DCCC936/2020

DCCC936/2020

A A B B DCCC 936/2020 [2022] HKDC 147 C C D IN THE DISTRICT COURT OF THE D HONG KONG SPECIAL ADMINISTRATIVE REGION E CRIMINAL CASE NO. 936 OF 2020 E ____________ F HKSAR F v G G REESE ROBERT MILES DAVID H ____________ H Before : HH Judge Dufton I I Date : 23 February 2022 J Present: Mr Duncan Percy, counsel on fiat, for HKSAR J Mr Cao Yuan Shan instructed by Littlewoods, for the defendant K K Offence: Possession of child pornography (管有兒童色情物品) L L REASONS FOR VERDICT M M 1. The defendant pleads not guilty to one charge of possession N N of child pornography, contrary to section 3(3) of the Prevention of Child O Pornography Ordinance1. O P P 2. The particulars of the charge read: Q Q “REESE Robert Miles David, on the 22nd day of November R 2016, at No. 16 Willow Path, Monterey, Palm Springs, Yuen R Long, New Territories, in Hong Kong, had in his possession S S child pornography, namely 4,738 photos and 931 video clips containing child pornography stored in his desktop computer.” T T 1 Cap 579 U U V V  2 A A B B Introduction C C 3. On the morning of 22 November 2016 the police conducted D a search at No. 16 Willow Path, Monterey, Palm Springs in Yuen Long, D where the defendant resided together with his wife and two teenage E E children. The police seized from the living room a black desktop F computer. A preliminary examination revealed video clips suspected to F be child pornography. The defendant was arrested and cautioned for G G possession of child pornography. H H The law I I 4. On a charge under section 3(3) of the Ordinance the J J prosecution must prove beyond reasonable doubt that the photos and K K video clips subject of the charge are child pornography within the L definition of section 2 of the Prevention of Child Pornography Ordinance L and that the defendant was in possession of the child pornography. M M 5. Possession involves the prosecution proving that the N N defendant had control of and knowledge of the existence of the photos O and video clips on the computer but not that the defendant knew they O were child pornography or that he had opened the files (see HKSAR v P P 2 3 4 Justin Yves Herbonnet ; Atkins v DPP ; McMurdo v HM Advocate and R Q v Okoro (No3))5. Q R R S 2 S [2006] 1 HKLRD 862. 3 [2000] 1 WLR 1427. T 4 T [2015] HCJAC 37. 5 [2019] 1 WLR 1638. U U V V  3 A A B B 6. If the prosecution proves beyond reasonable doubt that the C defendant was in possession of the child pornography a defendant may C rely on any of the statutory defences set out in section 4 of the Ordinance. D D Prosecution case E E F 7. The prosecution case in summary is that the black desktop F computer belonged to the defendant and that the defendant was in G G possession of the child pornography found stored in the computer. H H Defence case I I 8. The defence case in summary is that the defendant did not J J knowingly download child pornography, only adult pornography and had K not seen the child pornography or suspected there was child pornography K on his computer. The defendant relies on the statutory defence in section L L 4 (3) (c) that he had not seen the child pornography and did not know, nor M did he suspect, it to be child pornography6. M N N 9. The defence challenged the lawfulness of the search which O challenge was dealt with by way of voire dire at the beginning of the trial. O The defence also challenged the chain of evidence in respect of the black P P desktop computer and the reliance on expert evidence. Q Q Evidence R R 10. Apart from the evidence of the police officers who S S conducted the search the prosecution relies on the reply under caution and T T 6 See §§62 of the written submission of Mr Cao. U U V V  4 A A B B the answers given by the defendant in a video recorded interview and C expert evidence of the forensic examination of the computer. C D 11. The prosecution called nine witnesses on the schedule of D prosecution witnesses submitted to court, namely: DPC 7098 (PW1) who E E arrested the defendant and conducted the video recorded interview; DPC F 5517 (PW2) who conducted the preliminary examination of the black F desktop computer, DPC 58721 (PW3) who seized the black desktop G G computer; WDPC 7186 (PW4) the investigating officer; Danny Choi Pak H Lung (PW57) the keeper of the property office where the black desktop H computer was stored; DPC 7280 (PW68) who handled the black desktop I I 9 computer in January 2017; WDPC 4171 (PW7 ) who handled the black J J desktop computer in February 2018 and Sgt 34232 (PW810) and WPC K 15499 (PW911) who both gave expert evidence. K L 12. Facts have been admitted pursuant to section 65C of the L Criminal Procedure Ordinance12 including the defendant was the owner M M of the black desktop computer; the seizure of the black desktop computer; N the arrest of the defendant; the video recorded interview and the child N pornography subject of the charge was stored on the black desktop O O computer. I will refer to the admitted facts as I review the evidence. P P Q Q R 7 PW14 on the schedule of prosecution witnesses. R 8 PW13 on the schedule of prosecution witnesses. S 9 S PW5 on the schedule of prosecution witnesses. 10 PW9 on the schedule of prosecution witnesses. T 11 T PW15 on the schedule of prosecution witnesses. 12 Cap 221. See exhibits P28 & P28A-E. U U V V  5 A A B B 13. The defendant elected to give evidence on the general issue C only. The defendant’s ex-wife was called on the voire dire. No witnesses C were called on his behalf on the general issue. D D 14. Admitted in evidence is that the defendant has a clear E E 13 criminal record . I direct myself as to good character both as to F credibility and propensity in accordance with the decision in HKSAR v F Tang Siu Man14. G G H 15. In reaching my verdict I remind myself of the burden and H standard of proof and that the burden is on the prosecution throughout. I I The defendant has to prove nothing. I direct myself that I must be sure of J the guilt of the defendant before I can convict. On the other hand, if the J court thinks that the defence evidence pointing to innocence is true or K K may be true, it would follow that the defence has raised sufficient doubt L in the prosecution case and the defendant entitled to be acquitted. L M M 16. I remind myself that when drawing inferences from the N evidence a court may only draw an inference if that inference is the only N reasonable inference to draw from the proved facts. If from the facts O O proved there is a reasonable inference to draw against a defendant as well P as one in his favour the adverse inference cannot be drawn. P Q Voire Dire Q R R 17. The defence objected to the admissibility of the black S desktop computer (“the computer”) on the grounds the search of the S T 13 T §7 of the admitted facts, exhibit P28. 14 [1997-98] 1 HKCFAR 107. U U V V  6 A A B B home of the defendant was unlawful. The search was said to be unlawful C because no search warrant was ever shown to the defendant or his wife C and therefore infringed the defendant’s constitutionally protected rights D D under Article 29 of the Basic Law and Article 14 of the Hong Kong Bill E of Rights15. E F 18. The defence asked that the admissibility of the computer be F determined by way of voire dire as the ruling may affect the further G G conduct of the trial. These are my reasons for ruling the computer H (exhibit P1) admissible in evidence. H I I 19. The prosecution called four witnesses: DPC 7098 (PW1), J DPC 5517 (PW2), DPC 58721 (PW3) and WDPC 7186 (PW4). Facts J were also admitted including that the defendant resided with his wife and K K two teenage children at No. 16 Willow Path, Monterey, Palm Springs in L Yuen Long; that the defendant was the owner of the computer which was L seized by DPC 58721; the arrest of the defendant together with his reply M M under caution and the video recorded interview16. N N 20. The defendant elected not to give evidence and called one O O witness Lau Ka Lai, his wife in 2016. P P Prosecution evidence Q Q 21. In summary at 6:30 a.m. on 22 November 2016, after a R R briefing, D Sgt 51386 led DPC 7098, DPC 5517, DPC 58721 and WDPC S 7186 to execute a search warrant at No. 16 Willow Path, Monterey, Palm S 15 T See §1 of the grounds of objection to admissibility of evidence. §2 relating to the chain of T evidence was dealt with in the general issue. 16 See §§1-5 of the admitted facts, exhibit P28. U U V V  7 A A B B Springs in Yuen Long (“the house”). All the police officers were C attached to District Crime Squad, Border District except DPC 5517 who C was attached to Team 2B Regional Crime Unit, New Territories and was D D a technology crime initial response cadre. D Sgt 51386 was not called as E a witness and was not required by the defence to be tendered for cross- E examination. F F 22. DPC 7098 testified that before going to the house the police G G already had a search warrant, writ No. 12585/16 (exhibit P21). H H 23. After the police knocked on the door a Chinese female, later I I known to be Lau Ka Lai, the wife of the defendant, answered the door. D J Sgt 51386 produced the search warrant and revealed their police identity. J D Sgt 51386 then handed the search warrant to DPC 7098. DPC 7098 K K explained to the wife in Cantonese the power of the search warrant and L that the police suspected possession of child pornography. The female L permitted the police to enter the house. Inside DPC 7098 also explained M M the search warrant to the defendant. N N 24. In cross-examination DPC 7098 agreed that in his witness O O statement he said he produced the search warrant after the female opened P the door. DPC 7098 agreed he did not mention that D Sgt 51386 P produced the search warrant and handed to him the search warrant and Q Q did not mention that he explained the search warrant to the defendant R inside the house. R S 25. DPC 7098 was also cross-examined about the briefing and S said that during the briefing the search warrant was passed around. T T U U V V  8 A A B B 26. DPC 5517, who was assigned to examine any computers C found in the premises, testified that after D Sgt 51386 knocked on the C door a female (the defendant’s wife) answered. D Sgt 51386 produced D D the search warrant and indicated the purpose of their visit. The female E then let the police inside for investigation. Inside DPC 5517 told the E defendant the reason for examining the computer was in relation to child F F pornography. G G 27. In cross-examination DPC 5517 said he did not see clearly D H Sgt 51386 produce the search warrant but heard him say that they had a H search warrant and had to enter to conduct a search. I I J 28. DPC 5517 was also cross-examined about the briefing and J said that it was only mentioned that there was a search warrant and that K K the search warrant was not passed around. L L 29. DPC 58721, who was assigned as an exhibit officer, M M testified that after D Sgt 51386 knocked on the door a female (the N defendant’s wife) answered. D Sgt 51386 showed his warrant card and N produced the search warrant. The female then let the police inside. O O Inside D Sgt 51386 explained to the defendant’s wife why they had to P search the premises. This was said when the defendant was in close P proximity. Q Q 30. In cross-examination when asked if he recalled DPC 7098 R R talking to the female before entering the house, DPC 58721 replied that S DPC 7098 did speak to the female after which they entered the house. S DPC 58721 agreed this was not mentioned in his witness statement. T T When Mr Cao put the defence case that the search warrant was never U U V V  9 A A B B shown to the defendant DPC 58721 replied that after the defendant came C out of the bedroom D Sgt 51386 showed him the search warrant. DPC C 58721 also agreed this was not in his witness statement. D D 31. DPC 58721 was also cross-examined about the briefing and E E said that D Sgt 51386 showed the search warrant but did not recall if the F search warrant was passed around. F G G 32. WDPC 7186, who was assigned as an investigating officer, H testified that after she and DPC 7098 knocked on the door a female (the H defendant’s wife) answered. D Sgt 51386 then told the female the police I I came for investigation of suspected possession of child pornography after J which they entered the house. Inside DPC 7098 showed the search J warrant to the female. When the female was explaining who the K K computers belonged to WDPC 7186 saw the defendant appear. L L 33. WDPC 7186 was also cross-examined about the briefing and M M said that in the briefing D Sgt 51386 said there was a search warrant but N she had no impression that he took out and showed the search warrant. N O 34. In cross-examination all four witnesses disagreed that the O search warrant was never produced to the female (the defendant’s wife). P P DPC 7098 and DPC 58721 disagreed the search warrant was not shown Q to the defendant. DPC 5571 did not know if the search warrant was Q shown to the defendant. WDPC 7186 was not asked. R R S Defence evidence S T 35. Madam Lau testified that she was married to the defendant in T November 2016 but that they are now no longer married. U U V V  10 A A B B 36. On the 22 November 2016 Madam Lau was at home when C the doorbell rang. Madam Lau opened the wooden door to find the police. C 17 Madam Lau then went out of the iron gate to confirm their identity . The D D police officer showed his police identity to Madam Lau and said he had E something to investigate. E F 37. Madam Lau then closed the iron gate but left the wooden F door open and went upstairs to wake up the defendant. The defendant G G and Madam Lau then went downstairs. The defendant opened the iron H gate for the police officers. After the police entered a police officer said H that an investigation had to be conducted. I I J 38. Madam Lau said that a search warrant was never produced J and shown to her or the defendant. K K L Discussion L M 39. I carefully considered all the evidence and submissions of M Mr Percy and Mr Cao. Due allowance was given to all witnesses, both N N prosecution and defence, by reason of the fact the events they testified O about were just over five years ago. O P P 40. I had no hesitation in rejecting the evidence of the defence Q witness, Madam Lau. I did not find her evidence credible. In cross- Q examination when asked when she was contacted to be a witness Madam R R Lau replied “Yesterday”. After Madam Lau disagreed that she had S forgotten that the search warrant was produced, Mr Percy cross-examined S Madam Lau on her witness statement. T T 17 Photographs of the wooden door and the iron gate were produced and marked exhibit D1. U U V V  11 A A B B 41. The witness statement was taken by WDPC 7186 at 0800 C hours on 22 November 2016 inside the house18. Madam Lau agreed she C signed the statement and that she had signed the declarations at the D D beginning and the end of the statement. E E 42. Mr Percy then asked Madam Lau to read out paragraph 5 F which was then translated in court as follows19: F G G “In addition, at around 7 o’clock in the morning on 22 November 2016 the police came to my residence and at that H H time my husband Reese Robert Miles David was also present. I Afterwards the police produced to me