R v L, SJ [2026] SADC 44

Prosecution: R Counsel: MR P SCHAEFER - Solicitor: DIRECTOR OF PUBLIC PROSECUTIONS (SA) Defendant: L, SJ Counsel: MR O GREEVES - Solicitor: LEGAL SERVICES COMMISSION (SA) Hearing Date/s: 23/06/2025, 17/07/2025, 04/08/2025, 18/09/2025 File No/s: DCCRM-23-016576 B DISTRICT COURT OF SOUTH AUSTRALIA (Criminal) DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment. The onus remains on any person using material in the judgment to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court in which it was generated. R v L, SJ [2026] SADC 44 Judgment of Her Honour Judge Mackenzie 1 May 2026 CRIMINAL LAW - PARTICULAR OFFENCES - CHILD EXPLOITATION MATERIAL OFFENCES - TAKING A STEP The defendant was charged with six counts of taking a step toward obtaining access to child exploitation material (CEM), intending to obtain access to CEM. The prosecution case relied on circumstantial evidence to prove that it was the defendant who had conducted the six charged internet searches by typing terms into a search engine on his computer or by clicking on links to web pages in search of CEM on the internet. Rulings were made on the admissibility and use of discreditable conduct evidence pursuant to s 34P of the Evidence Act 1929 (SA), including forensic artefacts relating to uncharged search terms, cross-admissibility of uncharged searches, images found in the cached memory of the computer and a photograph taken on the day of the police search of the computer’s browser-history. The evidence may point to a likelihood that the defendant conducted the charged searches, but likelihood is not proof beyond reasonable doubt. There were two other occupants of the defendant’s house who could have accessed the defendant’s computer because it was in a multi-use space in the house and was not password protected. The forensic artefacts relied upon by the prosecution did not identify the defendant as the user of the computer at the time of each charged search and no other contemporaneous identity-marker activity was found to exist. An alternative rational explanation that another person with access to the computer conducted the charged searches remains open on the evidence. -- 1 of 42 -- [2026] SADC 44 2 As the prosecution failed to establish the defendant made the charged searches, it was inappropriate for the Court to determine whether the elements of the offence for each charge were satisfied. Any such determination would rest on a hypothetical factual finding not established in this case. Held: Prosecution has failed to prove each charged offence beyond reasonable doubt. Verdict: Not guilty on all counts. Criminal Law Consolidation Act 1935 (SA); Juries Act 1927 (SA); Evidence Act 1929 (SA), referred to. F, BV v Magistrates Court of South Australia (2013) 115 SASR 232; R v Finnigan (No. 3) [2015] SADC 166; R v Finnigan (No. 2) [2015] SADC 55; Finnigan v The Queen [2014] SADC 34; R v Winner (1995) 79 A Crim R 528; Kane (A Pseudonym) v The King [2024] SASCA 70; R v Falzon (2018) 264 CLR 361; R v Garner; R v Webb (2021) 140 SASR 454; R v Heinze [2017] SASCFC 155; IMM v The Queen (2016) 257 CLR 300; R v Fleming; R v Maher (2017) 129 SASR 27; Perry v The Queen (1982) 150 CLR 580; Sutton v The Queen (1984) 152 CLR 528; Peacock v The King (1911) 13 CLR 619; Barca v The Queen (1975) 133 CLR 82; R v Keyte (2000) 78 SASR 68, considered. -- 2 of 42 -- R v L, SJ [2026] SADC 44 Publication note: This version is prepared for online publication. Explicit terms, graphic descriptions and URL query strings have been suppressed. Introduction 1 It is alleged that during a period in mid-2022 the defendant took a step to access child exploitation material (CEM) by typing terms into a search engine on his computer, or by clicking on links to web pages, with the intention of obtaining access to CEM over the internet. 2 A pivotal issue for determination is whether it was the defendant who conducted the impugned internet searches. The evidence revealed there were two other occupants of the house, being the defendant’s spouse and the defendant’s teenage son, and that the computer was set up in a multi-use room in the house to which they all had access. 3 If I am satisfied to the requisite standard that the defendant conducted the impugned searches, the prosecution must still satisfy me beyond reasonable doubt of each of the elements constituting the offence for each count. In circumstances where there was no direct evidence of CEM accessed as a result of the impugned searches, the issues relevant to the elements of the offence for each count are: 1. whether the internet search would have yielded (or would be apt to yield) access to CEM; 2. whether the material sought was CEM; and 3. whether the defendant had intended to access CEM by conducting the impugned internet search. 4 Prior to determining any substantive issues it is necessary to rule on the admissibility and use of discreditable conduct evidence (DCE) which was received on a provisional basis during the trial. Charged counts 5 The defendant is charged with six counts of “taking a step” towards obtaining access to CEM, pursuant to s 63A(1)(b) the Criminal Law Consolidation Act 1935 (SA) (CLCA). A summary of the charge for each count appears at Annexure A to these reasons. 