anyparticular time. [69] There was limited information about security card use at Mr. Clayton’s workplace at Bankers Hall on April 16, 2010, which Iwill refer to later. [70] Finally, there were email messages that were sent from Mr. Clayton’s Mac at various times that may be important.

In thisregard we have the testimony of Cst. Sloan and

schedule 6 of Ex. 39 logging some of the Clayton Mac use as well as some photocopiesof emails entered by Mr. Clayton. There are some timing issues of these emails which I will deal with when it comes up later. It is alsoimportant to note that although Mr. Clayton had other electronic devices none of them were hooked up wirelessly to his Mac so that anyemails that were found on his Mac had to have been sent while he was in front of his Mac. [71] In the analysis of this alibi evidence it bears reviewing the legal tests that I need to apply when weighing the evidence.

TheCrown and Defence gave me the leading cases in this regard: Lizotte v.The King, (SCC), [1951] S.C.R. 115, R. v.Smith, (1989), 1989 ABCA 187 , 95 A.R. 304 (C.A), aff’d (SCC), [1990] 1 S.C.R. 991. , and R. v. B.K.T.S.,2007 MBQB 86, 219 Man. R. (2d) 25. To quote from the latter decision at para 6 about who bears the burden of proving alibi evidenceMadam Justice Beard said the following: - burden of proof: Evidence of an alibi may arise either through evidence led by the crown or by the defence, but in either case, it alwaysrests with the crown to disprove the alibi beyond a reasonable doubt.

An accused does not have to prove an alibi even where the alibiarises from evidence lead by the defence.(See McWilliams, p. 24 - 26; and Ewaschuk, p. 16-107). [72] And, as stated in R. v. Parrington (1985), (ON CA), 20 C.C.C. (3d) 184 (Ont.

C.A.): 1) if I believe the alibi testimony I must acquit, 2) if I do not believe the testimony, but am left in reasonable doubt about it, once again Imust acquit, and 3) that even if not left in doubt by this testimony, then on the basis of all of the evidence I must determine whether I amconvinced beyond a reasonable doubt of the guilt of the accused. [73] The burden remains throughout on the Crown to prove the accused’s guilt - by tendering alibi evidence, the accused does notassume the burden of proving his innocence - see R. v.

A. (S.), (1999) (QC CA), 129 C.C.C. (3d) 548 at 554 (QC.C.A.) [74] Keeping these tests in mind I will now turn to a day by day analysis of the alibi evidence. Monday, December 21, 2009 [75] Mr. Clayton testified that he was not with his Mac for any of the times that his Mac recorded that Intotaboo was chatting withvarious other Gigatribe users at 12:36, 12:37, 1:14, and 1:22 - 1:23 p.m. He said that he left the condo to go to a meeting with his accountant at 10 a.m. on 17th Avenue S.E., then he returned to his condo on 12th Avenue, got his hair cut at Posh Hair, drove out to meetMs.

Carpenter at Tim Horton’s in Westhills on the west side of the City, then drove back to his accountant’s office and stopped for lunchat A&W before going back to his office to “pick up his computer” and return to his condo. He then picked up his girlfriend to go to theairport to fly to Winnipeg. [76] In support of his story, Mr. Clayton entered an email he sent at 8:13 am to his accountant that said in part: “I will be at youroffice by 10:30". I am not sure how he was able to write this since he stated later, as noted above, that his Mac was at his office until hepicked it up.

His evidence is internally inconsistent on this point. He said that he left the condo at 10 a.m. to get to this appointment bycar arriving there at 10:25 a.m. Yet the fob entry shows he left the condo at 8:16 a.m., only minutes after the 8:13 a.m. email.

[ 77 ] He also entered a TD visa statement with a Posh hair and A&W entries that day. There is no time entry next to them. There was also a parking payment in the amount of $5.00 that he said that he incurred to go to the office. Nonetheless, he estimated that he got his hair cut at 11:30 a.m. and met Ms. Carpenter at 12:00 - 12:15 to 1:15 p.m.. He did not give other estimates of time in his testimony but in argument suggested that he did not eat lunch at A&W until 1:45 p.m. [ 78 ] Ms. Carpenter is a reporter with CTV news. She first met Mr. Clayton in the spring of 2009 to do an interview of him.

Later she met with him on several occasions to do some communication consulting work with him. She met him 20 to 30 times and most of the time she met between 11 a.m. and 3 p.m. for coffee and occasionally for lunch. She had great difficulty pinning down exactly when she met with Mr. Clayton and agreed to most suggestions put to her during that period of time. In my view, she was making every effort to be truthful but had difficulty remembering because of the passage of time. [ 79 ] With respect to the 21 st of December, Ms.

