Her Majesty the Queen — v. —, 2022 ONCJ 111

A non-publication and non-broadcast order in this proceeding has been issued under subsection 486.4(3) of the Criminal Code . This subsection and subsection 486.6(1) of the Criminal Code , which is concerned with the consequence of failure to comply with an order made under subsection 486.4(3) , read as follows: 486.4(3) CHILD PORNOGRAPHY —

(1) In proceedings in respect of an offence under

section 163.1, a judge or justice shall make an order directing that any information that could identify a witness who is under the age of eighteen years, or any person who is the subject of a representation, written material or a recording that constitutes child pornography within the meaning of that section, shall not be published in any document or broadcast or transmitted in any way. . . . 486.6 OFFENCE —

(1) Every person who fails to comply with an order made under subsection 486.4(1), (2) or (3) or 486.5(1) or (2) is guilty of an offence punishable on

summary conviction. ONTARIO COURT OF JUSTICE CITATION: R. v. Shaporov , 2022 ONCJ 111 DATE: 2022·03·09 BETWEEN: Her Majesty the Queen — and — Aleksandr Shaporov Judgment J. Stanton ............................................................................................... Counsel for the Crown M. Sciarra ......................................................................................... Counsel for the Defendant Felix J.: Table of Contents: R. v. Shaporov I. Introduction 4 A. The Trial 6 B. The Defence Position 7 C. Decision 8 D. Organization of this Judgment 8 II. Electronic Evidence 10

A. Introduction 10 B. The W2V Website 11 1. The Existence and Purpose of the W2V Website 11 2. TOR Browser 12 3. Accessing and Downloading Child Pornography from W2V 13 4. “Flydaze”, and Various Permutations and Iterations of Same 13 5. “Super2323” 14 6. The W2V Credentials 14 7. Conveying BTC to W2V 15 8. Downloads from W2V 16 C. Coinbase BTC Wallet 17 1. Introduction 17 2. Coinbase Password 17 3. Coinbase Account Creation 18 4. Coinbase – Adding a Payment Card. 18 5. Coinbase Login to Convey BTC 19 6. Conclusion 22 D. The Defendant’s Computer 22 1. Lack of IPA Regarding Downloads 22 2.

The Downloaded Files 23 3. Linkfiles and Download Times 23 E. Conclusion – Electronic Evidence 25 III. Roman – Third Party Suspect 26 A. Introduction 26 B. Application Issue – R. v. Grandinetti , 2005 SCC 5 27 1. Crown Position 27 2. Defence Position 27 3. Characterization of the Roman Issue -- Did the Defendant Raise Third Party Suspects? 27 4. Was an Application Required? 28 C. Permissible use of the Defendant’s Statement to the Police 30 1. Introduction 30 2. The Right to Silence 31 3. Impermissible Use of the Statement 31 4. Discreditable Conduct 32 D. Does “Roman the Roommate” Exist? 32 E.

The Police Statement and Roman 34 F. Roman and BTC Mining 36 G. The Defendant’s Testimony in Court about Roman 37

H. The Roman Communications 37 I. Conclusion – Roman 38 IV. Deficient Investigation 39 A. Introduction 39 B. Reconstructed Memory and the Defendant’s Travels 40 C. Uber, Esso, the Mechanic, and Pizza 41 D. Possession of the National Bank Credit Card 44 E. Deficient Investigation – Tower Information and SMS Messages 45 F. Deficient Investigation - Roommates 45 G. Deficient Investigation – Roman 46 H. Deficient Investigation – Subway, Canadian Tire, Seneca, Restaurant. 47 I. Access to the Defendant’s Seized Items 48 J. Hacking 48 K. “Drinking Buddies” 49 L. Guests of Roman 49 M. Mercedes Benz Job 49 N.

Out of Province Travel 49 O. Conclusion 49 V. Credibility and Reliability of the Defendant 50 A. Demeanour 50 B. Credibility, Reliability, and the Criminal Burden of Proof 51 VI. The Criminal Offences – Knowledge, Possession, and Control 53 I. Introduction [ 1 ] Beginning in 2016, an international group of law-enforcement agencies investigated a child pornography website located in South Korea named Welcome to Video [W2V]. [ 2 ] The police investigation primarily involved authorities from the United Kingdom, United States, Germany, and the Republic of South Korea.

Ultimately, cooperating law-enforcement agencies conducted arrests of individuals in Australia, Brazil, Canada, Croatia, Finland, France, Hungary, Ireland, Italy, Poland, Saudi Arabia, Spain, Sweden, and the United Arab Emirates. [ 3 ] In the United States of America, the Department of Homeland Security led a diverse group of law enforcement and private industry contractors in the investigation of the W2V website. Investigators discovered that the W2V website was receiving Bitcoin [BTC] as part of the operation.

In the United States, specialized Internal Revenue Service investigators took a keen interest in this BTC angle. [ 4 ] On March 5 th , 2018, the Korean National Police Agency raided the premises where the server for the W2V website was housed. The website was neutralized.

The W2V server hard drives were forensically copied and provided to numerous police services around the world to investigate persons who had allegedly accessed the W2V website. [ 5 ] American investigators recognized that many users of W2V had conveyed BTC to a BTC wallet registered to W2V in exchange for access to the website and child exploitation material. The investigators obtained subpoenas for records held by virtual currency exchanges. [ 6 ] As part of the investigation of many individuals, the American investigators took note of one member of W2V who had selected “flydaze” as a username.

The American investigators examined records held by Coinbase – a BTC wallet company associated to the user “flydaze”. Based on the Coinbase subpoena results, the American investigators obtained the name, address, cellphone number, internet protocol address, credit card details, and other information, demonstrating that the BTC conveyed to the W2V website was from the defendant - Aleksandr Shaporov. The American investigators conveyed the product of their investigation to the Canadian authorities.

[ 7 ] Detective Constable ALEXA [D.C. ALEXA ] of the Toronto Police Service was assigned to the case. The Department of Homeland Security conveyed the identifying particulars of the defendant and the product of the investigation so far. D.C. ALEXA examined the actual files downloaded from W2V and determined that four of the five downloaded files met the definition of child pornography in the Criminal Code . He also investigated the residence of the defendant.

Finally, he confirmed the details of the BTC transaction, verifying that in fact, a BTC wallet associated to Aleksandr Shaporov conveyed BTC to the W2V website. [ 8 ] The Toronto Police Service executed a search warrant on the defendant’s residence and seized electronic devices. The defendant was arrested. He spoke to Defence counsel. He provided a statement to the police where he chose to speak about some subjects and declined to speak about other subjects. A.

The Trial [ 9 ] The main focus at trial during the prosecution case involved the continuity and admissibility of electronic evidence sourced from the W2V website, the devices seized from the defendant, and the electronic data relevant to the identity of “flydaze”. [ 10 ] The defendant retained special Defence counsel to challenge the seizures from his residence pursuant to s.8 of the Charter of Rights and Freedoms [ Charter ].

The defendant, as was his right, instructed prior Defence counsel to admit nothing, provide no admissions, and to vigorously challenge the admissibility of electronic evidence. [ 11 ] This provoked a significant response from the prosecution. The Crown Attorney went on to conduct a veritable “Master Class” in how to prove the continuity of electronic evidence, notwithstanding it’s international character. The “Master Class” continued with the prosecution’s meticulous approach to the admissibility of the electronic evidence and technical evidence in a criminal trial.

The prosecution response comprehensively addressed every single issue in this regard.

During submissions, Defence counsel cited the prosecution’s response and provided no submissions challenging the continuity or admissibility of the electronic evidence record. [ 12 ] The electronic evidence overwhelmingly and convincingly establishes beyond a reasonable doubt that a person using the defendant’s peculiar credentials conveyed BTC to the W2V website, accessed the W2V website, downloaded child pornography movie files to the defendant’s desktop computer, and opened the movie files. [ 13 ] While the electronic evidence solidly documents many facts supporting the identification of the defendant, there is one core area of evidence that deserves preeminent focus. [ 14 ] The W2V resided on the “Dark web”, a place unreachable by conventional web browsers.

