Your World of Legal Intelligence
 Hong Kong | 1-800-335-6202

Hksar v Leung Chi Keung

Judgment Cited authorities 4 Cited in Precedent Map Related
Vincent
Judgment Date19 May 2016
Year2016
Judgement NumberCACC373/2015
Subject MatterCriminal Appeal
CourtCourt of Appeal (Hong Kong)
CACC373/2015 HKSAR v. LEUNG CHI KEUNG

CACC 373/2015

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF APPEAL

CRIMINAL APPEAL NO. 373 OF 2015

(ON APPEAL FROM DCCC NO. 97 OF 2015)

________________________

BETWEEN
HKSAR Respondent
and
LEUNG CHI KEUNG（梁志強） Applicant

________________________

Before: Hon Macrae JA in Court
Date of Hearing: 12 May 2016
Date of Judgment: 19 May 2016

________________________

J U D G M E N T

________________________

Introduction

1. The applicant was convicted after trial by HH Judge Dufton (“the judge”) in the District Court on 25 September 2015 of one charge of possession of child pornography, namely 10 video films and 4 still films being stored in a computer hard disk, contrary to section 3(3) of the Prevention of Child Pornography Ordinance, Cap 579. He was acquitted of a separate charge of possession of apparatus for radiocommunications without a licence, contrary to section 8(1)(b) and section 20(a) of the Telecommunications Ordinance, Cap 106. On 15 October 2015, the applicant was sentenced to 14 months’ imprisonment on the charge of possession of child pornography. On 27 October 2015, he applied for leave to appeal against both his conviction and sentence.

2. On 25 April 2016, the applicant abandoned his application for leave to appeal against sentence. This judgment is concerned, therefore, only with the question of leave to appeal against conviction for a single charge of possession of child pornography.

The trial

3. There was no dispute that the child pornography as particularised in the charge, of which ten files were classified as Level 4 child pornography and four as Level 2, were found in the hard disk of a computer (Exh P1), which was in the ownership and possession of the applicant on the day it was seized by police officers from the applicant’s bedroom, namely 29 January 2014.

The prosecution case

4. It was recognised from the outset that the issue in the case was the applicant’s knowledge of the material on his computer.

5. The prosecution invited the judge to infer knowledge from the circumstances of the finding of the computer, from the admission made by the applicant that he owned and possessed the computer on the material day, and from the evidence of DSPC 23344, an expert on computer forensic examination. The expertise of DSPC 23344 was not disputed and the judge was satisfied that the witness was able to give evidence as an expert.[1]

6. The evidence of DSPC 23344 comprised his oral evidence as well as three written statements, which were adopted as part of his evidence-in-chief, pursuant to section 65B of the Criminal Procedure Ordinance, Cap 221 (Exh’s P10, P11 & P12). He dealt with the examination of the hard disk of the computer concerned by the forensic programme “Encase”, the finding of the child pornography (video files and photo files)[2], the subject of the charge, and the shortcut files linked to the video files[3] (“the shortcuts”), as well as the “restoring” of the hard disk contents of the computer to an external hard disk (Exh P5), which became a complete and accurate clone of Exh P1.[4] It was an admitted fact that 14 images were extracted from the hard disk by PC 4384, which were contained in an album and produced as Exh P6.[5]

Location and “last access” to the child pornography

7. Child pornography videos and photographs[6] found by DSPC 23344 in the computer (Exh P1) were listed in a tabulated summary (Exh P13)[7]; the computer path to the child pornography videos and photographs being Users – user – downloads – Foxy – download in C drive.

8. The shortcuts found were created and had appeared in the RealPlayer programme (“RealPlayer”) File menu and/or Window Start menu[8]; the correlation of these shortcut files with the video files was summarised in an agreed table (Exh P14).[9]

9. For access to the videos and photo files, DSPC 23344 explained in his statement[10] that the Last Accessed Timestamp in the computer (Exh P1) was disabled, which meant that “at any time the file is opened the Last Access date will not make any change”.[11] The last access time of the video files[12] shown may not therefore be the last time the files were viewed.

10. However, the disabling of the Last Accessed Timestamp did not affect the last access time of the shortcut files. When a user took a shortcut link to a file, the last access stamp for that shortcut file would change, without changing the last access time for the original file. The true last access time would therefore be shown by that of the shortcut link file.[13]

11. It could be established that the files were mostly created in September 2008 or October 2008, save for one created in July 2009. The last access times were mostly on the same day that they were created or the following day, with one or two exceptions; for example, there was a file which had last been accessed a month after creation.