Carpenter recalled, on cross-examination, that she had dropped her son off that day at about 10:45 to 11 am and then drove from the Bowness area to Tim Horton’s in Westhill’s to meet Mr. Clayton . He was already there when she met him. She recalled that it was around lunchtime and noted that they sat on the Wendy’s side of the combined Wendy’s/Tim Horton’s shops because the Tim Horton’s side was full.

They had a coffee and met for around 3/4 hour. [ 80 ] In addition, on that date there were entries noted with fob 14463 to the condo at 12:09 p.m. (overhead garage), 12:10 (parking) and 12:11 (elevator), which suggest that somebody, and likely Mr. Clayton reviewing all of the fob evidence in my view, entered the condo at that time. [ 81 ] In addition, on December 21 st , there was a variety of computer activity, besides the email noted above, that started at 12:36 p.m. and onwards for the next couple of hours (to 2:43 p.m.).

This included some Internet browsing on Firefox, pictures sent on aMSN at 12:41 p.m. and onwards (which may not have been pornographic as there is no evidence one way or another and we know many non contentious pictures were sent using the aMSN program), 12 files created in the address book, a Quick Time download as well as the four short Gigatribe chats that were executed at the beginning and in the middle of all of this activity. Cst. Sloan’s opinion was that Clayton’s Mac was on and running during this period of time.

This latter evidence was not challenged (except I should point out that as suggested by the Defence, and I agree, that the time in ex. 39

schedule 6 by all accounts is 1 hour off and needs to be adjusted to be read appropriately). [ 82 ] In sum, in my review of all of the evidence of that day, I find that the meeting with Ms. Carpenter occurred closer to the period between approximately 11 a.m. and 11:45 a.m. that day. I find this because she has a recollection of dropping her son off at the babysitter at around 10:45 a.m. and she then went straight to the meeting.

Further, she recalls that the Tim Horton side of the shop was full, not the Wendy’s side - which suggests that most people were having coffee and perhaps just starting into lunch and not the other way around. [ 83 ] Mr. Clayton may well have done all of the chores he suggested he did that day but is in my view mistaken with respect to the timing or the order of the chores and I reject his evidence in that regard. Certainly he was confused about when he left his condo and when he had his Mac with him.

For instance, leaving the condo at 8:16 a.m. he could have easily had time to meet with his accountant and get his hair cut by 10:45 a.m. in order to drive out to Westhills by 11:00 a.m. and be home to enter his condo at 12:09 p.m. as noted on the fob log entry list. [ 84 ] Further, with respect to the period 12:36 to 1:23 p.m. there was a fair amount of other“legitimate” activity on Mr. Clayton’s computer - not just the brief Gigatribe chats. Accordingly, on the whole with respect to December 21 st , the Crown has satisfied me beyond a reasonable doubt that Mr. Clayton had access to his Mac at those times.

Saturday, February 6, 2010 [ 85 ] The Gigatribe chats in question on February 6, 2010 occurred at 5:36 p.m. (a quick question - “any chance I can see your private folder please? - with no reply) and 7:13 p.m. (with the question “sharing?” and again no reply).

[ 86 ] Mr. Clayton testified that he finished a course for the day that he was teaching at around 5 - 5:30 p.m. He said that he then went on his computer - he had it in his car and was preparing some emails that were noted to be “sent” at 5:05 p.m. and 5:27 p.m. He then said that he was home around 6 p.m. and would have sent two more emails at 7:13 and 10:32 p.m. [ 87 ] Indeed, Cst.

Sloan confirmed activity on his computer at that time which included a Word document saved to the file, folders created that filed some work documents in them, including a CP video folder, a certificate for his course (H.E.P.C.O.) and a series of emails - besides the Gigatribe chats. Accordingly, there is no issue that Mr. Clayton had access to his Mac when the Gigatribe chats were made. [ 88 ] Nonetheless, interestingly, one of Mr. Clayton’s students, Mr. Aziz Khadem, testified that he met with Mr. Clayton after the course on the 6 th at around 5 p.m. At first they were standing outside and then they were in Mr.

Clayton’s car. They met for 3/4 of an hour to an hour. He said that although Mr. Clayton had used his computer that day he did not see him use it while they were meeting. Clearly Mr. Khadem, although I believe he was trying to be honest, did not remember accurately since the computer was used by Mr. Clayton at that time. Also, Mr. Clayton did not mention anything about this meeting in his testimony. Perhaps the meeting occurred on another day - it was over a year and a half after the event that Mr.

Khadem was contacted, so his memory could understandably not be accurate. [ 89 ] Another alibi witness also testified about the end of the day on February 6 th , a co-instructor, Mr. George Garai. He indicated that he recalled that a group photo was taken after the course at about 5 p.m. and that they spent some time cleaning. Neither Mr. Clayton nor Mr. Khadem mentioned anything about this group photo. However, Mr. Garai was not sure where Mr. Clayton was after the course because “he wasn’t paying attention to Mr.Clayton’s movements”. He said as well that as a result he is not sure if Mr.

