



WARNING

The President of the panel hearing this
    appeal directs that the following should be attached to the file:

An order restricting publication in this
    proceeding under ss. 486.4(1), (2), (2.1), (2.2), (3) or (4) or 486.6(1) or (2)
    of the
Criminal Code
shall continue.  These sections of
the Criminal
    Code
provide:

486.4(1)       Subject to subsection
    (2), the presiding judge or justice may make an order directing that any
    information that could identify the victim or a witness shall not be published
    in any document or broadcast or transmitted in any way, in proceedings in
    respect of

(a)     any of the following offences;

(i)      an offence under section 151,
    152, 153, 153.1, 155, 159, 160, 162, 163.1, 170, 171, 171.1, 172, 172.1, 172.2,
    173, 210, 211, 213, 271, 272, 273, 279.01, 279.011, 279.02, 279.03, 280, 281,
    286.1, 286.2, 286.3, 346 or 347, or

(ii)      any offence under this Act, as
    it read at any time before the day on which this subparagraph comes into force,
    if the conduct alleged involves a violation of the complainants sexual
    integrity and that conduct would be an offence referred to in subparagraph (i)
    if it occurred on or after that day; or

(iii)     REPEALED: S.C. 2014, c. 25,
    s. 22(2), effective December 6, 2014 (Act, s. 49).

(b)     two or more
    offences being dealt with in the same proceeding, at least one of which is an
    offence referred to in paragraph (a).

(2)     In proceedings in respect of the
    offences referred to in paragraph (1)(a) or (b), the presiding judge or justice
    shall

(a)     at the first reasonable
    opportunity, inform any witness under the age of eighteen years and the victim
    of the right to make an application for the order; and

(b)     on application made by the
    victim, the prosecutor or any such witness, make the order.

(2.1) Subject to subsection (2.2), in
    proceedings in respect of an offence other than an offence referred to in
    subsection (1), if the victim is under the age of 18 years, the presiding judge
    or justice may make an order directing that any information that could identify
    the victim shall not be published in any document or broadcast or transmitted
    in any way.

(2.2) In proceedings in respect of an
    offence other than an offence referred to in subsection (1), if the victim is
    under the age of 18 years, the presiding judge or justice shall

(a) as soon as feasible, inform the
    victim of their right to make an application for the order; and

(b) on application of the victim or the
    prosecutor, make the order.

(3)     In proceedings in respect of an
    offence under section 163.1, a judge or justice shall make an order directing
    that any information that could identify a witness who is under the age of
    eighteen years, or any person who is the subject of a representation, written
    material or a recording that constitutes child pornography within the meaning
    of that section, shall not be published in any document or broadcast or
    transmitted in any way.

(4)     An order made under this section
    does not apply in respect of the disclosure of information in the course of the
    administration of justice when it is not the purpose of the disclosure to make
    the information known in the community. 2005, c. 32, s. 15; 2005, c. 43, s.
    8(3)(b); 2010, c. 3, s. 5; 2012, c. 1, s. 29; 2014, c. 25, ss. 22, 48; 2015, c.
    13, s. 18.

486.6(1)       Every person who fails to
    comply with an order made under subsection 486.4(1), (2) or (3) or 486.5(1) or
    (2) is guilty of an offence punishable on summary conviction.

(2)     For greater certainty, an order
    referred to in subsection (1) applies to prohibit, in relation to proceedings
    taken against any person who fails to comply with the order, the publication in
    any document or the broadcasting or transmission in any way of information that
    could identify a victim, witness or justice system participant whose identity
    is protected by the order. 2005, c. 32, s. 15.




COURT OF APPEAL FOR ONTARIO

CITATION: R. v. Cusick, 2019 ONCA 524

DATE: 20190624

DOCKET: C61360

Juriansz, Watt and Harvison Young JJ.A.

BETWEEN

Her Majesty the Queen

Respondent

and

Frederick Cusick

Appellant

M. Halfyard and B. Vandebeek, for the appellant

Manasvin Goswami, for the respondent

Heard: April 17, 2019

On appeal from the order of Justice Leonard Ricchetti of
    the Superior Court of Justice, dated November 2, 2015, with reasons reported at
    2015 ONSC 6739, allowing an appeal from the acquittal entered on October 30,
    2014, by Justice E. A. Ready of the Ontario Court of Justice.

Juriansz J.A.:

A.

Introduction

[1]

This appeal concerns the validity of a search warrant issued primarily
    on the basis of information received by the Peel Regional Police (Peel
    police) through the National Center for Missing and Exploited Children
    (NCMEC). NCMEC was established pursuant to American legislation and is funded
    by the United States Justice Department. Electronic Service Providers and
    providers of remote computing services are required to report to the NCMEC CyberTipline
    when they have knowledge of child pornography on their systems. NCMEC then forwards
    the CyberTipline Report to the appropriate law enforcement agency.

[2]

In this case, NCMEC forwarded CyberTipline Reports to the
Canadian National Child Exploitation Coordination Centre, a division
    of the RCMP
, who sent it on to Peel police. That information led to the
    execution of a warrant at the appellants residence. The subsequent forensic
    analysis of his computer and external drives revealed a number of digital
    videos and images alleged to be child pornography. The appellant was
    subsequently charged with possession of child pornography.

[3]

The trial judge found that the warrant should not have been issued and that
    the appellants s. 8 rights were breached. She excluded the evidence under s.
    24(2) and entered an acquittal. The Crowns appeal to the Superior Court was
    allowed and a conviction entered.

[4]

While leave to appeal was granted at the outset of the appeal hearing, I
    would dismiss the appeal.

B.

OVERVIEW OF THE Facts

[5]

Microsoft provides cloud-based storage to registered users. In
    May 2012, Microsoft became aware that a user had uploaded 41 files containing
    some 2000 images of child pornography between May 10 and May 19, 2012. As
    required by legislation, Microsoft sent NCMEC:

·

the files containing child pornography;

·

the date and time each file was uploaded;

·

the users screen name (John E.);

·

the users email address (we.are.theborg@hotmail.com); and

·

the two IP addresses of the computer or computers used to connect
    to the internet and upload the files.


[6]

NCMEC determined that the two IP addresses,
174.95.50.159 and
174.95.54.28, originated in Canada and forwarded
    the 41 CyberTipline Reports to the RCMP, in two groups. The RCMP received 21 CyberTipline
    Reports in August 2012,
and
a further 20
    CyberTipline Reports in December 2012. I will refer to these collectively as the
    NCMEC Report.

[7]

The RCMP viewed the images and believed the majority of the images
    constituted child pornography under the
Criminal Code
, R.S.C., 1985,
    c. C-46, s. 163.1(1).

