HKSAR v. Sze Hang, Tony

DCCC 204/2015

IN THE DISTRICT COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

CRIMINAL CASE NO 204 OF 2015

----------------------

----------------------

---------------------------

Reasons for Verdict

---------------------------

1.The defendant, Tony Sze, faces a single charge of possession of child pornography contrary to Section 3(3) of Cap 579. I have decided the defendant will be convicted of that offence.

2.The introduction is as follows.  The defendant is an inspector of police.  At the time of the offence he was serving in an administrative position at North Point Police Station.

3.In November of 2014 during the Occupy Central disturbances, police investigated the posting of the details of serving police officers on a Facebook site.  The nature of the post showed that the details had been “hacked” off a police computer.  The materials were posted by a poster called “Tonic Shepherd”.  The investigations led to the defendant as he had accessed the details of those police officers from his police computer, subsequently taking a photograph of the relevant page and then posting details under his “Tonic Shepherd” Facebook account.

4.The defendant was interviewed under caution.  As part of the investigation, a Lenovo computer and a hard disc were seized from the flat in Conduit Road where he lived with his wife and baby son.  Following a forensic investigation of the computer and hard disc (which I will refer to as “the devices”), various child pornography material was discovered.  

5.The defendant says that he was not aware of the existence of such materials on the computer or hard disc.  He says he is not responsible for their presence.  In his defence, he proposed certain possible scenarios whereby such material could have been placed on these devices, which included the possibility that the police themselves had caused those materials to be placed on the devices to discredit him.

6.The issue in its broadest form to be decided is whether at the material time, and that is 1 December 2014, the defendant was in possession of the relevant child pornography materials.

7.The background is as follows.

8.On 28 November 2014, the details of two police officers, captured by way of a screenshot of the police directory record, were posted on the Facebook page of a group calling itself the “Anti-Occupy Central Identification Group”.  The poster of the screenshots went by the user name “Tonic Shepherd”.

9.Investigations led police to the defendant’s police computer at the MESU office at North Point Police Station.  The computer had been used to access the directory and to access the relevant entries.  The unique user identity of the defendant had been used to access the directory. 

10.A party of police officers from the Technology Crime Division went to North Point Police Station to collect evidence and to invite the defendant to assist them in their investigation.

11.At 1742 hours on 1 December 2014, the party of police officers entered the defendant’s office.  Defendant was not arrested. Neither was he cautioned at that stage.  A preliminary search of the defendant’s office was conducted.  A Sony mobile phone of the defendant was examined.  It was found that the Facebook account on the phone was logged on to that of the user account “Tonic Shepherd”.

12.Later that evening, between 1910 and 2000 hours, a search of the defendant’s home at Buxey Lodge, Conduit Road, was conducted. The Exhibit Officer, PC2513, seized a Lenovo notebook computer (that is “the Lenovo”) and a Samsung external hard disk (that is the “HD”).  The Lenovo computer had two user accounts:  “Guest” and “Tony Sze”.  The “Tony Sze” account was password protected.  The defendant himself deactivated the password at the request of the investigation officers.

13.Subsequently at the police station, PC7284 conducted a forensic examination of both these devices and discovered various child pornography materials in the “Tony Sze” account on the Lenovo and on the HD.  The material was initially discovered on the late evening of 1 December 2014 and then fully unpacked over the next few days.

14.Prior to the discovery of the child pornography, the defendant was interviewed in respect of the dishonest use of a computer in respect of the “Tonic Shepherd” account posting of the police directory entries.  The defendant made a full admission to that offence.

15.On the basis of this admission and other evidence, the defendant has been charged with the dishonest use of a computer, contrary to section 160(1) of Cap 200.  He has subsequently pleaded guilty to this offence. 

16.Whilst being interviewed under caution on 1 December 2014 for the suspected offence under section 160(1) of Cap 200, the defendant was asked about all digital and computing devices found at his home.  At that time, he admitted that the Lenovo and the HD were his and had been used by him.

17.The subsequent examination of the Lenovo revealed a total of 23 videos and one child pornography photo under a password-protected file path “Tony Sze”.  The HD revealed 231 videos and two child pornography photographs under a file path of “Tony”.  In total, the final figure is 248 video files and two photograph files, as charged.

18.The defendant was subsequently interviewed under caution for a second time on 8 December 2014 in respect of the child pornography found on the two devices.  The defendant denied knowledge or possession of those materials.

19.The prosecution case was that the Lenovo and HD were found at the defendant’s home, he admitted he was the main user of the devices, that the defendant must have known that child pornography was stored on the devices, that the material was not inserted onto the devices by the police for any reason whatsoever or by any other person.

20.At trial, the prosecution called six witnesses. A large amount of evidence is agreed.  The defendant challenged the admissibility of the two video recorded interviews.  That issue was resolved in favour of their admission following a voir dire.

