Possession: nine points of the law?
I have worked as a computer forensic expert for the defence in over 100 cases which involved creation or possession of indecent images of children on a computer. I have also worked in cases involving computer-based evidence relating to counter-terrorism, murder and fraud, although in these matters computer-based evidence tends to be peripheral rather than fundamental to the case.
One of the factors in cases such as indecent images, where the prosecution case is based solely upon the findings of the prosecution computer expert, and which is almost universal, is the lack of in-depth investigation by the prosecuting authorities. Very often the prosecution case is based simply upon the assumption that: “The images are on your client’s computer, therefore he is guilty.”
In my experience, the truth is often very far from that. The language of the indictment usually tends to be somewhat emotive, using words such as ‘accessing’,‘making’, ‘downloading’ and ‘saving’, all of which imply a conscious action on the part of the computer user to select and keep images. However, many such cases involve the computer user being redirected to a child pornography website without his having any choice in the matter. Once a web page is opened the contents, including pictures, are written to the computer hard drive. The indictment will damningly read that ìhe downloaded them”.
A broader investigation of the computer evidence is always likely to help the court and can do the defendant no harm. How did the images get onto the computer? When? Why? Did anyone else have access to the computer? Could the images have got onto the computer without the client’s knowledge?
Even if they are on the computer, does the client have access to them? Are they viewable images or tiny parts of a web page? Are they adverts that popped up on their own? What are the dynamics of the case? What else is on the computer that the prosecution did not feel was relevant?
As an example of the importance of the defence expert taking up these lines of enquiry, I recently acted in a case in the South where the defendant was charged with making and possessing indecent images of children. He flatly denied the charge.
The images were certainly on his computer, but I decided to approach the matter from a different angle. I was able to reconstruct the internet sessions, including the times, during which the images had been written to the hard drive. For some of those sessions the defendant had an alibi.
Armed with this information his defence counsel elicited from his stepdaughter under cross examination an admission that she had downloaded the images herself to incriminate her stepfather.
On another prosecution, brought about as a result of the infamous ‘Operation Ore’, I was able to demonstrate that the client’s credit card details had been stolen and used to access a child pornography site from the USA when the client was clearly in the UK at the time. My client was lucky – 39 of those investigated in the UK under ‘Operation Ore’ committed suicide.
My advice, then, when instructing a Computer Forensic Expert is to choose an experienced expert who is not only accomplished in his field, but who can demonstrate a track record of creative investigation as well.
• Steve Lewer is a computer forensics consultant for Digifor Ltd. (This email address is being protected from spambots. You need JavaScript enabled to view it.). He is a member of the UK Register of Expert Witnesses and the Society of Expert Witnesses. He is also a technical security analyst for the nuclear and merchant banking industries.