[8]

The RCMP made a law enforcement request to Bell Canada to identify its
    customer accounts that had the IP addresses 174.95.54.28 on May 10, 2012 at 11:24
    PM UTC, and 174.95.50.169 on May 19, 2012 at 11:46 PM UTC. Bell Canada provided
    its customer information. The first IP address was associated with the account
    of a resident of Nipiwin Drive, Mississauga. The second IP address was
    associated with the account of F. Cusick at 338 Queen Street, Mississauga. The
    RCMP forwarded this information to Peel police.

[9]

Peel police also viewed the files, formed the opinion that they
    constituted child pornography under the
Criminal Code
, and confirmed
    that the two IP addresses were in their jurisdiction. Peel police conducted
    surveillance at each of the two addresses and confirmed that each had a Wi-Fi
    network protected by security to prevent use by persons without the passwords. The
    investigating officer, Cst. MacDonald, prepared the ITO and applied for a warrant
    for each address. In the ITO, he asserted:

I have reasonable grounds to believe that one Microsoft
    account, we.are.theborg@hotmail.com, has uploaded images of child pornography
    using two different internet connections at two locations in Mississauga. This
    application is for 338 Queen St South, Basement Apartment, Mississauga, ON. I
    believe the seizure and analysis of the items listed in Appendix A will
    corroborate the information originating from Microsoft, determine what computer
    system(s) specifically had access to this Microsoft account and render evidence
    of the child pornography based offence named in appendix B.

[10]

The Justice
    of the Peace (the issuing justice) granted the warrants.

[11]

Cst.
    MacDonald first executed the warrant at the Nipiwin address. One of the persons
    living there was a 17-year-old male with autism, who had been previously
    cautioned by the police for child pornography offences three years earlier. His
    mother said he suffered from sexuality issues and was getting help. The young
    person admitted he had used we.are.theborg@hotmail.com, but denied uploading the
    child pornography. He also denied knowing the appellant and stated he had never
    been to the appellants home.

[12]

About
    two hours later, Cst. MacDonald executed the search warrant at the appellants
    address. The appellant told him there shouldnt be any child pornography on
    his computer. He said he did not know John E. and denied any knowledge of we.are.theborg@hotmail.com.
    He denied that any children had access to his computer. Cst. MacDonald performed
    a cursory examination of the appellants computer, but found no evidence of the
    use of we.are.theborg@hotmail.com, John E., or child pornography. Peel police nonetheless
    seized the appellants computer equipment, and after a complete search, found 131
    unique image files and 24 unique video files they believed constituted child
    pornography. None of these files matched the files contained in the NCMEC Report.

[13]

The
    appellant brought a ss. 8 and 24(2)
Charter
application to challenge
    the warrant. He also brought an application to cross-examine Cst. MacDonald, to
    which the Crown consented.

C.

DECISIONS BELOW

(1)

Decision of the Trial Judge

[14]

The RCMP
    obtained the identifying information about the appellant from Bell Canada
    without a warrant. As a result of
R. v. Spencer
, 2014 SCC 43, [2014] 2
    S.C.R. 212, the Crown conceded that this breached s. 8. The amplification
    evidence did indicate, however,
Spencer
was not the law when Cst. MacDonald
    drafted the ITO. The trial judge indicated that if this had been the only s. 8
    breach, she would not have excluded the evidence found at the appellants home.
    However, she found the following additional deficiencies with the ITO, all of
    which could not be cured by amplification:

1)

Cst. MacDonald failed
    to verify the information in the NCMEC Report for accuracy;

2)

Cst. MacDonald failed
    to include a disclaimer in the ITO;

3)

Cst. MacDonald failed
    to confirm Microsofts use of PhotoDNA software;

4)

There was a time
    discrepancy on the face of the NCMEC Report;

5)

The ITO was premised
    on indefinite and stale information; and

6)

The fruits of the
    Nipiwin search undermined the reasonable grounds to search the appellants
    residence.

[15]

I
    will review the trial judges basis for making these findings later in these
    reasons.

[16]

The
    trial judge allowed the appellants application to exclude the evidence. She
    concluded that the issuing justice was misled as to the reliability of the
    information in the NCMEC Report. There was no reliable and credible evidence
    connecting the appellants IP address to any criminal activity, and only the
    possibility of evidence being found at the appellants residence. There was no
    basis on which the warrant could issue. Cst. MacDonald displayed careless
    behaviour and a careless attitude. At best, he exaggerated the existence of
    reasonable grounds to believe that evidence of the offence would be found at
    the appellants residence at the time the warrant was executed.

(2)

Decision of the Summary Conviction Appeal Judge

[17]

The
    summary conviction appeal judge (the SCAJ) concluded the trial judge erred in
    law and made palpable and overriding errors of fact.

[18]

The
    trial judge first erred in law by reasoning that, absent verification by the [Cst.
    MacDonald], the information in the NCMEC CyberTipline Report was not reliable
    evidence for the issuing [justice] to consider. The trial judges second error
    of law was substituting her own views on whether a search warrant should have
    been issued, rather than considering whether the issuing justice could have issued
    the search warrant with the amplification evidence. As well, the trial judge
    made findings not supported by the evidence in concluding the information in
    the NCMEC Report was not credible and reliable, and there were no reasonable
    grounds to believe that evidence of the offence would continue to be found at the
    appellants residence at the time the warrant was executed.

[19]

The SCAJ
    found the NCMEC Report had the hallmarks of reliability and satisfied
the standard of reasonableness
for assessing
    information from a non-police, third-party source set out in
R. v. Debot
,
    [1989] 2 S.C.R. 1140. He concluded the issuing justice could have issued the
    warrant on the totality of the information.

[20]

I
    agree with the careful analysis and detailed reasons the SCAJ provided for
    reaching these conclusions. A detailed review of his reasons would be
    needlessly repetitious of my own analysis, as I adopt much of his reasoning. It
    is convenient to refer to his reasons and conclusions in the course of my own discussion
    of the issues.

D.

ANALYSIS

(1)

The NCMEC Report

[21]

The SCAJ,
    before turning to the issues in this case, reviewed how CyberTipline Reports
    are generated and how they are provided to local police authorities. This is a
    useful starting point. A proper understanding of these reports is fundamental
    to gauging the strength of the initial information in the ITO.

[22]

Microsoft
    Corporation is both an Electronic Service Provider and Internet Service Provider.
    Microsoft made available to Microsoft users cloud-based storage on its servers.
    The cloud-based storage was called SkyDrive (and now is known as OneDrive). SkyDrive
    made it possible for users not to have files stored on their own computers, but
    stored in the cloud where they can access, view, transfer, and retrieve them
    through an Internet connection. Persons with a Microsoft user account can access
    Microsoft servers through the Internet from any computer anywhere in the world
    to upload, store, transfer and download files, including image and video files.

[23]

American
    legislation - the
Victims of Child Abuse Act of 1990
, U.S.C. tit. 18,
    § 2258(a) - requires Electronic Service Providers and remote computing services
    that have actual knowledge of apparent violations of various child exploitation
    and child pornography criminal provisions to make a report to the NCMEC CyberTipline.