a search warrant and I indicated to me that they had to conduct a search of the J computer(s) at my home and then I also pointed out to the police J the two computers in the living room on the ground floor of my K K house, one black ACER computer which was used by my L husband Reese Robert Miles David whereas another silver L Apple computer was used by me myself.” M M 43. Put by Mr Percy that paragraph 5 was true, Madam Lau N N replied “No”. Asked what was false Madam Lau replied “The police O showed me a search warrant.” Asked if she deliberately made a false O statement Madam Lau replied “Definitely not.” Asked why she did not P P cross this part out when she had the chance to alter or amend Madam Lau Q replied “Actually at that time when I knew why the police came in for a Q search I was very shocked and I was scared therefore when the police R R S S T 18 At the request of the prosecution the witness statement was marked “A” for identification. T 19 When the court interpreter translated paragraph 5 as read out by Madam Lau the translation of the witness statement had not yet been submitted to court. U U V V  12 A A B B wrote these down despite the fact that I knew I had responsibility when I C signed it I was disturbed/discomposed.” C D 44. I rejected the evidence of Madam Lau that she was not D shown the search warrant which was contradicted by her witness E E statement made on the day of the house search. The rejection of the F defence evidence was not determinative of admissibility. The burden of F proving admissibility was on the prosecution beyond reasonable doubt. G G H 45. Mr Cao submitted that each of the witnesses gave a different H version about the production of the search warrant when the police team I I went to the house whereby the court could not be satisfied that the search J warrant was shown to either the defendant or his wife 20. J K 46. All four witnesses testified that the female (the defendant’s K L wife) opened the door and let them inside. All the witnesses testified L that the search warrant was shown to the defendant’s wife. Only DPC M M 7098 and DPC 58721 testified that the search warrant was shown to the N defendant. N O 47. The fact that there are discrepancies between the witnesses O as to who showed the search warrant to the defendant’s wife, whether D P P Sgt 51386 or DPC 7098 and whether this was at the door or inside the Q house was not surprising considering the house search was over five Q years ago. R R S S T 20 This submission was first made in the no case submission and adopted in the final submission. In T the final submission Mr Cao submitted an aide memoire setting out the differences between the police officers evidence. U U V V  13 A A B B 48. I accepted the evidence that the defendant’s wife opened the C door and that she was shown the search warrant. I also accepted the C unchallenged evidence that DPC 5517 told the defendant the reason for D D examining the computer was in relation to child pornography. E E 49. I considered the discrepancy between the witnesses as to F whether the search warrant was shown during the briefing. In my view F whether or not the search warrant was shown during the briefing was not G G material. The fact remained that the police had a search warrant which H they took with them to the house. In this regard I noted that in the police H notebook of DPC 7098 (exhibit P5 & P5A) the post record of the caution I I 21 states the writ no. of the search warrant . The discrepancy whether the J J search warrant was shown during the briefing did not cause me to doubt K the evidence of the police officers that the search warrant was shown to K the defendant’s wife. L L 50. I was not however sure the search warrant was also shown to M M the defendant as testified by DPC 7098 and DPC 58721 both having N agreed that they did not mention this evidence in their witness statements. N O O 51. The fact that the search warrant may not have been shown to P the defendant did not in my view make the search unlawful. The search P warrant was lawfully issued by a magistrate pursuant to section 50 (7) of Q Q the Police Force Ordinance 22 and was shown to the defendant’s wife. I R was satisfied the search was lawful and that there was no infringement of R Article 29. S S T 21 T See §§3 & 4 of the admitted facts, exhibit P28. 22 Cap 232. U U V V  14 A A B B 52. In submitting that the failure to produce the search warrant C made the search unlawful Mr Cao relied on the decision in K v C Commissioner of Police in which the common law position as to the D D production of the search warrant is set out as supplemented by paragraph E 4 of section 44-04 of the Police Force General Orders23. E F 53. While accepting the production of the search warrant allows F the occupier to satisfy himself that the police officers are acting lawfully, G G in my view the failure to produce the search warrant did not make the H search unlawful. I do not read the recitation of the common law position H on the production of the warrant in K v Commissioner of Police as saying I I a failure to show the warrant makes the search unlawful. J J 54. Even if it is said in these circumstances the failure to produce K K the search warrant made the search unlawful and Article 29 was therefore L infringed, I was nevertheless satisfied, applying the test set out in HKSAR L v Muhammad Riaz Khan 24, that there were no grounds to exercise my M M discretion to exclude the computer from evidence. N N 55. Evidence obtained as a result of an unlawful search does not O O automatically result in the exclusion of that evidence. The search warrant P was lawfully issued by a magistrate. In my view the reception in P evidence of the computer was conducive to a fair trial. Q Q 56. I was satisfied that a failure to show the search warrant was R R not a serious breach of the defendant’s right in the circumstances of this S S 23 T [2020] 1 HKLRD 606 at §§37 & 38. Section 44-04 of the Police General Orders was not T produced. 24 (2012) 15 HKCFAR 232 at §20. U U V V  15 A A B B case. The police officers were allowed to enter the house and did have a C lawfully issued search warrant. C D 57. Even on the defence case the defendant allowed the police to D enter the house. The police did not have to use force. There was no E E suggestion from the defence that the defendant or his wife did not consent F to the police entering the house and no suggestion the defendant and his F wife were not told why the police wanted to search the house. As G G mentioned earlier DPC 5517 told the defendant the reason for examining H the computer was in relation to child pornography. H I I 58. This is a serious case involving an allegation of possession J of a substantial quantity of child pornography. I was satisfied that the J public interest in detecting crimes involving child pornography K K outweighed the breach of the defendant’s rights. L L 59. Taking into account that there is a requirement in the Police M M General Orders to produce the search warrant I did not consider that the N reception of the evidence would run the risk of future breaches. N O General issue O P Prosecution evidence P Q House search Q R 60. The prosecution recalled all four witnesses who adopted R their evidence given in the special issue25. S S T 25 The prosecution and defence also agreed that the evidence of the prosecution witnesses given on T the voire dire may be taken into consideration on the general issue 25. Also See HKSAR v Ma Yee Keung CACC 53/2000 at §§9-13. U U V V  16 A A B B 61. In summary on the morning of 22 November 2016, after a C briefing, D Sgt 51386 led the four witnesses to execute a search warrant C at No. 16 Willow Path, Monterey, Palm Springs in Yuen Long (“the D D house”). E E 62. On arrival at the house at 7:00 a.m. after knocking on the F door the defendant’s wife opened the door. The police showed the search F warrant to the wife and explained why they were there. The defendant’s G G wife then let the police in the house and went to wake up the defendant. H H 63. Inside the house the police saw two computers in the living I I room. The defendant said the black desktop computer (exhibit P1) was J used by him. In the presence of the defendant and his wife DPC 5517 J examined the computer which was turned on at the time and no password K K was required. DPC 5517 told the defendant the reason for examining the L computer was in relation to child pornography. L M M 64. The examination took eight minutes between 7:10 and 7:18 N a.m. DPC 5517 used the search function of Windows to look for video N clips. In the incoming folder of E drive DPC 5517 found video clips O O suspected to be child pornography 26 . In cross-examination DPC 5517 P said he viewed only one video clip suspected to be child pornography but P could not recall if he viewed the video clip using Windows Media Player. Q Q 65. At 7:18 a.m. DPC 5517 reported to D Sgt 51386 that he had R R discovered some videos on the computer suspected to be child S pornography. S T T 26 This evidence was given when DPC 5517 was recalled. U U V V  17 A A B B 66. Admitted in evidence is that at about 7:20 a.m. DPC 7098 C arrested and cautioned the defendant for the suspected offence of C possession of child pornography and that the defendant’s verbal response D D to caution is accurately recorded in DPC 7098’s notebook 27 . The E defendant replied in Punti “I downloaded those pornographic videos but I E seldom watch them. Give me a chance.” F F 67. Admitted in evidence is that at about 7:36 a.m. DPC 58721 G G seized the computer and that the defendant was the owner of the H computer28 . DPC 5517 switched off the computer before DPC 58721 H seized the computer. I I J 68. The police officers left the house at 08:10 hours together J with the defendant and went to the Lok Ma Chau Police Station. K K L Summary of the video recorded interview L M 69. Admitted in evidence is that between 10:31 and 11:12 hours M on 22 November 2016 (the same day) a video recorded interview N N (exhibits P2, P3, P4 & P4A) was conducted by DPC 7098 with the O assistance of a Chinese/English interpreter Li Sin Man. The defendant O consented to the video recorded interview and provided his answers P P 29 voluntarily . DSgt 58785 also asked questions in the interview (see Q counters 298-393). Q R R S S 27 Exhibit P5. See §§3 & 4 of the admitted facts, exhibit P28. T 28 T See §2 of the admitted facts, exhibit P28. 29 See §5 of the admitted facts, exhibit P28. U U V V  18 A A B B 70. After repeating the arrest and confirming what the defendant C had said under caution DPC 7098 asked the defendant about the computer C 30 (counters 111-130) . The defendant confirmed the computer was seized D D at his home and that the computer belonged to him (counters 131-144). E E 71. The defendant said he lived with his wife, son and daughter F (counters 145-156). F G G 72. The defendant was then asked who uses the computer. The H defendant replied “I use it mainly, yeah” (counters 157-160). Asked if H the other three family members use the computer, the defendant replied I I “My wife uses it, but those things, the videos, I downloaded. Okay?” J (counters 161-164). The defendant said his two children had their own J laptop/portable computers (counters 165-168). K K L 73. The defendant said the computer was pre-installed with L Kaspersky anti-virus software (counters 169-176) and that his wife M M subscribed the broadband service Netvigator which was used by everyone N via a Wi-Fi router (counters 177-200). N O 74. The defendant downloaded the child pornography videos O (counters 161-164, 221-225 and 236-239). P P Q 75. The defendant did not register for any child pornography Q websites on the internet and explained how he downloaded the videos by R R 30 S Counter 128 is the English translation given during the interview by the police translator of DPC S 7098’s question at 127 reciting the reply under caution and asking the defendant to confirm he said those words. The reply under caution was “I downloaded those pornographic videos T (footages)” which is what DPC 7098 recites in counter 127 whereas at 128 the police translator T mistranslated when in reciting the reply under caution she said “I downloaded those child pornography videos”. U U V V  19 A A B B using a programme called eMule from which he does a search and then C selects from a list what he wants to download; he used search words like C “Jap” and “Russian”; he had never been on any child pornographic D D websites only pornographic websites and that all the child pornographic E videos were from the eMule programme (counters 201-220, 232-247, E 319-329 and 333-363). F F 76. The defendant started downloading child pornography G G videos a few years ago when he had a lot of spare time and was under H pressure, stress and depression; he knew what he had downloaded but did H not have much time to watch any of them but had watched some and that I I it was a habit he could not control (counters 221-225, 236-247, 268-281, J J 315-318 and 364-375). K K 77. The defendant did not know when he last downloaded the L videos because it was like a torrent file which downloaded in the L background; he did not monitor the downloads which was a continuing M M process; the last time maybe it downloaded was maybe a week or two N weeks ago and he does not watch it every day (counters 226-251). N O O 78. The defendant knew it was wrong (counters 226-231, 248- P 253 and 373-379). P Q 79. The defendant never paid for any child pornography; never Q reposted any child pornography; never saved the child pornography on R R other devices; never printed the child pornography and never shared the S child pornography (counters 254-267 and 305-308). S T T U U V V  20 A A B B 80. The defendant did not target child pornography and if he C sees there was child pornography he would delete them and did not know C there were underage children until he looked at them (counters 282-287, D D 309-318, 326-332, 337 and 345-350). E E Chain of evidence F F 81. Admitted in evidence is the proper handling of the computer G G except for the periods 08:25 hours on 22 November 2016 to 12:07 hours H on 18 January 2017; 12:15 hours on 11 May 2017 to 10:13 hours on 16 H May 2017 and 17:46 hours on 26 February 2018 to 24 April 2018 31. I I 08:25 hours on 22 November 2016 to 12:07 hours on 18 January 2017. J J K DPC 58721 (PW3) K L L 82. On the voire dire DPC 58721 testified that after seizing the M computer he put the computer in his backpack and went with his M colleagues to Lok Ma Chau Police Station. DPC 58721 was recalled and N N testified he took the computer to the Lok Ma Chau Police Station at 08:10 O hours arriving at 08:25. O P 83. At 08:55 the defendant was taken to Border Headquarters. P Between 08:25 and 08:55 DPC 58721 said that the computer was all Q Q along kept by him, apart from him no one else had access to the computer R and no one unlawfully interfered with the computer. R S S T T 31 See §6 of the admitted facts, exhibit P28. U U V V  21 A A B B 84. Between 08:55 and 10:20 the computer was kept by DPC C 58721. At 10:20 DPC 58721 was instructed to go back to Palm Springs C for further investigation and therefore handed over the computer to DPC D D 7098. At 13:00 hours DPC 58721 took the computer back from DPC E 7098 and kept the computer until 14:21 when he handed the computer to E “Lung Gor” in the exhibits room of Lok Ma Chau Police Station. F F 85. DPC 58721 testified that at no time did he or anyone else G G unlawfully interfere with the computer. H H DPC 7098 (PW1) I I 86. Admitted in evidence is that between 10:31 and 11:12 hours J J on 22 November 2016 DPC 7098 conducted a video recorded interview K K with the defendant32. DPC 7098 testified that about five or ten minutes L before starting the video recorded interview DPC 58721 handed the L computer to him. In the video recorded interview DPC 7098 showed the M M computer to the defendant33. N N 87. After the video recorded interview DPC 7098 kept the O computer in his custody and control until around 1 p.m. which was after O the defendant had been taken to a tutorial centre for a search34. P P Q 88. When asked by Mr Percy whether he had in any way Q interfered with the computer DPC 7098 answered no and explained that R R S S 32 See §5 of the admitted facts, exhibit P28. 