6 At the commencement of the trial the prosecution elected to confine its case on each count to a charge that the defendant took a step towards obtaining access to CEM, intending to obtain access to CEM, pursuant to s 63A(1)(b). As such, the prosecution did not seek to prove that the defendant obtained, or obtained access to, CEM; however, evidence that the searches would have yielded access (or, at least would have been apt to yield access) to CEM was still required. -- 3 of 42 -- [2026] SADC 44 2 7 Each of the six counts relates, in turn, to a particular internet search term or webpage title (described at Annexure B). For counts 1 to 4, the search terms are alleged to have been typed on the computer keyboard into a search engine; for counts 5 and 6 the search is alleged to be of a title to a webpage linked to a previously searched URL1 address or a screen pop-up that was clicked on by the defendant. 8 The defendant elected to be tried by a judge sitting alone without a jury.2 Elements of the offence 9 Section 63A(1)(b) provides (emphasis added): A person who- … (b) intending to obtain access to child exploitation material … obtains access, or takes a step towards obtaining access, to child exploitation material …; is guilty of an offence. 10 There are three elements of the offence of taking a step toward obtaining access to CEM: 1. the defendant took a step to obtain access to material; 2. the material was CEM; 3. the defendant intended to obtain access to CEM. 11 There is a large degree of overlap between the three elements. Taking a step 12 The first element requires the prosecution to show that the defendant took a step to obtain access to material. For each of the charges the prosecution argues that step was the action by the defendant executing an internet search for CEM by typing, or clicking on a webpage link for, the impugned search terms. 13 The taking of a step for the purposes of s 63A(1)(b) requires an act that moves the defendant along the path to obtaining access to the material in a real way, and is part of a series of steps that would ultimately lead the defendant to obtaining CEM.3 If the step is not a material step, in a series of steps, which if taken would yield access to child pornography, the charge must fail.4 The step taken by the 1 A URL (uniform resource locator) is a “technical address” being the text-based address used to find source locations on the internet such as web pages, images or files. 2 Section 7 of the Juries Act 1927 (SA). 3 F, BV v Magistrates Court of South Australia (2013) 115 SASR 232. 4 R v Finnigan No. 3 [2015] SADC 166 at [69]; F, BV at [49]-[50] Kourakis CJ. -- 4 of 42 -- [2026] SADC 44 3 defendant must be one which is more than merely preparatory in nature.5 To take a step towards obtaining access implies the existence of CEM.6 14 In the course of the trial a question arose as to whether the conduct element requires more than taking a step which is apt to yield access to CEM. The issue can be traced to the contrasting remarks of Kourakis CJ and Vanstone J in F, BV v Magistrates Court of South Australia & Anor.7 In that case the then Chief Justice was of the view that the prosecution needed to establish that the impugned searches would have resulted in the user obtaining access to CEM; whereas Vanstone J thought it was enough that each internet search would be apt to lead to access to CEM.8 15 These matters were also in contest in Finnigan v The Queen9 where Millsteed DCJ granted a stay of proceedings on a charge of taking a step that would have led to child pornography (then being the relevant offence) because there was no evidence of what search results Google (in that case) displayed in response to the search term used on the day of the offence or which established the content of the websites accessed on that day. Millsteed DCJ adopted the construction expounded by Kourakis CJ and rejected the “apt to lead” construction preferred by Vanstone J because he thought the latter construction might embrace acts which are merely preparatory in nature (for example, obtaining from someone the name of a pornographic website displaying child pornography).10 In the case before me, the prosecution submitted that the “apt to lead” formulation was sufficient, though maintained that the higher threshold had nevertheless been satisfied on the evidence presented. The defence contended that the evidence presented did not prove the searches would yield CEM. 16 The unresolved tension in F, BV illustrates the difficulty in defining the requisite nexus between the step taken and actual access. The difficulty is compounded by the other elements for the offence necessarily engaging with the nature of the material being sought. However, in a case confined to s 63A(1)(b), and given the purpose of the provision,11 the offence does not in my opinion necessitate investigators replicating or reconstructing the impugned searches to establish they encounter CEM at or about the relevant time. That said, other evidence to prove that the search terms would have yielded, or been apt to yield, access to CEM is still necessary;12 this differs to the analogue “attempt” offence under s 270A of the CLCA.13 5 R v Finnigan (No. 2) [2015] SADC 55 at [43]. 6 F, BV at [50] per Kourakis CJ. 7 F, BV at [50] per Kourakis CJ, at [178] per Vanstone J. 8 Ibid. 9 [2014] SADC 34. 10 Ibid at [66]. 11 South Australia, Parliamentary Debate, House of Assembly, 26 October 2004, 561 (MJ Atkinson, Attorney-General). 12 Finnigan at [66]; Finnigan (No. 2) at [43]-[45]. 