[24]

The SCAJ
    set out the provisions of this legislation at some length at para. 13 of his reasons.
    Suffice it to say, the legislation requires the Electronic Service Provider to
    include in the report available identifying information of the source of the
    upload, such as the IP address used, and copies of the apparent child
    pornography.

[25]

Once
    NCMEC receives a report from an Electronic Service Provider,
it identifies the geographic location of the IP
    address and
creates a written report. The written report is called a
    CyberTipline Report. The information received from the Electronic Service Provider
    is set out in the first three pages of the CyberTipline Report, and NCMEC makes
    clear the Electronic Service Provider is the source of the information. The
    information is set out under the heading:

The following information was submitted to NCMECs CyberTipline.
    This information cannot be modified by [NCMEC] staff.

[26]

The
    legislation requires NCMEC to send
the CyberTipline
    Report to the appropriate local police authority.
When the apparent
    child pornography is uploaded from outside the United States, the appropriate
    law enforcement agency includes designated foreign federal agencies. In Canada,
    the federal agency designated to receive CyberTipline Reports is the National
    Child Exploitation Coordination Centre in Ottawa, a division of the RCMP. The
    RCMP reviews the CyberTipline Report and forwards it to the appropriate local
    law enforcement agency.
In the present case,
    NCMEC determined the two IP addresses used were in Canada, and so forwarded the
    NCMEC Report to the RCMP.


[27]

The SCAJ
    noted that Cst. MacDonald described NCMEC as a clearing house. NCMEC does not
    generate any information regarding the matter that was uploaded, when it was
    uploaded or the user who uploaded it. The SCAJ also noted the limited role
    played by NCMEC is described in the Report itself:

NCMEC does not investigate and cannot verify the accuracy of
    the information reported to NCMEC. NCMEC forwards reports of child sexual
    exploitation to law enforcement for purposes of investigation and disposition.

...

LAW ENFORCEMENT OFFICIALS PLEASE BE ADVISED: This Report is
    being provided solely for informational purposes pursuant to NCMECs
    congressional authorization and mission. Under no circumstances shall this
    Report be used as evidence of criminal wrongdoing Please treat all information
    contained in this report as law enforcement sensitive information and do not
    share any contents of this report with persons unrelated to the criminal
    investigation or any resulting criminal prosecution.

[28]

The
    trial judge referred to these two statements in the NCMEC Report as the disclaimer.
    I will have more to say about these two statements later when discussing what
    the trial judge made of them.

[29]

Cst.
    MacDonald was qualified
as an expert in the
    areas of online cloud storage and internet investigations. He
had previous
    experience with about 30 cases involving CyberTipline Reports. He testified
    that he has never come across a CyberTipline Report that had given him false
    information, and there was never an error in the reported IP address.

[30]

Cst.
    MacDonald testified CyberTipline Reports are sent to law enforcement agencies
    all over the world. He said the vast majority of Internet child exploitation
    investigators base their work on CyberTipline Reports. He explained that local
    police forces have no way of knowing when child pornography is uploaded to a
    cloud server in a foreign country from a local computer connected to the
    Internet. CyberTipline Reports link the providers of cloud storage to local law
    enforcement. NCMEC makes possible a system of international cooperation
    designed to combat child exploitation and child pornography.

(2)

The Trial Judge Erred by Requiring Verification for Accuracy

The Trial Judges Reasons

[31]

In
    the trial judges initial statement of the law, she indicated the standard on
    review of a search warrant was one of reasonable probability. In fact, she
    observed that the standard is not an onerous one. She stated that the issuing
    justice acts on reliable information verified for accuracy, in other words,
    credible, compelling, corroborated evidence. However, the standard she applied
    throughout her analysis was that the police themselves were required to verify
    the information for accuracy.

[32]

The
    trial judge reasoned that large corporations do make mistakes and Microsoft is
    no exception. The police officers need to check with Microsoft to verify the
    accuracy of any report that comes into their possession. She regarded Cst.
    MacDonalds reliance on the NCMEC Report without verifying for accuracy as
    both careless and reckless.

The SCAJs Conclusion

[33]

The
    SCAJ concluded that the trial judge erred in requiring verification for
    accuracy before the Microsoft [i]nformation could be relied upon by the issuing
    [j]ustice. As the SCAJ observed, if verification for accuracy were required,
    hearsay evidence would never be sufficient to support the issuance of a search
    warrant.

[34]

I
    agree.

The Trial Judges Errors

[35]

As
    the SCAJ pointed out, verified as to accuracy is not consistent with how the
    standard is usually described in judicial authorities. The terms usually used
    are credibly-based probability, reasonable probability or reasonable
    belief. Section 487(1) of the
Criminal Code
authorizes a justice to
    issue a warrant if there are reasonable grounds to believe.

[36]

Certainly,
    it must be considered whether the information provided by a third-party source
    outside the police is compelling, from a credible source, and corroborated.
    However, that does not change the standard of reasonable belief. The SCAJ pointed
    out that a tip or information that comes from a source which is generally
    credible and reliable
can provide some
    evidence which an issuing justice could rely on to issue a search warrant.

    I agree. The standard is reasonableness, not certainty.

[37]

Wilson
    J. made that clear in
Debot
, at p. 1168. She said that a consideration
    of whether information is compelling, from a credible source, and corroborated
    is not a separate test, but that the totality of the circumstances must meet
    the standard of reasonableness. She added that weaknesses in one area may, to
    some extent, be compensated by strengths in the other two.

[38]

The
    trial judge in this case lost sight of the reasonableness standard. Information
    from a large corporation may be reasonably believed, even if it is known that
    the corporation makes mistakes on occasion. In this case, Cst. MacDonald
    testified that in his experience with some 30 cases, Microsoft had never made a
    mistake in the information it reported to NCMEC and that was subsequently
    passed on to the police.

[39]

I
    agree with the observation of the SCAJ at para. 87, that:

The trial judges sole focus was on verification of accuracy,
    in other words, corroboration. While referring to
Debot
, the trial
    judge erred in failing to consider all the circumstances, including whether the
    information was compelling, credible, to what extent was it corroborated and,
    if so, whether considering the totality of the evidence, it was sufficient to
    meet the standard of reasonableness.

[40]

I
    conclude that the trial judge erred in law by applying an incorrect standard to
    the ITO.

[41]

This
    error alone required the SCAJ to assess, without deference to the trial judge,
    whether there was a basis on which the warrant could have issued.

(3)

The Trial Judge Failed to Consider Whether the Issuing Justice Could
    Have Authorized the Warrant.

[42]

I
    agree with the SCAJ that the trial judges analysis reflects her own view as to
    whether the warrant should have been issued. It was an error in law to fail to
    determine whether the issuing justice could have authorized the warrant.