Clayton met with another student after the course. He too was contacted just before the trial in November 2011 about his recollection, so his evidence is not surprising considering the lapse of time. This timing does not necessarily preclude Mr. Clayton accessing his Mac in my view. [ 90 ] In sum, the Crown has satisfied me beyond a reasonable doubt that Mr. Clayton did have access to his Mac on February 6 at the time the Gigatribe chats were in progress.

Sunday, February 7, 2010 [ 91 ] The Gigatribe chats on February 7, 2010 in question were sent at 6:55 p.m. (“hi”) and then nine separate short times between 7:12 and 7:31 p.m. This latter chat, and distribution of child pornography by Intotaboo, was with the undercover officer from Toronto, Det. Krawchuk.

The entries by Intotaboo, who we know in this instance was sending from his condo IP address, were mainly one word chats, for example: “Trade?” “Young, family?” “Hot” “yeah you” “sister, 3 - 9” “27” “stopped about 6 years ago” and “can I see please?”. [ 92 ] There was no real alibi witnesses called for this period of time. Both the witnesses who testified about this period of time, Mr. Clayton and his girlfriend Leah Ms, were of the view that Mr. Clayton was in his condo at that time with his Mac. The only issue then was whether he was using his Mac at that time (Ms.

Ms thought that he was sitting next to her watching the Super Bowl and did not think that he had his Mac on the couch, and Mr. Clayton agreed that he used his Mac later that night, but denied using it at the times in question). This is not really an alibi issue but more of a credibility issue that I will come back to. [ 93 ] Mr. Garai and Mr. Khadem also testified about events on February 7 th but were not able to comment on events after about 6 p.m. Mr. Garai in particular parted ways with Mr. Clayton around that time since Mr.

Clayton was on his way home. [ 94 ] Accordingly, I find that the Crown has satisfied me beyond a reasonable doubt that Mr. Clayton had access to his Mac at the times of the Gigatribe chats on February 7, 2010.

Sunday, February 21, 2010 [ 95 ] On this day, Intotaboo chatted with two other users on Gigatribe. The chats were between 12:15 and 12:37 p.m. There were 4 short chats with “Donna-pedo2" about trading and passwords being shared and 3 short chats with “vbnbvc” about what they were into, trading passwords and downloading Intotaboo’s material of “young” which was defined as “0 - 12”. [ 96 ] Ms. Ms testified that on the 21 st of February she and Mr. Clayton went shopping.

Firstly, they went to Marketmall, then to HomeSense, then to his office at Bankers Hall, then to Lululemon in the Mission area and then out for a very late lunch to an Italian restaurant, Guiseppe’s and from there, home. [ 97 ] Mr. Clayton testified that they left the condo at 11:00 - 11:30 a.m. and then went for lunch at an Italian café, not restaurant, downtown, first and that they then went to Marketmall, HomeSense to buy some new office organisers, and at some point stopped at the office to drop off stuff they had bought, and then headed home. He pointed to Ms.

M.s’ bank statement to show what purchases they had made. This statement included the charges for Giuseppe’s, Lullulemon, Ricky’s, Nine West and La Babie Nails. There was no receipt for HomeSense or other evidence of payment at that store or any other office supply store that day. Indeed, the credit card statement provided by Mr. Clayton for February 2010 shows that he had paid for a rental car but did not show an entry for HomeSense either. [ 98 ] The condo key fobs show that Ms.M.s’ was used at 11:42 to go out and 15:43 to come in, and Mr. Clayton’s was used at 15:47 out and 19:01 in.

Of course, theoretically they could have been together either of those times. [ 99 ] I reject Mr. Clayton and Ms. M.s’ evidence that Mr. Clayton did not have access to his Mac on February 21 st for the following reasons. Firstly, I have issues with Mr. Clayton’s and Ms. M.s’s overall credibility which I will elaborate on later. However, more particularly, the recounting of this shopping trip between Mr. Clayton and Ms. Ms was inconsistent in that they recount being at different places at different times. For instance, Mr. Clayton suggested that they went straight to a café downtown whereas Ms.

Ms said that they went to Market Mall. Ms. Ms says that later on they were in the Mission area (at Lululemons) and then went to a restaurant late in the afternoon.Whereas Mr. Clayton didn’t mention being in the Lululemon Mission area or going to a restaurant late in the afternoon at all. [ 100 ] Further, the receipts (and lack thereof) suggest that Ms. Ms was shopping on her own, not with Mr. Clayton on that day. [ 101 ] In sum, I do not believe that Mr. Clayton accurately recounted his whereabouts that day and I do not believe that Ms. Ms accurately recalled being with Mr. Clayton shopping on that day.