13 Finnigan (No. 2) at [52]. -- 5 of 42 -- [2026] SADC 44 4 17 For reasons I will come to, I am not satisfied beyond reasonable doubt that it was the defendant who conducted the charged searches. The prosecution therefore necessarily fails at the threshold factual stage. In those circumstances it would be artificial and inappropriate to determine whether the prosecution was required to establish that the impugned searches “would have yielded” access to unlawful material, or whether it was sufficient that they were merely “apt to lead” to unlawful material. Any such determination would rest on a hypothetical factual foundation that is not established in this case. Material was CEM 18 Pursuant to section 62 of the CLCA, material is “child exploitation material” if it: 1. describes or depicts a child under, or apparently under, the age of 17 years engaging in sexual activity; or 2. consists of, or contains, the image or representation of a child under, or apparently under the age of 17 years, or the bodily parts such of such a child, or in the production of which such a child has been or appears to have been involved; and 3. is of a pornographic nature. 19 Relevantly for this matter, the prosecution accepted the pornographic characteristic was limited to the material being intended or apparently intended to excite or gratify sexual interest.14 Paragraph (b) of the definition of CEM was also irrelevant, relating to “a child-like sex doll”. 20 For offending under s 63A(1)(b) which is limited to “taking a step towards obtaining access” it is apparent that there will not necessarily be any actual “material” from which to assess whether it was CEM. 21 In these circumstances, I consider this element looks to the material that the prosecution establishes the search would have yielded (or was apt to yield) pursuant to the first element of the offence. To satisfy the second element, that material must be the kind of material that depicts a child under 17 years (or apparently under 17 years of age) or their bodily parts, and be of a pornographic nature. 22 An issue in this case was whether the prosecution needed to identify the item of CEM for each count to which the internet search, being the step, was directed to obtaining. Without identification of the specific material the defence contended that a determination that it related to children, and of its objective pornographic nature, could not be made; and the offence did not criminalise immorality alone. 14 The prosecution conceded that paragraph (b) of the definition of “pornographic nature” had no application to this case. -- 6 of 42 -- [2026] SADC 44 5 The prosecution submitted that the search terms themselves, read with their ordinary meaning and within the context of surrounding user activity, show the defendant was seeking pornographic depictions of children or their bodily parts. The admissibility of the uncharged searches and images found in the cache memory of the computer are matters to which I will return when addressing the admissibility and use of DCE. 23 As noted above, as the prosecution has failed at the factual threshold of attribution, it would be artificial and inappropriate to determine whether the search terms themselves, read in context, were sufficient to prove the second element. Any such determination would rest on a hypothetical factual foundation that is not established in this case. Intention 24 The third element concerns the defendant’s state of mind. 25 There is a degree of overlap with the other elements because it must be established that the defendant intended to obtain access to CEM; that is, by taking the alleged step. 26 The precise ambit of this element, in circumstances where there is no subject material in evidence, is unclear. I consider the material the prosecution must point to in order to establish intention to access CEM is the same material necessary for the prosecution to adduce to prove the second element. In contrast to s 63A(1)(a), which expressly requires only that the defendant knows of the pornographic nature of the material in their possession and not whether it features children, s 63A(1)(b) expressly requires that the defendant intends to obtain access to CEM – or takes a step towards obtaining such access. Section 63A(1)(b) would therefore appear to require not only that the material to which the defendant is intending to access be pornographic, but that it also depict children. 27 To my mind, in circumstances of a step to obtain material by way of an internet search, for this element of the offence, the prosecution must prove beyond reasonable doubt that the kinds of material the offender was intending to obtain were both of a pornographic nature and depicted children under 17 years of age or their bodily parts (or images or representations of them). Therefore it would seem the prosecution would fail to satisfy this element if there remains a rational inference to be drawn from the evidence that the person conducting the internet searches was, for example, intending to obtain access to pornographic material but not of children under 17 years of age; or, they were intending to obtain access to material depicting children but which was not of a pornographic nature. 28 The prosecution submitted that, taken objectively and in context, the defendant’s intention was borne out by the nature of the internet searches made because for each count the searched phrase, particularly where it was typed, allegedly conveys a clear “child-sexual” meaning. The prosecution submitted that this intention was bolstered by surrounding (uncharged) searches directed to -- 7 of 42 -- [2026] SADC 44 6 pornographic material (the extent to which those uncharged searches were admissible evidence is an issue to which I will return). The prosecution also sought reinforcement from two allegedly pornographic images found in the cache memory of the computer (that submission was also subject to admissibility of the images – a topic to which I will return when considering DCE). 