21.In summary, PW5 who was Chief Inspector of Police Lau gave evidence mainly in relation to the voir dire issue, the search of the defendant’s office locker and home.  He denied any impropriety in his conduct.  He was himself unaware of any prior disciplinary action against the defendant till told by his superior.  He considered the matter (that is, the section 160(1) matter) to be a criminal case from the outset.  He said the laptop and HD had initially been found on the desk in the living room and then moved to the dining table for examination and photography.

22.Sgt 12564 had been with CIP Lau.  He had supervised the searches, conducted the two video recorded interviews of the defendant.  PC7871 had examined the devices at the defendant’s home.  He said the Lenovo was switched on.  There were two accounts:  Guest, which was not locked with a password, and Tony Sze, which required a password to log in.  He asked the defendant to input the password, which he did.  He photographed the devices, save another Lenovo, which the defendant said belonged to his wife.  This computer was not seized.  No child pornography was seen at this time.

23.PW8, PC2513, was in fact responsible for the searches.  He collected the two devices, placed them in bags, kept them in his custody.  He had handed the exhibits to the sergeant for use in the first video recorded interview, VRI.  He had handed the devices to PC7284 for forensic examination on the same day.  Following examination, they had been returned to him and kept in a locked cabinet. 

24.PC7284 had received the Lenovo and HD for forensic examination.  He had acquired the forensic image.  He had kept the devices in a locked and secured cabinet.

25.The examination of the forensic image had been conducted by PC7284.  Initially, he had misrecorded the last login time of “Tony Sze” as 19.25.27 on 2 December 2014.  In fact, the time stamp was almost 24 hours ahead.  PC7284 said he had checked the login time against a watch, but this could not be correct.  PC7284 had later conducted what was called a “file system analysis”, by which he purported to establish that child pornography materials had existed on the Lenovo before the most recent Windows update in November 2014, an approach that was also adopted by another prosecution expert witness, SIP Lam.

26.PC7284 also evidenced access to child pornography materials by way of a link file created at various times between 27 May and 20 October 2014.  He showed the files had been executed by the Lenovo.

27.SIP Lam, another expert, discovered that some child pornography files had been downloaded on 27 September 2014 through P2P software, uTorrent - four files being created, he said, between 1700 and 1900 hours on that day.  He said the child pornography files had also been opened 11.49 am on 2 October 2014, 11.55 am on 2 October 2014, 9.25 am on 4 October 2014.  The files were downloaded, he said, by uTorrent software.  However, such software did not need the user to be present to control the computer.

28.Both witnesses said they had used what is described as the LSN/USN method in reaching these conclusions.

29.In addition, the prosecution relied upon admissions made in the defendant’s first video recorded interview conducted before the discovery of the child pornography materials on the Lenovo and HD that the laptop was owned by him and that he used the Lenovo at home, that he had been in possession of the HD.

30.In the second VRI, the defendant said that the password to the Lenovo was last changed in May or June of 2014, that his wife knew the password was changed.  He had mentioned it to her, but believed she had forgotten it.  The laptop was used by him only.  He and his wife used different laptops.  He was not aware that anyone else had used the Lenovo.

31.In the defence case, on both the general and special issue, the defendant gave evidence.  Naturally, he is a person of clear record.  The defendant joined the police in 2008/2009 as an inspector.  He bought the Lenovo computer in 2009.  He said it (the Lenovo) was used by “all of us in the household” without a password.  He met his wife in 2009.  The HD belonged to her.  She had bought it before they met to store details for her parents’ company’s tax returns.  At Buxey Lodge, both he and his wife used the Lenovo.

32.Initially the defendant had said that a password was set on the Lenovo because many people came to their house after the birth of their son.  Later he said this was because he was going to take the Lenovo to work. 

33.He had been subject to disciplinary proceedings by the police.  Initially, it was because he posted something concerning the schoolteacher Alpais Lam on his Facebook site.  He also posted a note about the June 4 vigil.  He said this caused a disturbance amongst some colleagues who took exception to his opinions.  

34.He received offensive messages through a WhatsApp account after the commencement of the investigation of the “Tonic Shepherd” postings.  He also received offensive phone calls.  He had wanted to be a frontline officer, but after his disciplinary troubles he was eventually posted to MESU at North Point as an administrative post.  He believed his political expressions led to this move to take him away from frontline policing.

35.During Occupy Central, he was part of a fall-back platoon as a commander.  He was deployed as part of the Solar Peak operation.  He posted on Facebook a picture of a lunchbox provided to officers on duty.  It contained raw meat.  He was immediately removed from the frontline operation and a disciplinary inquiry was commenced.

36.On 1 December he had been interviewed in respect of his posting screenshots on that Anti-Occupy Central website.  He said CIP Lau told him he could be forced to co-operate by them, involving, as it were, disciplinary proceedings.  If he did not co-operate, he would be arrested immediately. 