33 T See counter 131. T 34 In the video recorded interview, the defendant consented to a search of High Flyer Education Centre. See counters 288-295. U U V V  22 A A B B as far as he recalled barcodes and labels had already been fixed on the C computer. C D 89. In answer to the court DPC 7098 explained that barcodes and D labels were affixed to prevent anyone from interfering with the computer E E and that from past experience said they would usually be affixed on the F power switch but since he was not the one who affixed the labels he did F not know and was not sure whether the labels were affixed in the house or G G 35 the police station . H H 90. DPC 7098 testified that no one else interfered with the I I computer. J J 36 Danny Choi Pak Lung (PW5 ) K K 91. Mr Choi, a clerical assistant with the police, has been L L attached to the Lok Ma Chau police station since 2014 as the keeper of M the property office. M N N 92. Mr Percy showed Mr Choi a Property Movement History O Report (exhibit P29) and with reference to the last entry (the first in time) O Mr Choi explained the procedure when an exhibit is brought to him in the P P property room37. Mr Choi would record in the computer the date and Q time, the receipt of the exhibit, from who he had received the exhibit and Q that he was the person who received the exhibit. Mr Choi confirmed that R R he had input all the details of the last entry shown in the record. S S 35 This was after cross-examination. 36 T PW14 on the schedule of prosecution witnesses. Mr Choi gave evidence on 22 December and 23 T December 2021. 37 Evidence on 22 December 2021 (Day 3). U U V V  23 A A B B 93. Mr Choi had a partner but he was the only one who had a C key to the property room which he kept on his person all day. Mr Choi C testified that no unauthorised person could access the property room D D without asking him for the key and that between 14:21 hours on 22 E November 2016 to 16:55 hours on 24 April 2018 nobody unauthorised E approached him to borrow the key38. F F 94. Mr Choi said he received a request to generate the Property G G Movement History Report which he printed from a police computer in his H exhibit room39. Mr Choi described the exhibit room was for him to store H all the exhibits which no one could interfere with. I I J 95. Mr Choi said that his computer was used to store, process J and retrieve information which he input into the computer for the purpose K K of his work as the keeper of the property office; that the record printed L out matched the information he put in the computer; the security L measures to protect unlawful use were that Mr Choi had to input his UI40 M M and the password; Mr Choi was not aware of any unauthorised use of his N computer between November 2016 and April 2018 and said that during N that period the computer was working properly41. O O P 96. Mr Choi said the description of the exhibit would be entered P by the OC case. Mr Choi confirmed that according to the report he Q Q R 38 Evidence on 23 December 2021 (Day 4). R 39 Evidence on 23 December 2021 (Day 4). S 40 At the request of the court Mr Choi produced his police identity card which showed his UI S (unique identity) number was 87298. This is the same number which appears on the Property T Movement History Report. T 41 At this stage Mr Percy applied for the report to be admitted in evidence pursuant to section 22A of the Evidence Ordinance, Chapter 8. The defence had no objection to production of the report. U U V V  24 A A B B received the exhibit on 22 November 2016 and twice on 24 April 2018 C and that he returned the exhibit on 18 January 2017 and once on 24 April C 42 2018 . In answer to the court Mr Choi said that he entered the details on D D each row where his name appears43. E E WDPC 7186 (PW4) F F 97. WDPC 7186 was recalled and testified that on 21 December G G 2016 she made an enquiry with the Cyber Security & Technology Crime H Bureau (“CSTCB”) in relation to the progress of an urgent application for H examination of the computer seized in the defendant’s home. As a result I I of that call WDPC 7186 withdrew the computer from the property office J at Lok Ma Chau at 10:24 a.m. on 18 January 2017 and handed over the J computer to DPC 7280 at CSTCB at 12:07 hours. K K L 98. WDPC 7186 testified that at no time did she or anyone else L unlawfully interfere with the computer. M M DPC 7280 (PW644) N N O 99. DPC 7280, who was attached to Digital Forensic Team A of O the Forensic & Training Division of CSTCB, testified that at 12:07 hours P P on 18 January 2017 the computer was handed over to him by WDPC Q 7186. At 2:42 p.m. DPC 7280 stored the computer in the exhibit room of Q CSTCB. R R S S 42 Mr Choi was not asked about the entries for 2020 and 2021. T 43 T This was after cross-examination. 44 PW13 on the schedule of prosecution witnesses. U U V V  25 A A B B 100. DPC 7280 testified that at no time did he or anyone else C unlawfully interfere with the computer. C D 12:15 hours on 11 May 2017 to 10:13 hours on 16 May 2017 D E E 101. WDPC 7186 testified that between 11 a.m. and 12:15 hours F on 11 May 2017 she went to CSTCB when PC 8084 showed her some F video files found upon preliminary examination of the computer45. Due G G to the substantial number of files, 2572, PC 8084 made two copies of the H files for WDPC 7186 to view in her office. H I 102. WDPC 7186 identified exhibits P8 and P9 as the two copies, I one as the master copy and one as a working copy46. After the discs were J J burnt WDPC 7186 brought the discs to her office to continue K K investigation of the case. L L 103. On 16 May 2017 WDPC 7186 contacted PC 8084 and M requested him to see if the files had been opened or played and whether M the application eMule was in the computer. N N O 17:46 hours on 26 February 2018 to 24 April 2018 O P WDPC 4171 (PW747) P Q Q 104. On 5 February 2018 colleagues in CSTCB arranged for R WDPC 4171, who was attached to District Crime Squad, Border District, R 45 S PC 8084 who resigned from the police force on 16 September 2020 was not called as a witness. S See §114. 46 T The chain of evidence and the proper handling of exhibits P8 and P9 was admitted. See §1 (a) & T (b) of the third admitted facts, exhibit P28B. 47 PW5 on the schedule of prosecution witnesses. U U V V  26 A A B B to view the contents of the computer which they had extracted from the C hard disc of the computer. In cross-examination WDPC 4171 agreed she C was the second investigation officer in the case. D D 105. On 27 February 2018 colleagues from CSTCB handed over E E to WDPC 4171 the computer (exhibit P1) and two hard discs (exhibits P8 F and P9). In cross-examination WDPC 4171 agreed she took over the F computer from PC 8084. G G H 106. WDPC 4171 then kept them in her custody until 24 April H 2018 when she handed over the computer (exhibit P1) and the master I I copy (exhibit P8) to the exhibit room of Lok Ma Chau police station. The J Property Movement History Report (exhibit P29) shows the receipt of the J computer on 24 April 2018. K K L 107. In cross-examination WDPC 4171 said that between 27 L February 2018 and 24 April 2018 she kept the computer in a locked M M cabinet and that she was the only person who had a key to the cabinet. N N 108. WDPC 4171 testified that at no time did she or anyone else O unlawfully interfere with the computer. O P P Child pornography Q Q 109. Admitted in evidence is that on 22 November 2016 12,275 R photos and about 2,793 videos, including the 4,738 photos and 931 video R clips containing the child pornography particularised in the charge, were S S T T U U V V  27 A A B B stored in the computer and that all depict real children under the age of 16 C years48. C D Expert evidence D E E 110. The prosecution called two experts: Sgt 34232 (PW849) who F examined a forensic image of the computer and WPC 15499 (PW9 50 ) F who explained the programme eMule and gave a demonstration of the G G forensic image examined by Sgt 34232. H H Sgt 34232 I I 111. Sgt 34232, who was attached to Digital Forensics Team A, J J CSTCB on 9 November 2020, adopted his witness statement dated the K same day together with five annexes (exhibit P6 & P6 (1)-(5))51. K L L 112. Between 2009 and 2019 Sgt 34232 attended numerous M training courses pertaining to computer forensics examination as M 52 particularised in his witness statement . In evidence Sgt 34232 told the N N court that he had worked with Digital Forensics Team A for three years O during which he had examined fifty to one hundred similar cases and O managed over one thousand cases. Sgt 34232 was giving expert evidence P P in court for the first time. Q Q 48 R See §§1-4 of the amended second admitted facts, exhibit P28A. R 49 PW9 on the schedule of prosecution witnesses. 50 S PW15 on the schedule of prosecution witnesses. S 51 The witness statement was in Chinese. An English translation was admitted in evidence as an T accurate translation except for paragraph 8. See fifth admitted facts, exhibit P28C. Also see T footnote 83 for reference to paragraph 8 of the witness statement. 52 See §2 of the witness statement. U U V V  28 A A B B 113. There was no challenge to the expertise of Sgt 34232. I was C satisfied Sgt 34232 was an expert in computer forensic examination. I C permitted Sgt 34232 to give expert evidence on computer forensic D D examination. E E 114. Upon the resignation of PC 8084 on 16 September 2020 Sgt F 34232 took over exhibit-handling of the case53. Sgt 34232 was requested F to re-examine the contents of the digital evidence pertaining to 2572 G G pornographic photos, videos and zip files from the computer (exhibit P1) H to see whether any of the videos had been opened and if there were H records of files being downloaded by using eMule software54. I I J 115. Sgt 34232 told the court Annex 1 sets out the details of all J 2572 files. Admitted in evidence is that the 931 video clips containing K K child pornography and a sample of 20 photographic images containing L child pornography are accurately cross-referenced with Annexes 1, 2, 3 L and 5 in a folder (exhibit P31)55. M M N 116. On 30 September 2020 WDPC 7747 delivered the computer N 56 to PC 15892 . WDPC also handed over two external hard disks. Sgt O O 34232 told the court that he requested WDPC 7747 to buy two brand new P external hard disks to extract evidence after examination. Sgt 34232 P 53 Q Evidence on 28 December 2021 (Day 6). Also see §3 of the witness statement. The witness Q statement wrongly states the date of the case as 12 November 2016. 54 See §3 of the witness statement. R R 55 See §§3 & 4 the sixth admitted facts, exhibit P28D. No child pornography was found in Annex 2. The cross-reference folder was prepared at the request of the court when it transpired that the S parties did not know which of the files in Annex 1 contained the child pornography. This was S after Sgt 34232 started giving evidence on 28 December 2021 (Day 6). Sgt 34232 resumed his T evidence on 4 January, 5 January and 6 January 2022 (Days 10, 11 & 12). T 56 The withdrawal of the computer the same day by WDPC 7747 from Lok Ma Chau police station is shown in the The Property Movement History Report (exhibit P29). U U V V  29 A A B B identified the two external hard disks in court, the master disc (exhibit C P10) and the working copy (exhibit P11)57. C D 117. Admitted in evidence is that the two portable hard drives D exhibits P8 and P9 contain the same video clips and photo images as the E E two external hard disks exhibits P10 and P11 which contain the 4,738 F photos and 931 video clips containing child pornography referred to in F the charge sheet58. G G H 118. After PC 15892 checked the computer was functioning H properly the computer was kept in the exhibit storage room of the Digital I I Forensic team.59 At 19:38 on 8 October 2020 acting under the authority J of a search warrant PC 15892 retrieved data from the computer in the J form of a forensic image. The production of the forensic image finished K K the next day60. L L 119. Sgt 34232 explained that the hard disk of the computer was M M turned into a forensic image which was then stored internally on the N server of the forensics lab of CSTCB and the computer returned to the N 61 exhibit storage room . O O P P 57 Q Evidence on 28 December 2021 (Day 6). The serial number of the working copy (exhibit P11) is Q wrongly stated in the witness statement. Sgt 34232 corrected this in court. R In §13 of his witness statement Sgt 34232 describes relevant data from the files being exported to R the master disc and the working disk. Also see §162. 58 See §§1 & 2 of the sixth admitted facts, exhibit P28D as read with §1 of the third admitted facts, S S exhibit P28B. 59 See §4 of the witness statement. T 60 T See §5 of the witness statement. 61 Evidence on 28 December 2021 (Day 6) and on 4 January 2022 (Day 10). U U V V  30 A A B B 120. WPC 15499 gave a demonstration of the forensic image C examined by Sgt 34232. At the request of the court WPC 15499 C produced 29 photographs of the images shown during her demonstration D D (exhibit P7C). As I review the evidence of Sgt 34232 I will refer to the E photographs produced by WPC 1549962. E F 121. At 1100 hours on 28 October 2020 Sgt 34232 examined the F forensic image derived from the computer with forensic examination tool G G X-ways forensics version 20.0. Sgt 34232 explained that he first H examined that the MD5 Hash (hash value) of the forensic image was the H same as the hash value of the 2572 files chosen by PC 8084 and WDPC I I 63 4171 on 5 February 2018 . J J 122. Pictures 1-3 (exhibit P7C) show the X-ways forensic K K interface and the MD5 Hash. WPC 15499 confirmed the hash value was L the same as the hash value of the forensic image examined by Sgt 34232. L M M 123. Sgt 34232 explained that he was the sergeant of PC 8084 and N that he had supervised PC 8084 in February 2018 when PC 8084 was N 64 tasked to forensically examine the computer . Sgt 34232 said the hash O O values were consistent and therefore the data had not been tampered P with65. P Q Q R 62 The photographs were produced after WPC 15499 had finished giving evidence. I directed that R the photographs were to be shown to both Mr Percy and Mr Cao for agreement that they were the images shown during the demonstration. The defence had no objection to the production of the S S photographs. 