A TOR-enabled browser, stripping the user of all identifying features in a quest for anonymity, had to be used. A specific URL address had to be inputted. In that remote environment, a person selected the username “flydaze” to create a free account on the W2V website. The prosecution has proven that the defendant held an affinity for this precise username. The defendant’s evidence at trial only confirms this fact. [ 15 ] The W2V website required users to select a password to accompany their username. These passwords were encrypted on the W2V server. The password selected by “flydaze” was also encrypted.

American investigators decrypted the password and discovered that “flydaze” selected the password “Super2323”. The prosecution has proven that the defendant commonly utilized this password. Again, the defendant’s evidence at trial confirms this fact. [ 16 ] In addition to the W2V login credentials, the prosecution proved that the five movie files downloaded from the W2V resided on the defendant’s desktop computer hard drive despite it having been reformatted. Further, the files had been opened. B. The Defence Position [ 17 ] The defendant testified at trial.

There are four central components of the defence presented at trial. [ 18 ] First, the defendant expressly denied accessing his Coinbase account, conveying BTC to the W2V website, or downloading child pornography. [ 19 ] Second, the defendant testified that he was not within his residence at the time BTC was conveyed to the W2V website or when child pornography was downloaded. [ 20 ] Third, the defendant testified a third party named Roman – his roommate at the time – was responsible.

He also speculated that perhaps his roommate could have admitted guests to the residence they shared, and the guests were responsible. [ 21 ] During submissions, Defence counsel eloquently submitted that a deficient police investigation and “tunnel vision” contributed to reasonable doubt. C. Decision [ 22 ] Ultimately, this criminal trial is resolved based on issues around identification evidence, the electronic evidence, and the technical record. These issues must be analyzed through the application of the criminal burden of proof as articulated in W.(D). v.

The Queen (1991), 63 C.C.C. (3d) 77 (S.C.C.) [ W.(D.) ], and with the guidance provided by R. v. Villaroman, 2016 SCC 33 [ Villaroman ], with keen attention to the contours of reasonable doubt. [ 23 ] On Thursday March 3 rd , 2022, I found the defendant guilty of possessing and accessing child pornography. I provided a brief outline of reasons in court and advised the parties that a supplementary written decision would be provided. [ 24 ] I do not believe the defendant’s testimony denying responsibility for having accessed the W2V website and downloading child

pornography. It is true that there are more than seven billion people inhabiting planet Earth.

While I accept that it could be a possibility that some one else on Earth would use either “flydaze” or “Super2323” as login credentials, the notion that someone other than the defendant would randomly use the combination of the two – both his peculiar username and his encrypted password of choice -- is too fantastic for rational acceptance. [ 25 ] In addition, I reject the implication presented by the defendant’s evidence -- that Roman compromised the defendant’s credentials on at least two separate occasions, on two different dates, for the purpose of surreptitiously downloading child pornography [ 26 ] The defendant’s evidence does not raise a reasonable doubt on stage two of the W.(D.) analysis.

Finally, having considered the guidance of Villaroman, I am not in a state of reasonable doubt nor are there other plausible theories or possibilities which are inconsistent with the defendant’s guilt. The purpose of this supplemental written decision is to more fully explain the findings outlined during the oral decision on March 3 rd , 2022. D.

Organization of this Judgment [ 27 ] There are four central pillars to the Defence case: [ 28 ] First, the defendant expressly denied accessing his Coinbase account, conveying BTC to the W2V website, or downloading child pornography. [ 29 ] Second, the defendant testified that he was not within his residence at these material times. [ 30 ] Third, the defendant testified in support of a theory that his roommate Roman was responsible.

He also speculated that perhaps his roommate could have admitted guests to the residence they shared, and the guests were responsible. [ 31 ] Finally, Defence counsel eloquently submitted that a deficient police investigation and “tunnel vision” weakened the circumstantial case presented by the prosecution thereby contributing to reasonable doubt. [ 32 ] The purpose of this written judgment is to explain in detail the findings I have reached and why I reached those findings.

My aim is to be responsive to the issues at trial and the submissions of counsel. [ 33 ] First, I will address the admissible electronic evidence record. [ 34 ] Second, I will squarely address why I reject the central premise of the defendant’s testimony – that his roommate Roman was responsible.

I will analyse the defendant’s defence and the evidentiary record using the guidance in W.(D.) and Villaroman. [ 35 ] Third, I will address why the submissions suggesting inadequate police investigation have minimal impact on my findings. [ 36 ] Finally, I will summarize the credibility and reliability findings concerning the defendant. [ 37 ] This written judgment is provided as the best means to explain my findings to the defendant, provide public accountability, and provide for appellate review: (See the authorities cited in R. v. G.F. , 2021 SCC 20 , at para. 108 ) II. Electronic Evidence A.

Introduction [ 38 ] The lion share of multiple days of trial focused on continuity and the admissibility of the electronic evidence and technical evidence record. [ 39 ] During submissions, Defence counsel submitted that previous Defence counsel focused on issues around continuity and the admissibility of the technical record. As a result, the Crown “plugged those holes” by presenting a comprehensive record addressing these issues. Defence counsel took the responsible position that given the record adduced by the Crown, the Defence would present no submissions on the issue.

Defence counsel invited the court to seize upon any perceived weakness in the record in aide of reasonable doubt. [ 40 ] This court received a significant exposure to the electronic record during the litigation on the s.8 Charter application.

Notwithstanding Defence counsel’s concessions concerning continuity and the electronic record, I have re-examined the submissions presented by two prior Defence counsel on the s.8 proceedings [1] and re-canvassed the record a second time using my notes of the evidence and a digital record of the trial. [ 41 ] Front of mind during this endeavour is Defence counsel’s appropriate caution that a trier-of-fact should be cautious and guard against the apparent allure of electronic evidence.

While electronic evidence is silent, and presents as objective, I heed Defence counsel’s submission that we are dealing with human beings, and a trier of fact should carefully examine what facts have been established. [ 42 ] I conclude that the prosecution has proven the entire electronic evidence and technical record. Given the appropriate position taken by Defence counsel and the sheer enormity of the electronic evidence record, I decline to comprehensively regurgitate the electronic evidence record in this judgment.

Nor will I exhaustively document every single available conclusion provided by the evidence: Welton v. United Lands Corporation Limited , 2020 ONCA 322 , at paras. 56-63 . I will restrict myself to explaining the factual findings that I rely upon in support the defendant’s guilt.

B. The W2V Website 1. The Existence and Purpose of the W2V Website [ 43 ] There is no question that the W2V website existed and that the purpose of the W2V was to facilitate the distribution of child pornography. [ 44 ] As to the existence of the W2V website, law enforcement persons accessed the website, observed topic contents, the organization of the contents including thumbnails of movies, [2] and even acquired child pornography. South Korean law enforcement seized the servers supporting the W2V website.

Forensic examination showed the contents and workings of the W2V website. [ 45 ] As to the purpose of the W2V website, having regard to the electronic evidence, and the viva voce evidence of Jeffrey DANIELS [DANIELS], Christopher MCGUCKIN, Darrell FRANKLIN, and Aaron BICE [BICE], there is no question that the purpose of the website was to facilitate the distribution of child pornography.

It is incontrovertible, that this purpose would be apparent to any person accessing the site. [ 46 ] The W2V website provided membership privileges including access to child exploitation material through the acquisition of points funding by the conveyance of BTC or uploading child exploitation material. [ 47 ] Given the evidence provided by DANIELS and FRANKLIN, I am satisfied that persons downloading child exploitation material had the opportunity to see thumbnail pictures of the contents of the material prior to download.

Having regard to the evidence of BICE, I am satisfied that the five videos at issue in this case were in fact available on the W2V website. [3] [ 48 ] Homeland Security Investigator FRANKLIN accessed the website on August 31, 2017, September 28, 2017, February 22, 2018, February 23 rd , 2018, February 24 th , 2018. The child exploitation material was arranged by categories such as “child porn” “boys” or “cellphone videos” byway of example.