[43]

The
    trial judge set out the governing principles correctly. A warrant, once issued,
    is presumed to be valid. The role of the reviewing judge is to determine
    whether there is at least some evidence upon which the issuing justice could
    have issued the warrant. The party challenging the warrant bears the burden of
    demonstrating its invalidity. The reviewing judge is not to engage in a fresh
    assessment of the grounds for the warrant or substitute their views for those
    of the issuing justice. The task of the reviewing judge is limited to assessing
    whether on the whole of the record before the issuing justice, as amplified on
    review, there is 
at least some evidence that might reasonably be believed
    on the basis of which the authorization could have issued
:
R. v. Araujo
,
    2000 SCC 65, [2000] 2 S.C.R. 992, at para. 51 (emphasis in original).

[44]

Having
    stated these principles, the trial judge expressed specific concerns she had with
    the ITO and concluded the warrant should not have been issued. For the
    following reasons I conclude, as did the SCAJ, that the trial judges concerns
    are unsupported by the evidence and that the issuing justice, on the totality
    of the evidence, could have authorized the warrant. In fact, as I discuss below,
    the issuing justice could have taken a different view of each of the
    deficiencies found by the trial judge.

(i)

The Disclaimer

The Trial Judges Reasons

[45]

CyberTipline
    Reports contain two statements, preprinted in the template used for its
    reports, which Cst. MacDonald did not include in the ITO. As indicated above,
    the disclaimer consists of a sentence plucked out of the paragraph in the
    header of the first page, and the complete paragraph in the footer of every
    page of the CyberTipline Report.

[46]

The
    trial judge found that the failure to include the disclaimer in the ITO would
    have misled the issuing justice. An application for a search warrant is an
ex
    parte

proceeding and the application must make
full and frank
disclosure of
material facts
:
Araujo
, at para. 46 (emphasis in
    original).

[47]

Cst.
    MacDonald agreed the disclaimer should have been included in the ITO to
    ensure disclosure was full, fair and frank, but testified he did not consider
    the statements material. The ITO did state that NCMEC acts as a clearing
    house of information, which is the import of the statement in the header. He
    offered his opinion that the footer was included to protect NCMEC itself from
    criminal responsibility.

[48]

The
    trial judge rejected the notion the disclaimer attempted to protect NCMEC
    from criminal responsibility. The trial judge pointed out that Cst. MacDonald
    never confirmed with NCMEC what the disclaimer meant. The trial judge found
    that on a common sense reading of the disclaimer, it was a warning to
    whoever comes into possession of this report, that
it is in essence a tip

    (emphasis added). The trial judge found by not including the disclaimer in
    the ITO, 
the [issuing justice] was misled
in respect of the reliability
    of the information he was acting upon (emphasis added).

The SCAJs Conclusion

[49]

The
    SCAJ concluded that the trial judge made a palpable and overriding error in
    finding that the failure to include the disclaimer misled the issuing justice.
    He explained, 
when properly considered, the [d]isclaimer
    was not material and had no effect on the reliability on the material facts
    necessary for the issuing justice to determine whether reasonable and probable
    grounds existed to issue the search warrant.

[50]

I agree.

The Trial Judges Errors

[51]

The
    first statement reflects what Cst. MacDonald included in the ITO and repeated in
    his testimony: namely, NCMEC acts as a clearing house of information. This is
    made clear by considering the statement in context.

[52]

The
    header begins by reciting NCMECs establishment in 1984, and states pursuant to
    its mission and congressional authorization, NCMEC operates the CyberTipline
    to assist law enforcement in identifying victims of child pornography and
    child sexual exploitation. It states that NCMEC works with the law enforcement
    and Electronic Service Providers to reduce the distribution of child sexual
    exploitation images and videos over the Internet. Then, the header states what
    the trial judge described as the first part of the disclaimer: NCMEC does
    not investigate and cannot verify the accuracy of the information reported to
    NCMEC. NCMEC forwards reports of child sexual exploitation to law enforcement
    for purposes of investigation and disposition.

[53]

The second
    statement appears as the footer of every page of the Report. The footer should
    be read keeping in mind the content and transmittal of a CyberTipline Report.
    NCMEC comes into actual possession of child pornography when it receives copies
    from the Electronic Service Provider. After it comes into actual possession of child
    pornography, NCMEC then engages in the distribution of child pornography when
    it sends out its reports. Cst. MacDonald provided his expert opinion that NCMEC
    includes the second statement to attempt to preclude the use of its CyberTipline
    Reports as evidence of criminal wrongdoing by itself.

[54]

A
    reading of the footer, keeping in mind that the CyberTipline Report is evidence
    that NCMEC has possessed and transmitted apparent child pornography, supports Cst.
    MacDonalds expert opinion. The first sentence of the footer says the
    CyberTipline Report is provided only for informational purposes and reminds the
    recipient of NCMECs statutory authorization and mission. The second sentence states
    that the CyberTipline Report should not be used to establish criminal liability.
    The only criminal liability conceivable is for the possession and distribution
    of child pornography. Understanding the second sentence to mean the CyberTipline
    Report should not be used as evidence of criminal wrongdoing
by the user who
    uploaded the child pornography
, as the appellant urges, is inconsistent
    with the last sentence and the header of the CyberTipline Report. The last
    sentence makes clear the CyberTipline Report is intended to be used in criminal
    investigation and any resulting criminal prosecution. In fact, in the last
    sentence, NCMEC uses the voice of a partner in the criminal process.

[55]

The
    only sensible interpretation of the whole footer is that NCMEC plays a role in
    the criminal process pursuant to congressional authorization, and NCMEC should not
    itself be seen to breach the criminal law though it possesses and transmits
    child pornography. The cautious inclusion of the statement as a footer of every
    page of the CyberTipline Report supports this reading.

[56]

The
    Crown submits that the trial judge had no basis to reject Cst. MacDonalds
    expert opinion of what the statement meant, as there was no contrary evidence.
    Certainly, Cst. MacDonalds expert opinion was deserving of appropriate weight.
    This was a technical area and the reading of the NCMEC Report involved some
    technical expertise. It is sufficient to observe that Cst. MacDonalds
    testimony on the point might reasonably be believed and could have been
    accepted by the issuing justice:
R. v. Caissey
, 2007 ABCA 380, 227
    C.C.C. (3d) 322, at para. 23, affd 2008 SCC 65, [2008] 3 S.C.R. 451. Accepting
    Cst. MacDonalds opinion, the issuing justice could have regarded the two
    statements as immaterial to the reliability of the information in the NCMEC Report.

[57]

Even
    if the trial judges understanding that the two statements are a disclaimer was
    correct, the disclaimer was still immaterial to the reliability of the
    information in the NCMEC Report. The pertinent information in the NCMEC Report originated
    with Microsoft and was simply passed on by NCMEC. The information that the
    files were uploaded, the times at which they were uploaded, the IP addresses
    from which they were uploaded, the username and email address of the Microsoft
    account that uploaded the files, and the copies of the files themselves were all
    provided by Microsoft, not NCMEC. The only thing NCMEC did was to identify the
    geographic location of the IP addresses provided by Microsoft. That the IP
    addresses were located in Mississauga was confirmed by the RCMP and by Peel police
    as well. The RCMP and Peel police also reviewed copies of the files and formed
    the view they contained child pornography. The rest of the information was as
    reliable as such information from Microsoft should be considered. The two
    statements from NCMEC comprising the disclaimer do not transform information that
    is otherwise considered reliable into unreliable information.

[58]

The
    failure to include the two statements in the ITO could not have misled the
    issuing justice as to the sufficiency of grounds contained in the ITO. The SCAJ
    correctly concluded the trial judge erred by finding that it did.

(ii)

PhotoDNA

The Trial Judges Reasons

[59]

Cst.
    MacDonald testified that he saw no need for the police to verify the
    information in the NCMEC Report, because the information originated with
    Microsoft. He testified Microsoft was a large organization that used computer
    software called PhotoDNA to identify child pornography. In Cst. MacDonalds
    experience, PhotoDNA was reliable and not subject to human error.

[60]

The
    trial judge rejected this explanation, criticizing Cst. MacDonald for not confirming
    with Microsoft that it had used PhotoDNA.

The SCAJs Conclusion

[61]

The
    SCAJ concluded the trial judge erred by requiring verification as to accuracy
    of the use of PhotoDNA when the only expert evidence was that this was
    developed by Microsoft, used by Microsoft and other [Electronic Service
    Providers] and there was no evidence to the contrary, expert or otherwise. He
    also concluded that in any event, the trial judge erred in considering the
    lack of verification as to the use of PhotoDNA to be material.

[62]

I
    agree with these conclusions.

The Trial Judges Errors

[63]

The
    trial judges criticism of Cst. MacDonald for not verifying with Microsoft that
    it had used PhotoDNA to identify the alleged child pornography was unwarranted.

[64]

It
    seems the trial judge took the view that the information provided by Microsoft
    would have had greater reliability if it were computer-generated and not
    subject to human fallacy. This may be a legitimate view, but the trial judge
    lost sight of the fact that whatever method it used, Microsoft did identify files
    containing potential child pornography. Both the RCMP and Peel police confirmed
    the files attached to the NCMEC Report contained child pornography as defined
    by the
Criminal Code
. As the SCAJ put it:

[A]ny issue regarding the use or reliability of the PhotoDNA
    program (or any other image identification program) to identify apparent child
    pornography being uploaded to the cloud was not relevant or material to whether
    the search warrant could have issued.

[65]

It
    is worth noting that the ITO did not even mention PhotoDNA. An issuing justice
    could have issued the warrant whether PhotoDNA had or had not been used.

[66]

In
    any event, the trial judge had no basis to reject the unequivocal opinion of Cst.
    MacDonald that PhotoDNA had been used. Cst. MacDonald was an expert in online
    cloud storage and Internet investigations, who had been trained on the use of
    PhotoDNA and had previous experience with it. He testified that when he saw
    output like that contained in the NCMEC Report, 
I know it to be PhotoDNA

    (emphasis added). He added, [i]f Im receiving something from Microsoft coming
    to NCMEC in that file format or in that format to say here is a picture, here
    is the IP address and the time and day, specifically, here is the user account
    its -
its PhotoDNA
 (emphasis added). He also said when he reviewed
    the NCMEC report, I knew the system in which it came from. There was no
    evidence that cast any doubt about the opinion of Cst. MacDonald. The issuing justice
    could have accepted Cst. MacDonalds testimony and proceeded on the basis that PhotoDNA
    was used.

(iii)

The Time Discrepancy

The Trial Judges Reasons

[67]

The
    trial judge found a time discrepancy on the face of the NCMEC Report. This
    finding provided considerable support for her view that the Microsoft
    information in the NCMEC Report should not be considered reliable without
    verification.

[68]

The
    NCMEC Report indicates the time when each file was uploaded to SkyDrive, and
    the time when the Microsoft incident report was generated about the file being
    uploaded. The discrepancy is that the incident reports are indicated to have
    been generated before the files were uploaded to SkyDrive. For example, report
    #1432170 shows an upload time of 23:46 GMT and an incident time of 16:46 GMT, a
    difference of seven hours. Obviously, Microsoft could not have started
    generating a report about a file being uploaded seven hours before the file was
    actually uploaded.

[69]

On
    his first day of testimony, Cst. MacDonald was unable to explain this time discrepancy.
    On his second day of testimony, Cst. MacDonald proffered a table showing the
    upload times and the incident times from all 41 entries in the NCMEC Report. In
    each case, the incident time was precisely seven hours before the upload time. Cst.
    MacDonald knew that Microsofts law enforcement team that generated these kinds
    of reports was located in the State of Washington, and the NCMEC Report, in
    identifying Microsoft as the Internet Service Provider, provided a street
    address for Microsoft Corporation in Redmond, Washington. Cst. MacDonald offered
    his opinion that the incident dates were indicated in local time at Microsoft
    headquarters, i.e. Pacific Time, whereas the upload times were indicated in
    Greenwich Mean Time. He testified that there is precisely a seven hour
    difference between Pacific Time and Greenwich Mean Time, and suggested the
    NCMEC Report should have indicated the incident times as PDT, not GMT.

[70]

The
    trial judge considered this to be unreliable amplification evidence because it
    had not been verified or confirmed with Microsoft. The trial judge said Cst.
    MacDonald conceded that the NCMEC Report did not state where it was prepared,
    and his new theory was based upon his personal theory and his assumptions. He
    should have confirmed with Microsoft that his explanation was sound.

[71]

The
    trial judge concluded Microsoft made a mistake. The NCMEC Report had a clear
    contradiction in it. It was the basis for the warrant, and it showed the
    Microsoft incident reports were generated hours before the appellant was
    associated with the identified IP address.

The SCAJs Conclusion

[72]

The
    SCAJ accepted that the apparent timing inconsistency was an issue to be
    addressed. However, in his view, while the discrepancy may have lessened the
    connection to the appellants home and computer equipment, the discrepancy did
    not eliminate it. The trial judge had no basis for rejecting Cst. MacDonalds
    explanation of the discrepancy, and
engaged in a
    parsing of the facts. The SCAJ concluded even with this 7 hour 0 minute time
    discrepancy, the issuing [justice] continued to have sufficient credible and
    reliable evidence that he could have issued the search warrant.

[73]

I agree.

The Trial Judges Errors

[74]

Before
    turning to whether the trial judge had any basis for rejecting Cst. MacDonalds
    explanation of the discrepancy, I first explain why the time discrepancy did
    not eliminate the sufficiency of the grounds. Even if the time discrepancy remained
    unexplained, the SCAJ noted at para. 121 the following evidence remained
    intact:

a) The file was uploaded by
    we.are.theborg@hotmail.com;

b) The file contained images which
    were apparent child pornography;

c) The IP addresses remained
    174.95.50.159 and 174.95.54.28;

d) The IP addresses continued to be connected to the Nipiwin
    address and Mr. Cusicks home; and

e) The IP address associated with the uploading of the apparent
    child pornography, was within a short time, 7 hours 0 minutes, of the time in
    the [NCMEC Report].