Indeed, according to Mr. Clayton’s key fob entries, he was at home and would have had access to his Mac at 12:15 - 12:37 p.m. when the Gigatribe chats occurred on the 21 st of February while Ms. Ms was out. [ 102 ] In my view, the Crown has proven beyond a reasonable doubt that Mr. Clayton had access to his computer on February 21st when the Gigatribe chats were going on that day. Saturday, February 27, 2010 [ 103 ] Mr. Clayton indicated that he was home all of that day packing to go to Chile.

His Mac was used both before and after a series of short Gigatribe chats between 1:22 p.m. and 1:30 p.m. for business emails. So it is clear that Mr. Clayton had access to his computer at those times and the fact that Ms. Ms and her mother came in and out of the condo that day is not really alibi evidence. Monday , March 1, 2010

[ 104 ] On March 1 st , there was a series of sent emails and aMSN pictures between approximately 10 a.m. and 6 p.m. (one of these aMSN messages was led in evidence and was child pornography in that it depicted an indecent act between a woman and a male child of about 5 or 6 years old). In addition, there were chats between Intotaboo and nine other Gigatribe users between 1:56 p.m. and 6:39 p.m. Ms. Carpenter meeting [ 105 ] Mr. Clayton testified that he was at work that morning, he probably came home, dropped his Mac off and then went to meet Ms. Carpenter at the Tim Horton’s across the street from the condo.

He said he was not sure of the time that he met with Ms. Carpenter. He felt it was later than the 1 p.m. noted in her diary since their planned meeting at Westhills could not work since he did not have a car that day because Ms. Ms was using it to shop with her mom. He recalled that she had to leave to pick up her child at 2:45 p.m., he believed so they likely met until then. Based on a review of his emails he reconstructed that the time they met was about 2 to 2:45 p.m. He denied sending any Gigatribe chats, but in particular those that were sent at 2:02, 2:03, 2:13, 2:44, 2:47 or 2:48 p.m. [ 106 ] Ms.

Carpenter testified that she was not sure what time she met Mr. Clayton that day even though her diary entry was for 1 p.m. meeting with “Dilligence”. She said “It didn’t occur to me that I would need to know two years later.” She had conversations with Mr. Clayton a “couple of times” and she told him that her recollection was this: “I remember that we had to change the meeting because you [Mr. Clayton] didn’t have a car that day; you were working from home that day.” [ 107 ] Ms. Carpenter recalled that she was going to meet with Mr.

Clayton at Bankers Hall but then this was switched to the Tim Horton’s across the street from his condo. She thought that they met for about an hour but was not sure. It could have been 15 minutes more or less. She thought that she had to leave around 2:45 p.m. to pick up her child. [ 108 ] In sum, Mr. Clayton’s testimony is again inconsistent with his alibi witness’ - he says he was at the office that morning and Ms. Carpenter says he was at home. He says they were initially supposed to meet at the Westhill’s Tim Horton’s, she says they were to meet at Bankers Hall at his office.

She has a diary entry of a meeting at 1 p.m. but now says she believes they met later but is not sure when or really for how long. He has no real recollection of when they first met other than reconstructing time through emails. [ 109 ] It is interesting to note that at the time that these reconstructions were being discussed between Ms. Carpenter and Mr. Clayton, they had not seen the key fob logs that were later entered into evidence. These logs note that Mr. Clayton’s fob was used at 8:28 a.m. for the elevator and 8:31 for the overhead door (which he could use to walk out or in as well as drive in or out).

His fob was not used again until 20:51 at the lobby door and 20:52 for the elevator. There is no use in between to suggest that he arrived home and went out and back again, or left and came back in the middle of the day. [ 110 ] In my view, this alibi evidence of Ms. Carpenter and Mr. Clayton is unreliable and I reject it. It is not based on memory but reconstruction of a diary entry that they both now say is wrong. It is inconsistent with the objective fob evidence that Mr. Clayton was not in his condo that day during business hours at all. Considering the number of times and locations that Mr. Clayton and Ms.

Carpenter met I can understand that there is confusion about where and when these events happened. Crush restaurant dinner [ 111 ] Mr. Clayton testified that he arrived home at 2:50 p.m. after meeting with Ms. Carpenter. Ms. Ms and her mother were at home - they had just arrived home before him. He had his Mac at home and was working on it at the kitchen bar while Ms. Ms and her mother were watching the Olympics on TV. They left for dinner at Crush restaurant at 5 p.m. On the way home, he went straight home and Ms. Ms and her mother went to Coop for some groceries before coming home.

It is possible that he was home at 6:36 pm when a Gigatribe chat was made (which he denied doing). [ 112 ] Ms. Ms testified that she took the day off of work because she had a dress fitting and she went shopping with her mother during the day. When she got home at 3:00 - 3:30 p.m., Mr. Clayton was there. They probably left to walk to the Crush restaurant for dinner together at around 5 to 5:30 pm. She said that was because that was her normal schedule, her mother usually eats early, and that they were probably hungry.

She said that after dinner they all went shopping together at the Coop and that they were not home at 6:39 p.m.

