R. v. Buss Date:, 2014 BCPC 185

Citation: R. v. Buss Date: 20140404 2014 BCPC 0185 File No: 196407-3-C Registry: Surrey IN THE PROVINCIAL COURT OF BRITISH COLUMBIA REGINA v. WILL LEE BUSS ORAL REASONS FOR JUDGMENT OF THE HONOURABLE JUDGE J.A. OULTON Counsel for the Crown: M. Fortino Counsel for the Defendant: J. Michaels

Place of Hearing: Surrey, B.C. Dates of Hearing: December 3, 4, 5, 2013; January 3, 13, 14, 15, February 27, 2014 Date of Judgment: April 4, 2014 [1] THE COURT: These are my reasons for decision in the case of R. v. Buss, Information 196407. INTRODUCTION [2] Mr. Buss, an American citizen, is charged with possession of child pornography, contrary to s. 163.1(4) of the Criminal Code. The charge arose when an image of a prepubescent naked girl was found on his laptop at a Customs secondary inspection at theCanadian border on September 14th, 2012.

A search warrant which issued November 7th, 2012 led to a forensic examination of hislaptop. On two folders on the computer, one user-created, there were 770 images of child pornography, showing girls aged one to 12,although many of them appeared to be aged two to six, and 192 videos containing child pornography. The photographs were found inthe Frostwire/Saved folder and the videos were found in the user-created Drivers folder. The full path of each of those folders was:C/Users/Will/Documents/Frostwire/Saved and C/Users/Will/Drivers.

Neither folder was on the desktop of the computer. [3] Three Border Services officers testified and the evidence of their superintendent was admitted. Crown also called an RCMPcivilian member as a computer expert whose qualifications as an expert were admitted in nine subject areas. Mr. Buss testified for thedefence. [4] It was admitted that the photos and videos on the computer were child pornography. It was established that these photos andvideos were on the computer, that is, there were “underlying data files” as R. v. Morelli 2010 SCC 8 has defined possession in thiscontext. It was admitted that Mr.

Buss, as the owner of this password-protected computer since August 2010, exercised control over thiscomputer. The issue to be determined is whether the Crown has proven beyond a reasonable doubt that Mr. Buss had knowledge of thechild pornography, photographs and videos, on his computer. Mr. Buss denies knowledge of the child pornography on his computer. LEGAL PRINCIPLES [5] The Crown case was circumstantial. Mr. Buss testified and was the only witness for the defence. I am required, therefore, toapply the principles enunciated in R. v.

W.D., (SCC), [1991] 1 S.C.R. 742 at 758 in the context of a circumstantial case. The required approach in assessing the evidence is as follows: If I believe the evidence of the accused, I must acquit. If I do not believethe testimony of the accused, but it leaves me in a reasonable doubt as to the guilt of the accused, I must acquit. Even if I am not left indoubt by the evidence of the accused, on the basis of the evidence I do accept, I must be convinced beyond a reasonable doubt by thatevidence of the guilt of the accused. [6] In this case, the credibility of Mr. Buss was a central consideration.

In our adversarial system of criminal justice, the truth-seeking function of a trial requires me to deal with any inconsistencies, contradictions and implausibility in the testimony of a witnessand to consider whether these affect the credibility of that witness. An accused person is presumed innocent until the Crown has provenhis guilt beyond a reasonable doubt. Where there is testimony from the accused, my decision is not based on a choice between theCrown's evidence and the accused's evidence. The task is not a binary choice or an either/or proposition.

The verdict of the court mustbe based on an assessment of the evidence as a whole, and whether on such an assessment, I am left with a reasonable doubt as to theaccused's guilt. [7] As I have said, this case is based on circumstantial evidence. Before a conviction can result from circumstantial evidence, Imust be satisfied beyond a reasonable doubt that the only reasonable inference that can be drawn from the proven facts is that the accusedis guilty: R. v. Cooper, (SCC), [1978] 1 S.C.R. 860 at 881. Other reasonable, or rational, inferences need only besufficient to raise a reasonable doubt.

There is no onus on the accused to advance or develop alternative theories that may be equallyrational inferences from the evidence as the theory of the Crown: R. v. Griffin, 2009 SCC 28 , [2009] S.C.J. No. 28 at paras. 34and 35. Nevertheless, a reasonable doubt must be a logical one, based on the evidence or on the absence of evidence: R. v. Lifchus, (SCC), [1997] 3 S.C.R. 320. Before an inference can be drawn there must be proven facts which logically give rise to thefacts sought to be inferred. Otherwise, the process is one of impermissible speculation: Caswell v.

Powell Duffryn Associated CollieriesLimited, [1940] A.C. 152. It is the cumulative weight of the facts that must prove the accused guilty beyond a reasonable doubt, and noteach item of evidence or fact examined separately: R. v. Morin (1988), (SCC), 4 CCC 3d 193 (SCC). CASE FOR THE CROWN [8] Mr. Buss agreed this was his computer. Much of what follows is a

summary of the evidence of the Crown expert Jenny Chauabout her examination of this computer, as summarized in Exhibits 12 through 16 in this trial. Much of this evidence was notcontentious. Mr. Buss bought this computer in August 2010 and the operating system was installed August 4th, 2010. It was password-protected and also protected with photo recognition software although Mr. Buss said that never worked and he did not use it, and I accepthis evidence on that point. There was only one user account on the computer, "Will," which Mr. Buss agreed was him. And the logoncount was 599 times in just over two years.

There was a guest account which had never been used. [9] Mr. Buss also agreed that Windows Live Messenger set up in the name of Will and with the e-mail addresswiblah@hotmail.com, was his account. The Skype account was in the name of Will and had a picture of Mr. Buss. Frostwire, a peer-to-peer file sharing program had been downloaded onto this computer. Mr. Buss admitted he did that. And Frostwire was set up in thename of wiblah, as well. The wiblah name was also used for a program called MIRC, a voiceover internet protocol. Mr. Buss agreedthat all these accounts were his. [10] On the desktop was a copy of Mr.

Buss' driving record and the screensaver was a photo of he and his then fiancée, now wife.

Intimate pictures of Mr. Buss' fiancée at the time were on the desktop. Mr. Buss' résumé was also on the desktop. Pictures of Mr. Buss and his passport photo were found in the Phone folder, a subfolder of the user-created Drivers folder. The Drivers folder was where the 192 child pornography videos existed in thumbnail form. [ 11 ] The Phone folder also contained photographs that Mr. Buss admitted he downloaded from his cellphone to that location. Ms.

Chau demonstrated via Exhibit 15 that to access the Phone folder a user would have to scroll through the child pornography thumbnail images before being able to access the Phone folder. Ms. Chau looked and found no evidence of any other user of this computer. She explained she looked for user accounts or personal documents or visits to websites or bank accounts for any person other than Mr.

Buss on his computer, and found none. [ 12 ] The desktop included three gadgets: (1) a CPU, which monitors the brains of the computer; (2) a network meter, which monitors network activity, for example, the strength of a wireless connection, keeping track of uploads and downloads, keeping track of the amount of data used; and finally (3) a drivers meter, which monitors the hard drive and tells an observer how much hard drive space is still available. Mr. Buss said he downloaded these three gadgets because they “looked cool,” but Ms.

Chau's opinion was that the presence of those gadgets on a computer desktop is “consistent with someone who wants to know exactly what is going on on the computer and on the network” and that “in order to use these gadgets, to understand and interpret them, would require someone who has above average knowledge of computers.” I will address this point later in my reasons, when I review Mr. Buss' testimony in more detail. [ 13 ] Ms.

Chau, who was qualified as an expert in this area, reviewed the Internet browsing history of the computer, and found that key words searched under Google on the computer were indicative of someone searching for child pornography-related files. Key words used included "PTHC" which are the initials of “preteen hardcore” and "Lolita." With respect to internet browsing history, a website called Jailbait Central Blogspot was visited August 29th, 2012, and teenporngallery.net was visited September 3rd, 2012. [ 14 ] Ms.

Chau scanned the computer for viruses or malware and found eight trojans but no evidence that any of them had executed, or run on the computer. She found no evidence that any virus or malware was responsible for the presence of child pornography on the laptop. She checked the times the viruses or malware were downloaded onto the computer in conjunction with the time that downloads of child pornography occurred and found no correlation or causation. She examined the date and time setting of the computer and found it to be working accurately.

She also found no signs of “remote hijacking.” In cross-examination she was asked whether it was possible that a malware program could have changed dates and times. She agreed it was possible, but highly unlikely in this case. [ 15 ] Ms. Chau testified that the Drivers folder in which the 192 child pornography videos were found, is a “user-created folder.” The folder was set to show “thumbnail” views, which means the first screenshot of the child pornography video with the title below it shows on the computer screen. Titles included \pthcPedolandFriframToddlerFucking&CumShots3yogirl,VeryGood!!!.mpg.

As I have said, in order to access the Phone folder located within the Drivers folder it was necessary to scroll past the thumbnail views of the 192 child pornography videos. [ 16 ] Mr. Buss admitted he created the Drivers folder and admitted he accessed the Phone folder located within it to download photos he had taken on his cellphone. To do so, he would have had to scroll past the thumbnails and the titles of all the child pornography videos in the Drivers folder.

He said the Drivers folder he created was on his desktop, but the forensic analysis of his computer showed that the Drivers folder, and there was only one, was not on his desktop. [ 17 ] Ms. Chau said the Frostwire Saved folder gets created automatically by the computer, as opposed to being user-created. [ 18 ] With respect to automatic downloads from Frostwire, she said the only automatic download would be updates to the software itself. Downloading of any file from Frostwire requires the active selection and participation of the user. Mr.

Buss admitted to downloading games and Hollywood movies from Frostwire, but denied that he had downloaded any child pornography. He testified that he was unaware that the Frostwire Saved folder existed and that he had directed Frostwire to save files to his desktop. Again, the forensic analysis of the laptop showed that the location of the Frostwire Saved folder was not the desktop of his computer. [ 19 ] Ms. Chau explained that in a former version, the Frostwire download location had been moved, and it had been saved to the desktop. Mr. Buss admitted he had changed the location to the desktop at one point.

The latest version of Frostwire had been last used around the end of August 2012, and downloaded around this time, as well. This version was no longer on the desktop. The default of Frostwire is to start automatically when the computer is turned on, but this had been de-selected by the user, as well, and Frostwire no longer started automatically. This also required a user's choice and selection. MR. BUSS' EVIDENCE [ 20 ] Mr. Buss' exculpatory explanations had three aspects.

The first two were that he did not have knowledge at the time, or later, of the child pornography on his computer because he allowed others, unspecified others, at unspecified times, access to the computer he controlled. This evidence asks the court to draw an inference that it was these unspecified others, at unspecified times, that downloaded that child pornography onto his computer without his knowledge, either at the time it was downloaded, or later.

The third aspect of his defence was the suggestion that a virus or malware could have been responsible for the presence of the child pornography on his computer. [ 21 ] Taking these three aspects in turn, the evidence he offered to support the inference that others had downloaded the child pornography onto his computer without his knowledge was that he had lived a transient lifestyle between August 2010 and September 2012, in rescue missions, and for six or seven days in between, on the street. His timeline for this evidence was a little unclear.

First he talked about living at a location called Building 9 until February 2010 which was six months before he owned the computer, which would not make it relevant.

But in any event, in the relevant period of time his evidence was that he stayed in rooms with no locks on the doors, and although he was of modest means at the time, and the computer was his most significant possession, he would leave it unattended in his unlocked room, and he would also leave it “logged on.” [ 22 ] When on the street for six or seven days, he would leave his computer with the other homeless men he was spending time with, if he was the one of the three of them who went out to buy the group dinner. He recalled one of them was named "Mike." Even if I were

to accept, and I do, that given Mr.

Buss' living situation at times others had access to his computer and he let them do so unsupervised, it does not explain the presence of such a quantity of child pornography on his computer, displayed in thumbnail form, in two folders, one user-created with subfolders, with 770 images and 192 videos that were downloaded, intermittently at different times of day and night, over an approximate two-year period of time, from August 6th, 2010 to July 22nd, 2012 for the 192 videos, and over a period of approximately one year, from December 28th, 2010 to January 17th, 2012 for the 770 photos. [ 23 ] If it were the case that there were only a few images of child pornography, in unallocated space, or perhaps even elsewhere on this computer, all downloaded at the same time or even on a few different dates, his exculpatory explanation might have raised a reasonable doubt for me on these facts.

But given the quantity, the location, the two-year time period, the thumbnail display, the likelihood that other users downloaded all of this child pornography is so remote that it does not raise a reasonable doubt. Given all the evidence in this case, I find this explanation implausible and I do not believe it. [ 24 ] Even if that explanation had been accepted or raised a doubt for me as to the provenance of the child pornography on his computer, it does not address why Mr.

Buss would not have come to know about the child pornography on his computer later, which would be, alone, a sufficient basis to establish his guilt on this charge. I find the exculpatory explanation he offered for that inconsistent with the following: 1. In order to open his Phone subfolder in the user-created Drivers folder, it was necessary to scroll down through the 192 thumbnails of the first screenshot of the child pornography videos. Mr. Buss admitted he created the Phone folder. He agreed that the computer was set to show thumbnails of the contents of folders. 2.

The DivX media player had viewed two child pornography videos recently. 3. He admitted downloading the games BioShock and BioShock2 from Frostwire on April 20th, 2012 at 18:23:04 and 18:27:44, and the downloading of images identified as child pornography: Batman's Babies; Shining Pretties; etc. (6 LS sets).torrent, began downloading from Frostwire at 18:20:28 on April 20th, 2012, three minutes before. His own evidence placed him at his computer within three minutes of child pornography downloading.

As Frostwire had been selected to download 15 items at a time, this suggests concurrent or contemporaneous downloading of child pornography and games while Mr. Buss agreed he was at the computer. [ 25 ] An aspect of Mr. Buss' disavowing knowledge of the child pornography on his computer involved some dissembling on his part about his level of proficiency with computers. First he said he had only basic knowledge, he could turn one on, play games or ask people if he had any problems.

Later he agreed that he knew more than an 80-year-old woman who buys a computer at Walmart, but I find his testimony on this point is inconsistent with: (1) his resumé, shown to him, taken from the desktop of his computer, which showed at line 1 that his objectives were, "To find a position in a company that can effectively utilize my computer , mechanical, detail-oriented, problem solving skills and customer service abilities." Jobs listed on this resumé included: Level II Tech Support Technician for Surfside Internet and the description of that position was: "Provide technical support/troubleshooting to customers regarding internet services, receive new customer calls and set up new accounts." When examined by his own counsel he testified that job took place in 2004/2005 in California and that he had resorted to manuals to assist in completing that job.

His resumé also listed Components Specialist for Fry's Electronics and the description was: "Provide assistance to customers seeking computer components including processors, memory, cabling, motherboards, cooling systems, cases, storage devices." Finally, under Skills, the second bullet reads: "Advanced knowledge of PC hardware/software/network repair and troubleshooting." When asked about this last point, his response in cross-examination was to say, "I lied on my resumé." This admission, whether true or not, reflects adversely on his credibility, either way, because he was either lying on his resumé where he claimed computer knowledge and related job experience, or lying in court, when he minimized his computer knowledge. [ 26 ] Other evidence in this case tends to suggest that it was in court that he was minimizing his level of knowledge.

Aside from his resumé, he had downloaded the three gadgets previously described onto his computer desktop. He admitted to creating .txt files. One .txt file shows a description of his fiancée asking him for help with her computer and his answer, which he said he copied and pasted from online, which was a technical explanation that he agreed had fixed the problem with her computer. He downloaded Frostwire, he had changed its location on his computer, moving it to his desktop at one point. He changed some of Frostwire's default settings. For example, it did not open automatically. He created the Drivers folder.

Finally, Jenny Chau's analysis showed that the user of the computer had used “regedit” commands, speaking directly to the computer rather than using a graphic interface, which “denoted someone with advanced computer knowledge,” in her view. [ 27 ] I find based on all the evidence that Mr.

Buss was minimizing his level of computer knowledge and based on the factors enumerated above, I do not believe his exculpatory explanations for how the child pornography came onto his computer and why he remained unaware for its presence; nor do those explanations raise a reasonable doubt. [ 28 ] With respect to the suggestion that a virus or malware could have downloaded the child pornography without Mr. Buss' knowledge, there was no evidence to support this contention and I reject that suggestion as implausible on the evidence in this case. [ 29 ] Finding that Mr.

Buss' exculpatory explanations do not raise a reasonable doubt is not the same as positive evidence of guilt. This is a circumstantial case and I must now go on to consider whether the Crown has proven his guilt beyond a reasonable doubt. I have already referred to the evidence relevant to the determination of the issue, but to summarize, it was Mr. Buss' computer, he agreed he controlled it, it was password-protected, there was only one user account, the name of the user was Will, Mr.

Buss admitted that was him, the Skype, Windows Live Messenger, Gmail, Hotmail, MIRC and Frostwire accounts on the computer were all his. His personal information, including a resumé, driving abstract, temporary residence application, passport photographs, and intimate pictures of his fiancée at the time, were all on this computer. There was no evidence of any other user of this computer, in particular as Ms. Chau describes searching the computer for other documents, searches or files.

The keyword searches and internet browsing history of this computer revealed a user with a continuing interest in child pornography. [ 30 ] There was a history of downloads to two folders, one user-created, over a two-year period. Mr. Buss admitted he created the Phone folder. He agreed that the computer was set to show thumbnails of the contents of folders. There is a deliberate process of steps

to download from Frostwire, and there is a deliberate process of steps to set up folders on a computer to store downloads. Mr. Buss was aware of that process because he agreed he set up Frostwire downloads to go elsewhere, to his desktop, at one point. [ 31 ] There was no evidence of malware or viruses that had run on the computer now or in the past. Ms. Chau's opinion, which I accept, is that it was not possible for any virus to have placed the child pornography on the computer.

Her opinion was based on the number of files, the multiple locations of the files, the time period over when the files were downloaded, a timeline analysis conducted on the computer, as well as the virus research she conducted. There was no evidence of remote hijacking. No defence expert testified. [ 32 ] Taking into account all of the evidence in this case I am satisfied that the only rational inference is that Mr. Buss had knowledge of the child pornography present on his computer and I find him guilty as charged. (REASONS FOR JUDGMENT CONCLUDED)