63 Also see §6 of the witness statement. T 64 T Evidence on 4 January 2022 (Day 10). 65 Evidence on 28 December 2021 (Day 6) and on 4 January 2022 (Day 10). U U V V  31 A A B B 124. In cross-examination after Sgt 34232 agreed that each file C has a unique hash value, Mr Cao referred Sgt 34232 to three groups of C files where the hash values were the same. Sgt 34232 explained if the D D hash values tally with each other they were the same files. In answer to E the court Sgt 34232 said the three groups of files were in different E locations and that they had either been copied or the same file was F F downloaded more than once. G G 125. Sgt 34232 disagreed that when a new forensic image was H produced new unique hash values would be generated for each of the files. H I I 126. The analysis made by Sgt 34232 is set out in paragraphs 6-13 J of his witness statement together with the five annexes. J K K 127. The computer name was DAVID-PC and the administrator L was also David with the path C:\Users\David. The tables in the witness L statement of Sgt 34232 refer to two partitions E: (E: drive) and C: (C: M M drive) with E: drive the file path of all the 2572 pornographic photos, N videos and zip files with the files located in E:\Incoming and N E:\Download. In answer to the court Sgt 34232 said that files 2534-2572 O O had a different path to the other files and should be in P C:\Users\David\pictures and not in E: drive66. P Q 128. Pictures 4-9 (exhibit P7C) show E:\Incoming and Q E:\Download folders which are in Partition 2. Picture 7 shows the files in R R 67 the download folder and picture 9 shows the files in the incoming folder . S S T 66 T This was after re-examination. 67 All the files are not shown as this requires the user to scroll down to see all the files. U U V V  32 A A B B 129. The times the files were created, modified and accessed and C whether the files had been deleted are particularised in Annex 1. In C answer to the court Sgt 34232 explained when the created time, modified D D time and access times were all the same the times were said to be E consistent and when they were different the times were inconsistent 68 . E F Created F G G 130. Sgt 34232 explained that when downloading is completed a H file will automatically be created in E: drive showing the date and time H the file was created 69 . Sgt 34232 said the files were created between I I 2011 and November 201670. J J Modified K K 131. Sgt 34232 explained that when a file is created the modified L L time will be consistent with the created time save that there may be a one M second deviation when eMule is used to download the file. M N N 132. Sgt 34232 explained that where a file had been opened the O modified time would be different to the creation time. By way of O example Sgt 34232 said when a Word file was opened and new words P P input in the file and saved the modified time would be updated71. Q Q R R 68 After re-examination. S S 69 Evidence on 28 December 2021 (Day 6). 70 T Evidence on 4 January 2022 (Day 10). The creation time of two files was in 2003. See files 2532 T & 2533. Also see §12 of the witness statement. 71 Evidence on 28 December 2021 (Day 6). U U V V  33 A A B B 133. In answer to the court Sgt 34232 explained that video files C and photo files can be modified with software such as Video Editor or C 72 Photo Editor by adding subtitles or changing the resolution . D D 134. Sgt 34232 was of the opinion that where the created time and E E the modified times are the same the file had not been viewed. Sgt 34232 F did not however go through the exercise of seeing how many files in F Annex 1 had been viewed. G G H 135. Sgt 34232 said that where a person views a video the H modified time would change 73. In cross-examination Sgt 34232 agreed I I the playing of a video file would not change the modified time. Asked by J the court which answer was correct Sgt 34232 said the playing of a video J would not change the modified time 74. K K L Accessed L M 136. Sgt 34232 explained that the access time means a file has M been opened but probably the contents have not been edited. If the N N contents of the file have been edited the modified time would also O change75. O P P 137. With reference to file 23 (Annex 1) Sgt 34232 was of the Q opinion that the modified time was seven days later than the created time Q because the user had opened the file with a player software. Sgt 34232 R R was however unable to say why the access time was four years later than S 72 S After re-examination. 73 End of evidence on 28 December 2021 (Day 6). T 74 T This was after re-examination. 75 Evidence on 28 December 2021 (Day 6). U U V V  34 A A B B the created and modified times but gave the opinion that the use of the C eMule programme may have tampered/interfered with the access time76. C Sgt 34232 said he had not done any experiment in this regard. D D 138. Sgt 34232 explained that in the case of a video file the access E E time would be affected (i) when a video file was played on some media F players; (ii) where the user has put the file in a folder and opens the folder F and (iii) where other programmes, such as eMule, have been used77. G G H 139. Regarding the access time Sgt 34232 clarified that opening H was the same as viewing, whether opening a video file, photo file or I I image file78. J J 140. When Mr Percy drew to the attention of Sgt 34232 twelve K K files in Annex 1 where the access time was the same day, 21 October L 2016, between 0115 and 1526 hours, Sgt 34232 said he was not clear L whether the computer could be programmed to access these files M M automatically and referred to the three ways in which the access times N could be affected79. N O 141. In cross-examination Sgt 34232 disagreed that by opening a O folder the times of the files would not change; said he was not clear P P whether Windows Defender, the antivirus programme installed on the Q Q R R S 76 S Evidence on 28 December 2021 (Day 6). 77 Evidence on 4 January 2022 (Day 10). T 78 T Evidence on 4 January 2022 (Day 10). 79 Evidence on 4 January 2022 (Day 10). U U V V  35 A A B B computer, could have accessed the files when scanning for viruses 80 ; C confirmed he had not conducted any test to see if any of the 2,572 files C had been accessed by eMule and agreed that from just looking at the D D access times in Annex 1 it was not possible to tell if any of the files had E been opened or viewed by a human being. E F Deleted F G G 142. Sgt 34232 explained that all the files had not been deleted H meaning that they existed on the computer and did not have to be H recovered by forensic software81. I I Annex 2 J J K 143. Sgt 34232 explained that Annex 2 was a list of LNK files, K which were shortcuts to 69 video files which could be created either L L manually or automatically. Sgt 34232 said he was unable to tell whether M the 69 LNK files had been generated manually or automatically and was M unable to explain why the access time for all the LNK files except the N N first file was the same, namely 19/11/2016 3:0382. O O 144. In cross-examination Sgt 34232 agreed that LNK files are P P created when a user either right clicks on a mouse and creates a shortcut Q (manually) or by opening a file when the LNK file shortcut is Q automatically created. R R S 80 Mr Cao also referred Sgt 34232 to a paper entitled “The Rules of Time on NTFS File System” S (marked exhibit D3 for identification) and specifically to scenario 8. Sgt 34232 said he was not clear about the findings under scenario 8. T 81 T Evidence on 4 January 2022 (Day 10). 82 Evidence on 4 January 2022 (Day 10). U U V V  36 A A B B 145. Pictures 10-18 (exhibit P7C) show the location of the LNK C files. WPC 15499 explained the location of LNK files is reached by first C clicking on Partition 1, then Users, David, App Data, Roaming, Microsoft, D D Windows and Recent. By clicking on the folder Recent the LNK files are E shown which are created by the user or automatically by the system. E F Annex 3 F G G 146. Sgt 34232 explained that Annex 3 is a record of shortcuts of H jump lists in relation to 1545 files opened by using Windows Media H Player, the jump list path showing the location of the files 83. By way of I I example Sgt 34232 confirmed that file 38/1323 (Annex 1/Annex 3) was J opened by Windows Media Player84. J K K 147. Pictures 19-29 (exhibit P7C) show the location of jump lists. L WPC 15499 explained the location of the jump lists was the same route L as the LNK files. On reaching Recent by clicking on Automatic M M Destinations 49 different files can be seen which are jump lists N automatically generated by the system with each file representing N different software. The location of the jump list path of the 1545 video O O files as shown in Annex 3 is the same as the file highlighted in picture 29. P P Q Q 83 Evidence on 4 January 2022 (Day 10). In paragraph 8 of his witness statement Sgt 34232 stated R that all 2572 pornographic videos had been opened with the software windows media player. The R accuracy of this paragraph was not admitted. In court Sgt 34232 read out paragraph 8 which was then translated by the court interpreter in the same terms as the translation i.e. that all 2572 S pornographic videos had been opened with the software windows media player. Mr Cao accepted S the court translation and explained he was not challenging the translation only what Sgt 34232 T meant by this paragraph. In cross-examination Sgt 34232 agreed that the intended meaning was T that some of the 2572 files had been opened with the software windows media player. 84 File 38/1323 (Annex 1/Annex 3) is a child pornography file see cross-reference file no.5. U U V V  37 A A B B 148. In cross-examination Sgt 34232 said the shortcuts were C created by either double clicking on the file where the default setting of C the computer was that the software would be used to play the videos or by D D opening the software directly and playing the video. E E 85 149. Mr Cao showed Sgt 34232 four tables (exhibit D4 (1)-(4)) . F Mr Cao called the first three tables clusters. Cluster 1 shows 154 files F where the last access time was within a seven second time frame; Cluster G G 2 shows 102 files where the last access time was within a fifty-three H second time frame and Cluster 3 shows 209 files where the last access H time was within a forty-seven second time frame. I I J 150. Mr Cao asked Sgt 34232 by reference to cluster 1 whether he J agreed that under either circumstances a shortcut was created it was K K highly unlikely for a human to be able to open 154 files in eight seconds. L Sgt 34232 agreed. Sgt 34232 disagreed the same proposition with L regards to cluster 2 and cluster 3. M M N 151. In re-examination Sgt 34232 was asked if there was a feature N on Windows that allows a user to select multiple files and open them at O O the same time. Sgt 34232 replied “Yes”. Asked if by using this feature P whether multiple files could be opened in several seconds, Sgt 34232 P replied “Yes, there is such a possibility”. Q Q 152. Mr Percy then asked Sgt 34232 to explain why he agreed R R with the proposition that it was highly unlikely for a human to be able to S open 154 files in eight seconds (cluster 1) but disagreed with the same S T T 85 Apart from a few inaccuracies which Sgt 34232 pointed out Sgt 34232 agreed the accuracy of the tables. As a result, Mr Cao amended the tables and submitted revised tables to the court. U U V V  38 A A B B proposition with regards to cluster 2 and cluster 3. Sgt 34232 replied that C having been reminded of the feature of “Select All” he said it was C possible for a human to be able to open 154 files in eight seconds. D D 153. Except for the 138 files listed in the fourth table (exhibit E E D4(4)), the last modified time of the files in Annex 3 (i.e. 1,407 files) is F later than the last access time. When asked by Mr Cao if he could explain F why the modified time was later than the access time Sgt 34232 replied G G that he had mentioned earlier in his evidence the reasons for change in the H modified time and that he was not clear in these circumstances why the H modified time was later than the access time86. I I J 154. In answer to the court Sgt 34232 explained that the jump list J files are hidden files; that under normal circumstances they cannot be K K opened or found; it is not possible for copying to occur; he was not clear L why the modified time was later than the access time because it might L take a lot of experiments to reach a conclusion and that from his M M knowledge he could only guess that some programme might have opened N these jump lists87. N O O 155. Mr Cao also referred Sgt 34232 to files 1070 and 1073 P (Annex 3) where the created time is later than the modified time. Sgt P 34232 explained this would happen when the file was copied, the created Q Q time being the time the file was copied and the modified time following R the record of the old file. R S S T 86 T Cross-examination on 5 January 2022 (Day 11) & 6 January 2022 (Day 12). 87 After re-examination. U U V V  39 A A B B 156. In cross-examination Sgt 34232 also said he was not clear C how to modify a jump list; a jump list is a record of recently opened files C and that it was not possible the last access time might have been modified D D by programmes such as eMule or antivirus programmes88. E E Annex 4 F F 157. Sgt 34232 explained that Annex 4 is a list of 30 keywords G G used to search eMule. Sgt 34232 did not know the dates of the searches H and whether there was a maximum number of searches that can be shown H in the list89. I I 158. With reference to search keyword ‘pthc jap’ (no. 2) and J J ‘pthc’ (no.10) Sgt 34232 explained that by searching a keyword in eMule K K there would be a pop up showing many results from which the user can L select which video files to download. Sgt 34232 said that using these L 90 keywords file 138 (Annex 5) could be searched and selected by the user . M M Annex 5 N N O 159. Sgt 34232 explained that Annex 5 shows records of 4227 O 91 files downloaded by using eMule software . P P Q Q R 88 Cross-examination on 5 January 2022 (Day 11). R 89 Evidence on 4 January 2022 (Day 10). Also see §§9 & 12 of the witness statement. S 90 Evidence on 5 January 2022 (Day 11). File 138 (Annex 5) is a child pornography file (cross- S reference file no. 482). In cross-examination Mr Cao did the same exercise with regard to search T keyword “Russian” by referring to files 379 & 1862 (Annex 5) which are both child pornography T files (cross-reference file nos. 2 & 12). 91 Evidence on 4 January 2022 (Day 10). U U V V  40 A A B B Findings C C 160. In summary Sgt 34232 found that the 2572 files were stored D in E: drive (save for files 2534-2572); the administrator David had D opened 69 shortcut LNK files (Annex 2) and 1545 shortcut files with E E Windows Media Player (Annex 3); the created time, modified time and F access times were inconsistent, denoting some of the files had been F opened by the administrator David between 2011 and 19 November 2016; G G a record of 30 searches for pornographic files by keyword using eMule H software were made by administrator David and records of 4227 files H were downloaded by administrator David using eMule software92. I I J 161. In cross-examination Sgt 34232 agreed that whenever he J referred to user David having done something he did not actually know K K who the individual was that did that action only that the account David L had been used. L M M 162. Between 28 October 2020 and 30 October 2020 relevant data N from the 2572 files together with the five annexes were exported from the N forensic image onto the two external hard disks (exhibits P10 and P11) O O which WDPC 7747 had obtained at the request of Sgt 3423293. On 9 P November 2020 Sgt 34232 returned the computer and the two external P hard discs to WDPC 7747 94. Sgt 34232 testified that he did not tamper Q Q with any of the data and did not see anyone tamper with the data. R R S S 92 See §§7-12 of the witness statement. 93 T See §13 of the witness statement. T 94 The return of the computer by WDPC 7747 the same day to Lok Ma Chau police station is shown in the Property Movement History Report (exhibit P29). U U V V  41 A A B B WPC 15499 C C 163. WPC 15499, who is attached to Digital Forensics Team D, D CSTCB, adopted her witness statement dated 30 July 2021 together with D two annexes (exhibit P7 & P7 (1) & (2))95. E E F 164. Admitted in evidence is that WPC 15499 is an expert witness F in computer forensics 96 . Between 2016 and 2021 WPC 15499 has G G attended numerous training courses pertaining to computer forensics as H particularised in her witness statement97. In evidence WPC 15499 told H the court that she had worked in CSTCB for two and a half years during I I which she had dealt with over 100 cases involving forensic images. WPC J 15499 was giving expert evidence in court for the first time. J K K 165. I was satisfied WPC 15499 was an expert in computer L forensics. I permitted WPC 15499 to give expert evidence on computer L forensics. M M 166. WPC 15499 first gave evidence about eMule, in particular N N how to search and download a file using eMule. WPC 15499 was asked O to perform search and download simulation 98. Both in court and in her O witness statement WPC 15499 explains how she conducted the P P Q Q R R 95 The witness statement was in Chinese. An English translation was admitted in evidence as an S S accurate translation (exhibit P7A). See §2 of the seventh admitted facts, exhibit P28E. 96 See §1 of the seventh admitted facts, exhibit P28E. T 97 T See §2 of the witness statement. 98 See §2 of the witness statement. U U V V  42 A A B B simulation together with screen captures of the simulation (pictures 1- C 31)99. C D 167. In summary on 28 July 2020 on a departmental computer in D which all the factory settings had been restored making the computer like E E a new computer, WPC 15499 simulated the environment of the computer F (exhibit P1) by reinstalling Windows 10 which was split into two F partitions C: drive and E: drive 100. WPC 15499 used the computer name: G G DAVID-PC and the name of the administrative account: David (path – H C:\Users\David) which are the same as the computer (exhibit P1)101. H I I 168. After creating two folders “Incoming” and “Download” in E: J drive WPC 15499 downloaded eMule on the computer (see pictures 4- J 13) 102 . After eMule was installed a configuration file was created K K automatically in the path: C:\Users\David\AppData\Local\eMule\config. L WPC 15499 then launched eMule, conducted basic configuration and L changed the default path C:\Users\David\Downloads\eMule\Incoming to M M customized path E:\Incoming (see pictures 14-23)103. N N Search O O 169. WPC 15499 then conducted a search on eMule by using P P keywords “abc”, “123” and “Olympics” by first clicking on “Connect” Q and then “Search” which opens the search box in which the keywords can Q R R 99 At the request of the court WPC 15499 also produced colour enlargements of the 31 pictures in her witness statement (exhibit P7B). S 100 S See §§3 & 4 of the witness statement together with pictures 1-3. 101 See 6 of the witness statement of Sgt 34232. T 102 T See §§5 & 6 of the witness statement of WPC 15499 together with pictures 4-13. 103 See §§7 - 9 of the witness statement together with pictures 14-23. U U V V  43 A A B B be input in the box “Name”. After inputting the keywords, the search is C started by clicking on “Start”. C D 170. The result of the search is shown under “File Name”. By D double clicking on a file name downloading will begin. WPC 15499 E E selected eleven files for downloading. By clicking on “Transfers” the list F of files selected for downloading can be seen. Two days later on 30 July F 2020 three of the files selected had been downloaded in the path G G 104 E:\Incoming . WPC 15499 then stopped downloading the remainder of H the files selected. H I I 171. A record of the files downloaded can be found by going to C: J drive and then clicking on “users”, “C57051” (the number assigned to the J computer), “App Data”, “local”, “eMule” and finally “config” where the K K two log files “AC_SearchStrings.dat” and “known.met” can be located. L Using computer forensic tool Magnet Axiom WPC 15499 could view the L log files. “AC_SearchStrings.dat” is a record of the search keywords M M used and “known.met” is a record of the files downloaded 105. N N 172. WPC 15499 told the court that eMule was freely available O O for downloading on the internet; eMule did not automatically download P files not selected for downloading; the file had to be downloaded 100% P before viewing; the files could easily be deleted by moving to the recycle Q Q bin and after removal from the recycle bin the file could not be retrieved. R R S S 104 See §§10 & 11 of the witness statement together with pictures 24-30. T 105 T See §§12 & 17 of the witness statement together with picture 31. U U V V  44 A A B B 173. In cross-examination WPC 15499 agreed holding down the C ‘control’ key and the ‘A’ key is a shortcut for selecting all files and that C she did not test whether this could be applied to the eMule programme D D but agreed there is such a possibility. E E Defence evidence F F 174. The defendant elected to give evidence. The defendant who G G is 46 obtained a Master of Science from the London School of Economics. H The defendant can converse in Cantonese but cannot read or write H Chinese. I I 22 November 2016 J J K 175. In November 2016 the defendant was living with his wife K and two teenage children at No. 16 Willow Path, Monterey, Palm Springs L L in Yuen Long106. M M 176. On 22 November 2016 the police attended the defendant’s N N home. The defendant was arrested and the computer (exhibit P1) seized. O The computer, which was located in the living room on the ground floor, O belonged to the defendant who was the main user. The computer had no P P password and could be accessed by anyone. Q Q 177. The defendant installed the software eMule on the computer. R The defendant said eMule was a kind of file sharing programme which R allowed one to download files after doing a quick search. S S T T 106 Also see §1 of the admitted facts, exhibit P28. U U V V  45 A A B B 178. The defendant explained that by putting in a keyword in the C search window and pressing the start button the programme will then C show a list of files relevant to the keyword. By selecting the files and D D pressing the download button downloading would be initiated. The E defendant said he used eMule mainly to download music files, music E videos, adult pornography videos and software. F F 179. The defendant described that after work, usually around 9-10 G G p.m. he would go home and if he were to use the computer he would open H eMule and initiate a search. The defendant said he was usually very tired H around that time of night and that it was more like a habit that he would I I basically just put in a keyword such as “Japan” or “Russian”. J J 180. Without looking exactly what the files were the defendant K K would press the ‘Control’ and ‘A’ keys to select all the files that popped L up in the search window and then press the download button. L M M 181. When asked why he selected all the files the defendant said N that he had no intention of understanding what the files were and that this N was just a casual habit to do a search, select all the files and then press O O download. P P 182. The defendant said this did not happen very often because Q usually by the time he got home he would be really tired and more often Q than not he would sit on the sofa in the living room looking at the walls or R R watching television before going to sleep. The defendant said he S probably used eMule once or twice a month and having used eMule for S quite a few years the number of files he would have downloaded by the T T time of his arrest would be in the thousands. U U V V  46 A A B B 183. The defendant said he never searched for child pornography. C Asked whether he played or viewed any of the files downloaded the C defendant replied that he would play some of the files but those occasions D D were seldom and the files were never child pornography. The defendant E repeated that what he did was more like a habit of downloading files E rather than intending to play any of them. F F 184. The defendant said he had never seen any of the child G G pornography subject of the charge; never imagined any of the files were H child pornography and did not suspect any of the files to be child H pornography. I I J Reply under caution. J K K 185. As mentioned already under caution the defendant replied in L Punti “I downloaded those pornographic videos but I seldom watch them. L Give me a chance” . 107 M M 186. When asked by Mr Cao what he meant when he said “I N N downloaded those pornographic videos” the defendant said that he was O referring to adult pornography videos not child pornography. Asked what O he meant when he said “Give me a chance” the defendant said he meant P P “to give me a break”. The defendant said he was not admitting Q downloading child pornography. Q R R S S T T 107 Exhibit P5. Also see §§3 & 4 of the admitted facts, exhibit P28. U U V V  47 A A B B Video Recorded Interview C C 187. As stated already between 10:31 and 11:12 hours on 22 D November 2016 DPC 7098 conducted a video recorded interview with D the defendant108. Around the time of the interview the defendant said he E E was feeling under a lot of stress because he had never been arrested F before. F G G 188. Mr Cao asked the defendant to explain various parts of the H interview. Mr Cao first drew to the attention of the defendant the recital H of his answer under caution at counter 128 109 and asked what the I I defendant meant when he answered at counter 129 “That’s true. Yes.” J The defendant replied that given the stress he was under he presumed J what the police meant was adult pornography and that he thought they K K were referring to adult pornography. L L 189. The defendant continued his answer saying, “Because I can M M understand Chinese, you know, if you look at 127, when the question was N proposed to me by the officer, they actually said “those pornographic N footages”; so in Chinese, that’s what I heard, and not “child O O pornography”, so when I answered the question, I was presumably P referring to the adult pornography videos and not the child pornography P videos.” Q Q R R 108 See §5 of the admitted facts, exhibit P28. S S 109 Counter 128 is the English translation given during the interview by the police translator of DPC 7098’s question at 127 reciting the reply under caution and asking the defendant to confirm he T said those words. As noted already in footnote 30 there was a mistranslation by the police T translator at 128 when in reciting the reply under caution she said “I downloaded those child pornography videos”. U U V V  48 A A B B 190. When giving the answer at counter 205 “The way I C downloaded those videos…” the defendant said he was referring to adult C pornography videos. D D 191. In answer at counter 219 when saying “All the videos which E E are child pornography is from the eMule program.” the defendant said he F was just describing a hypothetical situation that if there were child F pornography files on the computer they would have been through the G G programme eMule and not by him going to a child pornography website H to download and that he had no intent to download any child pornography. H I I 192. When giving the answer at counter 223 the defendant said he J presumed the police were referring to adult pornography and that his J answer he started downloading a few years ago and that he had watched K K some referred to adult pornography. L L 193. Asked what he meant by “I’m not saying I deny my M M responsibility for downloading it” the defendant said he had a kind of N guilt for downloading pornography files because he was still married and N so by downloading pornography he thought it was like a kind of betrayal O O to the marriage. P P 194. The defendant explained by the answer at counter 230 he Q meant he rarely watched videos; he had no craving to watch videos every Q day; he was referring to adult pornography and that he was again R R referring to the guilt he felt towards his wife when saying “I know it’s S wrong. I’m not denying that. And I’m sorry.” S T T U U V V  49 A A B B 195. The defendant explained that in the answer at counter 238 C when he said “Well, I know I downloaded them” he was referring to adult C pornography as he presumed that was what the police were talking about D D and when he said “I know they exist” he was referring to adult E pornography because he was the one who pressed the download button E with the intention of downloading adult pornography. F F 196. The defendant explained that in the answer at counter 246 he G G was again giving a hypothetical answer because of the generality of the H search, anything might pop up, which hypothetically could also include H child pornography. The defendant said that when he downloaded files he I I had no knowledge it was child pornography because he had no intention J J to download such things. K K 197. In the answer at counter 250 the defendant said he was L reiterating the point that when he went home he was really tired and that L he just had the habit of downloading files but did not have the intention of M M checking the content of the files. N N 198. In the answer at counter 252 the defendant said he was again O O referring to the guilt he felt towards his wife. The defendant also said in P the interview he never referred to downloading child pornography but P used pronouns like “it” or “them” and repeated that given the stressful Q Q situation he presumed the police when asking questions were referring to R adult pornography and so when he used “it” or “them” he was referring to R adult pornography. S S 199. In the answer at counter 270 the defendant said he was T T referring to adult pornography because he presumed that was what the U U V V  50 A A B B police were referring to. In the answer at counter 277 the defendant said C he was also referring to adult pornography. C D 200. In the answer at counter 280 the defendant said he was again D referring to the guilt he felt towards his marriage and that