r v. Jean-Roch, 2013 QCCQ 859

Unofficial English Translation R. c. Coupal 2013 QCCQ 859 JM 2091 COURT OF QUEBEC CANADA PROVINCE OF QUEBEC DISTRICT OF MONTREAL Criminal and Penal Division No.: 500-01-010877-071 DATE: February 5, 2013 ______________________________________________________________________ PRESIDING: THE HONOURABLE HÉLÈNE MORIN, J.C.Q. ______________________________________________________________________ THE QUEEN Prosecutor v.

Jean-Roch COUPAL Accused ______________________________________________________________________ JUDGMENT ______________________________________________________________________ Introduction [ 1 ] Jean-Roch Coupal is charged with possession of child pornography on February 9, 2007. On that date, a search of his home led to the seizure of a computer. [ 2 ] Some of the essential elements of the charge have been admitted.

It was not contested that the seized computer was that of the accused, who lives alone, and that some 10,000 images and one video that were found on this computer constituted child pornography. [ 3 ] According to the accused, who did not testify, the evidence suggests that he accessed child pornography well before the date of the search.

He is of the opinion, however, that the evidence cannot convince me beyond a reasonable doubt that on February 9, 2007, he had control of the contents at issue, which is an element essential to a conviction for possession of child pornography. [ 4 ] The prosecution, who decided, after a discussion on the subject, not to seek to amend the date stated on the information, considers that this is a continuing offence.

The ITO did not allege the distinct and separate offence of accessing child pornography … . [1] [ 5 ] Considering the testimony of Gilles Robert, a computer expert, who established that the contents at issue had last been accessed and double deleted six months prior to the search, I cannot agree with the prosecution's position. [ 6 ] For the following reasons, I find that the prosecution did not meet its burden of demonstrating that the accused was in possession of child pornography on February 9, 2007.

The evidence [ 7 ] The prosecution filed the report [2] of Henri Ho, a member of the RCMP working with the Integrated Technological Crime Unit. While examining the destroyed files on the hard drive of the accused's computer, Mr. Ho came upon a picture that appeared to him to be child pornography. The Internet address ... appeared at the bottom of the photograph. [ 8 ] He was able to establish that the file had been created on July 7, 2006, at 4:42:04 p.m. and that it had last been accessed on August 26, 2006, at 5:16:06 p.m., six months prior to the search.

He found two other similar files from the same Internet address, which had the same date of creation and the same date of last access as just mentioned. [ 9 ] The whole was immediately referred to Nathalie Morin of the Sexual Exploitation of Children Unit of the SPVM. Morin testified. She selected about 10,000 images that she considered to be child pornography. Gilles Robert

[ 10 ] As an investigator/analyst with the Technological Crime Unit of the SPVM, Robert's mandate was to identify the files that might contain child pornography from among those found on the accused's computer. [ 11 ] He identified and retrieved the images at issue using search engine software. Out of a total of 87,698 images on the computer's hard drive, 4423 images appeared to be questionable and were found in both retrieved and lost files. Additionally, 5722 images of a similar nature were found among the unallocated clusters. The images were found on the computer's C and D drives.

A questionable video was found in the Internet cache memory. [ 12 ] The hard drive was relatively small, with only 40 gigabytes. In Robert’s opinion, this is very average capacity. [ 13 ] According to the evidence, some of the numerous files with girls’ names ended up in the accused's computer as the result of concrete actions by the user. Unallocated clusters [ 14 ] Lost or retrieved files can be distinguished from files known as unallocated clusters by their properties.

The date of creation, modification and last access of a lost or retrieved file can be traced, but this is not the case for unallocated clusters. [ 15 ] Although we do not know the provenance of the unallocated clusters or the date on which they were created, modified or last accessed, we do know that they were sent to the trash folder, which was then emptied. The space was therefore free to be rewritten.

Once in the unallocated clusters, the images were outside the file system, not indexed, and thus inaccessible. [ 16 ] Robert testified that once they become unallocated cluster units, these files could no longer be accessed by an [ translation ] “average” user. Only a user with an [ translation ] “in-depth knowledge of computers” could do so, that is, one with [ translation ] “specific knowledge” that is [ translation ] “not within the range of the general public”. Lost files [ 17 ] The lost files are the orphan files that were all created on the same date and deleted on the same date by the user.