[ 113 ] Ms. M.s’s fob shows a lot of use that day: elevator access at 13:01, garbage room at 13:02 and lobby to service at 13:03. Later, at 13:32 there an overhead door swipe, 13:33 a Nova Park south and 13:34 an elevator access. Later at 15:29 there is an elevator access and at 15:32 an overhead door use. Finally, at 18:22 an overhead door use, 18:23 a Nova Park 1 South use and 18:23 and elevator access. [ 114 ] As noted previously, it is not always easy to interpret the fob use, nonetheless it does appear to show that Ms.

Ms was coming and going that day and was using the car - perhaps for her shopping as she indicated - and again later on at 6:30 p.m. where it appears to have been parked at the condo. [ 115 ] However, the times do not coordinate with either Mr. Clayton or Ms. Ms versions of what happened that day. And their versions are also inconsistent with each other’s. For instance Mr. Clayton said that Ms Ms and her mother “had just arrived home before me” at 2:50 pm yet Ms.

Ms said that they arrived home at 3 to 3:30 pm and that he was already there. [ 116 ] They were both quite sure what time they left to go to the restaurant, but neither testified about when they left the restaurant except to say that Mr. Clayton thought he could have been home, alone, at 6:39 p.m., and Ms Ms was quite sure that they went home together, via a Coop shopping detour, and that they were not home at 6:39 p.m. but indeed were still at the restaurant at this time. (There is a Coop purchase entry for March 1 on Ms. Ms and Mr.

Clayton’ s joint bank statement for $107.74, but no time entry and there is no receipt for the restaurant). Neither version coordinate with a car being parked at 6:23 p.m. [ 117 ] Finally, Mr. Clayton testified that Ms. Ms and her mother were watching the Olympics between 2:50 and 5 p.m. - which is somewhat odd since I take judicial notice that the Olympics were over on February 28, 2010. [ 118 ] In sum, in my view, the stories that Mr. Clayton and Ms. Ms cobbled together with emails and receipts about March 1 are unreliable and clearly mistaken.

I reject their evidence in this regard. [ 119 ] The Crown has shown that there was a significant amount of work being done on Clayton’s Mac between 10 a.m. and 6 p.m. on Monday, March 1, legitimate and illegitimate, and as a result I find that the Crown has proven beyond a reasonable doubt that Mr. Clayton had access to his computer throughout the day of March 1 and in particular when the Gigatribe and aMSN chats were ongoing between 1:56 and 6:39 pm. Tuesday, April 6, 2010 [ 120 ] There were Gigatribe chats that day at 4:31 p.m. to 4:52 p.m. and then a very short one at 6:05 p.m. For the latter chat both Mr.

Clayton and Ms. Ms testified that they were at Centini’s restaurant downtown. They reconstructed this from the fact that this was her first day at a new job and that they recalled going to dinner there to celebrate. There is no record of the dinner that night at Centini’s (although there was one for February 14, 2010) and there is a receipt for groceries being purchased at Coop near their condo. There is a $3 receipt for parking in the City of Calgary that day, with no time, which they believe show that they arrived at Centini’s and parked just before 6 p.m. [ 121 ] The fob records for the condo suggest that Mr.

Clayton entered through the lobby door at 7:09 p.m. and then accessed the elevator during the time he said he was at Centini’s. This timing coincides with Mr. Clayton’s tweet posted at 8:41 p.m. “Busy day ! Conference call with new client in Toronto, meeting with our new director, special Projects and orientation with new PR Associate.” Interestingly, this tweet was not dealt with in Mr. Clayton’s testimony and it does not correspond with an early dinner at Centini’s. [ 122 ] The fob records show that Ms.

M.s’ fob entered at 5:16 p.m. (her office was now only 2 blocks from their condo and she finished work at 5 p.m.), she exited at 5:51 p.m. and returned at 6:15 p.m. - again during the time she said she was at Centini’s. [ 123 ] The reconstruction of this day by Mr. Clayton and Ms. Ms does not coincide with the objective evidence and I therefore reject it as unbelievable. The evidence suggests that instead Mr. Clayton was at his workplace where his Mac and Internet were available until sometime before 7:09 p.m. As a result, I find that the Crown has proven beyond a reasonable doubt that Mr. Clayton could have had

access to his Mac that day at 6:05 p.m. Thursday, April 8, 2010 [ 124 ] There were Gigatribe chats on this day in the morning and later in the evening at 8:06 p.m. and 8:10 - 8:12 p.m. Mr. Clayton testified that there was an electricity outage at 6:10 p.m. and that it did not come back on until after Ms. Ms got home at 8:15 p.m. or so. The manager of the condo complex testified that the elevator went down around this period - and records from the concierge were entered that this was indeed the case at 6:08 p.m.