37.Later, he was told there would be a search of his flat and his computer devices would be seized.  He said he shared a computer, the Lenovo, with his wife.  CIP told him that, to avoid his wife being questioned, he should say the computer was his and was used by him.  He was told he should co-operate.  If he did so, the investigation might come to nothing.

38.The defendant decided to co-operate, as he considered that the matter might remain a disciplinary matter, and to admit to possession of the Lenovo to avoid his wife being involved.  He cared for his wife as she was still fragile following the birth of their son. 

39.By the time of the second interview, he realised he was facing a more serious charge and it could no longer just be a disciplinary matter.  He wanted to exercise his right to silence, but also did not want to give answers that contradicted his answers in the first interview.

40.In respect of the computer and HD, he said he had used the HD after they started to live at Buxey Lodge.  Before that, it had been at his wife’s home.  His wife continued to use it for her parents’ business.  The HD had been repaired.  When they moved to Buxey Lodge, the Lenovo did not have a password.  The Lenovo was used by himself, his wife and his brother-in-law.  The brother-in-law would stay at Buxey Lodge on occasions.  His wife would also use the Lenovo for web surfing.  He would use another tablet computer for web surfing.  He considered the Lenovo to be co-owned by himself and his wife.

41.The defendant had said that a password had been set on the Lenovo because in about May or June 2014 a lot of people had visited Buxey Lodge, so a password had been set to the “Tony Sze” account to prevent visitors prying into confidential Force documents which were on the computer. Later, the defendant said the reason for changing the password had been because he was taking the Lenovo to work and his wife had suggested a password because it would preserve the privacy of family things stored on the Lenovo.

42.The defendant gave evidence of his activities on certain days to show he could not have opened the files on the Lenovo computer on those days as he was occupied.  This evidence was in response to the prosecution evidence about the existence of the link files.

43.On 22 September, he was on paternity leave after taking the baby out.  The baby became unwell in the evening.  The baby was taken for medical treatment and was hospitalised from 23 to 26 September.  He accordingly did not use the Lenovo on the evening of 22 September or the morning of 23 September.

44.During Golden Week in October, his brother-in-law had come to stay.  He had used the Lenovo during that period. 

45.The defendant went into some detail on this matter.  For instance, he claimed that his brother-in-law had a row with his parents and wanted breathing space, so he could not stay on the Mainland or his parents’ house at Tseung Kwan O.  The brother slept on the sofa and they stayed up at night drinking.  Later, evidence from the Immigration records showed the brother-in-law had in fact not ever been in Hong Kong during this period. Defendant, when confronted with this, said he may have made a mistake. 

46.On 27 September, the defendant went running in the afternoon with his wife’s Uncle Kenny.  He was with Uncle Kenny until 8 pm and did not use the Lenovo laptop.

47.On 26 May, he had attended hospital; he was unwell.   He said he could not have accessed the files on the Lenovo that day between 11.06 and 11.12, as he was in hospital.

48.On 3 December, after his first interview on 1 December, he was forwarded a WhatsApp shown at tab 8 of the defence folder. The WhatsApp appeared to the defendant to show inside knowledge of the investigation he was currently under and said he would be going to prison.  He believed that this was a leak from within the investigation. 

49.He said he had no idea how the child pornography had got onto the Lenovo computer or the HD.  As far as the HD, he had 16,000 files on the HD; his wife had 20,000.  The laptop files were shared between himself and his wife. 

50.Besides the defendant, the defence called an SIP Chan who testified to the offensive WhatsApp in relevant WhatsApp groups that concerned the defendant.  He also gave character evidence for the defendant.

51.A computer expert, Dr Ricci Ieong, was called largely to establish at trial that file system analysis could not be used to establish the sequence and date upon which files were placed on the computer. Furthermore, the information present in the directories could be falsified. 

52.Dr Ieong in his first report did observe that the source of the child pornography could not be determined, that, although uTorrent was installed, no active download or upload activity could be identified.  The evidence could not show by which network channel (ie e-mail, Internet browser or uTorrent) had the materials been transferred from their source. 

53.Dr Ieong disputed the use of file analysis theory to determine the sequence of the file directories and disputed its use by PC7284 and Inspector Lam to reach the conclusions that they had made about the link files and use of uTorrent to create the transfer of those files.

54.The defendant’s wife was called to deal with her use of the Lenovo and HD.  She said the HD had been bought in August 2011 for her family company to store files and business records.  A receipt for the HD was produced. 

55.She said both herself and the defendant used the computer and that relatives and house guests would use the computer freely. 

56.She confirmed she had accessed the Lenovo computer in November 2014 when she was pregnant.  She had not seen any child pornography.  Earlier on she had checked the Lenovo to see if the defendant was conducting an extra-marital affair.  She had placed both uTorrent and eMule software on the Lenovo to assist in downloading music. 

57.She also confirmed the baby’s illness between 22 to 26 September 2014; the defendant’s sick leave on 26 May 2014. 

58.She also said the Lenovo was generally kept on and a password was not needed. 

59.I also heard from Uncle Kenny who confirmed he had arrived at Buxey Lodge on 27 September 2014 at about 1630 hours for a trail run, stayed till about 2030 hours.

60.In this trial, the defendant faces a single charge of possession of child pornography.

61.Prosecution must prove beyond reasonable doubt that, firstly, defendant had in his possession (that is, his custody, care and control) the child pornography particularised in the charge; and, secondly, he had knowledge of the child pornography in his possession.

62.The defendant is a person of clear record; relevant to consideration to his propensity to commit an offence of this nature; credibility and reliability of any testimony given by him.

63.On the special issue, two bases were submitted for the court to exclude the two video recorded interviews made by the defendant.  The resolution of these issues is subject to the same burden and standard of proof as the general issue, namely, proof beyond reasonable doubt, the burden being on the prosecution at all times.

64.Firstly, it was said that the first statement was given involuntarily, particularly that it was obtained was threats and inducements held out by CIP Lau, a person in authority, at the time of the initial investigation into the first charge, while inquiries were being conducted with the defendant at the MESU offices at North Point on 1 December 2014.

65.Secondly, the court should exercise discretion to exclude both VRIs on the ground of fairness, particularly that matters admitted in the first statement were only said by the defendant after he was cautioned for the offence under section 160(1) of Cap 200, when, in fact, it transpired those matters admitted would become relevant and used on the later discovery of child pornography on the Lenovo computer and the HD, which occurred after the completion of the first interview.

66.Although the defendant was properly cautioned before the second VRI, the absence of caution for possession of child pornography before the first interview meant the defendant was not able to exercise an informed choice before the first interview and, under the rubric of discretionary exclusion for fairness or unfairness, the first VRI should be excluded, as should the second VRI, which contained admissions relevant to the charge of child pornography, namely, admission to the ownership of the Lenovo computer which was made in the first interview.

67.The allegation of threats, inducements was against particularly CIP Lau, who was tasked to investigate the section 160(1) offence.  Initially, CIP Lau was alleged to have said to the defendant, “I think you ought to know what you have done and later it’s your choice whether you co-operate with us, but if you do not we can use the police disciplinary procedures and you will have to answer our questions.  We won’t arrest you as long as you co-operate with us.”

68.The defendant was asked about his home computer.  The defendant allegedly said there was a computer at home used by the family.  CIP Lau said that if that was the case they would have to all be questioned.  CIP Lau suggested the defendant simply admitted that he used the computer and the phone to keep his wife and family out of it.  CIP Lau also allegedly said, “If you tell us more, make admission to assist our investigation, we might not press charges against you.”  Defendant took part in the first interview as a result of these utterances and admitted to being the user of the Lenovo computer as a result of this.

69.The specific inducements and threats were:  not to arrest the defendant; not to question his wife or family members; and, thirdly, to facilitate the treatment of the allegation under Section 160(1) as a disciplinary matter if the defendant co-operated.

70.In support of the defendant’s evidence, the defence pointed to the fact the defendant was never arrested on 1 December 2014; also, that he was only cautioned prior to commencement of the first VRI. No caution was administered to the defendant throughout the defendant’s office and home when they were searched in the afternoon and evening of 1 December 2014.

71.Thirdly, that during the house search the defendant’s wife’s computer was not seized or even inspected although it was present in the defendant’s home in Buxey Lodge.  This was at a time when no photographs similar to those posted by “Tonic Shepherd” on Facebook had been found on any of the devices inspected by the police at the defendant’s home or office. 

72.These issues, of course, require a factual resolution.  CIP Lau denied ever saying any of the matters attributed to him by the defendant, and the defendant himself evidenced those matters during his testimony on the special issue.

73.In my resolution of this issue, I considered that CIP Lau and other police officers present had given truthful and reliable evidence.  There was a general denial by him and others of the conversation alleged by the defendant when put to him.  At the time of CIP Lau’s entry into the defendant’s office, CIP Lau said this was only a criminal investigation. He was in possession of evidence that the defendant’s computer and the defendant’s account had been used to access the relevant directory at the relevant time.

74.Shortly after the defendant surrendered his Sony mobile phone, CIP Lau was aware the defendant’s phone logged onto the Facebook account of “Tonic Shepherd”, from which 16 photographs had been posted.  It would seem unnecessary for CIP Lau to obtain the defendant’s co-operation at this point, as the evidential case against the defendant was by this time very strong.  Certainly, there would be no need for CIP Lau to consider or offer inducements to the defendant to obtain his co-operation. 

75.The only missing piece was the finding of the photographs on one of the defendant’s devices.  The defendant, however, did evidence this by his own admission during the first video recorded interview.

