) ) HER MAJESTY THE QUEEN Respondent – v. –, 2017 ONSC 4213

CITATION : R. v. Rhodes, 2017 ONSC 4213 COURT FILE NO.: 7692/16 DATE: 2017/07/07 ONTARIO SUPERIOR COURT OF JUSTICE BETWEEN: ) ) HER MAJESTY THE QUEEN Respondent – and – ROBERT SHANE RHODES Applicant ) ) ) ) ) ) ) ) ) ) ) D. Didiodato, for the Crown J. Raftery, for the Applicant Defendant ) ) HEARD: June 14, 26,27,28, 2017 rasaiah j. REASONS For Decision BACKGROUND [ 1 ] In August of 2015, an internet-based investigation revealed that an internet user was sharing child pornography using a file sharing program. As result of that investigation, Mr.

Rhodes is charged with one count of unlawfully possessing child pornography and one count of making it available. [ 2 ] He has entered pleas of not guilty to both counts. [ 3 ] At trial, the Crown called four witnesses, namely: 1. Detective Constable Jeremy Spence, who is a seventeen year member with the Ontario Provincial Police (“OPP”) with the Child Sexual Exploitation Unit (“CSEU”) of Orillia, Ontario. Det. Cst. Spence became involved in the investigation involving Mr. Rhodes after his police computer detected a user sharing files of interest at an IP address linked to Mr. Rhodes’ residence; 2.

Detective Constable Douglas Errkila, a member of the Sault Ste. Marie Police Service who has worked with the technological crime unit for 13 years, investigating crime that deals with digital elements, including child pornography. His role in the investigation was to assist with the execution of the search warrant and to perform a cursory forensic analysis of any devices found at the scene; 3. Douglas Lockhart, who is a retired member of the OPP who had completed 17 years of service with the CSEU in Orillia, Ontario. He was involved with execution of the search warrant at the residence.

His roles included being part of the entry team, securing the residence and being the Exhibit officer in respect of any items seized; and 4. Detective Constable Eric Pinkerton, who has been employed by the OPP since 2007. He is a forensic analyst in the technological crime unit in Orillia, Ontario. Det. Cst. Pinkerton was qualified at trial as an expert in forensic analysis of computers and operations of computer systems. Det. Cst. Pinkerton’s role was to forensically examine the laptop and thumb drive that was seized during the execution of the search warrant. [ 4 ] Mr.

Rhodes chose to testify. [ 5 ] Eight Exhibits were filed without objection, namely: a. Production order for subscriber information; b. Search warrant for the residence;

c. Report to justice; d. C4ALL report categorizing and identifying images and videos found; e. A bound collection of communications showing the contents of the shared folder captured by the police computer from July 14,2015 to August 17, 2015; f. Diagram of the layout of the basement bedroom area that Mr. Rhodes occupied drawn by Cst. Lockhart; g. Curriculum of Det. Cst. Pinkerton; and h. Computer Forensic Report prepared by Det. Cst. Pinkerton. [6] It is not an issue and in fact it was admitted by the Defence that the images and movies identified by Det. Cst.

Spence in thiscase as child pornography constitute child pornography as defined in subsection 163.1(1) of the Criminal Code. [7] Ownership of the laptop at the time of execution of the search warrant is also not an issue in this case. Mr. Rhodesacknowledged that the laptop at that time of execution of the search warrant was owned by him. DEFENCE POSITION [8] Mr. Rhodes denies ever viewing, downloading or sharing child pornography with the laptop. The Defence position is asfollows: a. Mr. Rhodes states that he purchased the laptop used, and he did so through his sister.

It was purchased from a neighbour (whoconducted computer repairs) sometime between August 28 and August 31, 2015. As such, he was not the user captured by the policecomputer. If this is accepted, the child pornography viewed by Det. Cst. Spence prior to that date is not attributable to Mr. Rhodes andthe child pornography found on the laptop may have already been on the laptop long before it came into his possession. All recoveredmovie files were in fact deleted files and as such, as an ordinary user, he would not have known or discovered those files after the laptopcame into his possession.

He would not have had control over the files. b. Mr. Rhodes states that he did not install the operating system on the laptop and does not recall an existing user account namedXOXOX. He added a username or he created a user account named “Pops-cycle”. c. Mr. Rhodes denies installing the sharing program Shareaza and did not know that it had ever been on the laptop. While he mayhave used Shareaza in the past, he did not do so on this laptop that he could remember. d. Mr. Rhodes raises that he allowed family members to use the laptop during the time he owned it.

The suggestion is that a familymember could have downloaded and deleted the identified files. If any of his family members had done this, again, as an ordinary user,he would not have known, given deleted files would have been and were on unallocated space. e. Mr. Rhodes raises his sexual orientation, namely that he is gay, and asserts that he would not have downloaded the childpornography in question. f. Mr.

Rhodes created and maintained an encrypted volume on the laptop and submits that if he was downloading files containingchild pornography, it would have made no sense for him to store such files on unencrypted volumes. g. Mr. Rhodes asserts that the police did not have grounds to arrest him when they seized the laptop having located no live files. Hestates that after forensic analysis, nothing has changed. No live files were found. All files were located on unallocated space or in areasin which an ordinary user would not know they existed. h.

Finally, in respect of the October 14, 2015 cache uncovered in the forensic analysis of the laptop, Mr. Rhodes emphasized that itwas an image and if it was accepted that a child pornography website was accessed at that time by Mr. Rhodes, the file is not a movie asparticularized in the indictment as such does not constitute possession of a movie. CROWN POSITION [9] The Crown’s position is as follows: a. Mr. Rhodes’ evidence should be scrutinized and assessed as unbelievable and not raising a reasonable doubt. b. Many portions of Mr.

Rhodes’ evidence the Crown submitted was evasive, self-contradicting and categorically unbelievable. c. The Crown submits that the elements of both offences have been proven beyond a reasonable doubt. The Crown relies on theevidence gathered in the investigation and the forensic findings. BURDEN AND SCOPE OF THE INDICTMENT [10] It is a fundamental tenet of our criminal justice system that the prosecution must prove the offence charged and must do so, asparticularized in the indictment. Where the prosecution chooses to particularize, the court may convict only in respect of the conductparticularized.

Illegal conduct beyond what is particularized, however, cannot be the basis for a conviction: see R. v. Saunders, (SCC), [1990] 1 S.C.R. 1020 (S.C.C.) at para. 5: R. v. Braudy, 2009 CarswellOnt 390, [2009] O.J. No. 347, 81 W.C.B. (2d)561, para. 39. [11] For both counts, the indictment is particularized to the time frame of July 14, 2015 to October 15, 2015 and confined to

computer graphic movies. ISSUES [12] Did Mr. Rhodes possess computer graphic movies of child pornography on or between July 14th, 2015 and October 15th,2015? [13] Did Mr. Rhodes make available computer graphic movies of child pornography for the purpose of making it available on or between July 14th, 2015 and October 15th, 2015? LAW AND ANALYSIS APPLYING R. v. W.(D.) [14] If I believe the evidence of Mr. Rhodes, I must acquit. If I do not believe the testimony of Mr. Rhodes but I am left inreasonable doubt by it, I must acquit. If I am not left in doubt by the evidence of Mr.