12. The evidence of last access, in the form of the presence of shortcut files created at various times between September 2008 and April 2013, showed that the files had been opened by RealPlayer and/or other video playing programmes. The last access times of the shortcut files were between June 2012 and April 2013.

13. I have summarised this evidence in the following table:

Item No. in Annex A to Exhibit: Type File Created Last Access/Written Shortcut (S/C) (Annex B to P11)[14] S/C(s) in[15] Last Access via S/C[16] P6[17]Image No. Level[18]
Video Files
2 P10 3gp 08-09-27 08-09-28 No.1 Real+WSM 12-06-01 13 2
3 P10 3gp 08-09-27 08-09-27 No.4 Real+WSM 12-06-01 8 4
6 P10 3gp 08-09-27 08-09-27 No.7 Real+WSM 12-11-26 7 4
7 P10 3gp 08-09-27 08-10-29 No.2 Real+WSM 12-06-01 9 4
9 P10 mpg 08-09-28 08-09-28 No.5 Real+WSM 13-04-24 10 4
10 P10 rmvb 08-09-28 08-09-28 -- N/A N/A 5 4
11 P10 wmv 09-07-28 09-07-28 No.9 WSM 12-11-28 14 4
1 P11 rmvb 08-09-27 08-09-27 No.8 WSM 13-04-24 6 4
2 P11 3gp 08-10-13 08-10-13 No.10 Real+WSM 12-06-01 11 4
3 P11 3gp 08-10-13 08-10-29 -- N/A N/A 12 2
Photo Files
13 P10 jpg 08-09-13 08-09-13 -- N/A N/A 1 2
15 P10 jpg 08-09-28 08-09-28 -- N/A N/A 3 4
16 P10 jpg 08-09-28 08-09-28 -- N/A N/A 4 4
20 P10 jpg 08-09-27 08-09-27 -- N/A N/A 2 2

Ways of Access to the child pornography

14. In his submissions before me, Mr Nicholas Wong, for the respondent, suggested that there were at least five methods of accessing the material concerned. At trial, DSPC 23344 demonstrated the accessing of the files from the full path C\Users\user\Downloads\Foxy\Download (the “Download” folder), and the shortcut files from the path C\Users\user\AppData\Roaming\Microsoft\Windows\Recent.

15. All of the suspected child pornography could be seen in the “Download” folder under the “Foxy” folder, among a list of 181 files. DSPC 23344 believed that they had been downloaded through the Foxy Application. In the folder “Recent”, there were 150 files, including the shortcuts linked to the child pornography files.

16. In the demonstration in court, access of the files using shortcuts was done by clicking the start menu on the simulation of the computer’s user home screen (“Start Menu”), and then “Document”, which opened up the box (“the Box”) showing the names given to the shortcut files, including the name of the child pornography files.[19]

17. Access to the files could be from the full path through file manager under the Start Menu; and the alternative way was by accessing the “user” folder either through Start Menu by clicking “user” on the top line of the Box[20], or by the “user” icon on the home screen page.[21]

18. It was also possible to access the files through the RealPlayer programme. After opening the RealPlayer from the Start Menu, by clicking “File(F)”, a box with shortcut files was then displayed[22]; one of them was a suspected child pornography video.

19. Those videos, which were not amongst the displayed shortcut files, were accessed by clicking “Open(O)” or Ctrl+O at the top of the said box; the “Download” folder was then reached.[23]

20. DSPC 23344 disagreed with defence counsel at trial that a file could be opened and a shortcut created without the video being played. The witness then demonstrated the playing of a video at the request of the judge. It was thereby demonstrated that after the video was played, shortcuts to the played video file had been automatically created and they replaced the shortcuts as displayed in paragraphs 15 and 17[24] (supra); since the number of shortcuts that could be shown in the Box was limited.[25]

21. It was confirmed in evidence that the files could also be opened and viewed directly from the Foxy application (“Foxy”).

Downloading files using Foxy

22. As discussed above, all of the files concerned were found in the “Download” folder of Foxy and were believed to be downloaded through the said application. DSPC 23344 explained that Foxy was a “peer to peer” file sharing application: files would not be downloaded automatically by Foxy; a user had to make a choice as to what file was to be downloaded from a list of file names displayed by the search engine which hit the keyword search.[26]

23. DSPC 23344 confirmed that there was no record of search for child...

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT