For eight years Scott Frankland was an RCMP officer specializing in computer forensics, investigating Internet crimes. About 75 per cent of his work involved child pornography, he reckons, and in cases where charges were laid, he says all of them ended with convictions.
Now retired from the RCMP, Frankland is working on the other side of a case, hired by the lawyer for a man charged with child pornography offences as a private consultant to help her defend him in court.
Frankland has attended the trial of Thomas O’Grady of Kilbride by sitting next to defence lawyer Rosellen Sullivan, guiding her by whispering in her ear as she cross-examined police investigators and civilian experts involved in the case.
On Thursday, Frankland took the stand himself as an expert witness in computer forensics and data recovery and analysis, tearing apart the investigation piece by piece as two of the forensic analysts involved in the case listened and sometimes scoffed in apparent disbelief.
O’Grady, 53, has pleaded not guilty to one charge each of possessing and distributing child pornography; charges laid in April 2017 after police received information about a local IP address (a specific computer identification number) being involved in accessing child pornography online.
A search warrant was executed on O’Grady’s home - which he shared with four other family members — and the police team set up tech triage units in the basement and in a van outside. Investigators searched the home and seized items, handing them to civilian members for a preliminary review.
Hundreds of images of child pornography were located, the court has heard, from a desktop computer found in the rec room, a portable hard drive found under a coffee table in the same room, and a jump drive found in O’Grady’s bedroom.
Frankland, who left the RCMP in 2016, began his testimony Thursday by describing what a typical search would have entailed while he was a member of the tech crimes unit. He spoke specifically of the police system of marking evidence with sticky notes during their search of O’Grady’s home.
“Sticky notes is definitely not in the RCMP policy in the handling of exhibits, I can guarantee you that. I don’t know what the current policy is, I’m not currently employed with the RCMP, but I guarantee you it’s not sticky notes,” Frankland said.
Frankland spoke of mistakes he believed police made in O’Grady’s case when it came to the triage of devices, the seizure of items, peer review of the evidence, and the way disclosure was presented to the Crown, which he said should have been on a CD. He focused most of his testimony on critiquing a lengthy report on the evidence completed by one of the RCMP’s civilian tech experts involved in the case.
“As a forensic investigator, what is missing (from the report)?” Sullivan asked.
“Everything of evidentiary value,” Frankland replied.
Frankland said he believed, after reviewing that report alone, that there was no evidence to determine any of the devices seized by police were responsible for uploading images of child pornography on one of the dates alleged.
He said the report had been unclear on whether or not the child pornography images that had been found on the devices were accessible or had been deleted at the time of the police search.
“In order to charge someone with possession, they have to be accessible,” he said.
Frankland said there was a Skype conversation located on a desktop computer in O’Grady’s basement family room that constituted, in his opinion, two pedophiles talking about the sexual abuse of children. The two people had exchanged images during the chat, he said, though in his opinion the images were not child pornography. He was not able to associate any of the images of child pornography found on the devices to the Skype chat, he said, because there wasn’t enough information in the report to allow for that determination.
Under the Criminal Code, the definition of child pornography includes not only photos, but text as well.
Frankland insisted a timeline analysis of all activities undertaken with the devices during the time period in question would have helped determine the “user behind the keyboard.’
“Child porn was located on removable devices. Seeing what devices they were plugged into would go a long way in determining who was responsible,” he said.
Frankland acknowledged during his time on the witness stand that he has not completed any training courses in his field since 2012, though he said he keeps himself up to date on the technology involved.
Prosecutor Paul Thistle will cross-examine Frankland when O’Grady’s trial resumes today.
Twitter: @tara_bradbury
RELATED