Computer Expert Witness
Graham Dilloway CITP MBCS
Computer Expert Witness

Chartered IT Professional and Member of British Computer Society

Listed in Register of Expert Witnesses


Member of the Academy of Experts


View Graham Dilloway's profile on LinkedIn

Definition of Indecent Image Offences

Evidence on Computers

The law and the courts recognise that it is possible to access indecent images of children without intending to look at or save the images.

A police examination might find indecent images of children on a computer even though the computer has not been used in a deliberate attempt to obtain indecent images.  It is the specific evidence found on a computer that shows how that computer might have been used ...

Every case is different and examination of the details in the evidence is important.  It might be that access to indecent images will be assumed based on little more than the name of the folder that contains the images.

Making Indecent Images

Examination of a computer may indicate the actions performed with the computer.  For example, the examination might find traces of two web pages that were displayed on screen where the interval between the display of each page is only a few seconds.  It might be argued that these web page traces are evidence that the first web page was clicked to cause the second web page to be displayed.

Actions that might be prosecuted as making an indecent image of a child include ...

Actions that will not be prosecuted as making an indecent image might include ...

Possession of Indecent Images

Charges of possessing indecent images are often based on the idea the person using the computer "must have known" that the indecent images were on the machine.

Evidence that might indicate guilty knowledge of indecent images includes ...

Findings that are likely to be unreliable evidence of possession of indecent images might include ...

Possession of Extreme or Prohibited Images

It is a crime to posses images that are "extreme" or "prohibited".  Extreme images might include pornography involving animals or violence.  Prohibited images might include cartoon drawings of children that do not involve any actual persons.  The evidence that might support the offences of possession of "extreme" or "prohibited" images is likely to be similar to the evidence for possession of indecent images of children.  There is no crime of making "extreme" or "prohibited" images.

Definition of Indecent Image of a Child

It is my understanding that the law does not define an indecent image of a child.  The decision that an image is a child under the age of eighteen (or not) and the decision that an image is indecent (or not) is left to the jury in a trial.  There is usually a consensus among the prosecuting and defending lawyers before any trial regarding the nature of the images that are to be evidence and it is often not necessary for the images to be seen during the trial.

Knowing and Deliberate Act

In summary, to be guilty of a crime, the law requires that we do something deliberately and that we know that we are doing it. Pictures of child abuse on a computer may not be evidence of making or possession of indecent images of children.  There needs to be evidence of a knowing and deliberate act.

Example of Evidence in Indecent Image Case

I received an email from Mr D saying that he was in the midst of criminal court proceedings.  I have no way of knowing the truth of Mr D's situation.  In his email Mr D said that indecent images had been found on his computer.  He said that the images had been downloaded unintentionally as part of a larger batch of material obtained by file sharing.  Mr D said that he had promptly deleted the images.

My email in reply ...

Mr D

I would expect that the police have produced a report listing the pictures that were found during their
examination.

The police report will show information about each file including the name of the file, the folder that
contains the file, the date and time that the file was created and other information. Typically, my first
task in any case is to review the police report and to write a description of the report to detail
everything that that can be known from the content of that report.

Every case is different. My review of the police report in a case might say that the police have not found
evidence to show what was done by the user of a computer that caused pictures to be on that
computer. It is my understanding that a prosecution requires evidence to show what was done.

My review of a police report might show that the evidence is consistent with an explanation given by
the user of a computer.

It has been my experience that evidence from computers is misunderstood by lawyers (and, sometimes,
by police officers) and that misunderstandings can lead to charges that are not supported by evidence.

My own view is that there is often something to be gained by the defence if evidence is examined by a
computer specialist.

I am not a lawyer and cannot give you legal advice. I would be happy to discuss the evidence in your
case with your lawyer or with you. I can take a call at any time.

Regards

Mr D replied in another email saying that all of the images in his case hid been in "unallocated clusters" or in the "swap file".

My email in reply ...

Mr D

Indecent images can be on a computer without any deliberate attempt to obtain such images by a user
of the computer. The Prosecution must show that images were on a computer as a result of knowing
and deliberate action to prosecute.