Rhodes, I must ask myself on the basis of theevidence which I do accept, whether I am convinced beyond a reasonable doubt by that evidence of the guilt of Mr. Rhodes: R. v. W.(D.), (SCC), [1991] 1 S.C.R. 742 POSSESSION OF CHILD PORNOGRAPHY [15] The relevant portion of subsection 163.1(4) of the Criminal Code provides: Every person who possesses any child pornography is guilty of (

a) an indictable offence and is liable to imprisonment for a term of not more than 10 years and to a minimum punishment ofimprisonment for a term of one year. [16] The relevant portion of subsection 4(3) of the Criminal Code provides: For the purposes of this Act, (

a) a person has anything in "possession" when he has it in his personal possession or knowingly (

i) has it in the actual possession or custody of another person, or (ii) has it in any place, whether or not that place belongs to or is occupied by him, for the use or benefit of himself or ofanother person. [17] A very useful

summary of the law with respect to possession of child pornography is set out in paragraphs 92 to 94, and 96 to98, of the case of R. v. Bools, [2015] O.J. No. 4695. Those paragraphs read as follows: POSSESSION [92] Both knowledge and control are essential elements to a finding of possession of child pornography: R. v. Morelli, 2010 SCC 8[2010] 1 S.C.R. 253 [Morelli].

KNOWLEDGE [93] To establish the requisite knowledge, the Crown must prove that the accused had knowledge of the criminal character of the itemin issue, and thus was aware of the general qualities of the files that might make them child pornography, or be reckless of wilfully blindto these qualifies: R. v. Chalk, 2007 ONCA 815, [2007] O.N.

No. 4627 (C.A.) [Chalk] at para. 18. [94] The Crown need not prove that the accused knew the files met the legal definition of child pornography: Chalk at para. 18. … [96] Knowledge of the objectionable images can be inferred through circumstantial evidence, such as ownership, the level of usage ofthe computer in question, the level of computer literacy of the accused, whether the file names for the images were description, theorganization of files, and the accused’s knowledge of the location of the files on the computer: R. v. Braudy [2009] O.J. No. 347, 81W.C.B. (2d) 561 (S.C.J.) [Braudy] at paras 51-52; r. v.

Douglas, 2013 SKQB 33, [2013] S.J. No. 59 (Q.B.) [Douglas] at paras 79, 85, 90-93; R. v. Benson, 2010 SKQB 459, [2010] S.J. No. 758 [Benson] at paras 28, 30; R. v. Connor, [2009] O.J. No. 3828, 84 W.C.B. (2d)904 (S.C.J. ) [Connor] at paras 27, 117, 121-122. [97] Where the file names of the objectionable images strongly suggest child pornography content, an inference of knowledge will bestrong: Douglas at para 94. CONTROL [98] The Crown must prove that the accused had a measure of control over the item at issue.

Control refers to power or authority overthe item, whether exercised or not: Chalk at para. 19. [18] Possession of an image or video in a computer means possession of the underlying data file: R. v. Morelli, [2010] 1 SCR 253,2010 SCC 8 , para. 19.

[19] R. v. Chalk, 2007 CarswellOnt 7625, 2007 ONCA 815, [2007] O.J. No. 4627, 227 C.C.C. (3d) 141, 231 O.A.C. 107, 52 C.R.(6th) 371, 76 W.C.B. (2d) 264, 88 O.R. (3d) 448, the Ontario Court of Appeal wrote: 18 Possession requires knowledge of the criminal character of the item in issue. In this case, the Crown had to prove that the appellanthad knowledge of the contents of the videos in issue. It was, of course, irrelevant whether the appellant knew the contents constitutedchild pornography: see R. v. Beaver (1957), (SCC), 118 C.C.C. 129 (S.C.C.), at 140; R. v. Hess (No. 1) (1948), (BC CA), 94 C.C.C. 48 (B.C.

C.A.), at 51-52. The appellant's knowledge of the nature of the videos was established by hisstatements to the police. 19 Knowledge alone will not establish possession. The Crown must also prove that an accused with the requisite knowledge had ameasure of control over the item in issue. Control refers to power or authority over the item whether exercised or not: R. v.Mohamad (2004), (ON CA), 182 C.C.C. (3d) 97 (Ont. C.A.) at paras. 60-61. [20] In R. v. Braudy [2009] O.J.

No. 347, 81 W.C.B. (2d) 561 (S.C.J.) at paragraph 47, the court wrote: 47 To the extent that courts have considered this element, however, they have found that the prosecution is merely required to showcontact or control in the narrow, physical sense. It is merely required, in other words, to show that the material was on a computer withwhich the accused had contact, or to which the accused had access. [21] In R. v. Pelich, 2012 CarswellOnt 8086, 2012 ONSC 3611, [2012] O.J.

No. 2931, 103 W.C.B. (2d) 295 at paragraphs 85 and86 the court considered possession and also the issue of files on unallocated clusters and wrote: 85 In R. v. Daniels, 2004 NLCA 73 (N.L. C.A.) at paras. 12-14, the Newfoundland and Labrador Court of Appeal held thatpossession began as soon as the accused began downloading the illegal image files to his hard drive. It was not necessary for the accusedto have viewed the images. 86 The approach in Daniels has been cited with approval as a "sensible

interpretation" by the Supreme Court in Morelli at para. 25.Fish J. pointed out that this

interpretation fit with Parliament's intention in creating two different offences, accessing and possessing childpornography. The Court explained at para. 27: What made a charge of possession "problematic", of course, is that possessing a digital file and viewing it are discrete operations — onecould be criminalized without also criminalizing the other. In the case of child pornography, Parliament has now criminalized both.

Butviewing and possessing should nevertheless be kept conceptually separate, lest the criminal law be left without the analytical toolsnecessary to distinguish between storing the underlying data file and merely viewing the representation that is produced when that data,residing elsewhere, is decoded. The Internet-based Investigation [22] CSEU was using EPHEX, a police program designed to work on the Gnutella Network, a peer to peer program. EPHEX wasmonitoring the Gnutella network for individuals in possession or trading child pornography in the form of movies or images. [23] EPHEX is a global program.

As such it detects child pornography based on various different

definitions. A file of interestwould have to be viewed to determine if it meets the Canadian definition of child pornography. EPHEX also captures IP addresses;global unique identifiers (“GUID”) which get installed into sharing programs when a user installs them; the shared folder of the user; andthe files in the shared folder. When the program EPHEX detects a user with files of interest, namely child pornography, it creates aninvestigative folder. [24] On August 25, 2015, Det. Cst. Spence learned that EPHEX had created an investigative folder for IP address 24.235.54.175. He reviewed the folder.

When he reviewed this folder, he noted direct connections with a computer at this IP address. In particular, theprogram was reporting that on July 14, 2015, three files were shared by the user having that IP address, two of which files were ofinvestigative interest. The program also captured the sharing program being used, namely Shareaza, version 2.7.8.0. and a global uniqueidentifier for Shareaza that would have been installed into the program when the user installed it.

The program further captured a username of “XOXOX”. [25] Between July 14, 2015 and July 31, 2015, EPHEX made 18 direct connections with this computer. Partial downloads werereceived. By July 18, 2015, files were still being shared and the number had grown to fifteen files, 5 of which were files of interest. OnJuly 31, 2015, there were twenty-five files, twelve of which were files of interest. This grew on this same day to 51 files, 24 of whichwere files of interest.

These facts, namely such regular activity and management of the shared folder, in my view support and inferknowledge and control of the files to the user. [26] On the 1st day of August, 2015 at 0623 hours, another direct connection was made with the user’s computer. Theinvestigative file now contained seven files, two of interest. The program remained active from August 3, 2015 to August 18, 2015. More direct connections were made. These facts, namely continuing regular activity and management of the shared folder, inferknowledge and control of the files to the user. [27] Det. Cst.

Spence testified that the unique Shareaza GUID and the IP address remained the same throughout the connectionsand all downloads. [28] Det. Cst. Spence was able to view the titles of the files in the shared folder. He observed the titles to include terms includingbut not limited to “11yo preteen”, “pthc” and “pedo”. “Pthc” means preteen hardcore; “11YO” which means 11-year-old preteen; and“pedo” means pedophilia. Exhibit 5 details many files in the shared folder having names containing such terms and other explicitsexual terms.

I am satisfied that these file names entered into evidence through the witnesses and exhibits are strongly suggestive ofchild pornography and would infer knowledge of the material’s nature and character to the user.

Child Pornography Movies [29] There were a total of 27 movies viewed by Det. Cst. Spence that the police computer was able to download from the shared folder, either in full or in part. He determined 16 of them to be child pornography.

The details are as follows. [30] On August 1, 2015, between 0623 hours and 0714 hours, the program was able to download, in full, a movie titled “DIVFIX PTHC 9YO GIRL ORGASM 2 WEBCAM (NEW2011.AVI) having a unique SHA 1 value of H2IYK3YFTMNBW3GTT2MTDX1AKC4FGAUX, which from a tracing perspective he described as a digital fingerprint for this particular movie that would never change in the event the name of the file was changed. Det. Cst. Spence viewed this movie. It was 5 minutes and 14 seconds in length involving a young prepubescent female of approximately 7 to 8 years of age.

Of note was that the name of this file was changed in the shared folder hours later on this date to “54.avi” and it remained in the folder for a period thereafter. These facts, in my view, demonstrate direct knowledge and control; knowledge of the file contents and intention to keep and possess the file and accordingly its contents. [31] On August 18, 2015, between 0307 hours and 0357 hours, the program was able to download in full, a second movie titled PTHC 10YO BLACK CUBAN GIRL01.MPG having unique SHA 1 value of KAAZK34DSV3H23YT0TX53JQ5MB2ZX13S. Det. Spence viewed this movie.

It depicted a young female of approximately 10 to 11 years of age with an adult male performing sexual acts. [32] There were 25 other partial movie downloads that were received from the same user during the said time frame. Det. Cst. Spence was not able to download and receive the full movies however he was able to review the partial files. Out of these 25 files, he identified 14 to be child pornography. [33] As a result of being able to download and view the above, Det. Cst.

Spence determined that the user was clearly in possession of child pornography; that the child pornography was in a shared folder of that user; and that the user was making it available to him and other users of the network. Connection To the Residence that the IP Address was Associated With and Connection to the Laptop [34] Det. Cst. Spence took steps to identify the internet service provider for the IP address in question, and to contact the provider to find out if subscriber records were present.

He then took steps to obtain a production order for subscriber information for August 1, 2015 between 0623 hours and 0714 hours and for August 18, 2015 between 0307 hours and 0357 hours. The subscriber was identified as Eugene Grenier of 27 Hergott Avenue (“the residence”), Elliot Lake, Ontario. [35] There is no issue placing Mr. Rhodes as a resident of 27 Hergott Avenue. Mr. Rhodes testified that he was living in the basement at this residence with his mother Jennifer Cruise and her spouse Eugene Grenier. Mr. Rhodes moved into the residence on or about March 20, 2015. [36] Accordingly, it is clear that Mr.

Rhodes was residing at the residence connected to the IP address that was attached to the user computer that was in communication with the police computer at the material times. Execution of the Search Warrant [37] Det. Cst. Spence took various steps in the investigation which ultimately culminated in the police obtaining a search warrant for the residence. The warrant was executed October 15, 2015 at approximately 0735 hours. Ms. Cruise, Mr. Grenier and Mr. Rhodes were located in the residence at the time. [38] Mr. Rhodes was located by Cst. Lockhart in the basement in a bedroom living area. Cst.

Lockhart observed Mr. Rhodes sleeping in the middle of the bed located in this room. Directly beside Mr. Rhodes, on his right-hand side, he observed the laptop. The laptop had no battery. It was powered on and plugged into an outlet near the bed. [39] Det. Cst. Errkila who was performing cursory searches of the electronics at the residence made the same observations regarding the condition and location of the laptop. [40] Sometime during the execution of the warrant, Det. Cst. Spence advised Det. Cst. Errkila that his police computer program EPHEX had captured a user name XOXOX. [41] Det. Cst.

Errkila determined that the laptop had the user name “XOXOX”. [42] The police seized the laptop, and a thumb drive for forensic examination. The also seized a notebook belonging to Mr. Rhodes. [43] Det. Cst. Errkila confirmed that no other electronic devices at the residence had the user name XOXOX or any evidence of child pornography. The user names of the other computers were either “Eugene” or “Jenny”. [44] No charges were laid at the time the warrant was executed because no live files or other evidence of child pornography was located during the search. However, Det. Cst.

Spence believed that based on the IP address information and the user name located on the laptop that he possibly had a match. Forensic Examination [45] On October 16, 2015, Detective Constable Spence submitted the laptop and thumb drive for forensic examination to the OPP technological crime unit (“TCU”). [46] All of the submitted evidence was forensically acquired by forensic imager Emily Matheson.

[47] After forensic verification of the images processed by Ms. Matheson, Detective Constable Pinkerton processed both the laptop and the thumb drive evidence files for purposes of running C4ALL. The results of all extractions were provided to Detective Constable Spence for purposes of identifying any child pornography. [48] Detective Constable Spence reviewed the C4ALL extraction results. A C4ALL report was prepared. It was determined that there were 11 images of child pornography and 150 videos of child pornography on the laptop.

No child pornography was found on the thumb drive. [49] Following the categorization process Detective Constable Pinkerton began his forensic examination of the evidence files, and generated his report, namely Exhibit 8 in this proceeding. [50] Det. Cst. Pinkerton determined that 10 of the 11 images of child pornography and 150 videos of child pornography on the laptop were all located on unallocated clusters. An unallocated cluster is an area of the hard drive which is currently not being used by live files.

This would include blank portions of the hard drive that have never been written to, or deleted data that has been flagged available for overwriting. The data of a deleted file is not erased from the hard drive. It remains on the hard drive until it is overwritten with new data. Files carved out of the unallocated clusters have no file name or date/time attribute associations. As such, the only evidentiary value of the data found in this location is that it can be said that at some point in time, these files existed as live files on the hard drive in which they were located.

Although now on unallocated space, it is clear that the underlying data files did in fact reside on the laptop at some point in time. It is equally true that the ordinary user would not know that deleted files remained in unallocated space. Det. Cst. Pinkerton agreed that the ordinary user would believe that a deleted file was no longer in existence. [51] In his forensic analysis, Det. Cst.

Pinkerton also determined the following: a. that the laptop contained one hard drive installed with Windows 8 operating system. b. aside from the system generated user accounts, there was only ever one manually created user account, namely user XOXOX, evidenced by the last four digits of the security ID for this account. c. the computer had four partitions one of which was an encrypted volume. d. that the sharing program Shareaza had been installed at one point in time on the laptop, and had specifically been active on the computer on August 11, 2015, which he located in a software registry hive located on unallocated space. e. on unallocated clusters, there was evidence of a Shareaza Library1.dat file showing the SHA-1 values of the August 1, 2015 and August 18 th , 2015 child pornography movies downloaded by the police computer during the Internet-based investigation – and analysis of this file indicated that they had been downloaded to the laptop using the program Shareaza.

Det. Cst. Pinkerton tested the program to confirm these findings. f. Det. Cst. Pinkerton recovered torrent artifacts he described as helping support the download and possession of child pornography. g. Det. Cst. Pinkerton recovered 318 Shareaza alternate data streams demonstrating further that at one point in time Shareaza had been installed on the laptop. These files represented files scanned by Shareaza. A great number of these files had the same name of many of the files Mr. Rhodes had on his computer or had downloaded before. h. Det. Cst.

Pinkerton recovered internet URLs that were helping support the accessing of the Shareaza website and specifically the downloading of Shareaza version 2.7.8.0.; there was a google URL that places a search for Shareaza in May of 2015. [52] Det. Cst. Pinkerton was not able to locate the GUID captured by Det. Cst. Spence during the internet-based investigation.

He testified that this was not unusual. [53] In addition to his forensic analysis of the laptop, Detective Constable Pinkerton set up a virtual computer with the same operating system as the laptop and installed the sharing program Shareaza version 2.7.8.0 on it. The purpose of doing so was to provide details on how the application is installed and to demonstrate how Shareaza operated. User Account XOXOX: The Laptop and Shareaza [54] The expert, Det. Cst.

Pinkerton, testified that when the Microsoft Windows 8 operating system is installed, there are certain accounts that are automatically set up during the installation for the operating system to utilize and there are also user generated accounts to set up, for the user to utilize when they are using the operating system. During installation the user is prompted to set up a user account. Det. Cst. Errikla gave the same evidence, namely that when you are setting up this Windows operating system – when you initialize the computer – the windows operating system will ask the user to create an account. [55] Det. Cst.

Pinkerton on the topic of the automatically generated accounts testified that by default, when Windows 8 is installed, the operating system automatically sets up an Administrator account and a Guest account. The Administrator account is utilized during installation to set up various features of windows and to get the operating system functioning. Once this is completed, the Administrator account is disabled. As for the Guest account, it is disabled by default and would need to be enabled. [56] Det. Cst. Pinkerton’s analysis of the accounts on the laptop revealed only three accounts: a.

The first was user account XOXOX, showing Mr. Rhodes’ nickname in the full name field and showing XOXOX in the user name field. This account had a profile path of C:\Users\XOXOX. The profile path is the directory for the user account meaning, if you are logged in to the laptop operating as user XOXOX, by default, your “my documents” and your “my pictures” etc. would exist under the user XOXOX;

b. the second account was the system generated Administrator account, which account had been last logged into on November 21, 2014; and c. the third account was the system generated Guest account which account Det. Cst. Pinkerton determined had never been enabled. [57] With respect to Shareaza, Det. Cst.

Pinkerton testified that when installing Shareaza, if you do not enter a user name into the program when you are installing it, the program will by default utilize the name of the windows account you are using – namely the account being currently operated on the computer when you are installing the Shareaza program. Therefore, if Shareaza was installed with a user account named XOXOX, the user name XOXOX would have been entered into the user name field by default, if the person who was installing Shareaza with this account chose not to enter a user name in this field. Det. Cst.

Pinkerton demonstrated this through the example installation process he undertook with the version of Shareza that was captured by the police computer. He used his windows account named “Eric P” at the time of example installation. He chose not to enter a name in the user name field. Shareaza by default populated the user name field with his user account name “Eric P”. [58] Det. Cst. Pinkerton was not able to recover the user name XOXOX as having been entered into the Shareaza program on the remnants he located on the laptop. Shareaza had been deleted.

However, the police computer captured the user name “XOXOX” and the information that the sharing program being utilized was Shareaza 2.7.8.0. The computer with which the police computer was communicating was using the exact same version of Shareaza found on the laptop by Det. Cst. Pinkerton. Moreover, Det. Cst.

Pinkerton located evidence of the same two movies the police computer captured. [59] Based on the above, I am satisfied that the laptop was in fact the computer in question that the police computer was communicating with, and that child pornography had been possessed, namely child pornography had been downloaded to, and in fact resided on, the laptop, at the very least from July 14, 2015 to August 18, 2015. In particular, I am referring to the 16 movies viewed by Det. Cst. Spence. I am not able to place any of the other movies within the time frame of the charge based on the evidence.

The other movies were located on unallocated space and as such, it is not known as to the when they were downloaded and when they were deleted. Who was Behind the Laptop at the Material Time? [60] On the issue of possession, the remaining major question in this case, in my view is: who was behind the laptop at the material time? [61] I accept that the laptop could have been purchased used. I accept that in such a case, the operating system could have already been installed with user name XOXOX and that Mr. Rhodes could simply have modified the full name field to include his nickname “Pops-cycle”.

It is a user modifiable field in which information can be changed without a new account being generated. [62] However, given my findings above regarding the connection of the IP address captured, the user name captured, and the strong corroborating forensic evidence that the laptop was the subject computer, the only possibilities for consideration as to who was behind the computer based on the evidence are: a. The neighbour from whom Mr. Rhodes stated he purchased the computer; b. Family members of Mr. Rhodes; and c. Mr. Rhodes. [63] During the time he was residing at 27 Hergott Avenue, Mr.

Rhodes testified that he was doing “a whole bunch of nothing”. He was new to the town and exploring Elliot Lake. He also did some volunteer work at St. Vincent’s. He started living at this residence on or about March 20, 2015. [64] Mr. Rhodes was separated from his wife. They had separated in February 2015. He had been convicted of assaulting his wife’s son, whom he said he assaulted during an argument because the child brought a weapon to the argument. He wanted a computer because he was gradually putting his life together and collecting items.

He gave examples of other items, namely a television and a couch. [65] Mr. Rhodes testified that he bought the laptop between the 28 th and the 31 st of August. He testified that he knew this because he got it shortly before school started. He stated he had children in school and that so did his sister. He purchased the laptop he stated for cheap because it had no battery. He paid maybe $150 to $200 for it. [66] Mr. Rhodes testified that his sister set up the purchase for him. She knew a fellow who fixed old computers and sold them. He did not know this man who he stated was a neighbour.

His sister set it up because she had purchased a computer from this neigbour as well. [67] I had difficulty with Mr. Rhodes testimony regarding the purchase of the laptop and the neighbour. I found Mr. Rhodes testimony at times vague and unconvincing. It appeared to me that his evidence was designed to place the computer out of his possession during the time frame the police computer captured the sharing. I also found that Mr. Rhodes statements changed as questions developed. He bounced back and forth between not remembering information to being able to provide information.

Some of his answers were not what one might expect to hear from an individual in his situation given that he was essentially suggesting that this neighbour was the user behind the communications; that he somehow used this laptop and the IP address assigned to Eugene Grenier to download and share child pornography. His testimony did not present as believable. [68] I noted that Mr. Rhodes began his account by saying that he bought the laptop from a neighbour through his sister. He indicated clearly that he didn’t know the name of the person his sister was buying the laptop from.

He stated he learned this later, namely that it was made known to him that the person was a neighbour of the house he was living in, namely 27 Hergott Avenue, his

mother’s spouse’s house. He repeated that he did not know the neighbour’s name. Interestingly, he did not describe the neighbour as his own neighbour, and in fact disagreed that this neighbour was his neighbour on the basis that he was living in the basement of the house. On further cross-examination when this position was challenged, Mr. Rhodes agreed one could call this person his neighbour too because he was in fact living at 27 Hergott Avenue. At this exact point in the testimony, without prompting Mr.

Rhodes’ account changed and he stated that he did not believe that this neighbour was a neighbour either to the direct left or right of the house he was living in. I didn’t receive any details from him as to how he would have known this particular detail. [69] When asked again about the name of the neighbour, Mr. Rhodes stated his sister would know the neighbour’s name but that his sister was unreachable. He was asked if he thought about calling her husband. His answer was he did not think they were together anymore.

He changed this answer to say that he did know that they were not together anymore because the rumour was that she had left her husband and was off somewhere in Mexico with another man. [70] When it was put to Mr. Rhodes that - surely when he was arrested that he would have been interested to find the neighbour, Mr. Rhodes stated that he really wasn’t thinking that at the time until he started talking about going to court and stuff. He was more concerned about bail. “Strategy for defence” was not really discussed for some time.

It was more a bail issue. [71] Another time when he was asked about the neighbour’s name he said “I don’t know the name” but then said “it may be Rick or Richard. I don’t know why I’m saying that. It just sounds right”. [72] Mr. Rhodes also stated that he tried to make collect calls to family after that, but it is difficult in jail to make calls. He may or may not have asked his mother or Mr. Grenier but he did not know. He thinks that this issue would have been dealt with through his sister and not his calls to his mother. [73] Mr. Rhodes could not remember the last time he spoke to his sister.

He did explain that it was difficult to call people from jail. [74] When he was asked other questions about efforts to locate a name of this neighbour, Mr. Rhodes responded by saying that he knew that the neighbour had moved. Mr. Rhodes started off by explaining that maybe his sister or mother or his mother’s spouse told him that this neighbour had moved. He couldn’t remember how he found out. He was informed either by his sister or his mother or his mother’s spouse. He added that he knew that his mother and her spouse had also moved and were no longer at 27 Hergott Avenue. Then Mr.

Rhodes continued on after having said he didn’t remember more than once, and testified that it may have been his sister that mentioned to him that the neighbour moved but again he could not remember when. He then followed this evidence with testimony that this topic may have been only something that had been mentioned in passing by his sister (as opposed to him making efforts to find out the name or whereabouts of the neighbour) and he oddly stated “when I found out I don’t think I even needed to know that or was required to remember something like that”.

The People Who Visited 27 Hergott Avenue and Who Had Access to the Laptop [75] Mr. Rhodes testified that his sister, her husband and her children visited 27 Hergott Avenue. His sister has five children but only four were with her at the time. Her fifth child was living elsewhere. He was able to name some of the children but appeared to have difficulty remembering some of the names of his sister’s children when he was asked for them. [76] Regarding access to the laptop, Mr.

Rhodes stated that he, his mother, his mother’s husband, his sister, his sister’s husband and his sister’s children had access to the laptop. [77] Based on the evidence, I had difficulty with the suggestion by Mr. Rhodes that one of his family members could have been the user the police computer was communicating with. [78] Overall, I found his evidence again to be vague and lacking in believability. [79] When he gave this evidence, it was in the context of his position that he bought the laptop between August 28, 2015 and August 31, 2015. He would have owned the laptop for 6 weeks.

He named (including himself) 9 people for this time frame of 6 weeks as possible users of a laptop he just purchased. [80] Mr. Rhodes did not elaborate or provide me with details, including but not limited to occasions during this time frame when he may have known about or seen family members using the laptop. [81] In respect of his mother and his mother’s spouse, I do not understand his explanation as to why his mother or his mother’s spouse would have used his laptop when they had four computers of their own (based on Mr. Rhodes’ evidence).

His mother’s husband had two computers dedicated to a handheld radio operation, and his mother and her husband had one computer in their dining room and one in their living room. The computer in the living room was connected to the internet. Mr. Rhodes also indicated that from time to time his mother’s spouse used his two dedicated computers to access Netflix to watch a movie. He said they were both retired and spend a lot of time in the living room. When he was answering questions about why family members would use his laptop, Mr. Rhodes stated that Mr.

Grenier apparently has an issue with noise and that is why family members came downstairs. [82] While Defence made the following submission, I did not receive any evidence from Mr. Rhodes that he himself believed that his mother or his mother’s spouse would have or could have downloaded child pornography to his laptop. [83] There was a significant number of files located by the forensic analysis. One of his family members would have had to have been very active on that laptop over 6 weeks. [84] I also did not receive any evidence from Mr.

Rhodes that he himself believed that any one of his visiting family members would or could have downloaded child pornography to his laptop. I received no details as to how often they visited, and when, and where he was when they visited.

[85] The laptop had a password. While I accept that it would not have been unreasonable to give a family member a password and agree that it may not have been needed if the computer was already logged onto, I found Mr. Rhodes answers to whether or not there was a password difficult to reconcile.

On the one hand he stated that he did not have the computer long enough to make memories with it, yet he certainly was able to remember that he made a user name for himself, made partitions, made an encrypted volume, created a password for the encrypted volume, that he filled the encrypted volume to full capacity, that he accessed particular websites such as kick ass torrent and used utorrent. I found it odd that he could not remember the basic log on steps to the laptop that would engage him each and every time that laptop was unplugged from the wall or turned off. [86] When Mr.

Rhodes was asked about the 318 Shareaza alternate data streams pertaining to music, audio and video files found during the forensic analysis, Mr. Rhodes pointed to items of interest he related to particular family members as a possible explanation for some of them. However he never saw any of his family members downloading the items or using the laptop. He agreed he could not say whether any of the items on the laptop had in fact been downloaded by any of them. I also noted, that there were not very many of these items identified by him as potentially attributable to his family.

So if there was downloading going on and use of the laptop by family members, this didn’t seem to suggest it was significant. Finally, the specific interests that Mr. Rhodes testified his family members had were all with respect to non-pornographic items, books, movies and music. [87] Another significant problem with pointing the finger at family members is Mr. Rhodes’ testimony and position regarding the purchase of the laptop. No other family members could be using a laptop he did not yet own to download, view and share child pornography movies. [88] Moreover, I received evidence from Det. Cst. Spence that Mr.

Rhodes may have stated to him that Mr. Rhodes used his laptop to access pornography, albeit gay pornography. The point is that, on all of the evidence concerning interests, Mr. Rhodes is the only person out of all of the family members who I was informed had an interest in pornography. [89] Further, the last log on date for the laptop was determined to be October 14, 2015 at 08:37:27 PM. Det. Cst. Pinkerton stated that this means that this is the last date and time that someone logged in to the XOXOX user account. Given the laptop had no battery this places the laptop with Mr. Rhodes in his bedroom at this time.

The laptop was plugged into the wall and on Mr. Rhodes bed when they found him. Mr. Rhodes was home that evening and agrees he was alone in his room because he was using headphones and likely listening to old time radio. Mr. Rhodes testified that he went to bed perhaps around 10:00 p.m. [90] Det. Cst. Pinkerton located a cache in the temporary internet files for Internet Explorer identified as an image of child pornography. He indicated that a cache is created when an individual visits the particular website. When the individual visits the website, the browser downloads the website onto your computer.

This is done for expediency purposes namely to permit you to access the website more quickly the next time you visit it. In this instance this cache was date stamped. The date stamp was October 14, 2015 at approximately 10:19 PM. This date stamp reflects the date and time the file was introduced to the system and saved on the system. There was no one else other than Mr. Rhodes who had the laptop at this time based on his own evidence. While this is an image and not a movie, it is relevant evidence in that it contradicts Mr. Rhodes evidence that he did not access child pornography ever.

The cache arises only from accessing a website, in this case, it was a website with images of child pornography. Mr. Rhodes had no explanation for this. [91] At the end of the day, I accept that it is possible that some of the evidence, namely the 318 Shareaza alternate data streams files could have been downloaded by family members. However, I do not believe or find that the evidence supports that any of these individuals would have accessed and/or downloaded child pornography. Sexual Preference [92] Mr. Rhodes testified that he is homosexual and that sexually he has zero interest in any female of any age. Mr.

Rhodes stated his sexual preference was settled for him in his late twenties. [93] He submits that with his sexual preference, he would not be motivated to view or download heterosexual pornography or pornography involving females, and that this information regarding his sexual preference is not convenient fabrication because he provided this information to Det. Cst. Spence after he was arrested. [94] I agree that a number of the titles of the files appear to indicate that the file includes females and heterosexual activity.

However, there are some titles that do not reference with certainty, females or heterosexual activity, including but not limited to “Horny russian 11yo masturbates in skype clip02.avi”; “(Pthc) Kinderkutje Pedoland Vid2.mpg.torrent”; and the many numbered “.avi” files (which were highlighted by Det. Cst. Spence as representing notable or child pornography files as determined previously by other investigators who had previously reviewed the files). Further, many of the words in the tiles of the files could apply to other preferences.

The point is that search engines search words entered by a user and many titles, even titles one may not be interested in, can appear as a search result if you enter a least one of the words from the title. [95] In addition, Mr. Rhodes admitted that he has a history with both sexes. His history includes bisexual preference and two marriages to women. He is the biological father of two children. His first marriage he states ended because he was unfaithful with a man. [96] Even though he states he was settled on his preference in his twenties, he married another woman after his first marriage ended.

He and this second wife were together until February of 2015. His explanation for this is that there was no sexual relationship with the second wife by agreement (it was one that allowed her to be financially secure and him to be a father again, a father to her children). I did not understand this given he indicated that he had two children of his own. [97] I considered Mr. Rhodes’ statement to Det. Cst. Spence. Det. Cst. Spence indicated clearly that he did not ask Mr. Rhodes about his sexual preference after arrest. Mr. Rhodes made a spontaneous statement about being gay after Det. Cst. Spence asked Mr.

Rhodes a question unrelated to sexual preference. In particular, Det. Cst. Spence stated that he had asked Mr. Rhodes “what the username Kathy Archer meant?” and Mr. Rhodes immediately stated “thanks for telling my parents I’m gay”. Det. Cst. Spence did not understand. He did not know how asking Mr. Rhodes about that particular username would generate such a response. I don’t either

quite frankly. The name is a female name. Mr. Rhodes at the time was not being asked about the contents of the pornography or men,he was being asked about a female user name and what it meant. Mr. Rhodes did not dispute Det. Cst. Spence’s evidence or contradict itor explain it when he testified. [98] Det. Cst. Spence in cross-examination was asked about and acknowledged that during his interview, Mr. Rhodes may havestated that he had been streaming gay pornography. Det. Cst. Spence did not find this of relevance in respect of the child pornographyinvestigation. Det. Cst.

Spence was not asked to provide any further context. Mr. Rhodes when he testified did not give evidenceexpanding on his statement to Det. Cst. Spence related to streaming gay pornography or the context. [99] Finally, Mr. Rhodes has no explanation for the cache file that was identified as an image of child pornography that waslocated on the laptop. The cache file was created October 14, 2015 at 2219:43 hours during which time Mr. Rhodes, by his ownevidence was alone in bed with control of the laptop. [100] Based on all of the above, I do not believe Mr. Rhodes and that Mr.

Rhodes’ stated sexual orientation would lead to theconclusion that he would not have accessed heterosexual and or pornography involving females or children. Having an Encrypted Volume [101] Mr. Rhodes had created an encrypted volume. The suggestion is that if Mr. Rhodes was downloading the files in question, hewould not have downloaded them to unencrypted volumes. [102] First, I noted that Mr. Rhodes did not testify that in each instance when he downloaded a file, he did so to the encryptedvolume. [103] Mr.

Rhodes said that he created the volume to protect things like those family pictures, music and movies that he did not wantother family members to accidentally delete. [104] Finally, Mr. Rhodes described the encrypted volume as full of movies, that he had filled the volume right up and nothing elsecould have fit on there. [105] Accordingly, this suggestion does not accord with his evidence.

Accidental Downloads [106] Based on the regular capturing of files by the police computer and activity in the folder between July 14, 2015 and August 18,2015, I find it is not reasonable to conclude that someone would have been accidentally acquiring child pornography during that timeframe. [107] Again, with respect to the movie downloaded on August 1, 2015, instead of being deleted (had it been downloaded by accident),the name was changed and the file remained in the folder. This happened with other files in the shared folder as set out by Exhibit 5.

Renaming and keeping files after they are renamed are actions that are contrary to a theory of accidental downloading. Potential Viruses [108] Det. Cst. Pinkerton conducted a virus scan of the laptop. He found zero infections.

Summary [109] Applying R. v. W.(D.), and in the context of all of the other evidence, I reject Mr. Rhodes evidence and I am not left in doubt. Inthe context of all of the evidence I do accept, I am satisfied beyond a reasonable doubt that Mr. Rhodes knowingly possessed childpornography movies during the time frame of the charge, and in particular July 14, 2015 to August 18, 2015.

MAKING CHILD PORNOGRAPHY AVAILABLE [110] The relevant part of subsection 163.1(3) of the Criminal Code provides: Every person who…makes available… for the purpose of transmission, making available, distribution, sale, advertising or exportationany child pornography is guilty of an indictable offence and liable to imprisonment for a term of not more than 14 years and to aminimum punishment of imprisonment for a term of one year. [111] At paragraph 83 of R. v.

Spencer, [2014] 2 S.C.R., Cromwell J., speaking for the majority of the court wrote: I accept Coldwell J.A.’s conclusion that the offence is complete once the accused knowingly makes pornography available to others. Ashe put it, “In the context of a file sharing program, the mens rea element of making available child pornography under s. 163.1(3)requires proof of the intent to make computer files containing child pornography available to others using that program or actualknowledge that the file share program makes files available to others. [112] In paragraph 84 in R. v.

Spencer,supra, the court states that wilful blindness is a substitute for knowledge and refers to theexplanation of Charron J. in R. v. Briscol, 2010 SCC 13 , 2010 S.C.C. 13 at para. 21, a portion of which is as follows: Wilful blindness does not define the mens rea required for particular offences. Rather, it can substitute for actual knowledge wheneverknowledge is a component of the mens rea. The doctrine of wilful blindness imputes knowledge to an accused whose suspicion isaroused to the point where he or she sees the need for further inquiries, but deliberately chooses not to make those inquiries. …

[Emphasis added by Cromwell J.] [113] In R. v. Bools, supra, at paragraphs 102 and 103 the court wrote as follows: The Supreme Court of Canada recently confirmed that there is no requirement that the accused take any positive step to make childpornography available beyond using a file sharing program that permits the sharing of files and either passively acquiesces to the sharingof the files or is wilfully blind to the sharing feature of the program used (R. v. Spencer, 2014 SCC 43, [2014] S.C.J. No. 43 at paras 83-85).

The Crown need not prove that the accused had an interest in active distribution, or even that he had a particular interest in sharing fileswith others. The Crown need only show that the accused knew that his participation on the sharing program would permit others toaccess his files (R. v. Mallory, 2008 (S.C.J.) at para. 24 (unreported); Connor at para. 131). [114] A useful case setting out the essential elements to be proven by the Crown in the offence of making child pornographyavailable, contrary to

section 163.1(3) of the Criminal Code of Canada is r. v. Beason 2010 SKQB 459 , [2010] S.J. No. 758. At paragraph 18 of that decision, the court states as follows: The elements of the offence of making child pornography available contrary to

section 163.1(3) are set out in R. v. Johannson (S.B.)2008 SKQB 451 at para 34: 34. In my opinion, the elements of the make available child pornography charges under s. 163.1(3) are as follows: (

a) The identity of the accused as the offender; (

b) The time and place of the offence; (

c) That the material in question constituted child pornography; (

d) That the child pornography was actually made available by the accused; and (

e) That the accused had the intent to make child pornography available to others. The Elements [115] I rely on my findings under count one to find that the first four elements in my view are established. [116] The issue of whether Mr. Rhodes had the intent to make child pornography available to others is the remaining issue. Mr. Rhodes as a User [117] On Mr. Rhodes’ evidence, I have no doubt that Mr. Rhodes was familiar at the material time and continues to be familiar withthe nature of file sharing programs and peer to peer networks. He started with Napster in the 1990s.

He has used Bearshare and anotherprogram that he could not remember the name of. Mr. Rhodes testified that he had heard of Shareaza and may have used it in the past. He was familiar with and used utorrent on the laptop because he accessed the kick ass torrent website. [118] In this one particular case, Mr. Rhodes demonstrated that knew how to do many things. He knew how to create a user account. He knew how to and in fact created partitions and an encrypted volume on the laptop. He created a password for this volume. He knewhow to stream movies and music. He knew how to download movies and music.

In fact, he testified that he has downloaded asignificant amount of movies, television shows, cartoons and music. He had many collections and themes of collections. The encryptedvolume of his laptop was full. Knowledge of the Existence of Shareaza on the Laptop [119] Despite the fact that Mr. Rhodes was familiar at the material time with sharing programs, including Shareaza, there remains theissue regarding the installation of Shareaza on the laptop. Mr. Rhodes testified that he did not install Shareaza on the laptop.

He alsotestified that while he had used Shareaza in the past, he did not believe that he used Shareaza on the laptop. Installation of Shareaza [120] Det. Cst. Pinkerton could only confirm that at some point in time Shareaza resided on the laptop. He could not establish whenit was installed or when it was deleted and by whom. He was able to locate a deleted Windows registry hive identified as the softwarehive which contained information about software installed on the laptop. He recovered the hive from unallocated clusters.

The Windowsregistry is a hierarchal database that stores low-level settings from the Microsoft Windows operating system and for applications that optto use the registry. In such a case when a sharing program is installed it will use the registry to store information for the program such assearch terms and the username that was entered. This hive contained information relating to the application Shareaza. When he looked atthe live software hive there were no traces of the entries he recovered on the deleted hive. He indicated when an application isuninstalled typically its registry entries are removed as well.

The last written date to the registry for this program was August 11, 2015at approximately 5:32 PM. [121] Of note, on installation Shareaza can be placed in a default folder or any other location the installer selects. [122] I noted that the installation process of Shareaza will populate the creation of a start menu shortcut, and a desktop or quicklaunch icon for Shareaza by default if these task options are not deselected. Mr. Rhodes however testified that he did not see an icon onthe laptop for Shareaza.

Even if it was there, I received no evidence as to how noticeable it would have been on the particular laptop inquestion. I do not know what Mr. Rhodes’ desktop looked like.