She did not have any information, like on all other occasions that the power had gone out, that there was a power surge that evening - although the elevators were not fixed until 10 p.m. [ 125 ] In any event, there is no dispute that Mr. Clayton was home with his Mac that night and at the time the Gigatribe chats were recorded. Certainly if the power was out for a period of time, it must have been on by 8:06 p.m. when Claytons’ Mac accessed the Internet. There was no evidence that this Mac could access the condo Internet without power. In any event this is not really alibi evidence.

Friday, April 16, 2010 [ 126 ] The Defence argued that an email address associated with Gigatribe was accessed at 8:24 a.m. at the Regus Wireless Café offices. The email itself was not entered into evidence so I am left unclear about what this was about. Reference was made to it in the cross-examination of the investigating officer, Cst. Jacobs wherein he said that “the last log in” was on April 16, 2010 at 8:24 a.m. Clayton and M.s’ Macs were seized on April 15, 2010.

As mentioned above, there was no Gigatribe program found on Clayton’s Mac that was still in existence, and indeed the program had crashed on April 12. So perhaps the reference was made to a log into the Gigatribe website email? [ 127 ] In any event, the Defence argued that it could not have been Mr. Clayton that logged in since he was not at the office until 8:55 a.m. (a security card log in time). Counsel base this theory in part on Ms. M.s’ testimony that she and Mr.

Clayton left their condo at around 8:15 a.m. and that they walked to her work a couple of blocks away so that she arrived as usual at work at 8:30 a.m. He then walked the 8 blocks from there to his office. Mr. Clayton testified that they left the condo at 8:20 a.m. and that after leaving Ms. Ms at her office, he then walked to his office arriving at 8:55. Further, Ms. Dawley, Mr. Clayton’s former partner, answered a leading question to the effect that she entered the office at 8:18 a.m. - an earlier time recorded from a Regus security card. She also said that she did not see Mr.

Clayton that morning until later. [ 128 ] Mr. Clayton’s fob log notes however that it was used at 7:56 a.m. - not 19 to 24 minutes later as suggested by Mr. Clayton and Ms. Ms. Further, the security card used to access the office that day at 8:18 a.m. was the one that was handed out to Mr. Clayton in July 2009, access card no 11002. Ms. Dawley testified that she got her own card and that she never used Mr. Clayton’s. Accordingly, I reject Ms. Dawley’s testimony that it was her that entered at that time. I find that she was mistaken. And I reject Mr.

Clayton’s evidence that he did not arrive until 8:55 a.m. as unbelievable. [ 129 ] I find that the Crown has proven that Mr. Clayton could have written the email in question at 8:24 a.m. Analysis Do I believe Mr. Clayton and his Defence witnesses? [ 130 ] I do not believe Mr. Clayton’ denials that he knew nothing whatsoever about the child pornography found on his Mac and that he was not involved in the accessing and distribution of child pornography to the detectives and others sent material via the aMSN program or made accessible via the Gigatribe program. I do not believe that Mr.

Clayton did not have access to his Mac at the time Gigatribe chats were in progress on the four days that he said that he did not (December 21, 2009, February 21,2010, March 1,2010, and April 6,2010) and I reject his evidence in that regard. Finally, I reject the Defence evidence that suggests that a hacker was responsible for the child pornography possession, distribution and access involving Mr. Claytons’ Mac. The following are the reasons for my conclusions in that regard.

Mr. Clayton’s evidence [ 131 ] Overall, I found Mr. Clayton’s evidence lacked credibility because it was internally inconsistent, sometimes obstinate and argumentative, and basically did not add up with the objective evidence that was put to him and that I accept as credible. Several examples follow. [ 132 ] Perhaps the most telling exchange that caught Mr. Clayton in a lie, in my view, was the fact that the Crown was able to show that Clayton’s Mac had been purchased new at an Apple store in April 2009 when Mr.

Clayton had initially said that he bought his Mac (the one that was seized) refurbished from Best Buy in June 2009. His hurried response that he had bought another computer at Best Buy in June 2009 did not ring true and indeed does not fit with any evidence that Mr. Clayton owned or used another computer. In my view, this story about buying his seized Mac at Best Buy was concocted by Mr. Clayton with the intent to show that it was possible that child pornography was on this Mac from a previous user without his knowledge. [ 133 ] Another telling exchange that marked Mr.

Clayton’s dishonesty with the Court, and a colleague of his, was his alleged visit to Haiti. In my view this exchange is insightful. Mr. Clayton was very careful with each of his answers, and I do not believe that he “misunderstood the question” when he was asked about being in Haiti. He had no hesitation initially about being there, only about when. He even knew for how long. Haiti after an earthquake is not something that you would forget or mix up. Further, he admitted lying to the recipient of the email in a business context when he suggested “he” was there as opposed to “his company”.

The email speaks for itself. [ 134 ] There were several other instances where Mr. Clayton was caught out by the Crown and made his evidence, as a result, incredible.