76.CIP Lau determined he did not need to arrest the defendant nor was there any need to caution him until the formal interviewing process began.  These are operational decisions.  They were not incorrect.  It cannot be inferred this was done to set the defendant’s mind at rest as to the eventual possible disposition of this matter as a disciplinary matter. 

77.I did consider the failure to seize the wife’s computer.  In fact, no investigation was carried on the wife’s computer at all. The officers concerned took the defendant’s word that this item belonged to his wife and took no further action, an attitude that went right to the top, apparently agreed to by the Inspectors Wong and Lau.

78.It is no doubt a procedural oversight and appears to be caused by a deference to the defendant’s position as an inspector. However, I did not see it as illustrative of any agreement not to involve the defendant’s wife in the investigations.  In any event, it is common ground there is nothing of evidential worth to Charge 1 on that computer.

79.I did find CIP’s evidence generally truthful and reliable and consistent with the wider evidence, as I did with the other officers.

80.I could not reach the same conclusion about the defendant’s evidence.  The defendant mentioned that for the first VRI, video recorded interview, he was of the view the matter could be reduced to a disciplinary matter if he co-operated.  This flies in the face of what was happening.  This was a clear criminal investigation.  There is no dispute CIP clearly outlined the offence and his evidence to the defendant at the outset. Before the search of the defendant’s home, they had to meet for a search warrant, could only be issued in context of an ongoing criminal investigation. VRI was conducted with a Pol 153 notified and under caution.  It was clearly a criminal investigation throughout.

81.It is just not credible that a police inspector himself could credibly offer that deal that CIP allegedly offered and considered it to be believable.  I found the defendant’s account not reliable.

82.He had no need to protect his wife as she was not a focus of the investigation and would not be involved.  She was not contacted or interviewed, not because of any agreement, but because she was simply evidentially irrelevant to the investigation.  I find that I rejected the defendant’s evidence on this issue.  I found he was not frank and truthful with the court.

83.I accepted CIP Lau’s evidence on the video recorded interview and rejected the evidence of the defendant.  The statement was proved to be voluntary beyond reasonable doubt.  Nevertheless, the issue of fairness and discretionary exclusion still arose.  Defendant submitted that the admission of VRI, video recorded interview admission, the use of the Lenovo computer and the hard disk, HD, should be excluded on the ground of fairness.

84.In the context of the present charge, the admission in the first VRI to use of the computer can support a charge of possession.  It is said if the defendant knew of that use of that charge, he would never have made such an admission when questioned in respect of the first charge.

85.In support, the defendant relies upon the case of Pang Ho Yin [2010] 3 HKLRD, and the cases referred to in that, where it says:

“...the right to choose whether to speak or to remain silent is denuded of its force if the choice is based on a material misapprehension, created by the circumstances of his questioning, as to the nature of the peril in which, by such answers as he might advance, he may place himself”.

And it says:

“...whether the choice as exercised remained an informed choice once the focus of the investigation had changed”.

86.The difficulty I find with this submission is that in the VRI 1, video recorded interview 1, the defendant had only been cautioned in relation to Charge 1, and in video recorded interview 2, in relation to Charge 2, he was cautioned commencement of that interview.

87.In Pang’s case, there was a failure to caution for the offence which the police believed he had committed when they re-interviewed him.  Thus, the court concluded the judge in exercising a discretion to admit must address what is described as the “true issue” (paragraphs 36 to 38) of whether the defendant’s choice not to exercise his right to silence “remained an informed one once the focus of the investigation had changed”.

88.In this case, in VRI 1, the focus of the investigation never changed.  By the time it did in VRI 2, the defendant was cautioned for the relevant offence prior to commencement of the interview. 

89.I do not believe at this stage that Pang’s case supports the proposition the contents of the first VRI and by analogy the second VRI should be excluded.  It supports the proposition, once the focus of the investigation changes, defendant should be cautioned anew so he can exercise a rational choice, which is exactly what happened here.  In fact, at the time of the first VRI, the police were unaware of the presence of the material.  Therefore, it would have been impossible for the defendant to have been cautioned for the second offence at this stage.

90.It cannot be used to exclude things, I find, said during an early stage of another investigation that subsequently have relevance to another later offence not being investigated at the time.  To do so would only preclude what was voluntary, relevant and admissible evidence.  In any event, it does not constitute any ground for exercising a discretion to exclude this voluntary, relevant, admissible evidence.  I saw no interest of justice would be served by so doing.

91.I now turn to the general issue.

The issues raised by the defence

92.The defendant denied all knowledge of the existence of the materials on the Lenovo laptop and HD before the time when they were seized by the police.  The defendant says he did not know how those materials came to be stored on the Lenovo and HD.  He had never voluntarily admitted that the Lenovo and HD were his. 

93.The defendant attributed the existence of the materials to the following possibilities. 

94.Firstly, other people could have accessed the devices due to the fact that the devices were not password protected and were accessible.  The Lenovo being left on all the time, any visitors to the flat (that included relatives and friends) could have accessed the computer.  The defendant particularly referenced his brother-in-law, who actually had other materials stored on the computer and the hard disk.