They were also double deleted, but the index for these files was not entirely erased, which is why Robert was able to trace some of the properties. [ 18 ] Here is the gist of Robert's testimony regarding these files: [ translation ] Therefore, it is obvious that there is a correlation between the handling of the images and the time frame, in 2006 between the months of July and August . It's obvious that on those dates, these orphans stayed there. So, it's certain that there is a period... Access and then deletion of these files.

As to what stayed as is, if you don't have a tool, or any knowledge, the only thing I'm saying, display System, go into the cache, it gives you the path, you will get to it and there is only the video. [Emphasis added.] [ 19 ] The 4423 images were created en bloc on July 7, 2006, and on August 26, 2006, they were sent to the trash folder, [ translation ] which was then emptied completely . [ 20 ] Therefore, if someone had wanted to see these images on the monitor again, it would have been impossible.

Since some of the properties of these files were still accessible, Robert was able to establish that they were all moved to the trash folder on August 26, 2006. [ 21 ] According to Robert's testimony, if someone had searched the computer on February 9, 2007, none of the approximately 10,000 images would have been displayed on the monitor without the use of editing tools that are not accessible to everyone. [ 22 ] An expert might have been able to [ translation ] “access some files in DOS, line by line, or on a black screen with white text, but really, it would have been difficult.

You really need specific knowledge to access them”. The video [ 23 ] R obert was able to establish that there were three videos, two of which had suffered the same fate as the lost files and the unallocated clusters. H e testified that all the questionable files had been deleted save one video, which was the only active file. Here is an excerpt from his testimony regarding this video: [ translation ] Obviously, it is clear that someone who understands computers to some degree, who can call up all of the System files, could simply access the Internet cache to see its contents.

Otherwise, by default, this same file would be hidden, because the Internet cache does not appear to the average user who does not do something specific to call up the files in the Internet cache . [Emphasis added.] [ 24 ] But there are Internet forums or other sites that explain how to find a file in the cache. [ 25 ] The name of the video in question was... . The Internet site gave this name to the file, which was uploaded to the browser.

It is only upon viewing the video that Robert was able to read a young girl’s name. [ 26 ] Robert was able to identify that the file had last been accessed on January 20, 2007. He could not affirm, however, whether it

had been the computer user who had accessed it. It is possible that it was accessed during a system scan by the antivirus software, for example. [ 27 ] Here is the exchange Robert had with counsel for the defence regarding this video: [ translation ] Mtre Pétranic : If a user accessed the D: drive and looked for this video, would there necessarily be an icon in a document somewhere to access it directly, easily, or is it absolutely necessarily to access the caches for that? Mr.

Robert : First, that person's operating system would have to allow him to see the System files when in search mode, in the tree structure. Without this basic action, it would be impossible to access this directory, it would be hidden. Because it is part of a System directory. Mtre Pétranic : On February 9, 2007, could I, with the system that is before you, have had access by doing what you just explained to the Court? Mr. Robert : I did not verify whether the files and the System files were hidden on the computer in question. I cannot answer this question because the basic action is mandatory .

The System files really need to appear so that they can be navigated to find the files inside those folders. The Court: You need to know what you are looking for. Mr. Robert: Exactly. You could have found it in that Internet cache. But you need to have [inaudible]. Obviously, you can go by dates as well, in the classification, and maybe the name of the file was visible at a given time and you remember it. Obviously, there are all these basic actions. There is also what we spoke of earlier: the famous browser history.

Obviously, when it happens the day before and you re-access the cache through the history, well you go to yesterday's history, then you click... obviously the page will reappear, and the cache will be updated. But otherwise, the search is more difficult. After all, we are in System files that are classified by the system. The files are not classified by the name they are given. Just look at the directory that precedes the file in question, OJMZOBCL, well, we don't manage that.

So it's more complicated as far as classification systems go. [Emphasis added.] [ 28 ] Under cross-examination, Robert admitted that the files that were found in the cache might have ended up there without any voluntary act by the user. For example, if the user had inadvertently landed on a page containing video files, one might have been saved in the cache without his knowledge and without any concrete action on his part.

Analysis [ 29 ] The Supreme Court of Canada has clearly established that to be convicted of the offence of possession of child pornography, as opposed to the offence of accessing it, the accused must have knowingly acquired the files and kept them in a place under his or her control. [3] [ 30 ] Although the evidence grounds the inference that the accused knowingly acquired the questionable files – the orphans and those placed in the unallocated clusters – it has been proved that on February 9, 2007, nothing was accessible from his computer, nor had it been since at least August 26, 2006. [ 31 ] Through concrete actions six months prior to the search, Coupal clearly expressed his intention of no longer having certain files on his computer.

In these circumstances, there is no continuous offence. Moreover, he was not charged with accessing child pornography, an offence that is not included in possession. [ 32 ] Although erasing the files constitutes circumstantial evidence of possession, in the absence of incriminating evidence, that the accused had in-depth computer knowledge or the necessary specialized tools to retrieve the lost files or the unallocated clusters, I cannot find that these files were under the control of the accused on February 9, 2007. [ 33 ] The search of the accused's home does not demonstrate that the accused was a computer ace.

In fact, the contrary seems to be true. [ 34 ] In R. v. Garbett , [4] 30 images of child pornography out of 48 were found in the unallocated clusters of the accused's computer. Even assuming that the accused had the requisite knowledge that these images existed, the judge concluded that the element of control had not been proved. It is the element of control, including deciding what will be done with the material, that is essential to possession. The accused did not have the ability to access or control the images. [ 35 ] In a recent American case, United States v.

Flyer , [5] the Court of Appeals for the ninth circuit was asked to rule on child pornography images found in the unallocated space or clusters of Mr. Flyer's computer.

[ 36 ] The Court noted that the user had deleted these files from the trash folder. To conclude that the accused was still in possession of the files, the government had to consider "that a user must have knowledge of and access to the files to exercise dominion and control over them at the relevant time". [ 37 ] There was no evidence that Flyer possessed "the forensic software required to see or to access the files".

The Court of Appeals overturned the conviction for possession of child pornography. [ 38 ] It was incumbent upon the prosecution to show that Coupal had access to the 4423 files erased en bloc on August 26, 2006, and the 5722 other files, whose dates of creation and deletion are unknown, to establish that they were under his control. [ 39 ] In light of the prosecution's burden, I cannot agree with its argument that it was up to the accused to establish that he had no way of making the files accessible.

That would be a reversal of the burden and would be contrary to the law. [ 40 ] Garbett , supra , establishes a rule as to possession of material in cache memory.

Since the material there is not necessarily voluntarily viewed by the user while browsing, "the mere fact that an image was found on a computer's hard drive does not lead inexorably to an inference that the user knew of its existence, or that the user had ever viewed it, intended to view it, intended to save it, or did anything to cause it to be saved". [ 41 ] The prosecution did not present anything beyond the existence of the video in the cache memory.

Alleging that Coupal accessed child pornography in the past is not sufficient. [ 42 ] Even if we suppose that the accused knew that the video was in his computer cache, a fact of which I am not convinced in light of Robert's testimony, I would still not be convinced, again because of this same testimony, that the accused had the control necessary to establish possession of the video. [ 43 ] This case is analogous to R. v. Love , [6] in which the Provincial Court of Alberta exonerated the accused of possession of material found in his computer’s Internet cache.

In paragraph 19, it concluded: In the absence of evidence to suggest that the accused had some computer expertise, I am not prepared to infer that the accused knew that this process was occurring or that the accused intended to store the image in the Temp Internet Files folder.

At best the image found was proof of accessing child pornography . [Emphasis added.] [ 44 ] In Morelli , the Supreme Court states that even though a cached file is in a place that is under the control of the user, it is still necessary to meet the requirements of mens rea or fault to prove possession. [ 45 ] Consequently, it is necessary to demonstrate that the user knowingly stored and kept the file in the cache memory.

It is therefore necessary to prove that the user knew the contents, the workings, and the existence of the cache memory to infer possession of the material found there. [7] [ 46 ] In light of the deletion en masse of all the material almost six months prior to the search and the overall testimony of Robert regarding cache memory, I am not convinced by the evidence that the accused knew of the existence of this video in that location on his computer. [ 47 ] In the present case, the prosecution has not shown that Coupal had control of the video stored in the cache memory.

There is no evidence in the record grounding a conclusion that he knew about this file in that location or even that he knew of the existence of the cache or how it worked and was therefore able to access its contents on February 9, 2007. [ 48 ] Consequently, the prosecution has not met its burden of proving that, on February 9, 2007, the accused was in possession of the child pornography materials found on his computer. Jean-Roch Coupal is acquitted. __________________________________ HÉLÈNE MORIN, J.C.Q. Crown Prosecutor Mtre Steeve Larivière Counsel for the accused Mtre David Petranic