Expert Witness

No Evidence of a Guilty Act or Intent

A police examination of a computer found a small quantity of pictures and movies that were indecent images of children.  The evidence found on the computer did not include anything to show the guilty act that caused the indecent images to be on the computer nor evidence of intent.  I prepared letters and an expert witness report describing the evidence.

Letter Describing the Evidence

8 February

Mr S
S Solicitors

Dear Mr S

Expert Witness Examination

Thank you for your letter dated 30 January  enclosing the witness statement of the police computer examiner, Mr P, and his reports regarding Exhibits M1, M2 and E1.

I have seen nothing to show the acts performed by Mr D that caused the movies and photos in Counts 1 – 4 to be “made” by Mr D.

The material that is the subject of the “making” Counts are the four files listed as items 1 – 4 on pages 3 and 4 of the “Examination Report for exhibit E1”. Items 1 and 2 are movie files and are in folders and the files would be accessible to anyone using the computer.

I have seen nothing to show how these files came to be on the computer. It may be that the files were obtained by, for example, clicking on a button labelled “Download” on a web page. I cannot know the text that might have been on that web page (if it exists). It may be that the hypothetical web page contained misleading text regarding the file to be downloaded.

It may be that the files were obtained using, for example, file sharing software. This is software that I, for example, might run on my computer. The file sharing software on my computer would connect to similar software running on many (thousand) other computers. I could use the file sharing software to search for files. I might search for “Queen” and would receive a long list of Queen songs stored on squillions of computers all over the planet. I might click on the first and last items in a list of hundreds and click to download all of the files. I might find, when the download has finished, that, in addition to many Queen songs, I had also downloaded pictures and movies of the Queen.

I have seen nothing to indicate downloads from a web page and nothing to indicate downloads using file sharing software.

It is my understanding that police computer examiners limit their initial examination and produce only enough evidence to get a guilty plea. If a guilty plea is not forthcoming the examiner may conduct an additional examination and may find additional evidence.

I cannot know what might be found should Mr P undertake an additional examination. It may be that an additional examination by Mr P would find evidence of Google searches or searches using file sharing software and these searches might include words that explicitly seek photographs rather than cartoons.

I have not seen the transcripts of any interview with Mr D. It is my understanding that there is nothing in any interview that the Prosecution could rely on as evidence to support a Count of “making”.

The names of the movie files give no indication that the content of the movies involves children. It may be that the only way to know the content of the file would be to view the movie. For both movie files, the “File Created” and “Last Accessed” dates are the same. To view a movie file, it would be necessary to access the file after the file had been created. Identical created and accessed dates and times are consistent with the movie not having been viewed.

All of the above also applies to the photo files listed as items 3 and 4 with the additional factor that the photo files are deleted files. The photo files have no file names and no dates. The photo files could not be viewed in any typical way at the time that the computer was seized.

I would welcome the opportunity to discuss the next steps and I look forward to hearing from you.

Yours sincerely

Graham Dilloway
Expert Witness

Second Letter Describing the Evidence

12 February

Mr S
S Solicitors

Dear Mr S

Expert Witness Examination

Thank you for your letter dated 8 February  and the enclosed interview transcript.

In the interview on 15 June  at Counter 38.58, Mr D says, “ … I've downloaded them in big bulk folders off U-Torrent ...”. U-Torrent is file sharing software. Mr D would have been downloading files from computers that are in all manner of homes and offices. The files that he was downloading would have been given file names and labels by the people making them available for download. I might use U-Torrent to download a file with a file name and labels that indicate that the file is a Queen song. I might find that the file is actually a Beatles song.

Mr D says, “... downloaded them in big bulk folders …”. I might have many pictures of motor cars and I might wish to share my pictures. I might compress all of my motor car pictures into a single large file (often called a zip file). I might give the file a name of “Motor car pics” and other labels indicating that the file contains pictures of motor cars. I might make the file available for download using Utorrent. You might download the file expecting only pictures of motor cars and be horrified to discover that I have included a picture of a railway train among the motor cars.

I have seen no evidence to show that Mr D had viewed the files in Counts 1 – 4. I do not know of any way that the Prosecution can use the evidence as it is to show that Mr D knew that he was “making” illegal material.