95.The second possibility is the investigation officers or other members of the Police Force could have inserted the materials into the devices after their seizure.  The defendant considered that the defendant’s political stance had attracted hostility from within the Police Force and that there was a motive to discredit him.

96.Thus the defendant’s position was that he believed that the child pornography was not on any of the devices when seized by the police.  Therefore he considered that it was possible the police had planted the material. 

97.However, if he was wrong about this, then the presence of those materials must be the result of another person storing them there, that this could have happened as the devices were freely accessible to anyone visiting the flat.  Computer was always on without password activated. 

98.Furthermore, on certain days when certain files were created (that is, the link file), he could not have been responsible, as it would have been impractical for him to have been present to do so.

99.The prosecution’s position is they say:

(a)  that the court can be satisfied that the materials were present on the devices when they were seized from the defendant’s flat at Buxey Lodge;

(b)  that defendant had admitted to ownership and control of the devices in his records of interview;

(c)  that the inference can be drawn that it was the defendant who placed the materials on the devices;

(d)  that the attribution of the placing of the materials on the computer by others was contradicted by the defendant’s statement that he had password protected the computer and it was in any event illogical and unlikely that anyone else would do this;

(e)  his attempt to implicate or blame his brother-in-law was not credible, given the defendant contradicted himself as to whether the brother-in-law was staying at Buxey Lodge in October 2014;

(f)  that the attempt to insinuate that the police had planted the material was said to be desperate. The police had proved a continuity of dealing with the devices that excluded the possibility of tampering by them;

(g)  that they had no motive to frame the defendant;

(h)  that although the defendant had been referred for disciplinary investigation on two occasions it had in no way affected his career. He was allocated to administrative duties because he had an obvious talent for it. This is illustrated by his acting as an ADVC in North Point, a senior position which would only be occupied by a trusted, competent officer;

(i)  that any failure by him to be promoted lay in his failure to pass the necessary examinations.

100.Thus the prosecution say there is no other source from which the materials could have originated, that the defendant had failed to evidentially raise a reasonable doubt in respect of this area.  That being the case, the only available inference of fact from the evidence to be drawn was that the defendant knew about and stored those materials on the devices and he was thereby in possession of them.

101.I deal with the expert evidence.

102.I noted considerable time was spent on what could be described as computer expert evidence, firstly, because an error was made when the critical examination of the Lenovo was conducted in that it was not apprehended that the time record of the computer was running almost 24 hours fast and, secondly, because, after it became apparent there was an allegation of tampering, the prosecution decided to gather further evidence in support of the forensic analysis of USN/LSN numbers to provide a tool by which it was said that all the materials must have been on the computer prior to seizure by police.  The defence contended that this forensic analysis was not reliable.

103.The undisputed evidence in respect of the devices was they were both seized in the living room of the defendant’s home, that the forensic examinations discovered a total of what was eventually 248 videos and 2 photo files containing child pornography.  It was not accepted in respect of the link files they had been executed by the Lenovo.

104.It was accepted that the last login by “Tony Sze” account on the Lenovo was recorded at 19.25.27 + 8 hours on 2 December 2014, that the time stamp was not accurate and should be 19.33.27 + 8 on 1 December 2014.  That was the time when the defendant accessed the computer at Buxey Lodge during the investigation when the defendant deactivated the password. 

105.It was not conceded that various link files had been created at the various times between 27 May 2014 and 20 October 2014 or that these files had been executed by the Lenovo at those times.

106.13 link files were found in the Lenovo allegedly.  Nine link files were found in the HD, and that on 27 September 2014 it was said 37 pornography files were downloaded from around 00.09 by uTorrent, four of which created between 17.00 and 19.00 hours, that, of those files, one CP1 was opened at 11.49 hours on 2 October 2014, CP2 at 11.55 hours on 2 October 2014, CP4 at 09.25 hours on 4 October 2014.  The argument was the file analysis theory could not necessarily support such conclusions.

107.I will deal now with the file analysis theory. This evidence was disputed.  The prosecution witness contended that there are numbers assigned by the operating system to files.  They are assigned chronologically in ascending order, that none of the child pornography files had USN/LSN numbers higher than the last Windows update in November 2014. Therefore, they must have been present before that date.

108.The defence expert said that the use of LSN/USN numbers for this purpose was a new and untried forensic tool.  He evidenced himself and demonstrated the USN/LSN numbers could be created by an experienced operator and inserted without detection.

109.I heard lengthy evidence on this question.  Eventually I was referred to the originator of the file analysis theory, a Mr Carrier.  He describes his theory himself in his own book, where he says: 

“However, he maintains the following prevent the journal (the record of USN/LSN numbers) could provide information about recent changes or charges to the file system, but it is not known how long the entries exist before they are overwritten and, worst of all, it is not known how the file is organised. Therefore, you may be able to find evidence but it may be difficult to explain.”

