Computer pornography

IF INDECENT images have been deleted from the computer, can an individual still be charged with possession?

THE CASE of R v Ross Warwick Porter5 considered offences that related to the making of indecent photographs of a child under s1(1)(a) Protection of Children Act 1978 and of possessing indecent photographs of children contrary to s160(1) Criminal Justice Act 1988. However, the images in question had been deleted by the defendant before his arrest and were retrieved by the authorities only with the support of specialist forensic technologies and expertise.

As a result, the appeal was upheld and it is now generally accepted that if an individual cannot retrieve or gain access to indecent content, then they cannot be regarded as having custody or control of it.

Note, however, that prosecutors are seeking redress in matters where the ‘Porter ruling’ may be brought into frame by carefully specifying the dates in the indictment to periods when it can be stated with greater certainty that the imagery was ‘live’ and present on the computer drive.

• Is it a realistic defence to argue that there was no reason to suspect that the media were potentially illegal and that there is no evidence of actual viewing?

WHILE the motive behind possession is separate from the question of indecency (R v Graham-Kerr, 1988) the 2004 criminal trial of R v Collier agreed that it would be a defensible position in law if it can be shown that an individual had no knowledge or reason to suspect that any multimedia content in their care (or to which they had access) was illegal in nature.

This issue is typified in cases involving indecent imagery encountered on the internet, when the web browser ‘caches’ (automatically saves copies of web pages and imagery to the local hard disk without any user intervention).

While this action does occur without user intervention, the rulings in Atkins v DPP and Goodland v DPP (2000) have made it clear that an offence will still have been committed if an ‘internet photo [is] stored automatically on computer’.

A defence case built on reasonable knowledge can be further strengthened by forensic evidence that shows an absence of viewing or access to the indecent media. Operations on files and folders are recorded in ‘time-stamps’, providing three classes of information: when the file/ folder was created, when it was last accessed and when the file/folder was last modified.

Time-stamp data is recorded automatically by the operating system, and specialist skills and technical understanding are required to change these time/date entries; such tampering can normally be uncovered by astute investigators. In matters of illegal imagery, time-stamps provide crucial evidence as to actions, and put into context when they occurred.

• Can images, which are essentially binary computer code consisting of 1s and 0s, be considered illegal?

THE CASE of R v Fellows and R v Arnold (CACD Sep 1996)6 explored this legal argument and considered whether transformations on the raw code, such as those that may be necessary to include the data in an email, could affect the legal definition of indecent media.

It was held that, irrespective of format or transformations, if code can be reconstructed into material with characteristics that would liken it to a photograph or movie, then for the purposes of the law that data would be regarded as media and be subject to the same threshold tests of indecency/illegality.

• Does making a file available for download indicate exposure or distribution?

ELECTRONIC files can take many forms, from newsgroup postings to web pages, images and multimedia content such as movies. Such files can be made available for access or duplication by using a variety of means (eg, the inclusion of the file on a website or within a filesharing application such as Kazaa).

Compounding the legal positioning is the fact that, after the initial set-up, the file may be accessed or manipulated without the knowledge or consent of the individual who has made it available. The ruling in R v Skinner (2005) holds that even material automatically copied from one website to another can be regarded as ‘real evidence’ and the owner/administrator of the websites in question – as well as those potentially accessing and viewing the content – may be committing criminal offences.

Furthermore, the case of R v Arnold married the technical and legal arguments, making it clear that the individual responsible for making a file available also distributes it. After this process there may be no more action or intervention by the defendant; however, the initial positive steps taken are binding and go towards facilitating distribution.

Should a ‘receiving computer’ create a copy of the media, then this only adds gravity to the finding.

• Is it possible that a website displaying child pornography could ‘pop up’ on the screen unrequested by the user?

MANY CASES involving illegal imagery focus on whether there is evidence of accessing websites that have been confirmed to house child abuse material. A common defence tactic is to suggest that a suspect website was not directly accessed and simply appeared on the screen during the course of browsing the internet. For instance, the user is surfing website A when suddenly pages for websites Y and Z appear on the screen – which have not been requested and may contain content quite unlike site A.

On pornographic websites of all forms it is common to have extra browser windows, known as ‘popups’, to be produced to encourage visitors to view and explore more content than intended.

A more modern variant to the ‘pop-up’ is the ‘pop-under’, where the browsing window is produced ‘minimised’ and as such an entire page of content/imagery could load – with fragments potentially ‘cached’ and saved to the computer drive – without the knowledge or action of the user.

In such cases, a comprehensive forensic evaluation of the evidence can reveal whether a site was explicitly requested or if a user had been looking for something else but had been directed automatically towards the website in question.

Furthermore, it is possible to identify whether a given site has been accessed repeatedly (which would challenge any defence that it was an accidental, one-off visit) and which areas or categories of the site had been viewed.

• The computer hard disk is second-hand; could the illegal media have originated from actions attributable to the former owner?

HARD DISKS, the main storage devices for data and files, are frequently changed between computers, especially when systems are being upgraded or current capacities have been reached and an additional (often cheap, second-hand) drive is added to increase space for file storage.

Few users appreciate the capabilities of data recovery experts and tend to simply delete or format their drives before disposal or exchange.

Unless a drive has been wiped in accordance with standards such as US DOD 5220.22-M8, data can usually be easily retrieved by using forensic techniques and sensitive materials may be found residing on a drive long after it has been thought removed by the owner.

While the “it was on the drive when I got it” defence is sometimes considered by defendants, it is important to note that skilled forensic examiners will be able to identify times of creation for the images/media and patterns of access which would contradict their account.
• When obscene media are identified on a shared computer, can the material be attributed to an individual user?

THE CLASSIC investigator mantra of ‘who?’, ‘what?’, ‘where?’ and ‘when?’ are essential starting points.

‘Who?’ considers all the individuals with access and opportunity to the system at the time of the offence; are passwords employed to access the system and/or is the computer in a locked office?

‘What?’ explores the nature of the material (eg, Lolitastyle movies) identified, which may itself suggest a particular individual.

‘Where?’ asks in what areas of the computer were the data stored; were they public folders accessible to all or restricted portions of the drive available only to authorised users?

‘When?’ relies on timestamps and environmental evidence (eg, personal alibis and/or looking at specific files on the computer that were accessed in and around the time of the offence) to tie many of the complementary facts together in order to help attribute specific actions with an individual.