[75]

I
    expand on the SCAJs observation in subparagraph (e). Cst. MacDonald testified
    about the nature of dynamic IP addresses. IP addresses can and do change, but
    that does not mean they will change every time a computer user connects to the
    Internet. Cst. MacDonald said:

Bell [Canada] records when they gave you that IP address and
    gives it to you for certain amount of time. Then after  sometimes with Bell
    [Canada] it could be three weeks, it could be three days, it could be  the
    most Ive seen is about two months with Bell [Canada] for them to allow you to
    keep an IP address, then you change it in for another one.

[76]

For
    example, consideration of Exhibit 3, the Combined table of all the NCMEC
    report time discrepancies, and the NCMEC Report, makes it apparent that IP
    address 174.95.50.159 was associated with the appellants address both for the
    uploads on May 14 and May 19, 2012. A reasonable inference is that the
    appellants IP address did not change between May 14 and May 19. The time
    discrepancy of seven hours did not eliminate the value of the NCMEC Report,
    which had to be weighed in the context of all the information.

[77]

I
    add another observation. The times at which the files were uploaded were
    pertinent to the grounds, but the times at which Microsoft generated its incident
    reports were not. Cst. MacDonald was steadfast in his testimony, even on the
    first day, that the upload times in the NCMEC reports were accurate. His
    testimony about the uploading times was based on his training and experience. He
    testified that the GMT upload times and the IP addresses were bound together in
    the computer logs. So, while the times of the incident reports may have been
    puzzling, all the evidence in the record was that the upload times were those
    indicated in the NCMEC Report. It was only the upload times that were pertinent
    to the sufficiency of the grounds.

[78]

Nevertheless,
    the trial judge never engaged Cst. MacDonalds explanation of the time
    discrepancy on its merits, but simply refused to accept it because he had not
    verified it with Microsoft. Cst. MacDonalds explanation of the time
    discrepancy was compelling and uncontradicted. The trial judge did not consider
    whether an issuing justice could have reasonably believed the explanation.

(iv)

Staleness

The Trial Judges Reasons

[79]

The
    NCMEC Report indicated that the files containing the child pornography were
    uploaded to SkyDrive between May 10 and May 19, 2012. The search warrant was
    executed on January 23, 2013.

[80]

Cst.
    MacDonald was extensively cross-examined about the chances the search would
    obtain relevant evidence after the passage of more than seven to eight months.
    He was forthright that he could not say what the chances were and that
    answering the question would require him to speculate.

[81]

Cst.
    MacDonald said he had no grounds to believe the actual image files would be at
    either address. He did not know how they had been uploaded, including whether
    they were uploaded from a hard drive or a thumb drive, though he had reason to
    believe a thumb drive was involved. He explained that he would be looking for
    what he called artifacts, which he described as electronic footprints left
    behind by the use of a computer. There are different kinds of artifacts that
    may be found in different locations on a computer. The type of artifacts and
    their location depends in part on the type of computer and its operating
    system. How long these artifacts remain depends on many factors such as the
    hard drive size, user activity, the type of artifact and so forth. Some
    artifacts might be currently used and saved in the current operating system.
    Cst. MacDonald indicated he was primarily interested in any activity of
    we.are.theborg@hotmail.com. He said that until he executed the search warrant,
    he did not know what technologies were used and for what specific artifacts he
    should even look.

[82]

The
    cross-examination culminated with counsel putting to Cst. MacDonald that, at
    the time he prepared the application for the search warrant, he did not know
    what the chances were that he was going to find artifacts on the appellants
    computer. Cst. MacDonald agreed, saying he would have to speculate on user
    activity, hard drive size, and other factors that he would not know before the
    search.

[83]

The
    trial judge found it was speculative that artifacts would be found at the time
    of the search, as some seven to eight months had elapsed from the time of the
    uploading to the execution of the warrant.

[84]

The
    trial judge summarized the import of Cst. MacDonalds cross-examination by
    saying [a]t the time of drafting, he had no idea of any of this, of the usage,
    of the systems, etc. Nor, he had no idea as to the chances the artifacts on the
    computer would be there 7 to 8 months later. He couldnt say, he said if he
    tried it was speculation. The trial judge concluded that speculation was well
    below the standard for reasonable and probable grounds to believe that evidence
    would be found at the address searched.

The SCAJs Conclusion

[85]

Despite
    Cst. MacDonalds lack of detailed knowledge as to what would or could be found
    on the appellants computer equipment, and the delay of seven to eight months,
    the SCAJ concluded there were sufficient grounds on which the warrant could
    have been issued. The SCAJ found the trial judge had
not paid sufficient deference to Cst. MacDonalds ability to draw
    inferences and make deductions as a police officer and as an expert in online
    cloud storage and internet investigations. He was satisfied that the trial
    judge erred in equating the lack of knowledge of the precise manner of uploading/computer
    use and the inability to state the chances that electronic artifacts or use
    of the user account would be found.

[86]

I agree.

The Trial Judges Errors

[87]

As a
    matter of context, it is worth noting that the police investigation did not
    contribute to the delay. Cst. MacDonald testified that it takes NCMEC between 90
    days to 6 months to transfer the files received from the Electronic Service Providers
    to the designated foreign federal agencies. In this case, NCMEC completed
    transferring files to the RCMP in December 2012. After the investigative steps
    described above, Peel police applied for the warrant on January 21, 2013 and
    executed the warrant on January 23, 2013. This is not a case in which the lack
    of police diligence allowed evidence to grow stale.

[88]

Further,
    there is something more fundamental than staleness at issue here. Even if he
    had been cross-examined shortly after the files were uploaded to Skydrive, Cst.
    MacDonald would have been unable to state the chances that artifacts would be
    found during the search. Given his lack of knowledge about the computer devices
    from which the files were uploaded and their technical characteristics, he
    would not have able to quantify for the court the chances that any particular
    artifacts would be found. He would not have been able to say anything more
    definitive than what he explained in the ITO:

When these devices operate on the internet, electronic
    artifacts are left behind. These artifacts can be used to corroborate the
    information sent from Microsoft. With the information at hand, it is unclear it
    is one person using the account we.are.theborg@hotmail.com or two individuals.
    Further, if it is in fact one individual it is not clear if the suspect is
    travelling between the dwelling houses with a computer system and using the Internet
    service at each house, or is using the computer system(s) that are already
    present at the residences. Police wish to seize all computer system capable of
    operating on the Internet in order to identify, collect and preserve any images
    on the computer, as well as the electronic artifacts to afford evidence of
    possession of child pornography.
The further analysis of the computer
    system(s) will clarify  what computer(s) have access to this Microsoft account
.
    [Emphasis added.]

[89]

The
    fundamental point is that the assessment of reasonable grounds does not depend
    on mathematical notions of probability. Cst. MacDonalds inability to express
    the chances, i.e. the odds, of finding artifacts on the appellants computer
    does not mean that he lacked reasonable grounds. The standard is whether the
    authorizing justice of the peace, considering the evidence as a whole on a
    common sense, practical and non-technical basis, and drawing reasonable
    inferences therefrom, could have reasonably believed that there was evidence to
    be found at the place to be searched. The standard to be met is determined
    qualitatively by applying reason to the evidence, not quantitatively by
    attempting to apply notions based on the probability branch of mathematics. As Deschamps
    J. said in
R. v. Morelli
, 2010 SCC 8, [2010] 1 S.C.R. 253, at para.
    129: [d]etermining whether evidence gives rise to a credibly-based
    probability does not involve parsing the facts or
assessing them
    mathematically
 (emphasis added). She approved of the non-technical,
    common sense approach taken by Rehnquist J. in
Illinois v. Gates
, 462
    U.S. 213 (1983).

[90]

It
    is essential, as this court said in
R. v. Campbell
, 2010 ONCA 588, 261
    C.C.C. (3d) 1, at para. 54, affd 2011 SCC 32, [2011] 2 S.C.R. 549, that the
    grounds for believing there is evidence in the place to be searched are based
    on the operation of reason and not on mere suspicion. In determining whether
    there was a breach of the accuseds constitutional right, the test is whether
    there was reliable evidence in the sworn information before the justice that
    might reasonably be believed on the basis of which the justice could have
    granted the warrant:
R. v. Manders
, 2007 ONCA 849, at para. 11.

[91]

The
    starting point of the assessment of Cst. MacDonalds testimony about artifacts
    is his expertise in cloud computing and Internet investigations. He had much
    education, certification, and experience in electronic evidence collection and
    the forensic examination of computers. It is significant that throughout his
    testimony, he steadfastly maintained he had reasonable grounds for searching for
    artifacts. His opinion in a highly technical field had to be carefully
    considered and was deserving of weight.

[92]

During
    his prolonged cross-examination about the chances of finding artifacts, Cst.
    MacDonald conceded that the chances he would find evidence of the actual uploading
    of the child pornography on the appellants physical computer were most likely
    pretty low. He did clarify that he had grounds to believe the images were on a
    thumb drive or other external media. He reminded counsel of what the ITO he had
    indicated. The ITO indicated:

Other devices capable of storing electronic data may contain
    images of child pornography. Due to the type of files uploaded, there is reason
    to believe that the suspect used an external storage device, that at some point
    was plugged into a Windows operating system and later a Macintosh/Linux operating
    system, or vice versa. Police wish to seize all devices capable of storing
    electronic data to have it analysed for evidence of child pornography images.



The suspect uploaded some hidden files to the SkyDrive. This
    includes thumbnail image database (thumbs.db) for a Windows based operating
    system and a Desktop Services Store (DS_Store) for a Macintosh or Linux Operating
    System. The fact that both these files were loaded by the same user at almost
    the same time tells me these two files existed in the same folder.



In my experience, these files usually co-exist in one folder on
    a thumb drive, external hard drive, or other types of external media that can
    be plugged into a computer running the Windows operating system and a
    Macintosh/Linux operating system.

[93]

In
    response to other questions, Cst. MacDonald testified that he would be
    speculating
as to the chances
of finding artifacts. Specifically, he
    testified that he would not know the chances of finding artifacts until he knew
    the technologies. To estimate the chances of finding artifacts would
    necessarily require speculation on user activity, which varies depending on a
    number of factors unknown prior to the execution of the search warrant. He
    testified that it would be speculation as to what exact technologies - whether
    an iPad, computer or other device - were used, based only on the time, date and
    IP address provided by NCMEC.

[94]

Cst.
    MacDonald was clear that the artifacts he would be looking for were not limited
    to those created when the child pornography files were uploaded to SkyDrive. He
    gave two examples.

[95]

First,
    he indicated that artifacts would be created if the child pornography was viewed
    after it had been uploaded. He said, [a]s soon as you look at [the child
    pornography] you are going to create a cache and all that kind of different
    stuff on your computer. There is still lots of evidence. The issuing justice
    could have reasonably inferred that the files were uploaded for retention and
    later viewing. As Cst. MacDonald explained, later viewing of the files any time
    after their upload would create artifacts. This would be so even if the
    computer used to view the files was not the same one that had been used to
    upload the child pornography earlier.

[96]

Second,
    Cst. MacDonald indicated he was primarily interested in artifacts left by we.are.theborg@hotmail.com.
    Such an artifact need not be connected to the upload of the pornographic files some
    seven to eight months earlier. Any login into that SkyDrive account would
    create artifacts, and, in fact, use of we.are.theborg@hotmail.com at any time
    whatsoever, for any purpose whatsoever, would create artifacts that could
    connect the computer to the child pornography. Again, such artifacts would be
    highly relevant, even if the computer was not the same one that had been used
    to upload the child pornography months earlier. The issuing justice could
    reasonably infer the person who uploaded the child pornography would use their
    email account to access SkyDrive for other purposes as well.

[97]

While
    Cst. MacDonald was forthright that quantifying the chances of finding artifacts
    would be speculative, he could not be dissuaded from his view there were
    reasonable grounds to search the computer. The issuing justice could have accepted
    Cst. MacDonalds expert opinion, evident in the following exchange:

Q. Okay. So when youre talking about the artifacts because
    you  I mean youre saying you had grounds to believe that there should be
    artifacts that have some evidentiary value on computers, right?

A. Yes, there is.

[98]

As I
    understand it, Cst. MacDonalds testimony was not that the prospect of finding
    artifacts was speculative, but that quantifying the chances of finding
    artifacts would require him to speculate. The trial judge erred by concluding
    that the fact Cst. MacDonald could not express the odds of finding artifacts some
    seven to eight months later meant he was engaging in speculation and lacked
    reasonable grounds that artifacts would be found. She failed to recognize the
    assessment of reasonable grounds is qualitative. All the circumstances have to
    be considered, the passage of time being only one.

[99]

Considering
    all the circumstances, the issuing justice could have accorded the passage of
    time less weight, and attached greater weight to the expert opinion of Cst.
    MacDonald, in this highly technical field in which common sense intuitions
    about the lapse of time are less helpful.

(v)

The Reliability of the NCMEC Report

[100]

Given the trial
    judges several errors, it was the SCAJs task to determine if the warrant
    could have issued.

[101]

The SCAJ correctly
    observed that the information in a CyberTipline Report has hallmarks of
    reliability. The Microsoft username, email account, files uploaded, times of
    upload, and IP address of the computer that uploaded the files all come from
    Microsoft, not from NCMEC. Microsofts reports to NCMEC, and the CyberTipline
    Reports sent to police agencies, are mandated by statute. Microsoft is a large
    multinational corporation which took the initiative to co-develop PhotoDNA to
    combat child exploitation and comply with its statutory obligation. Microsoft
    has no interest in what the information transmitted to NCMEC consists of, as
    long as it complies with the relevant legislation. PhotoDNA is not subject to
    human judgment, but is generated electronically by a computer program, as an
    automatic response by Microsoft to their program determining that images are
    apparent child pornography.

[102]

In addition, the SCAJ correctly concluded that the
totality of the circumstances met the
Debot

standard of
    reasonableness
for assessing information from a non-police, third-party
    source.

[103]

The SCAJ found the information from Microsoft was compelling that
    an offence was committed. The files contained in the reports were examined by
    the local police, and it was their belief that many of the files constituted
    child pornography under the
Criminal Code
. The information about the
    file names and times they were uploaded, along with the username, email
    address, and IP addresses used to upload the files, was detailed and specific.

[104]

The SCAJ found the
    information from Microsoft was adequately corroborated. Corroboration of every
    aspect of information from a third-party source outside the police is not
    necessary. The three
Debot
factors  compelling, credible and
    corroborated  are not considered separately. Rather, the totality of the
    circumstances must meet the standard of reasonableness. Weaknesses in one area
    may, to some extent, be compensated by strengths in the other two:
Debot
,
    at p. 1168. Meaning, the quality of the information and the reliability of the
    source can compensate for weakness in corroboration.

[105]

The information at
    issue was not susceptible to independent corroboration. The police could only
    have asked Microsoft to provide the contents of the NCMEC Report directly to
    them. The SCAJ observed this 
would simply be a
    repetitive exercise and that [t]here is no further investigative technique
    which can be used by the police to corroborate the offence by the user without
    a search warrant.
The informations hearsay character did not exclude
    it from the issuing justices consideration.

(4)

The Trial Judge Erred in Finding the Nipiwin Search Undermined the
    Grounds for the Search of the Appellants Residence

The Trial Judges Reasons

[106]

The trial judge
    accepted the appellants argument that the police lost reasonable grounds to
    search the appellants residence after the search of the Nipiwin address. As
    indicated above, on executing the first warrant, the police learned that a young
    person with autism at the Nipiwin address used we.are.theborg@hotmail.com. His
    mother advised he had involvement with child pornography three years earlier.
    The young person denied responsibility for uploading the child pornography
    identified by NCMEC. Cst. MacDonalds subjective belief was the young person
    was involved in the uploading of the child pornography.

[107]

The trial judge noted
    that when the police arrived at the appellants residence, the appellant denied
    any knowledge of John E. and we.are.theborg@hotmail.com. The appellants mother
    said no kids came over to use the appellants computer or brought their own
    computers to the house. The appellant told the police they would not find child
    pornography on his computer, perhaps just an image of child nudity without sexual
    features. The police used a device to go onto the appellant's computer and
    found no connection to we.are.theborg@hotmail.com and no images of the child
    pornography identified by the NCMEC Report.

[108]

The trial judge
    emphasized that Cst. MacDonald agreed in cross-examination he had no grounds to
    believe the appellant had anything to do with the uploading of child
    pornography associated with we.are.theborg@hotmail.com. All the evidence Cst.
    MacDonald had at that point pointed to no connection between the two houses or
    the two suspects. Thus, she concluded that Cst. MacDonald lacked reasonable
    grounds to seize the appellants computer and external drives, saying it would
    not be objectively reasonable that there would be evidence of the uploading
    activity on the accuseds computer and storage discs at the time.

The SCAJs Conclusion

[109]

The SCAJ concluded the trial judge erred in finding
    that the police no longer had reasonable grounds after the Nipiwin search and
    the appellants denials. He identified several errors in the trial judges
    reasoning.

[110]

I agree with the SCAJs analysis.

The Trial Judges Errors

[111]

First, as the SCAJ
    pointed out, as a matter of law the validity of the search warrant does not depend
    on tying the appellant to the offence. The search warrant could have issued if
    there were reasonable grounds for discovering evidence of the offence at the
    appellants residence, even if the appellant was not the offender.

[112]

Second, the trial
    judge only considered if it was objectively reasonable to believe evidence of
    the
uploading
activity would be found. As explained above, artifacts of
    the use of we.are.theborg@hotmail.com at any time and for any purpose would be
    relevant evidence.

[113]

Third, as Cst.
    MacDonald pointed out, after the Nipiwin search there was still evidence that
    child pornography had been uploaded to SkyDrive from an IP address associated
    with the appellants home using we.are.theborg@hotmail.com email address.
    Nothing the police learned at the search of the Nipiwin address negated or even
    undermined that evidence. That evidence alone provided a reasonable basis to
    believe the appellant homes internet connection had been used to upload child
    pornography. A search of the appellants computer and storage devices was
    necessary to investigate this connection.

[114]

Fourth, the trial
    judge engaged in hindsight reasoning when she observed that the child
    pornography eventually found on the appellants computer was totally unrelated
    to the NCMEC report. It is true that the unique images and video files the
    police found at the appellants residence did not match those in the NCMEC Report.
    But, the fact that the evidence found was not the evidence searched for is irrelevant.
    The SCAJ correctly stated:

A reviewing judge does not consider what was found as a result
    of the execution of the search warrant but only whether there were reasonable
    and probable grounds that the issuing justice of the peace could have issued
    the search warrant at the time the ITO was issued. A reviewing judge should not
    consider whether or not evidence was found pursuant to the execution of the
    search warrant to determine whether the issuing justice could have issued the
    search warrant.

[115]

The trial judge did
    not consider whether the issuing justice could have viewed matters differently.
    The issuing justice could have accorded less weight to the appellants denials
    to the police that child pornography would be found on his computer and that he
    had no connection to the young person at the Nipiwin address. The issuing
    justice could have attached greater weight to the evidence that child
    pornography was uploaded from the appellants homes internet connection, and resultantly
    issued the warrant.

(5)

Section 24(2)

[116]

The SCAJ found that
    the
Spencer
breach was the only s. 8 breach. In view of the fact that
Spencer
was released after this search warrant had been issued and executed, the police
    conduct fell on the lower end of the spectrum. Considering this together with the
    other two factors

in
R. v. Grant
, 2009 SCC 32, [2009] 2 S.C.R.
    353, the SCAJ reasoned that an order excluding the evidence should not be
    granted. In my view, he was correct to do so.

E.

Conclusion

[117]

The SCAJ correctly concluded that the appellants s. 8 rights had
    not been infringed except for the
Spencer
breach. He properly declined
    to exclude the evidence under s. 24(2). I would dismiss the appeal.

Released: RGJ JUN 24 2019

R.G. Juriansz J.A.

I agree. David Watt J.A.

I agree. A. Harvison Young J.A.