I have looked in more detail at the dates for the cartoon files and it seems that my initial thoughts were incorrect. The files appear to have been created on rather more dates than I first thought. The “File Created” dates for the files listed in “Examination Report for exhibit EH1” include:

The great majority of the files were created on 3 June and 5 June. Some of the other dates have only two or three files created.

The second page of the examination report says that Windows was installed on the computer on 19 January . DC P says, in his statement dated 7 July , that the computer was seized on 15 June . It may be worthy of note that all of the files listed in the examination report were created in a period of less than three weeks immediately before the computer was seized.

DC P says, “There were in excess of 1000 such images, I bookmarked 758 of these images to an examination report”. It may be that DC P found illegal pictures on the computer that were created before 27 May and these pictures are not included in his examination report.

The dates for items 411 and 412 are illegible in my copy of the examination report.

The “File Created” date and the “Last Accessed” date and time are the same for almost all of the cartoon files. The is consistent with the pictures having not been viewed after they were created at their current location.

Files on the USB stick (Exhibit M1) have “File Created” dates of 19 May  and times that span a fourteen second period. This is consistent with all of these files having been created in a single operation.

Please call if any of this requires clarification.

Yours sincerely

Graham Dilloway
Expert Witness

Expert Witness Report

The Author

1. This report was prepared by Graham Dilloway of 39 Conham Hill Bristol BS15 3AW. I am a Member of the British Computer Society, the chartered professional body for the computer industry in the UK. I am a member of the Academy of Experts. I have worked with computers for more than 30 years. This work has all involved the implementation and configuration of computers, their operating systems and the core software applications of a computer environment (e.g. word processors and spreadsheets). I have worked with personal computers almost exclusively for more than twenty years.

Instructions

2. I have discussed my instructions with S Solicitors and I understand these instructions to be that I should describe the evidence.

3. I have a letter dated 30 January  from S Solictors that encloses documents that include the statement of DC P dated 7 July  and the Examination Reports that accompany that statement.

4. I have a letter dated 8 February  from S Solictors that encloses the transcripts of an interviews with Mr D dated 15 June  and 19 August .

Evidence

5. I have seen no evidence to show that Mr D searched the Internet for photos or movies of real children.

6. I have seen no evidence to show that Mr D clicked on explicit text on a webpage or did anything that would have caused him to knowingly download photos or movies of real children from a website.

7. I have seen no evidence to show that Mr D clicked on explicit text on a webpage or did anything that would have caused him to view photos or movies of real children on a website.

8. I have seen no evidence to show that Mr D clicked on an explicit filename or did anything that would have caused him to knowingly download photos or movies of real children using file sharing or other software.

9. I have seen no evidence to show that Mr D had viewed the movie and photo files listed on Pages 3 and 4 of DC P's “Examination Report for exhibit EH 1”.

Folders

10. On 28 February , I created a new user account for a user called “G” on my computer running Windows 7 software. I logged on to the G account. This process created folders on my computer for the user G and these folders included a Users\G\Downloads folder.

11. Mr D says, in his interview on 15 June  at counter 38.58, “ ... I've downloaded them in big bulk folders ..”. I understand Mr D to mean that there have been occasions when Mr D has downloaded a large file that contains the compressed contents of several files.

12. I have downloaded large files that contain the content of several smaller files. I have opened the larger file and extracted the smaller files that are contained in the large file. This extraction process has automatically created folders on my computer to replicate the folders that contained the smaller files when they were compressed and added to the large file on the computer of the person creating the large file.

13. I have seen nothing to show that the Users\G\Videos folder was created deliberately by Mr D typing the word “Videos”.

Summary

14. I have seen nothing to show any knowing and deliberate act by Mr D that caused there to be movies and photos of real children on the computer.

15. I understand my duty to the Court and I confirm that I have complied with and will continue to comply with that duty.

16. I confirm that insofar as the facts stated in my report are within my own knowledge I have made it clear which they are and I believe them to be true, and that the opinions I have expressed represent my true and complete professional opinion.

Graham Dilloway
Expert Witness

28 February