The children ranged in age from 3 or 4 years old to aged fifteen, sixteen, or seventeen. [ 49 ] Investigator FRANKLIN has a vast experience as an investigator having been involved in perhaps one hundred child exploitation investigations. He has sufficient experience to ascertain age of persons in videos.

In addition, he defined what constituted child pornography from his perspective as an American law enforcement agent, I am satisfied that his definition mirrors the Canadian definition of “child pornography”. [ 50 ] It is true that none of the investigators accessed the W2V site on the same day as the downloads in this case. But I am satisfied that the W2V website did not materially change throughout all of the times FRANKLIN attended including the time he visited, 11 days after the downloads at issue in this case. 2.

TOR Browser [ 51 ] A TOR enabled browser was required to access the W2V website. [ 52 ] In his statement to the police, the defendant told the police that he had the TOR browser installed. During cross-examination at trial, the defendant suggested that his admission to possessing the TOR browser during his police statement was restricted to the time- frame of his arrest (i.e., not necessarily at the time of the offence). [ 53 ] This was a transparent attempt by the defendant to adjust his evidence in cross-examination because he perceived that it might assist him. I reject this vacillation.

The context of the TOR-related discussion in his statement is clearly August 2017. Listening to the defendant being cross-examined on this issue, it was apparent that defendant wished to present some lack of clarity as to the existence of the TOR browser on his desktop computer in August 2017. [ 54 ] The prosecution has proven that the defendant’s desktop had the TOR browser installed. In particular, D.C.

Jeff KIDD testified that TOR was installed on the defendant’s desktop computer. [4] [ 55 ] It is also important to note that the electronic evidence in this case establishes that the TOR browser does not allow for an “autofill” function for password insertion on websites. The W2V Darknet website was only accessible via a TOR browser. The person who downloaded child pornography on the defendant’s computer would have had to possess the username “flydaze” and the password “Super2323” as I have explained above.

Even if I believed the defendant’s position that Roman must have been responsible (and I do not), there was no way for Roman to use TOR to access W2V website without the defendant’s peculiar username and password. [ 56 ] The Crown insinuates possession of a TOR enabled browser is suggestive of culpability. While there are circumstances where that might be so, I must stipulate that in this case, I do not draw any adverse inference against the defendant based solely on the fact that the defendant possessed a TOR enabled browser. The defendant is a Russian national who lived in Russia.

I do not believe that I am engaging in baseless stereotypical reasoning by acknowledging that persons in certain countries commonly use TOR to avoid scrutiny from government oversight. [ 57 ] What remains is the credibility finding that the defendant sought to adjust his testimony, even in the face of his own admission to the police and the definitive evidence provided by D.C. KIDD – that his desktop had the TOR browser installed. 3.

Accessing and Downloading Child Pornography from W2V [ 58 ] Amongst the thousands of persons allegedly involved in accessing and downloading child pornography on the W2V website, this case concerns a single user [5] named “flydaze”. [6]

[ 59 ] Investigator DANIELS examined the W2V server hard drives and determined that on April 4, 2017, a server backup disclosed a member named “flydaze” with an encrypted password. By December 30, 2017 “flydaze” had accumulated 95 points on the website, used 0.01 BTC, and had downloaded five specific child exploitation videos. [7] 4. “Flydaze”, and Various Permutations and Iterations of Same [ 60 ] The Crown has proven beyond a reasonable doubt that the username “flydaze” was used by the defendant in myriad websites.

The defendant’s affinity for all things “flydaze” extended to permutations using the root “flydaze” across several email addresses and usernames. [ 61 ] In addition, in his statement to the police, the defendant initially refused to discuss usernames [8] but later, when asked in a different way, told the police that he used “flydaze” for Facebook and non-TOR websites. [9] [ 62 ] When cross-examined – the defendant broadened this narrow admission to encompass his predilection for using the name “flydaze” in a plethora of electronic locations. 5. “Super2323” [ 63 ] When Homeland Security Investigators first acquired the username “flydaze” there was an associated password, but it was encrypted.

Certain means were used to defeat the encryption. As a result, the Crown has proven beyond a reasonable doubt that the unencrypted password for user “flydaze” on the W2V website was “Super2323”. [ 64 ] This is significant because as part of the electronic evidence record adduced in the prosecution case, the Crown also proved that the defendant used password “Super2323” on a transportation application housed on his iPhone. [10] [ 65 ] During direct-examination the defendant acknowledged that he used this password across a number of websites and email accounts.

He also volunteered that it was his password on Coinbase subject to his constant refrain accompanying his evidence -- “to the best of my recollection”. 6. The W2V Credentials [ 66 ] As it concerns the issue of identity, the prosecution has proven beyond a reasonable doubt that the combination of “flydaze” and “Super2323” was used by the person accessing the W2V website in this case. [ 67 ] There are more than 7 billion people on Earth. The defendant told the police that the username “flydaze” was the name of a song performed by an American music band.

While no evidence has been presented as it concerns the fanbase or popularity of the American band or their song “flydaze”, I may infer that there must exist other persons who are fans of the American band and perhaps even the song “flydaze” – the defendant must not be the only fan. As such, perhaps there are others in the world who could possibly select the username “flydaze” on W2V.

Perhaps there are also others in the world who would select the password “Super2323”. [ 68 ] But the notion that a person, other than the defendant, selected his username of choice, and combined it with his password of choice, in joining the W2V website, is implausible. I would require the skills of a mathematician using a probability theory calculus to determine the magnitude of the coincidence that a person, other than the defendant, used his favoured login credentials. No rational, logical, objective person could accept this as mere coincidence. [ 69 ] I reject the defendant’s evidence implicating Roman.

Further, his evidence does not raise a reasonable doubt. [ 70 ] The defendant told the police in his statement that he kept his passwords in his head. Even at trial, the defendant’s testimony was that Roman did not have his passwords. [ 71 ] There is no evidence or foundation for a reasonable inference that Roman possessed the login credentials for the W2V website. 7.

Conveying BTC to W2V [ 72 ] A significant aspect of the prosecution’s evidence involved proving the time that the defendant’s Coinbase BTC wallet purchased BTC, the time when the defendant’s Coinbase BTC wallet conveyed BTC to the W2V website, and the time when child pornography was downloaded from the W2V website. [ 73 ] Once again, I endorse the submissions of Defence counsel as it concerns any weakness in the electronic evidence record.

Notwithstanding the fact that Defence counsel did not challenge the electronic evidence record in submissions, he properly asserted that if there was a weakness, it should be examined by the court to determine if the prosecution has proven the case beyond a reasonable doubt. [ 74 ] The international investigation presented challenges around determining time. It is critical to keep in mind the differences between the usage of Korean Standard Time, Coordinated Universal Time [UTC], and Eastern Standard Time [EST] across the electronic evidence analysis.

Furthermore, it is important to keep in mind the application of Eastern Daylight Time [EDT]. [ 75 ] Defence counsel’s cross-examination of D.C. ALEXA illuminated the fact that the police investigation perhaps did not explicitly consider the application of the EDT change in August 2017. D.C. Alexa’s evidence on this point was unclear. I may take judicial notice of the notorious fact that in Toronto, Ontario, EDT is observed. I am confident that in August 2017 Toronto was experiencing EDT, contrary to the viva voce evidence of D.C.

ALEXA. [ 76 ] A fundamental consideration in a criminal possession case must be a focus on the time frame of possession. An error in time

could be a significant feature of a possession case. But, despite the controversy around this issue in the Crown’s case, ultimately, this issue did not contribute to reasonable doubt for several reasons. [ 77 ] First of all, D.C. ALEXA articulated the correct time, he just mislabeled the time as EST rather than EDT. The effect of persuasive cross-examination leading the witness into this error should not be understated.