Such as: - the lie on his C.V. and on the Internet site LinkedIn about a University of Calgary degree that he does not have; - the denial that he changed the time on his Mac when he had to have done so according to expert evidence; -the denial that his home router was password protected when it was; and - the many instances that he testified he was somewhere else when objective fob evidence showed otherwise. [ 135 ] Finally, the evidence of the Gigatribe charges on his credit card are insightful.

The Defence had cross-examined and obtained admissions from the first few police witnesses about the fact that they had not gathered evidence from Gigatribe or from other sources to show that Mr. Clayton had paid for Gigatribe. The credit card statements that showed the payments on Mr. Clayton’s credit card came later on in the trial. As mentioned above, Mr. Clayton tried to explain this by suggesting that he basically was not very careful in reviewing his statements each month.

In my view, considering the short nature of the statements and the large space these charges took on the statements since the payment was exchanged into Canadian dollars, this explanation is incredible and I reject it. [ 136 ] In sum, considering Mr. Clayton’s lack of credibility I do not believe that he was telling the truth about not knowing about the child pornography on his Mac and its distribution from his Mac. Does the evidence nonetheless raise a reasonable doubt about Mr. Clayton’s guilt? [ 137 ] Even though I do not believe Mr.

Clayton’s evidence, considering the other evidence called by the Defence as well, does any of it raise a reasonable doubt about Mr. Clayton’s guilt? In my view it does not. [ 138 ] Firstly, as analysed above, I do not believe that any of the alibi witnesses raise any reasonable doubt about Mr. Clayton’s ability to have access to his Mac on the days alleged. Although I went through each day in detail I will make some comments more particularly about some of the alibi witnesses starting with Ms. Ms.

[ 139 ] Although Ms. Ms gave her evidence in a fairly forthright manner, she had admittedly collaborated with Mr. Clayton to try and come up with various versions of where they had been and when. She then presented this evidence, as did Mr. Clayton, as if they “remembered” doing this or that when in fact, in my view, they had no precise memory at all. This became clear when presented with other objective evidence such as Clayton’s Mac purchase receipt (which she had also said was purchased in June or July as opposed to April), the condo fob evidence and email evidence.

As I have discussed above, her evidence was clearly in conflict with the latter objective evidence that I accepted that showed that she was mistaken about the dinners of March 1 st and April 6th and the evening of February 7th.Accordingly, I did not find Ms. M.s’ evidence reliable or credible on these points. [ 140 ] With respect to Ms. Carpenter, as I have mentioned above, I found that she was trying hard to reconstruct her memory and did acknowledge basically how frail it was considering that she did not think she would ever be questioned about two out of dozens of meetings she had with Mr. Clayton back then.

Accordingly, although I found her to be truthful, her evidence was vague and unreliable. [ 141 ] The two witnesses that Mr. Clayton called that were involved with the course he gave were both very credible but not helpful in terms of the issue of Mr. Clayton’s access to his Mac - indeed they had to have been mistaken with respect to its use on February the 6 th as discussed above. [ 142 ] The Defence also argued that the fact that other people were around Mr. Clayton when certain chats were underway, such as instances when Ms.

Ms and her mother may have been in the condo at the same time as the chats, and the fact that he would leave his Mac accessible to others at work, with his students, and at home, should raise a reasonable doubt that Mr. Clayton would engage in these chats. [ 143 ] Firstly, I note that the chats in question were very short and would have only taken a few key strokes to do, so the presence of others would not necessarily preclude such activity. Further, Mr. Clayton admitted, when pressed, that he would not have been comfortable with Ms.

Ms seeing all the activity that he was engaging in on his Mac, so in my view, it would have been fairly easy to keep what he wanted to keep hidden away from her view if he wanted to. [ 144 ] Further, Clayton’s Mac and both the aMSN and Gigatribe programs were password protected. As a result, they were not accessible to any of the others that might possibly use his Mac briefly. As a result, this evidence does not leave me with a reasonable doubt about Mr. Clayton’s guilt. [ 145 ] This leaves us with the expert evidence. I have already found that in my view the November virus on Mr.

Clayton’s Mac could not have executed to the point that a backdoor access would have been allowed for a hacker to go through. However, his experts also testified that the two Macs could have possibly been hacked into on other occasions and there is no way of knowing now if that occurred or not. [ 146 ] The Crown argued that there was no air of reality to this defence and as a result it should be rejected entirely. As stated in R. v. Cinous , 2002 SCC 29 , [2002] 2 S.C.R. 3, the question is whether there is evidence upon which a properly instructed jury might convict.

The Defence refers to his expert computer testimony in this regard. [ 147 ] Certainly, if I had accepted that a virus with the capability to allow a backdoor had indeed executed fully on Clayton’s Mac, there would be an air of reality to this defence. Without that finding however, the issue is more difficult.

