What Counts as Possession of Child Pornography?
When law enforcement finds pornographic content featuring a minor on a person’s computer, the first step towards prosecution is proving possession of the computer. The next is proving the person knew he or she possessed the file in question. Many factors come into play when law enforcement attempts to establish purposeful possession.
Temporary Internet Files
Every time a new web page is viewed, many of its images and videos are downloaded to a folder on the hard drive. These temporary internet files, or cache files, are used by the computer to load web pages more quickly in the future. Depending on the amount of internet use and the space allocated for these files, these images and videos can remain on a hard drive for months or years.
If a person regularly visits pornography websites, the cache folder will be filled with associated images and videos. If any of these files depict a minor engaging in a sexual act, the computer’s owner will be in possession of child pornography.
Of course, if someone browses the internet using private windows or tabs (known as “Incognito” on Chrome or “Private Browsing” on Firefox), it is less likely that image or video files will be saved to the hard drive. In this case, it is still possible to identify frequented websites by associating the IP address at the web server.
Many people believe emptying the “recycle bin” or “trash can” on a computer completely and permanently deletes any files within. But these files aren’t really erased. Windows (and other operating systems) simply deletes the “pointer” telling the computer where the file’s data begins and ends. The system considers the file to be gone, but until new data is written over the previously used sectors, the file is still recoverable.
These files are typically not visible to the user and can only be accessed using special software. EnCase is a forensics program used by law enforcement to examine hard drives. Another is Forensic Toolkit (FTK), which can locate deleted emails or files and crack encryption. FTK can mount devices, save an image of a hard disk in one file, and recover all deleted files still available. If a person under investigation is using a previously-owned computer or lent it to friends at any time, he or she may be unaware of the existence of many “deleted” files.
Accidental Downloading or Viewing
It may seem unlikely, but accidental downloading of child pornography is quite common. The internet is saturated with unlawful pornographic images and innocent people stumble upon them every day. When someone is charged with possession of child pornography, how does a criminal defense attorney prove the possession is accidental?
Accidental downloading occurs most often during the use of peer-to-peer (P2P) file sharing programs. When someone downloads music or videos through BitTorrent, Gnutella, or other P2P networks, a folder is created on his or her hard drive containing the downloaded file. Other users may access this folder when requesting to download the same content. This is cost-efficient, as P2P file sharing often does not require a dedicated server, but it can also lead to accidental download of child pornography, as users can name files inaccurately or erroneously place the wrong file in a shared folder.
When an illegal pornographic file is downloaded, a user will usually try to delete it. As discussed above, however, deletion does not necessarily remove it from the hard drive.
Proving Possession Is Accidental
Using software like EnCase allows a computer forensics expert to retrace the steps that led to a file being downloaded. Often, a link can be found between innocent search terms and the name of the illegal file. If the file was acquired through a P2P network, an expert can survey the shared folder and find that the contents are otherwise legal.
Every file contains properties a defense lawyer can use to tell a story. These properties will indicate when the file was created (or downloaded), when it was last changed, and when it was last accessed. If an expert finds that the file was created and last accessed at the same time, it is quite possible the user was unaware of the file because it was never accessed after the initial download. If the file was last accessed within an hour of the creation timestamp, this suggests the user deleted it shortly after download.
Most importantly, if a file was created or accessed at a time when the user did not have access to the computer, it is very unlikely he or she was ever aware of it.
Looking beyond file sharing, the retrieval of internet browsing history can establish a user’s online habits and create a timeline of events leading up to an accidental download. This can be very helpful if an alibi needs to be established or the defense is that another user downloaded and viewed the file.
Berry Law has been defending the rights of clients for over 50 years. If you are under investigation for possession of child pornography, please contact our team of defense attorneys today.