110.He was certainly right about that.  It would appear the originator of the idea appreciates it is limited in operation. I do not consider it is at present sufficiently developed to be applicable as a forensic tool in criminal hearings where proof beyond reasonable doubt is required.  I find little help in its conclusions and generally disregarded them. 

111.The sequencing of files within and by an operating system is governed by the needs of the system and not by any requirement to create a chronologically accurate record.  The system itself may update and alter files without any human intervention.  The theory at this stage cannot provide forensic certainty and was demonstrated to be inaccurate in a number of instances.

112.I was thus left with the existence of the files on 1 December 2014 on the Lenovo and HD as being the operational computer evidence.  These child pornography materials existed at some point after the forensic examination and image was clearly concluded and available as evidence for me.

113.Now, the question of credibility underlay the salient questions posed by the evidence.  Were the prosecution evidence to be trustworthy, then I could eliminate the possibility there had been tampering with the devices prior to their forensic examination and I could be satisfied that the materials were on the devices at the time of their seizure. Furthermore, if the records of interview were properly obtained, I could be satisfied that the defendant had made certain admissions about the user and use of those devices.

114.The resolution of this issue is, of course, made after hearing all the evidence both from the prosecution and defence.  In particular, when assessing the defendant’s evidence, one must bear in mind his clear record and the impact this has on his credibility and the likelihood of his committing an offence of this nature and the reliability of the testimony he has given.

115.The prosecution called a number of witnesses to give evidence about the integrity of the process by which the forensic image was obtained.  The SGT12564 assisted in the search of the defendant’s home and office.  PC7871 said that PC2513 collected the electronic items, placed them on a table in the dining room.  PC7871 had done an initial examination of the devices and found the Lenovo had the two users:  “Guest” and “Tony Sze”.  “Tony Sze” was set with a password which was cancelled by the defendant in their presence.

116.I noted that this somewhat cursory examination had not led to the discovery of child pornography at that time, even though some of it was behind an icon on the desktop of the “Tony Sze” user.  However, I did not find this particularly surprising, as the officer was not looking for this material and as  inspection was superficial. 

117.PC2513 had seized the devices and taken photographs and the exhibits had been placed on the dining room table for that operation.  From then on, the exhibits had been kept in a safe, save for release to the sergeant for the VRI and PC7784 for acquisition of the forensic image.

118.I found the chain of evidence to the examination of the image was unbroken and the evidence clear, reliable and unshaken in cross-examination.

119.The police officer obtaining the image was criticised about his handling of the exhibits and acquisition of the forensic image.  He had taken charge of the exhibits on the evening of 1 December 2014, checked the clock on the Lenovo and entered a time and date that was erroneous. He said his watch was showing the wrong time as well.  I considered he was confused about this and clearly made an error.  That much was clear.  I did not believe he was mendacious about this issue.

120.He said he made the initial examination between 22.45 and 00.15 on the evening of 1 December 2014 and morning 2 December 2014. It was then that he said he found the child pornography materials.  He said he phoned PC2513 about this.  In fact, in his notebook he recorded finding the materials at 9.45 on 2 December 2014.  He was criticised for recording the matter in this way and it was argued there should have been some form of post-recording of the finding in the evening.  He was also criticised for not mentioning his discovery to PC6504 who was working nearby. 

121.The officer appeared nonplussed by this line of enquiry.

Court adjourns - 10.47 am

Court resumes - 10.50 am

Defendant present. Appearances as before.

122.He said he made no immediate record on 1 December 2014 as he was looking for the screenshots in relation to the “Tonic Shepherd” account.  He was concerned enough to call another officer and had recorded, but that was in relation to the screenshots.

123.I find there was no basis on which to impugn this officer’s evidence about the acquisition and finding of the child pornography materials after the examination of the exhibits.

124.I found that the prosecution evidence was reliable and credible.  Devices were properly seized and properly stored so as to establish there had been no interference with the process of creating the forensic image of the contents of the devices.  Such criticisms as there were of the process were cleared up during the evidence (ie the misrecording of the material time stamp). 

125.I was completely satisfied also that the conduct of the interviews with the defendant were entirely proper and that reliance could be placed on the things said by the defendant in those interviews.

126.I also found there was no evidence whatsoever of tampering with the devices.  The defendant’s position was based on what was, in fact, his speculation that he was so much of a problem that some police officers or people in the Force would create false evidence to embarrass and discredit him.

127.I have seen the defendant’s disciplinary files that relate to the two Facebook postings.  It is clear that these postings could not and did not lead to any substantial disciplinary action against him. In any event, his superiors were generally apparently tolerant of him, considering that a warning was sufficient to deal with the matter.