he was sorry for E E downloading adult pornography because he had been brought up a proper F person. The defendant said he held the fundamental beliefs of his family, F one of which was not to download pornography. The defendant said that G G was why he felt sorry towards his wife for doing so. H H 201. The defendant explained that in the answer at counter 286 he I I meant that he never had the intention or desire to download, play or view J child pornography and that hypothetically if child pornography was on J his computer he would delete them. In cross-examination the defendant K K said he never deleted any child pornography files. L L 202. The defendant said that his answer at counter 311 (referring M M to the age of the people in the child pornography) “No. I – until I look at N them, then I know, yes” meant that if he was able to find any child N pornography videos on the computer he would be able to know that they O O are child pornography and not that he had seen any child pornography on P the computer. P Q 203. The defendant explained that by saying “And when I do find Q it, I usually delete it” in the answer at counter 315 he was saying if he R R ever found any such inappropriate files on the computer he would delete S them. S T T U U V V  51 A A B B 204. In the answer at counter 376 the defendant said he was C referring to adult pornography and in 378 was saying he had no intention C to download child pornography and that he thought it was wrong for D D downloading adult pornographic files. E E 205. In giving this answer the defendant said there was one line in F the interview where he said he never downloaded child pornography. F The defendant said this was counter 337110. G G H 206. The defendant concluded his evidence by again saying he H was a proper person who was raised properly; that he would never do I I such things to download child pornography; that he has two teenage J children and that it would disgust him if anything ever happened to them J let alone child pornography which was disgusting. K K L Discussion L M Consideration of the evidence M N N 207. I have carefully considered all the evidence and the written O submissions of Mr Percy and Mr Cao. Due allowance is given to all O witnesses, including the defendant, who testified about events which P P occurred up to five years ago. Q Q Defence evidence R R 208. I have no hesitation in rejecting the defendant’s evidence that S S he had never seen any of the child pornography subject of the charge; T T 110 At counter 337 the defendant said: “Yeah. And I’ve never - - I’ve never searched for child pornography.” U U V V  52 A A B B never imagined any of the files were child pornography and did not C suspect any of the files to be child pornography. C D 209. I do not find the defendant’s evidence credible, for example I D do not find credible the defendant’s evidence that for over a period of E E about five years he had a habit of downloading files from eMule without F looking exactly what files he was downloading, had no intention of F understanding what files he was downloading; did not intend to play any G G of them and had never seen any of the child pornography. H H 210. In the video recorded interview when asked when did he I I start downloading the child pornography the defendant answered a few J years ago and said that he didn’t really have much time to watch but had J watched some (see counters 221-225). K K L 211. I do not find credible the defendant’s evidence that he L presumed the police were referring to adult pornography and that he was M M referring to adult pornography in his answer. The question clearly asked N the defendant when did he start to download those child pornographic N footages. O O 212. I do not find credible the defendant’s evidence that in his P P answer to caution he was referring to adult pornography and that Q throughout the video recorded interview he presumed the police were Q referring to adult pornography. R R S 213. The defendant was arrested for possession of child S pornography not adult pornography. At the beginning of the interview T T DPC 7098 stated he was continuing to make enquiry of the defendant U U V V  53 A A B B about a case of child pornography and recited the reason for the C defendant’s arrest (see counters 107-130). DPC 7098 then showed the C computer to the defendant and said the police believed that the computer D D contains child pornography videos (see counters 131-140). Throughout E the interview DPC 7098 and DSgt 58785 referred to child pornography, E see for example counters 217, 221, 236, 248, 254, 258, 268, 282, 309 and F F 325. G G 214. Whilst accepting that anyone arrested for the first time and H being interviewed by the police would feel under stress, I do not find H credible that the defendant believed the police were questioning him I I about adult pornography the possession of which is not unlawful. J J 215. I do not find credible the defendant’s evidence that his K K answers at counters 219, 246, 286, 311 and 315 were hypothetical L answers. The questions were all clearly asking the defendant if he had L downloaded child pornography, what he knew about the suspected child M M pornographic footages found in his computer, whether he had any lawful N use for possession of the child pornography and if he knew the footages N were of underage children. I reject the defendant in answering the O O questions was describing hypothetical situations of how child P pornography might be on his computer and what he would do if he found P child pornography on his computer. Q Q R 216. I do not find credible the defendant’s evidence that R throughout the interview when he said he accepted his responsibility for S S downloading pornography, said he knew it was wrong and said he was T sorry, he was referring to the guilt he felt towards his wife and his T marriage for downloading adult pornography. At no time throughout the U U V V  54 A A B B interview did the defendant say he was accepting responsibility, he knew C it was wrong or he was sorry because he felt a kind of guilt towards his C wife for downloading the pornography. D D 217. I remind myself that the rejection of the defendant’s E E evidence is not determinative of the issues in the case. The defendant has F to prove nothing. A case in which defence evidence is called and is not F believed is no different from one in which no evidence is called. In either G G case the burden is on the prosecution to prove the defendant’s guilt H beyond reasonable doubt. H I I Prosecution evidence J J Chain of evidence K K 218. Admitted in evidence is the proper handling of the computer L L except for the periods 08:25 hours on 22 November 2016 to 12:07 hours M on 18 January 2017; 12:15 hours on 11 May 2017 to 10:13 hours on 16 M May 2017 and 17:46 hours on 26 February 2018 to 24 April 2018 111. N N O 219. Mr Cao submits that in the three periods where the proper O handling of the computer is not admitted there are periods where the P P handling of the computer is unaccounted for; there are no proper records Q of the movement of the computer and no evidence of the proper handling Q of the computer in these periods112. R R S S T 111 T See §6 of the admitted facts, exhibit P28. 112 See §§1-34 of the Defendant’s closing submissions. U U V V  55 A A B B 220. Seven witnesses testified with regards to the handling of the C computer: DPC 7098 (PW1); DPC 5517 (PW2), DPC 58721 (PW3); C WDPC 7186 (PW4); Danny Choi Pak Lung (PW5); DPC 7280 (PW6) D D and WDPC 4171 (PW7)113. Unless otherwise stated I accept the evidence E of the prosecution witnesses. E F (1) 08:25 hours on 22 November 2016 to 12:07 hours on 18 January F 2017. G G H 221. The impugned period refers to the time when the computer H was taken to the Border Headquarters by DPC 58721 (PW3) to the time I I when the computer was received by DPC 7280 (PW6). J J 08:25-13:00 hours on 22 November 2016 K K 222. Admitted in evidence is that at about 07:36 hours DPC L L 58721 seized the computer. I accept the evidence of DPC 58721 that M after seizing the computer he put the computer in his backpack; at 08:10 M he took the computer to the Lok Ma Chau Police Station arriving at 08:25; N N between 08:25 and 08:55 the computer was all along with him; at 08:55 O the defendant was taken to the Border Headquarters; between 08:55 and O 10:20 he kept the computer; at 10:20 he was instructed to go back to Palm P P Springs for further investigation and therefore handed over the computer Q to DPC 7098 and at 13:00 took the computer back from DPC 7098. Q R R 223. I accept the evidence of DPC 7098 that about five to ten S minutes before he started the video recorded interview at 10:31 DPC S T T 113 Their evidence is summarised at paragraphs 60-68 and 81-108. U U V V  56 A A B B 58721 handed the computer to him and that he showed the computer to C the defendant during the interview. C D 224. The video recorded interview concluded at 11:12 hours. D DPC 7098 testified that after the interview concluded the defendant was E E taken by the police to a tutorial centre for a search. In cross-examination F when asked where the computer was when the defendant was taken to the F tutorial centre DPC 7098 said he took the computer with him. G G H 225. I reject the submission that because DPC 58721 and DPC H 7098 did not record in their notebooks about the handling of the computer I I on 22 November 2016 they have put their heads together to cover the J whereabouts of the computer during the time of the search of the tutorial J centre114. K K L 226. I do not agree that there is no evidence that DPC 58721 L 115 applied anti-tampering labels to prevent any undocumented access . As M M summarised earlier when asked by Mr Percy whether he had in any way N interfered with the computer DPC 7098 answered no and explained that N as far as he recalled barcodes and labels had already been fixed on the O O computer to prevent anyone from interfering with the computer but since P he was not the one who affixed the labels he did not know and was not P sure whether the labels were affixed in the house or the police station116. Q Q 227. In cross-examination when asked if he had made any written R R record of what he did with the computer on 22 November 2016, DPC S S 114 See §§2, 3, 5, 6, 7 & 30 of the Defendant’s closing submissions. T T 115 See §§8-10, 30 and 32 of the Defendant’s closing submissions. 116 See §§88 & 89. U U V V  57 A A B B 58721 replied that “The computer was sealed in a bag and there was a C sealed tag on this bag.” The computer was shown to the defendant in the C video recorded interview at counter 131. A viewing of the interview D D shows at this time the computer was inside a plastic bag. It is not E however possible to see whether the bag was sealed or whether any labels E or barcodes were affixed to the computer. F F 228. The computer as produced in court is contained in a plastic G G bag on which there are labels affixed. Labels are also affixed to the H computer. The Property Movement History Report (exhibit P29) records H the serial number of the computer as CA098348. A label bearing this I I serial number is affixed to the computer. This is also the serial number J J referred to in paragraph 4 of the witness statement of Sgt 34232 under K safety protection. K L 229. The Property Movement History Report also refers to other L reference numbers DD07011 and DD77012. Labels bearing these M M reference numbers are affixed to the plastic bag. Other serial numbers N and reference numbers are affixed to the computer. No evidence was N however given when either serial numbers or reference numbers were O O affixed to the plastic bag and the computer. P P 230. I do however find unlikely that DPC 7098 would take an Q Q exhibit with him when conducting a search. I agree with Mr Cao that it is R likely the computer was left in Border Headquarters. The handling of the R computer is therefore unaccounted for during the period of the search S S until 13:00 when DPC 58721 took the computer back from DPC 7098117. T T 117 See §§1-4, 7 and 30 of the Defendant’s closing submissions. U U V V  58 A A B B I find inherently improbable that anyone in this short space of time C accessed the computer and changed the data on the computer. I accept C the evidence of DPC 58721 and DPC 7098 that they did not nor did D D anyone else unlawfully interfere with the computer. E E 13:00 - 14:21 on 22 November 2016 F F 231. I accept the evidence of DPC 58721 that at 13:00 hours he G G took the computer back from DPC 7098 and kept the computer until H 14:21 when he handed the computer to “Lung Gor” in the exhibits room H of Lok Ma Chau Police Station. I accept the evidence of Danny Choi Pak I I Lung, the keeper of the property office at Lok Ma Chau Police Station, J that he received the computer on 22 November 2016. J K K 232. Mr Cao submits that the Property Movement History Report L (exhibit P29) produced by Mr Choi is not a reliable record118. L M 233. I have no hesitation in rejecting this submission. Although M the entry at 2016-11-22 14:21:56 does not state under the remark column N N “Storage: CID Exhibit Room” the entry under movement type is O “Confirm Receipt”. In my view the only interpretation of this entry is O that Mr Choi did receive the computer from DPC 58721. P P Q 234. I reject the submission that because DPC 58721 did not Q record in his notebook the depositing of the computer at Lok Ma Chau R R Police Station this supports an inference this was not done 119. Whilst it S would have been better had DPC 58721 made a contemporaneous record S T T 118 See §§19-23 and 30-31 of the Defendant’s closing submissions. 119 See §§5, 6, 10, 30 & 31 of the Defendant’s closing submissions. U U V V  59 A A B B of this in his notebook the fact he did not does not cause me to doubt his C evidence and the evidence of Mr Choi that the computer was handed into C the exhibits room of Lok Ma Chau Police Station at 14:21 on 22 D D November 2016. E E 14:21 on 22 November 2016 to 12:07 hours on 18 January 2017 F F 235. WDPC 7186 testified that on 21 December 2016 she made G G an enquiry with CSTCB in relation to the progress of an urgent H application for examination of the computer as a result of which she H withdrew the computer from the property office at Lok Ma Chau at 10:24 I I a.m. on 18 January 2017. J J 236. In cross-examination WDPC 7186 agreed that in her witness K K statement dated 11 September 2020 she stated that she called CSTCB to L make enquiries of the progress of an urgent examination of the L 120 computer . WDPC 7186 disagreed that on 21 December 2016 the M M computer was actually in possession of CSTCB and was already N undergoing urgent examination. N O 237. WDPC 7186 was then cross-examined on the content of her O Investigation Report. WDPC 7186 disagreed that she made no record of P P 121 this call on 21 December 2016 in her Investigation Report . The entry Q Q 120 The witness statement was marked “B” for identification. R 121 R Cross-examination on 23 December 2021 (Day 4). WDPC 7186 disagreed after being shown her Investigation Report. Mr Cao immediately informed the court that he did not have the page S referred to by WDPC 7186. After the case was stood down and the parties had the opportunity to S look at the Investigation Report shown to WDPC 7186 it was discovered that Mr Cao only had pages 1, 3 & 5 and not pages 2, 4 & 6. The entry for 21 December 2016 was on page 4. The trial T was adjourned to the following day (24 December 2021-Day 5) when the Investigation Report T was marked “C” for identification. Mr Cao indicating that he would be further cross-examining WDPC 7186 on the content of her Investigation Report, I directed that the court be provided with U U V V  60 A A B B relating to the call, is a single entry on page 4 of the report 122. The entry C also states that WDPC 7186 called CSTCB to make enquiries of the C progress of an urgent examination of the computer. WDPC 7186 D D disagreed that she created this entry at the same time she made her E witness statement. E F 238. In my view the difference between making enquiries of the F progress of an urgent application for examination and making enquiries G G of the progress of an urgent examination of the computer are more H apparent than real. I am satisfied looking at the entry in the investigation H report as a whole WDPC 7186 was referring to the request for I I examination and was told to wait until January 2017 which was when she J J went to withdraw the computer. K K 239. I accept the evidence of WDPC 7186 that on 21 December L 2016 she made an enquiry with CSTCB in relation to the progress of an L urgent application for examination of the computer; she withdrew the M M computer from the property office at Lok Ma Chau at 10:24 hours on 18 N January 2017 and that she handed over the computer to DPC 7280 at N CSTCB at 12:07 hours the same day. I accept the evidence of WDPC O O 7186 that she did not nor did anyone else unlawfully interfere with the P computer. P Q Q 240. This is not the only evidence showing that on 18 January R 2017 the computer was withdrawn by WDPC 7186. The next entry in the R S a translation of the report. Further cross-examination was therefore adjourned pending S translation of the report. Cross-examination resumed on 3 January 2022 (Day 9). T 122 There are no traditional page numbers on the Investigation Report. The report has in a circle at T the top of each page the police reference J1. The first page is J1 and the remaining pages J1 1-5. Page 4 is therefore J1-3. U U V V  61 A A B B Property Movement History Report shows that the computer was C withdrawn from the property office by Mr Choi at 10:24:21 on 18 C January 2017 and handed to WDPC 7186. I accept the evidence of Mr D D Choi that he did return the computer at that time. E E 241. I do not agree the remarks, which Mr Choi said in cross- F examination he copied from the OC’s memo, suggest that the computer F was not in the exhibit room before 0500 on 18 January 2017123. In cross- G G examination Mr Choi disagreed the computer was not in the exhibit room H before 05:00 on 18 January 2017 and disagreed the computer was not put H in the storage room on 22 November 2016. I I J 242. The remarks clearly ask for the release of the computer. If J the computer was not in the exhibit room, there would be no need to K K request the release of the computer. L L 243. I reject the submission of Mr Cao that the failure by WDPC M M 7186 to keep proper records of the withdrawal of the computer on 18 N January 2017 also supports an inference the computer was not kept at Lok N Ma Chau Police station between 22 November 2016 and 18 January O O 2017124. P P 244. Whilst it would have been better had WDPC 7186 made a Q contemporaneous record of this in her notebook and investigation report, Q the fact she did not does not cause me to doubt the evidence of Mr Choi R R that he returned the computer to WDPC 7186 at 10:24:21 on 18 January S 2017 as shown in the Property Movement History Report. S T T 123 See §§20-22 & 30 of the Defendant’s closing submissions. 124 See §§11-18 & 30-32 of the Defendant’s closing submissions. U U V V  62 A A B B 245. I am satisfied so I am sure that between 14:21 on 22 C November 2016 and 10:24 hours on 18 January 2017 the computer was C stored in the exhibit room of Lok Ma Chau Police Station. D D 246. I accept the evidence of Mr Choi that the exhibit room was E E for him to store all the exhibits which no one could interfere with; no F unauthorised person could access the property room without asking him F for the key and that between 14:21 hours on 22 November 2016 to 16:55 G G hours on 24 April 2018 nobody unauthorised approached him to borrow H the key. H I I 247. I accept the evidence of DPC 7280, who was attached to J Digital Forensic Team A of the Forensic & Training Division of CSTCB, J that at 12:07 hours on 18 January 2017 the computer was handed over to K K him by WDPC 7186; that at 14:42 hours he stored the computer in the L exhibit room of CSTCB and that he did not nor did anyone else L unlawfully interfere with the computer. M M N (2) 12:15 hours on 11 May 2017 to 10:13 hours on 16 May 2017 N O 248. The only evidence adduced with regard to this period comes O from WDPC 7186. P P Q 249. In summary WDPC 7186 testified that between 11:00 and Q 12:15 hours on 11 May 2017 she went to CSTCB when PC 8084 showed R R her some video files found upon preliminary examination of the computer; S due to the substantial number of video files PC 8084 made two copies of S the files, exhibits P8 and P9, for WDPC 7186 to view in her office; after T T the discs were burnt she brought the discs to her office to continue U U V V  63 A A B B investigation of the case and on 16 May 2017 she contacted PC 8084 and C requested him to see if the files had been opened or played and whether C 125 the application eMule was in the computer . D D 250. In answer to the court WDPC 7186 said exhibits P8 and P9 E E 126 were handed to her at around 12:10 hours on 11 May 2017 . In further F cross-examination Mr Cao asked WDPC 7186 about the corresponding F entries in her Investigation Report127. WDPC 7186 said the meaning of G G the entry at 12:20 “PC 8084 signed for two Hard Disks” was that she H took the hard discs back. H I I 251. On a plain reading of the entries in the investigation report J the two hard disks were handed to PC 8084 at 12:20 on 11 May 2017 for J the purpose of saving the videos onto the hard disks and not WDPC 7186 K K took the hard discs back. Taking into account that exhibits P8 and P9 L contain the same video clips and photo images as P10 and P11128 which L Sgt 34232 said took two days to copy129, I have a doubt that exhibits P8 M M and P9 were handed to WDPC 7186 at around 12:10 on 11 May 2017. N N 252. I do not however agree with Mr Cao that WDPC 7186 was O O clearly lying when she said she received the discs around 12:10 from PC P 8084130. Considering this was over five years ago and there is no mention P in the investigation report of when WDPC 7186 collected the two discs it Q Q R 125 See §§101-103. R 126 After re-examination on 3 January 2022 (Day 9). S 127 S Page 6 (J1-5). 128 See the sixth admitted facts, exhibit P28D. T 129 T See §162. 130 See §§16-18 & 30-32 of the Defendant’s closing submissions. U U V V  64 A A B B is not surprising WDPC 7186 may have wrongly remembered the time C she collected the two discs. C D 253. I reject this evidence destroys the overall credibility of D WDPC 7186 such that her evidence regarding the withdrawal of the E E computer on 18 January 2017 cannot be believed. For the reasons F already given I accept WDPC 7186’s evidence she did withdraw the F computer from Lok Ma Chau Police station on 18 January 2017, which G G was not the only evidence of withdrawal. H H 254. Whether or not WDPC 7186 received exhibits P8 and P9 on I I 11 May 2017 no evidence has been adduced as to the proper handling of J the computer between 11 May and 16 May 2017. PC 8084 was not called J as a witness. K K L 255. Mr Cao submits that in the absence of calling PC 8084 it L cannot be presumed that the examination/reproduction by PC 8084 was M M conducted properly or that the computer was kept in proper custody while N in PC 8084’s possession131. N O 256. For the reasons already given I accept the evidence of O WDPC 7186 that she handed over the computer to DPC 7280 at CSTCB P P at 12:07 hours on 18 January 2017. I accept the evidence of WDPC 4171 Q that on 27 February 2018 colleagues from CSTCB handed the computer Q over to her132. R R S S T T 131 See §§24-30 & 33 of the Defendant’s closing submissions. 132 See §§104-108. U U V V  65 A A B B 257. I am satisfied so I am sure that between 12:07 on 18 January C 2017 and 27 February 2018 the computer was in the custody of CSTCB. C The proper handling of the computer is admitted for the periods 12:07 D D hours on 18 January 2017 to 12:15 hours on 11 May 2017 and 10:13 E hours on 16 May 2017 to 17:46 hours on 26 February 2018 133. E F 258. I find inherently improbable when the computer was in the F custody of CSTCB that someone in CSTCB improperly handled the G G computer between 11-16 May 2017 and changed the data. The failure to H call PC 8084 does not cause me to doubt this finding. H I I (3) 17:46 hours on 26 February 2018 to 24 April 2018 J J 259. The main evidence adduced with regard to this period comes K K from WDPC 4171. In summary WDPC 4171 testified that on 27 L February 2018 colleagues from CSTCB handed over the computer after L which she kept the computer in her custody until 24 April 2018 when she M M handed the computer to the exhibit room of Lok Ma Chau Police Station. N In cross-examination WDPC 4171 said that she kept the computer in a N locked cabinet and that she was the only person who had a key to the O O cabinet134. P P 260. The Property Movement History Report (exhibit P29) shows Q the receipt of the computer on 24 April 2018. Mr Choi also testified he Q received the computer on that day. Mr Cao submits that the Property R R Movement History Report is not reliable, the report showing that within a S period of just over six minutes the computer was returned to the exhibit S T 133 T See §6 of the admitted facts, exhibit P28. 134 See §§104-108. U U V V  66 A A B B room, withdrawn and returned a second time135. The fact WDPC 4171 C says she did not withdraw the computer during this time and had no C impression of these movements does not cause me to doubt her evidence D D that she returned the computer to the exhibit room on that day. E E 261. I accept the evidence of WDPC 4171 given in re- F examination that because there was an accurate record in the police F computer system she did not record that she returned the computer to the G G exhibit room of Lok Ma Chau Police Station in her investigation report. H H 262. I accept the evidence of WDPC 4171 that she did not nor did I I anyone else unlawfully interfere with the computer. J J 263. No evidence has however been adduced as to the proper K K handling of the computer between 1746 hours on 26 February and 27 L February 2018 when WDPC 4171 collected the computer from CSTCB. L I find inherently improbable that in this relatively short space of time M M someone in CSTCB improperly handled the computer and changed the N data. N O 264. Whilst finding that it is inherently improbable that anyone O improperly handled the computer and changed the data, in view of the P P fact that there are periods, albeit short periods, where there is no evidence Q as to the proper handling of the computer, I am satisfied that I must Q proceed with caution before placing any reliance on the data and look for R R any supporting evidence. S S T T 135 See §23 of the Defendant’s closing submissions. U U V V  67 A A B B Expert evidence C C 265. I do not agree with Mr Cao that Sgt 34232 is a charlatan who D gave wrong/misleading evidence such that no reliance can be placed on D his evidence136. I am satisfied that Sgt 34232 tried his best to explain E E technical matters although at times not very clearly and on occasions F needed to revise his evidence. I nevertheless approach the evidence of F Sgt 34232 with care before placing any reliance on his evidence. G G H 266. Mr Cao submits that the evidence of Sgt 34232 in regards to H the metadata in Annexes 1-3 is of no probative value in proving that any I I of the impugned child pornography files had been opened/viewed by the J defendant137. J K K 267. Having carefully considered the evidence of Sgt 34232 and L WPC 15499 summarised earlier, in particular the testimony of Sgt 34232 L that the access time in Annex 1 may be affected in three different ways; M M Sgt 34232 agreed in cross-examination that from just looking at the N access time in Annex 1 it was not possible to tell if any of the files had N been opened or viewed by a human being; the playing of a video did not O O change the modified time and that he was not clear whether the antivirus P programme installed on the computer could have accessed the files when P scanning for viruses; Annex 2 has no child pornography files138 and that Q Q Sgt 34232 was not clear why in Annex 3 the modified time in most files R was later than the access time and that some programme might have R opened the jump lists, I do not in reaching my verdict rely on the S S 136 See §§35-42 of the Defendant’s closing submissions. T T 137 See §§35-61 of the Defendant’s closing submissions. 