There is a Court Judgement that says unambiguously that there needs to be evidence of a deliberate act
of possession or of making. The Judgement is at …

http://www.bailii.org/ew/cases/EWHC/Admin/2000/302.html

Pop-up web pages are well known. The pages pop-up on the screen without any deliberate act by the
user of the computer. Many web sites include pop-up web pages that carry advertisements. Most web
browser software includes an option that can be ticked to prevent pop-up web pages.

Pornography web sites are well known users of pop-up web pages (including pop-ups that circumvent
pop-up prevention). The user of a computer has no control of the content of a pop-up web page. It has
been accepted by police computer examiners in other cases that pop-up web pages could be the source
of unintended indecent images found on a computer.

A user of file sharing software such as Limewire relies on other file sharing software users to create and
to label the material that is being downloaded by the file sharing software. The great majority of file
sharing software users are engaged in anonymous copyright theft. Users of file sharing software cannot
be relied upon to accurately label the material that they make available for download. A file sharing
software user might download a file expecting to hear Beatles songs and would be disappointed to hear
songs by the Rolling Stones.

Those who distribute pornography using file sharing software are likely to be the most unreliable of all
file sharing users. It is entirely possible for a computer to use file sharing software to download a file
expecting to find legal adult pornography and for that file to include indecent images of children. It has
been accepted by police computer examiners in other cases that file sharing software could be the
source of unintended indecent images found on a computer.

I have seen cases were images found in the “swap file” were included in evidence. Simply stated, an
image would have been in the swap file if the computer had been processing the image in the hours (or,
maybe, days) before the computer was seized. I have never seen a case were the police were able to
say what processing of the image had occurred for an image in the swap file. It is my firm view that
nobody should be prosecuted for images found in the swap file because it is not possible to say exactly
why those images were in the swap file. An image (or images) may have been in the swap file as a result
of, for example, a pop-up web page.

Police computer examiners describe deleted files as being in unallocated space. A deleted file (a file in
unallocated space) would not be visible to a typical user of the computer. A deleted file (a file in
unallocated space) would not be accessible by a typical user of the computer. I cannot recall that I have
ever seen a case where someone has been successfully prosecuted for possession of deleted files. It is
my understanding that the Atkins Judgement requires a person to know that they have possession of a
file and a typical person does not know that they have possession of a deleted file (a file in unallocated
space).

It is my understanding that the Atkins judgement requires a person to deliberately cause an indecent
image to be stored on a computer to prosecute a charge of making. I would expect the Prosecution to
show the act that caused a file to be on the computer. The Defence might say that a file is inadvertently
on a computer due to a web page pop-up if the Prosecution are unable to show the act that caused a file
to be on the computer.

Anything that I say here should be treated with caution because I am not a lawyer and I do not have full
knowledge of your circumstances …

But …

If the only evidence is evidence of a file (or files) in the swap file and evidence of files in unallocated
space …

And …

There is no evidence regarding, for example, the names or creation dates of files.
There is no evidence of, for example, Google searches or Limewire searches.
There is no evidence regarding the web browser history showing visits to, for example, web sites that
display indecent images of children.
There is no compelling evidence to show the actions (such as mouse clicks or typing) that caused the
indecent images to be on the computer.

Then … the absence of evidence of a deliberate act may prevent a successful prosecution.

Please note that there are factors that are outside the remit of a computer specialist including the
impact of any admissions or other remarks made in interview.

Additionally, there may be those who take the view that 69 images is too many to have been acquired
by accident. This may be a matter of context and may require consideration of the total number of
images on the computer (legal and illegal) and the number of legal pornographic images.

It is my understanding that a Newton hearing is where a Judge hears evidence and then states the
sentence that would be given if the plea was Guilty. The implication of this is that a Defendant has the
opportunity to plead Not Guilty after a Newton hearing.

The police computer examiner might be at the Newton hearing. The police computer examiner might
answer “Yes” if asked …

I am not a lawyer and cannot give you legal advice. I would be happy to discuss the evidence in your
case with your lawyer or with you. I can take a call at any time.

Regards

I cannot know Mr D's true situation nor the full extent of the evidence in his case.  It may be that something had gone horribly wrong if he was being prosecuted based only on evidence from deleted files and from the swap file.

I do not know what role, if any, a computer expert witness had in this case.