128.The police files show that the defendant was seen as a valuable officer, particularly in relation to his administrative skills.  The defendant may have wanted to be a frontline officer, but he was a member of a disciplinary service where allocation of duties lies in the hands of superiors and the needs of the service. 

129.I found the defendant had no ground for complaint.  He was well treated, enjoying a number of acting positions within his time at North Point.  I find no evidence of any institutional hostility to the defendant.  In fact, the situation was quite the opposite. 

130.I also noted the WhatsApp messages the defendant says shows enmity directed at him by fellow police officers and also inside information being used.  Clearly, the defendant has and had strong opinions on many matters and was not shy of voicing that on social media, so he can hardly complain if others disagree with him.  Clearly, in this format, opinions are expressed in a forceful way, because in these discussion groups it is easy to do so.  I found there was no evidence this ever went further than the expression of opinion. 

131.I found it to be inherently improbable that any police officer would have gone to the effort of planting this material.  I found there was no motive to do this and no opportunity.  I was entirely satisfied with the integrity and reliability of the corpus of the prosecution evidence. 

132.I could not, however, say the same thing about the defendant. 

133.I was satisfied he had given untruthful evidence during the voir dire about the allegations of threats and inducements made to him. 

134.In respect of the general issue, there were other contradictions in his evidence on the general issue. 

135.The defendant had given different versions of why the password protection had been placed on the computer.

136.He had also tried to implicate by analogy his brother-in-law to say he had been present in Buxey Lodge during the Golden Week, when it was clearly shown the brother was not in Hong Kong. 

137.I found I could not place any weight on the evidence of the defendant, especially his denials of possession of the materials on the devices.

138.In the defendant’s records of interview, he said the Lenovo computer belonged to him.  He bought it six, seven years before 2014 (that is, 2007/2008).  He had changed the password, which implies that the computer was password protected before the change, that it was done half a year before 2014, the month of the interview (ie May or June of 2014 it should be), that his wife knew the password was changed but it was not known if she knew of the change to the password, that he had mentioned to her once but to no one else, the Lenovo had been repaired once four to five years before, that the computer, he said, was used by one person only, that the external hard disk was his.  He had no idea if his wife had ever used the computer and that the computer was mainly used by him.

139.I found these answers were also inconsistent with the general account by the defendant of how the computer was protected by password or user.  It certainly showed the computer was not used by others such as his brother-in-law or by other family members.

140.I did note the defendant claimed ownership of the HD.  There was evidence it had been bought by his wife’s parents’ company. This was, however, a long time prior to the interview.  The defendant was referring to the position at the time of the interview and its customary usage.

141.It would be the case that certainly from at least the middle of 2014 the access to the Lenovo was password protected.

142.I also assessed the defendant’s wife’s evidence was not generally reliable.  It was her case that on the HD and the Lenovo there were materials that related to herself, her brother and her parents’ company.  This can be seen.  I found that her evidence that she used to the computer to research about childbirth in 2014 and to check to see if her husband had information about other women to be a transparent attempt to protect her husband.  I did not actually believe her. 

143.I did not believe there had been any reference or usage of the other files on the HD for a considerable time.  The wife had her own computer.  The reality was that any information about the family business on the HD and the brother-in-law’s files on the HD were old and none of them had any present need to access the computer or HD.

144.I noted the evidence given about the specific dates in May, September and October when the prosecution had alleged there was activity within the files and the defendant’s evidence he was busy so it could not have been him controlling the computer.  I was not prepared to use the file analysis theory to conclude that the recordings of specific dates and times by the operating system corresponded to specific human intervention at that time. I did not find that conclusion could be drawn with sufficient certainty to establish matters to a criminal standard.

145.However, what it is noted that the Lenovo is a portable computer.  It only requires a Wi-Fi connection to access the Internet.  The actions can take place in a short space of time at any place such connection is available.  Furthermore, there was expert evidence that such operations could be remotely operated if necessary.

146.The uncontested evidence shows that the Lenovo and HD were seized at the defendant’s home on 1 December 2014; that the Lenovo had two identified user accounts, one of which was “Tony Sze”; the “Tony Sze” account was password protected; that at the time of the investigation the password was active on the “Tony Sze” account only and needed the defendant to deactivate it.

147.The evidence I found proved that within that user account and on the HD under the file name “Tony” were the child pornography materials which must have been present at the time of seizure.  I found the defendant then went on to admit ownership of the Lenovo and HD, and that at the time he was the sole user of both devices.  That admission I found to be reliable.

148.I therefore concluded that at the time of the seizure of the Lenovo and HD, that the defendant was the only user of the computer and HD as admitted by him and that at that time the child pornography materials set out in the charge were present on both the Lenovo and HD; that, on the evidence I heard, it was inherently improbable that any other person than the defendant had placed and possessed the child pornography materials on the computer and HD.

149.This left the defendant by way of irresistible inference to be proved beyond reasonable doubt to be the only person in possession of those materials on the relevant date, so I convicted him accordingly.