138 See cross-reference folder, exhibit P31. U U V V  68 A A B B modified and access times in Annexes 1-3 to show that the defendant had C viewed any of the child pornography. C D Child pornography D E E 268. As stated already on a charge under section 3(3) of the F Ordinance the prosecution must prove beyond reasonable doubt that the F photos and video clips subject of the charge are child pornography within G G the definition of section 2 of the Prevention of Child Pornography H Ordinance and that the defendant had control of and knowledge of the H existence of the photos and video clips on the computer but not that the I I defendant knew they were child pornography or that he had opened the J files. J K K 269. Admitted in evidence is that on 22 November 2016 12,275 L photos and about 2,793 videos, including the 4,738 photos and 931 video L clips containing the child pornography particularised in the charge, were M M stored in the computer and that all depict real children under the age of 16 N years139. N O Control of and knowledge of the existence of the photos and video clips O on the computer P P Q Control Q R 270. Admitted in evidence is that the defendant was the owner of R the computer (exhibit P1) 140 . In the video recorded interview, the S S T 139 T See §§1-4 of the amended second admitted facts, exhibit P28A. 140 See §2 of the admitted facts, exhibit P28. U U V V  69 A A B B defendant admitted that the computer belonged to him (counters 131-144) C and that he was the one who mainly uses the computer (counters 157- C 160). In evidence the defendant said the computer was his and that he D D was the main user of the computer. E E 271. I accept the evidence of Sgt 34232 that the computer name F was DAVID-PC and the administrator was also David with the path F C:\Users\David141. G G H 272. The defendant’s full name is Robert Miles David Reese. In H cross-examination the defendant agreed he opened the account in the I I name of DAVID and that he used the given name David following the J family tradition to use the third given name. J K K 273. Admitted in evidence is that on 22 November 2016 12,275 L photos and about 2,793 videos, including the 4,738 photos and 931 video L clips containing the child pornography set out in the charge sheet, were M M stored in the computer142. N N 274. Admitted in evidence is that the 4,738 photos and 931 video O clips containing the child pornography referred to in the charge are O contained within the 2,572 files examined by Sgt 34232143. P P Q 275. I accept the evidence of DPC 5517 that when he examined Q the computer in the house he found video clips suspected to be child R R pornography in the incoming folder of E: drive 144. S S 141 See §127. T 142 T See §§1-4 of the amended second admitted facts, exhibit P28A. 143 See §2 of the sixth admitted facts, exhibit P28D. U U V V  70 A A B B 276. I accept the evidence of Sgt 34232 that the file path of all C 2,572 files was E: drive with the files located in E:\Incoming and C 145 E:\Download, save for files 2534-2572 which were in C: drive ; and D D that none of the files were deleted meaning they existed on the computer E and did not have to be recovered by forensic software 146 . In cross- E examination the defendant accepted that none of the files were deleted. F F 277. I am satisfied so I am sure the only inference to draw is that G G the defendant had control of the computer and the 4,738 photos and 931 H video clips containing the child pornography stored in the computer. H I I Knowledge of the existence of the photos and video files on the computer J J 278. I accept the evidence of Sgt 34232 that the 2572 files were K K created between 2011 and 2016, none of the files were deleted; user L David had used keywords to search for pornographic files and used L 147 eMule to download part of the files . M M 279. Under caution and in the video recorded interview the N N defendant admitted downloading videos by using eMule; using search O words such as “Russian” and “Jap” and that he had watched some of the O videos. P P Q 280. The defendant testified that he installed the software eMule, Q searched for pornography by using keywords such as “Japan” and R R “Russian” and selected all the files that popped up in the search window S 144 S See §§63-64. 145 See §127. T 146 T In cross-examination the defendant accepted that none of the files had been deleted. 147 See §§130, 142 & 157-159. U U V V  71 A A B B before pressing the download button. In cross-examination the defendant C accepted that the files were created between 2011 and 2016 and that none C were deleted. D D 281. In his evidence the defendant said that because there was no E E password anyone could access and use the computer. In cross- F examination when asked if he accepted that he alone downloaded all the F files in Annex 1 the defendant said that because the computer was kept in G G the living room and was freely accessible he could not ascertain that he H was the one who downloaded those files. H I I 282. When asked by Mr Percy if he accepted he was the only J person who used eMule to download pornography, the defendant repeated J that because over the years the computer was in the living room without a K K password, freely available for anyone to access, he could not with any L certainty say he was the only one. L M M 283. Mr Percy also cross-examined the defendant about the search N keywords in Annex 4 148 . The defendant said that he never made the N searches using search keyword “pthc”. When Mr Percy asked the O O defendant whether because the computer was left in the living room P without a password he was claiming someone unknown to him had P entered the living room and used the keyword “pthc”, the defendant Q Q answered that the computer had been in the living room over a long time, R many years and had even been out for repairs maybe a couple of times. R S S T T 148 The defendant was asked about search keywords nos. 1, 2, 3, 10 & 17 (“german pthc”, “pthc jap”, “french pthc”, “pthc” and “russian”). U U V V  72 A A B B 284. I find inherently improbable that a visitor to the house used C the computer and without anyone knowing secretly downloaded child C pornography or any pornography and left the pornography on the D D computer. Equally, I find inherently improbable that if someone repaired E the computer they would download child pornography or any E pornography and leave the pornography on the computer. F F 285. I am satisfied full weight is to be attached to the admissions G G in answer to caution and in the video recorded interview that the H defendant downloaded videos by using eMule; used search words such as H “Russian” and “Jap” and that he had watched some of the videos. I I J 286. In cross-examination the defendant said he was not aware of J anyone else downloading pornography of any sort onto his computer; he K K was not suggesting his wife or children downloaded the files and that his L wife was not interested in pornography, he did not think his children were L interested in pornography and that he was the only person in the house M M interested in adult pornography. N N 287. I reject anyone else downloaded the pornography, including O O the child pornography, onto the computer. I am satisfied so I am sure the P only inference to draw is that the defendant downloaded all the P pornography and was aware of the existence of the photos and video files Q Q on the computer. R R 288. Having carefully considered all the evidence I find I am S satisfied so I am sure that the prosecution has proved beyond reasonable S doubt that the defendant was in possession of the child pornography, the T T U U V V  73 A A B B defendant having control of and knowledge of the existence of the photos C and video clips on the computer. C D 289. If I am wrong and cannot reject that others may have used D the computer and downloaded pornography, including the child E E pornography, the question to ask is does this stop the inference being F drawn that the defendant was in possession of the child pornography? F G G 290. In the Scottish case of Harris v HM Advocate, the defendant H sought to incriminate his girlfriend for the presence of indecent H photographs of children found on his computer. The Court of Appeal I I held that more than one person might have access to the material and J therefore knowledge and control149. Similarly in HKSAR v Justin Yves J Herbonnet the court held that the fact others may have access to the K K computer did not stop the inference running150. L L 291. Even if someone else used the computer and downloaded M M pornography, including child pornography, taking into account that the N computer belonged to the defendant; the defendant was the main user of N the computer; no one else in the house was interested in pornography and O O the files had been downloaded between 2011 and 2016, I am satisfied so I P am sure that the only inference to draw is that the defendant was in P possession of the child pornography, the defendant having control of and Q Q knowledge of the existence of the photos and video clips on the computer. R R S S T 149 [2012] HCJAC 5 at §§40-42. T 150 [2006] 1 HKLRD 862 at §§ 12-15. U U V V  74 A A B B Statutory defence C C 292. The defendant relies on the statutory defence in section 4 (3) D (c) of the Ordinance that he had not seen the child pornography and did D not know nor suspect it to be child pornography. A defendant is taken to E E establish any fact that needs to be established for the purpose of a defence F under subsection (3) (c) if (a) sufficient evidence is adduced to raise an F issue with respect to the fact; and (b) the contrary is not proved by the G G 151 prosecution beyond reasonable doubt . H H 293. In HKSAR v. Ng Po On152 Ribeiro PJ explained the nature of I I an evidential burden as follows:153 J J “An evidential burden stands in contrast to a reverse K persuasive burden. It does not require the accused to establish K anything as a matter of proof. An evidential burden arises L L where the defendant wishes to put in issue some matter that is potentially exculpatory while the prosecution continues to bear M M the persuasive burden throughout. In such cases, there must be N evidence supporting such exculpatory matter which is N sufficiently substantial that it raises a reasonable doubt as to the O defendant’s guilt. Unless such reasonable doubt is removed, the O prosecution fails to prove its case. If, on the other hand, the P P accused fails to adduce or point to any evidence on the relevant issue or if the evidence adduced is rejected or is not sufficiently Q Q substantial to raise a reasonable doubt, the potentially R exculpatory matter places no obstacle in the way of the R prosecution proving its case beyond reasonable doubt. An S S 151 See HKSAR v Justin Yves Herbonnet [2006] 1 HKLRD 862. T 152 T (2008) 11 HKCFAR 91. 153 At §27. U U V V  75 A A B evidential burden, functioning in this manner, is wholly B consistent with the presumption of innocence.” C C D 294. Later in the judgment Ribeiro PJ went on to add:154 D E “It must be emphasised that an evidential burden is not E something nominal or illusory. It requires the defendant to F F adduce or otherwise be able to rely on evidence which is sufficiently substantial to raise a reasonable doubt which the G G prosecution must negative if he is to be convicted.” H H 295. In R v Lambert, Lord Hope of Craighead put this point as I follows: I J J “If the evidential burden were to be so slight as to make no difference – if it were to be enough, for example, for the accused K K merely to mention the defence without adducing any evidence – L important practical considerations would suggest that in the L general interest of the community the burden would have to be a M M persuasive one. But an evidential burden is not to be thought of as a burden which is illusory. What the accused must do is put N N evidence before the court which, if believed, could be taken by a O reasonable jury to support his defence.” 155 O P 296. This passage was also quoted in HKSAR v Hung Chan Wa156. P Stock JA giving the judgment of the court said that the burden may be Q Q R R 154 At §§72 & 73. S 155 It is a defence to possession of indecent photographs of a child contrary to section 160A of the S Criminal Justice Act 1988 and section 52A of the Civic Government (Scotland) Act 1982 for the T defendant to prove (not an evidential burden as in Hong Kong) that he had not himself seen the T photograph and did not know, nor had any cause to suspect, it to be indecent. 156 [2005] 3 HKLRD 291. U U V V  76 A A B B discharged regardless of the quarter from which the evidence derives but C is not discharged by the mere mouthing of words by an accused. C D 297. Having rejected the defendant’s evidence, I find that the D defendant has failed to adduce sufficient evidence to raise an issue with E E respect to the fact that he had not seen the child pornography and did not F know nor suspect it to be child pornography. I have nevertheless F considered whether the prosecution can prove the defendant had viewed G G the child pornography or knew or suspected child pornography was on H the computer. H I I 298. I do not find credible the defendant’s answer in cross J examination that what he meant by viewing the files was that on the rare J occasions he would go into the incoming folder he would probably just K K select the very first file, whatever that may be, by pressing enter and L probably would not even look at the file157. L M M 299. I am satisfied that in answer to caution and in the video N recorded interview the defendant was admitting he downloaded the child N pornography and that he had viewed some of the child pornography albeit O O rarely. I am satisfied in answer to caution when the defendant asked for P a chance and in the video recorded interview said he was sorry, he was P asking for a chance and saying he was sorry for downloading child Q Q pornography which is unlawful and not sorry for downloading adult R pornography which is not unlawful. I am satisfied full weight is to be R attached to the defendant’s admissions. S S T 157 This was towards the end of cross examination when Mr Percy asked the defendant why, having T gone to the trouble of selecting files and downloading the files, he did not review what he had downloaded. U U V V  77 A A B B 300. I do not find credible the defendant’s evidence that he never C imagined any of the files were child pornography and did not suspect any C of the files to be child pornography. In the video recorded interview, the D D defendant said he used search words like “Jap” (see counters 352-355). E In Annex 1 “Jap” is found in the file name of at least 108 child E pornographic videos158 of which the names of 51 files specifically refer to F F children under the age of 16159. G G 301. I agree with Mr Percy that given the frequency of the English H names amongst the files downloaded with references to children or H preteens it could not have escaped the user that child pornography was I I 160 present on the computer . J J 302. I am satisfied the prosecution have proved beyond K K reasonable doubt that the defendant knew or suspected child pornography L was on the computer and had viewed the child pornography. L M M 303. In reaching my verdict I have carefully considered the N submission of Mr Cao that it is inherently improbable that the defendant N would knowingly download child pornography onto the computer to be O O P P Q Q 158 This is best checked by looking at the cross-reference folder, exhibit P31. 159 The file numbers taken from the cross-reference folder, exhibit P31 are numbers 11, 19, 22, 24, R R 85, 86, 87, 91, 111, 118, 120, 194, 200, 205, 209, 345, 487, 519, 520, 523, 528, 562, 565, 581, 602, 621, 634, 635, 636, 637, 639, 645, 664, 673, 674, 678, 679, 686, 687, 688, 691, 699, 704, S 711, 715, 717, 722, 724, 725, 730 and 738. S 160 See §§34 & 35 of the prosecution final address. T The names of all the files are contained in Annex 1 to Sgt 34232’s witness statement. Admitted T in evidence is that the 931 video clips containing child pornography are accurately cross- referenced with Annex 1 in exhibit P31. See §3 of the sixth admitted facts, exhibit P28D. U U V V  78 A A B B viewed in the living room of his residence, especially when the computer C could be accessed by his wife and teenage children 161. C D 304. Having downloaded pornography over a period of at least D five years the defendant was clearly not concerned whether his wife or E E children would see what he was downloading. This submission does not F cause me to doubt the findings I have made. F G G 305. I have carefully considered everything said by Mr Cao both H individually and collectively. Nothing said by Mr Cao causes me to H doubt the findings I have made. I am satisfied so I am sure there are no I I material and significant discrepancies, improbabilities or omissions in the J evidence, which cause me to doubt the findings I have made. J K K 306. I am satisfied so I am sure the prosecution has proved all the L elements of charge beyond reasonable doubt. The defendant is convicted L as charged. M M N N O O P P (D. J. DUFTON) District Judge Q Q R R S S T T 161 See §§64, 65 & 72 (c) of the Defendant’s closing submissions. U U V V