View source for Online Sexual Offences

{{Currency|May 2021}}
{{LevelZero}}
{{HeaderOffences}}
==General Principles==
{{seealso|Sexual Offences}}
There are several ''Criminal Code'' offences that are either primarily or exclusively committed through the use of the internet and computer. These include:
* Making, distributing, accessing, or possessing [[Child Pornography (Offence)|child pornography]].
* [[Child Luring (Offence)|Child luring]]
* [[Making Sexually Explicit Materials Available to Child (Offence)|Making Sexually Explicit Materials Available to Child]] 
* [[Agree or Arrange a Sexual Offence Against Child (Offence)|Agree or Arrange a Sexual Offence Against Child]]

; NCMEC CyberTipline Reports
Many investigations into ICE related crimes, include reports generated by organizations such as the National Centre for Missing and Exploited Children. These reports are generally considered reliable for the purpose of establishing grounds for the issuance of a judicial authorization.<Ref>
{{CanLIIR|Cusick|glzkp|2015 ONSC 6739 (CanLII)}}{{perONSC|Ricchetti J}}
</ref>

==Peer-to-Peer Investigations==
Peer-to-peer investigations concern the detection and investigation of the distribution illegal computer files through the internet.

The automated collection of hash values and file names consistent with child pornography is not sufficient to substantiate a charge. The file must be looked at to make this determination.<ref>
{{CanLIIRP|Lamb|2fhq5|2010 BCSC 1911 (CanLII)|[2010] BCJ No 2701}}{{perBCSC| Ehrcke J}}
</ref>

The specialized computer forensic examiners and investigators are able to testify to the types of offenders that they have observed in their experience.<ref>
e.g. {{CanLIIRx|Thompson|grhkz|2016 ONCJ 271 (CanLII)}}{{perONCJ| McKay J}}{{atL|grhkz|24}}<br>
</ref>
Some basic technical concepts are required. 

; The Internet
The ''internet'' is a "global system of computer networks" that is an "important tool for the exchange of information". It is a "single global venue" that is accessible to users where ever they may be.<ref>
{{CanLIIRP|Ward|ft0ft|2012 ONCA 660 (CanLII)|112 OR (3d) 321}}{{perONCA|Doherty JA}}{{atL|ft0ft|19}}</ref>

The internet is accessed through an Internet Service Provider. The subscriber connects to the service provider who in turn connects the subscriber to the internet.<ref>
{{ibid1|Ward}}{{atL|ft0ft|20}}</ref> 

An ''IP address'' is a numerical identifier that is automatically assigned to a subscriber when the computer device connects to the internet.<ref>
{{supra1|Ward}}{{atL|ft0ft|21}}</ref>
There are over 4.3 billion IP addresses.<ref>
{{supra1|Ward}}{{atL|ft0ft|21}}</ref>

The ISP records the dates and times that the IP address is assigned to the subscribers.<ref>
{{supra1|Ward}}{{atL|ft0ft|23}}</ref>

{{Reflist|2}}

==Undercover Investigations==

==Computer Forensic Analysis==
In preparing the computer for examination the expert should make a duplicate copy of the device's hard drive.<ref>
{{CanLIIRx|Woods|20msj|2008 ONCJ 395 (CanLII)}}{{perONCJ|G Campbell J}}{{atL|20msj|16}}</ref>

Forensic examiners typically are able to recover the following information from the computer:
* evidence of when the operating system was installed <ref>
{{ibid1|Woods}}{{atL|20msj|16}}</ref>
* when the computer was last shut down properly<ref>
{{supra1|Woods}}{{atL|20msj|16}}</ref>
* evidence that the hard drive had been wiped clean, overwritten prior to the installation of the operating system<ref>
{{supra1|Woods}}{{atL|20msj|16}}
</ref>
* the name of the user who registers the computer at the time of installation<ref>
{{supra1|Woods}}{{atsL|20msj|16|}}, {{atsL-np|20msj|20|}}</ref>
* history of computer use based on website history, the presence of cookies, and the data cache<ref>
{{supra1|Woods}}{{atL|20msj|22}}</ref>

It would be usual to find the internet browsing history to be set to be deleted automatically.<ref>
{{supra1|Woods}}{{atL|20msj|23}}</ref> 

An expert can usually rule out the possibility of hacking the computer, viruses or malware by running a scan.<ref>
{{supra1|Woods}}{{atL|20msj|29}}</ref>

Computer forensics considerations:
* a computer forensic analyst will not necessarily be able to comment on the use of various apps and their ability to leave inculpatory evidence.<Ref>
e.g. {{CanLIIRx|Gauthier|jf76n|2021 ONCA 216 (CanLII)}}{{perONCA|Harvison Young JA}} expert could not comment on whether chat logs could have been inserted on the device by having a concurrent log-in from a different device.
</ref>
{{reflist|2}}

==Proof of Identity==
{{seealso|Identity}}

In many online sexual offences there is clear evidence that a particular computing device was used in the commission of a criminal offence. The primary issue at trial would be the identity of the culprit.

Evidence suggesting of identity of the culprit (e.g. the person who possessed certain files or operated certain software) include:
* person associated with a user account with administrative rights that may have installed software that facilitated the crime;<ref>
e.g. see {{CanLIIRx|Thompson|grhkz|2016 ONCJ 271 (CanLII)}}{{perONCJ|McKay J}}{{atsL|grhkz|37| to 39}}<br>
</ref>
* the level of computer sophistication or computer literacy of the accused;<ref>
{{ibid1|Thompson}}{{atL|grhkz|38}}<br>
</ref>
* ownership of the computer<ref>
{{supra1|Thompson}}{{atL|grhkz|38}}<br>
</ref>
* level of usage of the computer;<ref>
{{supra1|Thomspon}}{{atL|grhkz|38}}<br>
</ref>
* the descriptive file names;<ref>
{{supra1|Thompson}}{{atL|grhkz|38}}
</ref>
* organization of the files<ref>
{{supra1|Thompson}}{{atL|grhkz|38}}<br>
</ref>

{{reflist|2}}