Further, clearly the use of UTC is designed to mitigate the confusion that can result from time zones in technological investigations. [ 78 ] Second, as it concerns the timing of the BTC transfer from the defendant’s Coinbase wallet to the BTC wallet associated to the W2V website, D.C.

ALEXA checked the open source Blockchain capture of this transaction thereby verifying that the conveyance occurred on 2017-08-18 15:43.32 UTC which is 11:43 AM EDT in Toronto. [ 79 ] Third, both the Coinbase subpoena evidence and the W2V server observations made by DANIELS corroborate the time. [ 80 ] Finally, as I will more thoroughly explain further on in his judgment when I evaluate the defendant’s evidence, the precise time of the BTC conveyance is not critical as it concerns the defendant’s whereabouts on August 18 th and 19 th 2017. 8.

Downloads from W2V [ 81 ] The precise time of the BTC conveyance or the precise time of the W2V downloads is not critical to my evaluation of the defendant’s evidence. [ 82 ] The defendant’s position is that he was not present within his residence at the time a person logged in to his Coinbase credentials and conveyed BTC was conveyed to the W2V website. Nor was he present when child pornography was downloaded. [ 83 ] First of all, I do not believe the defendant’s evidence based on his lack of reliability and his lack of credibility.

But more particularly, given the defendants lack of specificity and precision in his evidence, his reconstructed memory of his movements at the relevant times does not equate to an alibi defence in the sense that he is suggesting that he was engaged elsewhere at the precise time of the BTC conveyance or the precise time of the downloads. Finally, later in this judgment I will specifically address the defendant’s evidence about his movements and explain why I do not believe the evidence, nor does it raise a reasonable doubt. C. Coinbase BTC Wallet 1.

Introduction [ 84 ] Daniel CURTIN [ CURTINS], the Director of Global Intelligence for BTC Wallet company Coinbase, attended court in-person and testified. The Crown adduced two large spreadsheets into evidence through this witness comprehensively addressing the activity that occurred on the defendant’s Coinbase account. This information was legally obtained by American law enforcement in the United States.

Of particular interest in this trial, the records capture both user inputted information associated to the accountholder as well as activity generated by Coinbase as a result of interaction with the accountholder. 2. Coinbase Password [ 85 ] During direct-examination, the defendant testified that his password to his Coinbase account was “Super2323”.

The implication being that Roman could have accessed his password. [ 86 ] I do not believe the defendant’s insinuation that Roman knew this password or accessed his Coinbase account for several reasons. [ 87 ] First of all, while it appears that the defendant used this password on many websites, the defendant testified that this was his password “to the best of my recollection”.

This was a ubiquitous caveat to much of the defendant’s evidence and did not inspire confidence in the reliability of the evidence. [ 88 ] Second, when asked about his Coinbase account during his police statement, the defendant told the police “ Oh. No. I don’t keep passwords on the computer. ” He also told the police “ I keep all of the passwords in, well, inside of my head. I don’t use anything to keep my passwords really .” [ 89 ] Third, during his police statement the defendant was asked if he was in the habit of leaving his BTC wallet open on his computer, and he agreed he was not.

I would also observe that according to the defendant’s testimony at trial, he did not even use his Coinbase BTC wallet – all the more reason to conclude that it was not left open on his computer in an insecure manner for Roman to surreptitiously access. [ 90 ] Finally, the defendant admitted during his testimony that he never gave his Coinbase password to Roman. In fact, he never provided any passwords to Roman save for a generic password (e.g., 1234) used to access the desktop computer. 3.

Coinbase Account Creation [ 91 ] On January 16 th , 2017, a person created a Coinbase account using the name Alexsandr SHAPOROV, email address flydazeeffort@gmail.com , phone number 647-802-1922, and using the IP address associated to the defendant’s residence. [ 92 ] In order to create an account on Coinbase the defendant would have engaged two-factor security authentication involving communications sent to his Gmail account and his cellphone. He would have had to input an SMS code into the Coinbase website to set up the account.

[ 93 ] Coinbase customers may add a payment card to the account to fund the purchase of BTC. The customer must “add” the payment card which involves inputting the card information in the Coinbase website and then “verify” the card before it is used. Verification involves Coinbase charging a nominal amount to the added payment card. The accountholder must obtain this amount from their online payment card website and then input the nominal amount into the Coinbase website. [ 94 ] At the time this account was created, a person attempted to add the defendant’s National Bank credit card but was unsuccessful.

Shortly thereafter a person successfully added the defendant’s CIBC credit card. 4. Coinbase – Adding a Payment Card. [ 95 ] In direct-examination, the defendant was adamant that while he had opened a Coinbase account, he never engaged in any activity in relation to the account and specifically, he did not add any payment cards to fund the account at any time.

He explained that when Roman moved into his residence in January 2017 he provided the defendant with a list BTC wallets and guided the defendant in this regard. [ 96 ] During cross-examination the defendant acknowledged receiving the two factor communications from Coinbase. He initially maintained his position that he never added any credit card payment cards to his account. As cross-examination went on, he changed his position and ultimately admitted that he added his CIBC card to the Coinbase account.

He then expanded his testimony to explain that when Coinbase required a verifying phone number and credit card to purchase cryptocurrency he abandoned the endeavour of verifying the account. The defendant did not address the unsuccessful attempt to add his National Bank credit card during his testimony. [ 97 ] The defendant’s testimony was materially inconsistent on this issue. It is also curious that he did not explain why adding a verified phone number and credit card in his name to purchase cryptocurrency caused him to abandon the endeavour.

If it is true that Roman re-ignited his burgeoning interest in BTC and BTC mining, why was adding a credit card in his name a problem? [ 98 ] I am satisfied beyond a reasonable doubt that the defendant set up this account. I am satisfied that he added the CIBC credit card as a payment card but never verified it. I am satisfied that the defendant was well aware of Coinbase two factor security procedures including the fact that multiple communications and procedures were involved. 5.

Coinbase Login to Convey BTC [ 99 ] The defendant disavowed any further contact with his Coinbase account after he opened the account in January 2017 until he was cross-examined. [ 100 ] On August 18 th , 2017, at 11:23 AM EDT an email was sent to the defendant’s email account and a person clicked on the email to acknowledge it confirming and thereby facilitating entry into the defendant’s Coinbase account.

Thereafter, an SMS message was sent to the defendant’s iPhone with the two factor confirmation code, and an email was sent to the defendant advising of the sign-in to his Coinbase account. [11] [ 101 ] An attempt was made to add the defendant’s National Bank credit card [12] and the defendant’s CIBC credit card [13] but the attempts failed. The witness from Coinbase explained that this was not unusual, as Coinbase users often had difficulty adding credit cards.

At 11:40 EDT the defendant’s Russian card was successfully added to his Coinbase account, and he was authorized to purchase BTC. [14] At 11:43 EDT the defendant’s Coinbase BTC wallet, using the IP address associated to the defendant’s residence, conveyed 0.1 BTC to the BTC address for the W2V website. This transaction took approximately ten minutes to complete. [ 102 ] The defendant implies that Roman must have engaged this purchase. This is not plausible.

I am satisfied beyond a reasonable doubt that the defendant performed this transaction for several reasons. [ 103 ] First, while I concede that if the defendant is telling the truth, Roman had access to his desktop computer password (1234), Roman could not have successfully added the defendant’s Russian payment card to the Coinbase account. In order to successfully “add” and “verify” the Russian payment card a person would have required access to the online account for the Russian credit card and input the nominal mount charged to the card in order to verify that the person had access to this payment option.

While the defendant chose to speculate during his testimony that Roman could have written down his credit card numbers on a piece of paper, even the defendant’s evidence at it’s highest does not support Roman having online access to his Russian credit card. [ 104 ] During cross-examination the defendant testified that he did not provide any passwords to Roman other than the generic password to access the desktop computer itself.

There is no evidence that Roman had access to the defendant’s Russian payment option and no foundation to draw a reasonable inference that this was a possibility. [ 105 ] Second, the defendant received at least six emails, one SMS text message, and charges to his Russian credit card that had to be confirmed. When cross-examined on the fact that the defendant must have noticed these communications, the defendant testified that he could not recall any of these communications and speculated that perhaps all of the email messages went into his junk folder. I do not believe the defendant’s testimony.