[123] From the Registry Hive, Det. Cst. Pinkerton, produced a screenshot of the graphic interface which showed a main folder for Shareaza, that included a subfolder named FileAssociations. The significance of this is that Det. Cst. Pinkerton testified that if Shareaza had been set up to be associated to torrent files, if one was to double-click on the torrent file Shareaza would start automatically without you even having to open up the Shareaza program. [124] Mr.

Rhodes indicated that he used u torrent, another file sharing program, because he primarily downloaded collections utilizing a website called “kick ass torrent”, which brought him to utorrent to complete the download. [125] The evidence was that Shareaza could have been set up to include both downloads and torrents folders, and in fact, they are set as shared folders by default in the installation process.

In addition, in the installation process, as indicated, by default, Shareaza could be set to handle torrent links and to be associated with them. [126] Detective Constable Pinkerton utilized the software package magnet axiom to search for artifacts supporting the possession of child pornography. He verified the findings by navigating to the reported location within the image file using x-ways. He located three files having names suggestive of child pornography which had been downloaded with the torrent network. He’s able to determine this by the name of the file.

The file would have been sought out on the torrent network and downloaded from the network. It is unknown what program was used to do the download. [127] Further, Det. Cst. Pinkerton confirmed that by default, when Shareaza is installed, one of the options for configuration with the computer is to automatically “start Shareaza every time Windows starts”. It also has a default option, which configures the computer to connect to the network every time Shareaza is started. Det. Cst. Pinkerton stated that Shareaza will connect to the network if you have internet access, which Mr. Rhodes had.

If all these options were in place, Shareaza could automatically start when Windows started and with an internet connection in place, it could have connected to the network as soon as Shareaza was started. [128] The evidence was also that once installed if set up to share folders, Shareaza makes folders available to others automatically with no further notification to the user. [129] I did not receive any information as to whether or not the utorrent program was located on the laptop or any other sharing program. When Det. Cst.

Pinkerton was explaining the default option for Shareaza to handle torrent files in the set-up process, he indicated that you could uncheck that option and have another torrent client handle torrent files. The point is that you can have more than one sharing program and choose which one you want to use. If someone else installed Shareaza after another torrent client had already been installed with the Shareaza default settings, Shareaza would have taken over handling the torrent files by default. [130] What’s troubling here in terms of believing Mr.

Rhodes and concerning is that the August 1, 2015 movie was a “.avi” file and not a torrent file. Det. Cst. Pinkerton also was able to determine that it was downloaded using Shareaza. [131] I also found Mr. Rhodes evidence on the use of Shareza troubling at times. He repeated the phrase “I don’t believe I would have used this program” a number of times. Although he almost always said he thought he used another program such as utorrent, there was a lack of certainty in his presentation. [132] I considered the process of downloading, and what Mr. Rhodes may have seen when downloading was going on. However, Mr.

Rhodes stated he did not often check on the status of his downloads and just waited for them, as some of them he knew would take time because they included large collections. I don’t accept that as unreasonable prospect. Also, on this issue, I note that Det. Cst.

Spence indicated that one can view a file as it is downloading in the temporary (file) and so one is not necessarily always waiting for a download to be completed. [133] I considered the communications with the police computer, and forensic findings in the context of awareness/knowledge of the Shareaza program; possible sharing features and /or passive acquiescence to sharing features. I made the following observations. [134] The communications between the police computer and the user computer combined with the forensic analysis establish that certain files were actually downloaded using Shareaza.

This evidence establishes that Shareaza shared the files. [135] On the communication printouts, however, many of the files did not remain in the folder for a long period (some were gone within hours, or a day or a few days). There was a pattern of files moving out of the folder. [136] In addition, some of the files that were not deleted were physically changed to names that would no longer outright identify the file as child pornography. In this case, they were changed to numbered “.avi” files.

This is suggestive of the user wanting to name the downloaded files with names that would specifically conceal the nature of the contents. This renaming process occurred with the movie downloaded by Det. Cst. Spence on August 1, 2015. Sometime that very day between 0119 hours and 0623 hours, the file was renamed in the folder as “54.avi”. Det. Cst.

Spence attributed the change of file names in the folder to the user and as demonstrating activity of the user. [137] I also noted that some of the files in the folder came into the folder having names that did not identify them as child pornography; coming in simply as numbered “.avi” files. [138] If the user was aware of the Shareaza program, or the sharing features of the program, or that sharing was going on, why only rename some but not others? [139] I appreciate that at some point Shareaza was deleted from the laptop before the search warrant was executed. It cannot be determined who did this. Det. Cst.

Pinkerton was not able to give evidence that the laptop appeared to have been cleaned by any person. [140] Was there anything to “tip off” Mr. Rhodes that there was a problem? I considered the following. [141] I received evidence from Det. Cst. Spence that Cst. Perkins of the Elliot Lake OPP attended the residence during the course of

gathering information for the warrant. The officer spoke to Mr. Grenier and the purpose of the attendance was to find out who lived at the residence. Mr. Grenier provided that information. Mr. Grenier provided the names and dates of birth of the residents of the house. However, I noted that one of the appendices attached to the warrant indicated that Cst. Perkins attended the residence under the pretext of car entries in the neighbourhood. Cst. Perkins did not testify and I have nothing to the contrary. Further, I have no evidence as to what if anything Mr. Grenier told Mr. Rhodes about the officer’s attendance.

I cannot conclude on this evidence that Mr. Rhodes was tipped off. [142] Moreover, I accepted that others family members may have had some limited access to the laptop. While I do not believe any of these individuals downloaded child pornography as previously stated, I cannot exclude them from downloading or deleting programs such as Shareaza without Mr. Rhodes knowing. The artifacts related to Shareaza were found on unencrypted partitions, partitions they would have had access to. Det. Cst.

Pinkerton was of the view that because he found the Shareaza remnants on partition one that it was likely that at some point it had been installed on partition one. [143] Finally, even if the facts surrounding Cst. Perkin’s visit to the residence could possibly be woven together to suggest that Mr. Rhodes was tipped off in any way, I am of the view that any such

interpretation would not necessarily displace a conclusion that at the material time the movies were being made available, Mr. Rhodes may not have known that the Shareaza program was on the laptop, for the reasons I previously set out. [144] Based on all of the above and the totality of the evidence, I am left in doubt on this element, and not able to come to the conclusion that Mr. Rhodes had actual knowledge that, or he was wilfully blind to the fact that child pornography movies were being made available as contemplated by the Criminal Code . CONCLUSION [145] For reasons set out above, on count one, I find Mr.

Rhodes, guilty. [146] On count two, I find Mr. Rhodes not guilty. Rasaiah J. Released: July 7, 2017 ONTARIO SUPERIOR COURT OF JUSTICE HER MAJESTY THE QUEEN – and – ROBERT SHANE RHODES REASONS FOR DECISION Rasaiah J.

Released: July 7, 2017