Nonetheless, although I find that this defence is questionable, I will consider it. [ 148 ] In my view, the evidence does not raise a reasonable doubt that Clayton’s Mac was being controlled by a skilled virtual interloper, otherwise known as a hacker, for the following reasons. [ 149 ] All of the computer experts agreed that hackers usually attack a computer, get the information that they want, such as personal banking or credit card information, and then they get out.

It is notable that with all of the combined years of experience of the five experts, none had ever encountered a situation where a hacker attacked a computer to access and distribute child pornography.

[ 150 ] Here, the evidence shows that hundreds of child pornography photographs and videos were accessed and distributed on Clayton’s Mac between June 2009 and April 2010, a period of 10 months - a lengthy period of time. And during this whole period of time, there is not one allegation, other than a $5 per month charge in January, February and March, that this alleged hacker stole any personal information or accessed Mr. Clayton’s bank accounts.

Not only that, by supposedly using his credit card for the $5 dollar charge to pay for a premium version of Gigatribe (instead of, or in addition to, using a cracked version), this would have risked detection by Mr. Clayton. [ 151 ] This hacker would have had to use the aMSN account, presumably with his own password, without Mr. Clayton noticing over a period of several months. Considering Mr. Clayton’s extensive use of his Mac, this is incredible. [ 152 ] Since Mr.

Clayton denied any knowledge of the Gigatribe program, then presumably it was a hacker on the Ms Mac that was doing the research about Gigatribe and tried unsuccessfully to download it (before it was available on a Mac on December 4, 2009). The coincidence of two hackers interested in the Gigatribe program on two computers associated with Mr. Clayton, or even one on both, is also incredible. [ 153 ] This hacker would have had to not only install a Gigatribe program on Clayton’s Mac once, he would have had to do so over and over since the program crashed over 150 times. It is incredible to believe that Mr.

Clayton would not notice a problem or seek some assistance to service his Mac. [ 154 ] I also note, that even if I had accepted the Defence evidence that a backdoor access could have been put on Clayton’s Mac in November, 2009, the experts agreed that this virus could not account for the aMSN child pornographic material that was on Clayton’s Mac beforehand – or the material found on M.s’ Mac which was virus free. Further, there is no evidence that the Mac accessed porn from November 3 to December 8, 2009 when the Gigatribe program was available for Macs and installed.

It would be incredibly odd that a hacker with the sole purpose of using Clayton’s Mac for the accessing of child pornography would not use it for that purpose for over a month after it had attacked the computer. This behaviour goes against the normal “get in and get out” hacker behaviour discussed by the computer experts. [ 155 ] In the end, in my view the suggestion that there might have been a hacker responsible for the collecting and distributing the child pornography in question on Clayton’s Mac is purely speculative and does not raise a reasonable doubt of guilt.

Although I cannot rule out the possibility, the cases are clear that I should not arrive at such an inference when it is not reasonable to do so on the evidence: R. v. Friers , 2009 ONCJ 103 , R. v. Donnelly , 2010 BCSC 1294 . Such is the case here in my view. Has the Crown proven Mr. Clayton’s guilt beyond a reasonable doubt? [ 156 ] Although I do not believe Mr. Clayton, and his Defence evidence does not raise a reasonable doubt, am I satisfied that the Crown has proven that he is guilty of the offences charged in light of the evidence that I do accept?

In my view the Crown has done so. [ 157 ] As outlined above, Clayton’s Mac had hundreds of images of child pornography on it that had been placed on there between June 2009 and April 2010. Notably in this regard, two of the identical images were also found on M.s’ Mac in addition to the other material found on it. [ 158 ] Clayton’s Mac was password protected and rarely out of his sight.

Although his girlfriend and perhaps a few students and work colleagues may have had some very limited access to his Mac, I do not believe on the whole of the evidence that they could have been responsible for the material found on there. [ 159 ] The evidence of Det. Krawzyk and Sgt. Wickens is determinative in showing that child pornography in the form of photographs and videos were made available from Clayton’s Mac on the dates they chatted with “Intotaboo”. On all of the evidence, I have no reasonable doubt that “Intotaboo” was indeed Mr. Clayton. Further, I find that Mr.

Clayton was responsible for sending the child pornography photos via aMSN.

[ 160 ] As a result, I find that the Crown has proven beyond a reasonable doubt that Mr. Clayton knowingly possessed, accessed, made available, and distributed child pornography as charged. Conclusion [ 161 ] Based on the above reasons I find Mr. Clayton guilty on counts 1, 2 and 3. Heard on the 21 st - 25 th , 28 - 29th days of November, the 1 st , 2 nd , 12 - 14 th days of December, 2011 and the11th and 12 th days of January, 2012. Dated at Calgary, Alberta this 23 rd day of March, 2012. K.M. Eidsvik J.C.Q.B.A. Appearances: Jennifer Rees Alberta Justice Special Prosecutions for the Crown Balfour Q. H. Der, Q. C. Lisa Burgis for the Accused