His credibility was harmed by his evidence that he never received or could not recall receiving any of the flurry of emails and SMS messages associated with Coinbase login and BTC transaction. The defendant was notified by email and SMS message as his account was logged into.

Multiple emails were sent to the defendant as BTC was purchased and conveyed to the W2V website documenting each step of the process. [ 106 ] Third, it is not as if the defendant was receiving regular communications from Coinbase associated with frequent use so that I might infer that these communications were just “trees in the forest” of communications. These communications should have stood out as unusual. [ 107 ] Fourth, the defendant received the authentication communications when he set up the account in January 2017. His email and cellphone number had not changed.

Surely he received the messages in August 2017 as well.

[ 108 ] Fifth, when I consider the guidance of Villaroman on circumstantial evidence, I note the absence of evidence about the Russian payment card. The police did not obtain judicial authorization to seize the records associated with the defendant’s Russian credit card. But I also recognize that while there is no onus on the defendant, he voluntarily testified that he had access to the online accounts of all of his credit cards.

He did not produce a Russian payment card statement suggesting that the Coinbase process failed. [ 109 ] Sixth, during cross-examination on some basic features of Coinbase two factor identification process in 2017, the defendant was extremely sensitive to this area of questioning. He constantly couched his answers with caveats. He would not even acknowledge the two-factor identification process until the cross-examiner appropriately admonished him that the evidence had been presented in court just the day prior.

Then, and only then, was the defendant willing to acknowledge the Coinbase two-factor authentication procedures. [ 110 ] Finally, the person engaged in this transaction had all three of the defendant’s credit cards as they were inputted into the Coinbase account. The likelihood that the defendant left his National Bank credit card next to his desktop computer while he was supposedly out of the residence using the card to charge at Subway, Canadian Tire, a restaurant, and a parking lot is remote.

When confronted during cross-examination on this issue the defendant’s credibility was not assisted by his malleable speculation that perhaps he used Apple Pay (i.e., his phone rather than the physical card). [111] The Coinbase evidence documents the identify of the BTC conveyer (the defendant), the hash value associated with the transfer, and the fact that the W2V BTC address received the conveyance. [15] 6.

Conclusion [112] As to the circumstantial evidence of identity, I am satisfied beyond a reasonable doubt that the defendant opened the Coinbase account and that it was he who used that account to convey BTC to the W2V website. D. The Defendant’s Computer 1.

Lack of IPA Regarding Downloads [113] Defence counsel made no submissions challenging the admissibility of the electronic evidence but cautioned the court that if there were any weaknesses in the evidence that might inure to the benefit of the defendant, the court should address that evidence. [114] There is no evidence of the IPA address associated with the download of the child pornography from the W2V website. This evidence is commonly available in child exploitation cases.

It is notably absent in this case. [115] Having considered the issue in the context of the totality of the electronic evidence record, I conclude that this is not a weakness in the prosecution case or a source of reasonable doubt for several reasons. [116] The first reason concerns the username and login information used to access W2V.

As I have outlined above, the W2V login credentials were peculiar to the defendant. [117] Second, the Crown has proven beyond a reasonable doubt that the defendant conveyed BTC to the W2V website. [118] Third, the TOR browser does not disclose an IPA when traversing the electronic world including the Dark Web. [119] Fourth, the W2V website was an inherently illegal entity, and the server did not retain IPA information. [120] Given the totality of the admissible electronic evidence record showing “flydaze” was the member who downloaded the files, the fact that the prosecution proved the downloads occurred, and the defendant’s desktop contained evidence of the prior existence of four of the five files available on the W2V website, I have no hesitation in finding that the downloads occurred despite there being no evidence of the IPA associated with the downloads. 2.

The Downloaded Files [121] The defendant had control over the desktop computer, MacBook Pro, iPad, and iPhone seized and forensically investigated by the Toronto Police Service. [122] The desktop computer containing two hard drives was the central focus of the investigation given the evidence of the downloaded child pornography from W2V in unallocated space. [123] There was only one user-generated account on the desktop computer – “flyda”. The files were located on the hard drive in a folder under username “flyda”.

These files were in existence on the defendant’s hard drive [16] prior to the hard drive being reformatted. Even after the hard drive was reformatted, metadata associated with the files was still accessible by way of forensic examination. [17] [124] The Crown has proven that the five downloaded files [18] that existed on the defendant’s desktop hard drive shared the exact same file attributes [19] as the files that existed on the W2V server. [20] 3.

Linkfiles and Download Times [125] Defence counsel’s submitted caution around technical evidence is front of mind as I evaluated the evidence concerning the timeframe of downloads. Earlier in this judgment I outlined some potential confusion caused by the difference in time zones. As such, keen attention to the details around the downloads was important.

[126] If there is any confusion in the electronic evidence associated with the computation of time zones, the evidentiary record was amplified by the forensic examination of the defendant’s desktop computer and the evidence of DANIELS about the server-side workings of the W2V website. As it concerned the defendant’s hard drive, D.C. KIDD’s evidence about linkfiles was also highly probative on the issues of proving the downloads and possession. [127] D.C. KIDD testified that linkfiles are unique files created by the Microsoft operating system automatically when files are opened. D.C.

KIDD was definitive and clear -- that the only way for the system to create linkfiles is for the user to click on the file and open it. [128] D.C. KIDD explained that the linkfile itself contains valuable forensic information including the time and date the file was created, [21] the location of the file (i.e., external medio or fixed hard drive), the volume serial number, a unique net bios identifier, a Mac address akin to a serial number for a part of the computer, and the file size in bytes. [129] D.C.

KIDD testified that the child pornography files from W2V were in fact present on the defendant’s desktop hard drive. The filename pathway was C:Users\flyda\desktop\po. It is clear that the file attributes associated with the W2V files matched the files on the defendant’s desktop hard drive. While it was true that the hard drive had been re-formatted, this merely re-indexed the contents. By the time of the forensic examination by D.C.

KIDD, the linkfiles associated with the child pornography files remained. [130] It is also clear, courtesy of the linkfile evidence, that someone clicked on each file thereby “opening” the file. D.C. KIDD was definitive that the create time for the linkfiles evidence the downloaded file had completed downloading and a user had clicked on the file.

The evidence shows that the download times began on August 19, 2017, at 21:33:15 UTC until 21:40 UTC. [22] Having regard for EDT this would mean from approximately 5:33 PM until 5:40 PM Toronto time. [131] This is the central relevant factual conclusion as it concerns the issue of possession and accessing child pornography – the criminal offences before the court. The child pornography files were in fact on the defendant’s hard drive based on the unchallenged expert opinion evidence of D.C. KIDD. Furthermore, I accept D.C.

KIDD’s opinion evidence that the presence of linkfiles created on the defendant’s desktop hard drive is singularly associated with the action of having opened each downloaded child pornography file. [132] D.C. KIDD could not forensically tell when precisely the child pornography files had been deleted. This might have been a key issue had the defendant testified that he clicked on a downloaded file by accident or that he did not possess the mental intent to possess child pornography and he deleted the files at the first opportunity after download.

But the defendant did not so testify. [133] Lastly, my confidence in this evidence is bolstered by the evidence of DANIELS who independently forensically examined the W2V server. There was no suggestion at trial that these two experts worked cooperatively on this investigation. [23] That they arrive at the same conclusions around the download of child pornography files -- one having examined the W2V server, and one having examined the defendant’s hard drive -- lends strength to the certainty of the electronic evidence record. E.

Conclusion – Electronic Evidence [134] The criminal burden of proof is not compared to pieces of evidence in a case in a piecemeal fashion. A trier-of-fact must examine the case as a whole and apply the criminal burden of proof to the entire record. [135] The electronic record is circumstantial evidence of the identity of the person who conveyed BTC to W2V and downloaded child pornography.

As this is an essential element of the offences before the court, it is appropriate to consider the criminal standard of proof beyond a reasonable doubt as applied to the issue of identity. [136] The record outlined in this judgment definitively and persuasively establishes that the defendant is the person who set up the “flydaze” account on W2V, conveyed BTC, and downloaded child pornography. [137] I do not believe the defendant’s denial or his attempt to implicate Roman. But simple rejection of the defendant’s evidence is not enough in a criminal trial.

I must also consider stage two of W.(D.) and the guidance in Villaroman . III. Roman – Third Party Suspect A.

Introduction [138] During examination-in-chief the defendant testified that he was not home at the time the downloads occurred, he did not download child pornography, he never visited the W2V website, he never transferred BTC to the W2V website, and he was not aware of any child pornography being downloaded to his computer. [139] The defendant went on to testify that he had a roommate named Roman, [24] and that he was at home on the date and time of both the BTC conveyance and the downloaded child pornography. [140] The defendant testified that Roman had knowledge about BTC.

The defendant testified that he shared his desktop computer with Roman for the purposes of setting up a BTC mining operation. Further, he testified that Roman had the password for the desktop as they had jointly created an easy password (i.e., 1,2,3,4,) to facilitate their joint venture. Finally, during cross-examination on this issue, the defendant testified that he was not “pointing the finger” at Roman as it was also possible that Roman had admitted other unknown persons into the defendant’s condominium, and that others were responsible. [141] The defendant was an unreliable witness.

While I would not necessarily fault the defendant for some reliability issues given the timespan between the criminal offences and his arrest, he was also starkly incredible as it concerns his testimony in several areas.

Finally, while demeanour evidence is of limited assistance in a criminal trial, the defendant’s performance as a witness did not assist in the credibility assessment. [142] I do not believe the defendant’s evidence about Roman. [143] I do not harbour a reasonable doubt based on the evidentiary record at trial. [144] There are many reasons for these findings. B. Application Issue – R. v. Grandinetti , 2005 SCC 5 1.

Crown Position [145] The defendant’s testimony about Roman was characterized by the Crown Attorney as the invocation of third party suspects – both known (Roman) and unknown (the speculation about Roman’s admitting other persons who were potentially responsible). The Crown position is that the defendant’s invocation of other suspects clearly mandated a pre-trial application: R. v. Grandinetti , 2005 SCC 5 .

The Crown submits that given this issue arose for the first time during cross-examination, the appropriate remedy is an adverse inference. [146] Implicit in the Crown complaint is that the timing of the issue – arising for the first time during the defendant’s examination in chief – prejudiced the prosecution case. An application would have afforded the Crown an opportunity to investigate the claim that Roman was responsible. The Crown demonstrated a willingness and ability to present an international cast of witnesses in this case.

I am aware that an investigation might have even produced Roman as a witness at trial. 2. Defence Position [147] Defence counsel submitted that his cross-examination of D.C. ALEXA in December 2021 provided sufficient notice that the deficient police investigation of roommates was in issue. As such, given the Defence was entitled to point to a deficient police investigation of roommates, no formal application was required.

Defence counsel argued that given the Defence was entitled to point to a deficient police investigation of Roman in defence of the allegations, this did not invoke the third party suspects application requirement. 3. Characterization of the Roman Issue -- Did the Defendant Raise Third Party Suspects? [148] At trial, the defendant never explicitly testified that Roman committed the child pornography offences. Cloaked with a veneer of objectivity, the defendant reasoned that given he was not home at the time, Roman (and or others) must have been responsible. [149] In sum, [25] the central testimonial defence was (

i) the defendant was not at home at the time of the downloads; (2) the defendant did not personally download any child pornography;

(3) Roman was at home at the relevant time;

(4) Roman had the password to the defendant’s desktop computer; and

(5) Roman had more knowledge about BTC than the defendant (relevant to the conveyance of BTC to W2V). [150] There is no question that the defendant “pointed the finger” at Roman. He testified that Roman was the only person with possession and control of his computer at the time of the downloads. He speculated that Roman could also have let in a guest who was responsible. That the defendant refused to explicitly utter the words – “Roman did it” is not important. The defendant neatly and clearly implied that Roman was responsible and speculated that Roman could have admitted other unknown persons.

In my view, on the circumstances in this case, this is a clear invocation of third party suspect Roman. 4. Was an Application Required? [151] The Crown is on solid footing to submit that a pre-trial application was required: Grandinetti . I need not explore the preconditions associated with adducing evidence of third party suspects – none were met in this case. The Defence did not adduce a single piece of evidence concerning Roman let alone evidence directed at his responsibility for the offences.

In fact, the defendant testified (albeit in cross-examination) that Roman never displayed any interest in child pornography and never exposed him to any child pornography. [152] It may be that the Crown is absolutely correct. Whatever the Defence position on a deficient police investigation, the invocation of third party suspects required an application. But after careful analysis, on the unique facts in this case, I respectfully decline to draw an adverse inference against the defendant sourced in the failure to bring an application.

There are several reasons for this finding. [153] First, this is not a jury trial. Any prejudice against the prosecution was not cast amongst a jury with potentially exponential effect. While I in no way dimmish the application requirements, I can easily balance any prejudice to the prosecution. In this case there was very little prejudice to the prosecution’s conduct of the case. [154] Second, the Crown did not seek an adjournment to investigate Roman and secure reply evidence. I do not criticize this tactical decision.

It may be that the Crown Attorney simply decided that litigation on the record at trial was sufficient. [155] I am mindful that the Crown Attorney and Defence counsel have possession of the disclosure brief and a criminal trial judge is privy only to the admissible record adduced at trial. Based on the record adduced by the parties, I note that there was not a whisper of Roman throughout the prosecution case. Across all of the terabytes of data and seized evidence, there is but one slender reference to a “Roman”.

Or perhaps the Crown Attorney merely recognized that defendant never mentioned Roman in his police statement. An issue I will address in detail below.

[156] I also consider that the Crown Attorney may have simply determined that it would have been difficult to find Roman so an adjournment for this purpose would simply delay the trial. [157] Finally, as it concerns the identification of Roman, I am positive it was not lost on both Defence counsel and the Crown Attorney that the defendant did not even spell Roman’s last name correctly until his memory was refreshed during cross-examination.

I was curious about the defendant’s spelling of Roman’s name and even asked the defendant to repeat the spelling during his direct- examination. [158] There are additional reasons for my decision not to visit an adverse inference upon the defendant. I am entitled to rely upon Defence counsel as an officer of the court and a professional. Defence counsel’s professional opinion was that a pre-trial application was not required, and his cross-examination provided sufficient notice. I take Defence counsel’s submission in good faith. [159] Further, Defence counsel is owed some latitude.

Defence counsel came onto this case after it was commenced by another Defence counsel. I have no hesitation in finding that the circumstances would be challenging as new Defence counsel acquired a command of not only the disclosure brief, but the record of the proceedings. It is possible that the issue of a pre-trial application would have been addressed by current Defence counsel had he been on the case from the beginning. It is also possible that the issue of a pre- trial application was canvassed and rejected by prior Defence counsel.

Finally, it is also at least possible that the defendant’s testimony pointing to Roman was a revelation for Defence counsel or aroused Defence counsel’s ethical obligations. [26] Were this the case, of course, Defence counsel could not professionally or ethically so advise the court. [160] Finally, while not relied upon by Defence counsel during submissions, I find there is some appellate support for his conception of the proper approach in this case: R v. Gauthier , 2021 ONCA 216 , at paras. 41 to 51 . C. Permissible use of the Defendant’s Statement to the Police 1.

Introduction [161] Upon his arrest, the defendant spoke with legal counsel. Thereafter, he provided a video statement to the police. [162] The admissibility of this statement was initially challenged as involuntary and violative of s.8 of the Charter . Ultimately, the challenge was not maintained, and the statement was conceded as voluntary. [163] The defendant had spoken to a lawyer and clearly understood that he did not have to speak to the police. Nevertheless, the police cautioned him that he did not have to answer any questions. [164] The defendant had never been in trouble before.

I accept his testimony at trial that notwithstanding the objective presentation of the statement, he was scared and intimidated by the circumstances. Notwithstanding this understandable state of mind, the conversation between the defendant and the police was friendly, as much as a police interrogation can be “friendly”. There were a few jokes. The police did not raise their voices. The police did not pressure the defendant in any way. [165] The defendant’s will was not subverted in any way. [166] The defendant posed questions for the police. The police answered every question asked.

The police posed questions to the defendant. The defendant chose to answer some questions and respectfully declined to answer other questions. 2.

The Right to Silence [167] The defendant agreed to discuss some issues with the police such as his family background, educational pursuits, employment pursuits, differences between Russian society and Canadian society, his email address flydazeeffort@gmail.com, his phone number, [27] that he paid for his own internet, the identity of his internet provider, BTC mining, that he keeps his online passwords in his head, and that he had no earthly interest in child pornography. [28] [168] The defendant also exercised his right to silence and chose not to speak about other issues such as his place of employment, the password for his iPhone, [29] usernames, [30] whether he rents or owns the search warrant premises, [31] where he goes on TOR (except specifies certain “legal” places he will visit), [32] whether he has a BTC wallet, [33] the subject of BTC exchanges, [34] and passwords to investigate his claim that hackers may be responsible for the child pornography on his computer. [35] The defendant’s expressed wish not to speak about these subjects was respected by the police interrogators. [36] [169] It is critically important to clearly acknowledge that the defendant is entitled to the protection of the right to silence even when he choses to speak about some subjects and not others: R. v.

J.S. , 2018 ONCA 39 . [170] Clearly, the defendant was able to apply the legal advice he presumably received and made his own decisions as to topics of discussion. 3. Impermissible Use of the Statement [171] The statement to the police was not edited in any way. During the interview with the defendant there were certain themes enlisted by the police. One theme was to ask the defendant to explain how the evidence was inconsistent with his guilt. I have self-instructed as it concerns the criminal burden of proof and ignored these areas of questioning. 4. Discreditable Conduct

[172] During the defendant’s statement he provided, objectively speaking, an odd response to a question about whether he had observed child pornography before. This response involved the defendant volunteering information about his exposure to other online content. [37] During cross-examination, the defendant denied exposure to the other online content. The Crown Attorney sought to cross- examine the defendant about this issue arguing that a pre-trial application to adduce discreditable conduct could not have been anticipated.

Defence counsel submitted the issue was irrelevant and inadmissible. [173] For the purposes of this judgment, the particulars around this evidence need not be explored. Suffice it to say, it relates to highly prejudicial un-charged conduct on the part of the defendant. I find that it engaged legal considerations around the admissibility of other discreditable conduct.

I do not criticize the Crown Attorney or Police for failing to edit the statement to remove the reference to the subject matter because it was comingled with relevant and admissible discussion about child pornography. [174] As the Crown was in mid-cross examination, the cross-examination on this issue was received on a voir dire subject to further argument from counsel at the end of the trial. [175] While it might be true that the defendant was not forthright about this issue, in the end, I agree with Defence counsel’s submissions on this issue and I hereby rule the evidence inadmissible. [38] The prejudicial effect associated with admission of this evidence at trial is outweighed by the probative value of demonstrating that the defendant did not tell the truth about a peripheral issue.

I disabuse my mind of the issue. D. Does “Roman the Roommate” Exist? [176] The defendant testified that Roman was his roommate for more than a year – from fall 2016 until the end of October 2017.

He also testified that “he believed” that the building management received notice that Roman was a tenant and that “he believed” that Roman was on the marquee directory. [177] My preliminary focus is to examine the evidence as it concerns Roman given his prominence in the defendant’s evidence implicating him in the criminal offences before the court. [178] First, I observe that there is no objective evidence establishing that Roman was the defendant’s roommate in August 2017 or at any other time. [179] Second, for a person who apparently lived with the defendant for approximately a year, Roman has an ephemeral quality.

There is not a scrap of objective evidence showing any connection between Roman and the defendant’s condo. No lease, no contract agreement, not a piece of paper, no personal objects, no photographs.

Given the unkempt state of the defendant’s condo, (something the defendant testified was in existence in August 2017), it is perhaps surprising that there is nothing supporting Roman’s residency. [180] Third, it is interesting that the defendant testified that Roman’s roommate status warranted notifying the building management, yet there is no written document (informal or otherwise) memorializing the roommate agreement. It is also clear that the defendant, while visibly reluctant provide the information at first, ultimately testified that his condo was owned by his mother.

Even more reason for any available documentation to be available. Or, in the circumstance of a less formal arrangement involving the defendant given the landlord was the defendant’s mother, I note the absence corroborating viva voce evidence. [39] Whatever the arrangement, the defendant’s evidence that the building management received notice that Roman was living in the unit is self-serving. [181] Fourth, the exploration of objective evidence to support the existence of Roman as a roommate must consider the context of the admissible electronic evidence.

The electronic and technical evidence robustly implicates the defendant in the offences before the court as set out in this judgment. What is glaringly absent from the electronic record is any electronic evidence concerning Roman. [182] Having regard to the vast expanse of electronic evidence adduced at trial, there was not a spec of evidence even supporting the existence of Roman during the prosecution case. At the end of the defendant’s examination-in-chief, there was no objective evidence supporting the existence of Roman. It was only during cross-examination that emails from a Roman were adduced.

Nothing in the emails supports Roman’s residency. [183] While the defendant does not have an onus in a criminal trial, I may assess the state of the evidentiary record as it concerns issues of credibility. This is a credibility consideration about the defendant’s assertion that Roman was his roommate and that Roman was likely responsible for the crime. [184] The defendant never told the police about Roman, so I do not fault the police for failing to acquire evidence of Roman. The defendant possessed this peculiar knowledge of Roman’s alleged involvement in 2019,2020,2021, and 2022.

A trial judge is entitled to use common sense when evaluating the credibility of a witness. This is not reversing the burden of proof. I am simply recognizing that the defendant had the peculiar capacity to place information about Roman before the court. Yet the objective evidence supporting the existence of Roman was adduced into evidence by the Crown Attorney during cross-examination. And even that evidence does not support the defendant’s position that he was a roommate. [185] The defendant’s viva voce evidence in support of the existence of Roman and his status as a roommate has a flimsy foundation.

But I should not draw an adverse inference or refuse to analyse the main pillar of the Defence case. The prosecution has not established that the defendant fabricated this evidence on the stand. [186] For the purpose of analyzing the defendant’s evidence, I will assume that Roman actually existed and was in fact the defendant’s roommate for approximately one year. E. The Police Statement and Roman

[187] No defendant is compelled to testify at a criminal trial. Further, it was the defendant’s choice to testify implicating Romanduring his examination in chief. Strictly as it concerns the defendant’s credibility, it is notable that he had many opportunities to mentionRoman during his police statement and did not do so. [188] During the defendant’s interview the police provided an overview of the evidence they possessed incriminating the defendant.

The police also made it clear that they were dealing with child pornography accessed from the defendant’s residence in August 2017 – specifically August 17th, 2017.[40] During the interview the police asked the defendant about roommates during this time period towhich the defendant answered: A. “In the search warrant sheet showed me the date of 2017 August and I don’t remember what I was doing in August 2017, especiallysomething related to the topic of our conversation. Yah I don’t remember.” [41] Q. Did you have anybody who lives with you, who lived with you at that time? A.

At the time of 2017? [Sigh] [pause], I had roommates before, like you remember I told you about a girl living as my roommate andbefore her I had roommates, but I don’t think someone used to live there. Not at that time.[42] [189] During cross-examination, the defendant agreed that the above-noted portion of his statement referred to a prior conversationwith D.C. ALEXA that was not on video. During that conversation. he told the police about certain female roommates and the policeasked him further questions about those roommates.

The defendant also agreed, albeit under intense cross-examination, that he told thepolice that he did not have any roommates in August 2017. [190] During cross-examination the defendant on two clear occasions while discussing the subject matter of roommates during hisstatement, he never mentioned Roman. This was exceedingly fair on the part of the Crown Attorney. In fact, there were half a dozenoccasions during the statement where the police drew the defendant’s attention to the August 2017 timeframe and access to his electronicdevices.

Rather than discuss Roman the roommate at these junctures, the defendant engaged the police with myriad nihilistic speculativepossibilities such as “hackers” or “drinking buddies”.[43] The defendant engaged the police in rhetorical questions. For example: Q. Why would you download child pornography? A. That is a topic for a bigger conversation, and I would not like to speak about it right now. I have to ask myself, did I at all in August2017? Do I ? Did I do it? Was it me? Was it done on my computer? Was it done on my computer by somebody or was it someone usingmy computer through some sort of virus to mislead?

I have seen real stories of hackers and how they do it. They mislead the police sogood.[44] [191] In these endeavours, the defendant presented as exerting great effort, struggling to recall the time-frame in question, physicallystraining and demonstrating his effort at recalling the circumstances. [192] The defendant’s pre-trial silence about Roman can not be used as a “brick” in support of the prosecution’s “house of guilt”.

But Iam permitted to consider the inconsistent versions of events provided by the defendant at trial as compared to his police statementincluding material omissions as it concerns the assessment of his credibility: (See the instructive guidance provided in R. v. Kiss, 2018ONCA 184, at paras. 35-50 including the cases highlighted therein; R. v. J.S., 2018 ONCA 39, at pars 55-56; R. v. McNeill, (ON CA), [2000] O.J.

No 1357 (C.A.)). [193] The adverse credibility consideration in this area of the evidence is not founded upon the extraneous speculative thoughtpresented by the defendant as his effort in searching for truth, it is that all of this occurred without Roman, the central figure responsible,coming to mind. F. Roman and BTC Mining [194] The central premise advanced by the defendant is that he shared access to his desktop computer with Roman in furtherance oftheir developing BTC venture. According to the defendant, it was Roman who was the “expert” possessing BTC knowledge andexperience.

The defendant testified that his involvement was limited to supplying the desktop computer and a bit of financial capital. [195] While it is clear that portions of one of the hard drives attached to the desktop computer had been overwritten, it is still notablethat the forensic evidence does not disclose a single byte of evidence demonstrating a connection between Roman and the desktopcomputer. For someone who lived with the defendant for more than a year, and according to the defendant shared access to the desktopcomputer, it is remarkable that there is not a single item attributable to Roman.

The only user on the desktop computer was thedefendant.[45] [196] What about the BTC venture involving Roman as a mentor? Nothing. There is no evidence of even the preliminary efforts onthe part of Roman and the defendant to set up this venture. The defendant testified that ultimately the BTC project never flourished withRoman. So, despite this apparent interest, and the fact that Roman apparently lived with the defendant for many months, their mutualefforts produced no result. [197] If Roman was the “brains” why is he a ghost in the electronic record of the desktop computer?

If the BTC project was abandonedso quickly, why did Roman apparently still have access to the defendant’s computer in August 2017? The answers to these questions donot provoke reasonable doubt. [198] Finally, it is also notable that the forensic evidence discloses only the defendant associated with BTC wallets (Coinbase andPaxful). There is no evidence of Roman the “BTC expert” having a BTC wallet.

G. The Defendant’s Testimony in Court about Roman [199] The defendant testified in examination in chief that he did not tell the police about Roman because it did not occur to him. He was terrified during the police interview and neglected to mention Roman. He also neglected to mention a trip to New York as well. [200] During cross-examination the defendant testified that he did not tell the police about Roman because “ he did not want to get anyone else involved ”.

Leaving the manifest inconsistency aside for the moment, there is good reason to disbelieve the defendant’s evidence that he forgot about Roman – evidence of communications from Roman. H. The Roman Communications [201] During cross-examination the Crown Attorney confronted the defendant with a record of email communications from a “Roman” to the defendant. The defendant testified that he did not recall the emails from Roman. He further claimed that he had no recollection of Roman sending him money on the dates disclosed in the email correspondence. [202] The defendant was clearly unnerved by this evidence.

He physically squirmed and stammered as the Crown Attorney cross- examined him in this area. He was argumentative with the Crown (e.g., his quarrel over the use of the word “transaction”). The defendant’s memory was often refreshed by Defence counsel during direct-examination using such evidence, in fact, Defence counsel used a different portion of the same extraction report during examination-in-chief without complaint from the defendant.

But in cross- examination, the extraction did not assist the defendant with his memory. [203] The extraction report was illuminating. [204] First, apart from the defendant’s testimonial reaction, it was also interesting that he used the report to correct himself on the spelling of Roman’s last name – something he incorrectly provided during his earlier testimony. [205] But more important was the content of the extraction report. It documented a series of emails concerning interact money transfers from Roman to the defendant.

The last email from Roman is one month prior to the defendant’s arrest. [206] I do not believe that the defendant simply forgot about Roman during his police interview. The series of emails including one a month prior to his arrest should have made Roman top of mind. [207] Finally, during examination in chief the defendant was crystal clear that he had no further communication with Roman after the first week of November 2017. This evidence and cross-examination rendered that testimony manifestly untrue. A realization that I am confident dawned on the defendant as the Crown Attorney kept probing on the issue. I.

Conclusion – Roman [208] I am certain that there are many Romans in the world. It might even be true that the defendant had a friend named Roman. But I reject the defendant’s evidence about Roman insofar as it is being suggested that he was a roommate and responsible for the criminal offences before the court. [209] The defendant never mentioned Roman in his statement to the police. I do not believe either of the conflicting explanations provided by the defendant for why this occurred.

Furthermore, it is clear that a person named Roman was communicating with the defendant one month prior to his arrest. [210] I do not believe that the defendant forgot about Roman due to the pressure of the circumstances. I do not believe that the defendant did not mention Roman because he did not want to get anyone else involved (thereby implying he did in fact turn his mind to Roman but positively declined to mention him). The defendant could not even keep his story straight throughout his testimony. [211] There is no objective evidence supporting Roman’s status as a roommate.

There is nothing in the electronic record supporting Roman’s status as a roommate. I decline to rely upon the defendant’s viva voce evidence alone in support of the position that Roman was a roommate, let alone responsible for the criminal offences before the court, based on my assessment of the defendant’s credibility and reliability. IV. Deficient Investigation A.

Introduction [212] Having addressed the credibility and reliability of the defendant as it concerns a central pillar of the defence – Roman, I now turn to the analysis of a collection of other trial issues. [213] During submissions, Defence counsel comingled several trial issues with the assertion that the police suffered from “tunnel- vision” and failed to properly investigate the circumstances.

In addition, Defence counsel persuasively argued that the deficiencies in the police investigation were an important consideration both as it concerns a fair evaluation of the reliability of the defendant’s evidence that he was not at home during the timeframe of the child pornography downloads, and the notion of reasonable doubt. [214] As I have set out earlier in this judgment, the defendant bears no burden in a criminal trial. The defendant is entitled to point to an alleged deficient police investigation in combination with other issues and argue that there is reasonable doubt.

[215] While I do not find the defendant to be credible or reliable, I agree with Defence counsel that these issues must be addressed insofar as they are relevant to stage two of W.(D.) and the considerations under Villaroman given the circumstantial case presented by the Crown. [216] Having self-directed in this manner, while some of the submissions provided by Defence counsel are persuasive, in the end, on the analysis mandated by W.(D.) a nd Villaroman , I am satisfied beyond a reasonable doubt of the defendant’s guilt. I will explain my reasoning based on a number of factors set out below. B.

Reconstructed Memory and the Defendant’s Travels [217] Ancillary to the defendant’s testimony about Roman, he testified that he was not home at the time his Coinbase wallet conveyed BTC to the W2V website or at the time child pornography was downloaded to his desktop computer. The defendant testified t

[…]