29 The defence contended that even if the nature of the internet searches reveal that the defendant has morally objectionable interests, that is not sufficient to prove that he had intended to obtain access to CEM. The defence rejected the prosecution’s reliance on the two allegedly pornographic images found in the computer’s cache memory (if admitted for a permissible use) and pointed to the automatic nature of cache images being stored during internet browsing. 30 At this stage of the analysis, it is neither necessary nor appropriate for me to determine the proper construction of the search terms in isolation; the threshold issue remains whether the prosecution has proved beyond reasonable doubt that the defendant conducted the searches. As already stated, for reasons that I will come to, I find that the prosecution has failed at the factual threshold of attribution, and it is therefore unnecessary to determine whether the search terms themselves, read in context, were sufficient to prove the third element. General directions 31 In a trial by judge alone it is not necessary for the judge to replicate every direction that would be given in a summing up to a jury.15 With this in mind, I set out some preliminary matters which have guided my consideration of the evidence in this matter. 32 The prosecution bears the onus of proving the guilt of the defendant at all times. The defendant is presumed innocent of the charges unless and until his guilt has been proved beyond a reasonable doubt. 33 The standard of proof is beyond reasonable doubt. The defendant cannot be found guilty of an offence unless the evidence which I accept satisfies me of his guilt beyond reasonable doubt. In these reasons, if I use the words “proved”, “established”, or “satisfied”, in each case I mean to an extent which excludes a reasonable doubt. 34 I must assess each witness as to their truthfulness and reliability. I must determine whether I can rely upon the evidence given by each witness. I can reject or accept all or part of a witness’ evidence. 35 I must bring an open and unprejudiced mind to the matters before me. This is particularly important in this case where the subject matter of the charges 15 R v Winner (1995) 79 A Crim R 528 at 530-531, cited in R v Keyte (2000) 78 SASR 68 at [54]. -- 8 of 42 -- [2026] SADC 44 7 allegedly affects innocent children. I must make my decision without sympathy or prejudice and not be influenced by public opinion in relation to this matter. 36 There was no defence case. The defendant did not give evidence. That was his right. I cannot, and do not, draw any adverse inference against him for declining to give evidence. 37 The defendant is charged with six separate counts. Each of these counts must be considered separately and only in relation to the evidence that is admissible in respect of each. I address below the prosecution’s application for cross- admissibility of the charged acts as evidence to establish each count. Agreed and Uncontroversial Facts 38 The following facts were either formally agreed between the parties16 or not controversial on the evidence. 39 On 7 September 2022 police attended the defendant’s home to execute a search warrant. At that time, the defendant resided at the address with his spouse. His teenage son also resided between the defendant’s house and his mother’s house throughout 2022 and prior to 7 September 2022.17 The usual arrangement was that the teenage son would stay with his father on weekends and during school holidays.18 He was 14 years old in September 2022.19 40 During the search, police located a desktop computer in a room at the front of the house. The room was accessible from shared parts of the house and was not secured or restricted. The evidence did not establish that the room was used exclusively by the defendant. 41 The desktop computer was powered on at the time police entered the room. The operating system was logged in and accessible without any password being entered. There was no evidence that the defendant was the only person who had physical access to the computer. Further, there was no evidence of separate user profiles, passwords or technical measures restricting access to the computer by other household members. 42 The desktop computer and other electronic devices were seized. The desktop computer was subsequently forensically imaged by the Digital Evidence Section of South Australia Police using accepted forensic procedures. Hash values were generated to confirm the integrity of the forensic image, and there was no issue taken with the integrity of that image.20 16 Statement of Agreed Facts at MFI P9 and MFI P9A (Statement of Agreed Facts and the Supplementary Agreed Facts). 17 MFI P9 – number 4. 18 MFI P9 – number 5. 19 MFI P9 – number 3. 20 During the trial the defence withdrew an earlier objection to the functionality of the Axiom software. -- 9 of 42 -- [2026] SADC 44 8 43 The forensic image revealed that the computer contained multiple internal hard drives. The analysis relevant to this matter concerned one hard drive, referred to in the evidence as “drive D”. That drive contained artefacts generated by multiple internet browsers, including Mozilla Firefox and Opera– as well as via the Google DuckDuckGo search engines, together with documents, images and other stored data. Witnesses 44 The prosecution called four witnesses. No issue was raised about their credibility and I find each of them to have honestly presented their account of events. For reasons that I will come to I found there to be some limitations in the underlying forensic material prepared on the filtering and tagging instructions of Detective Young. These limitations affected the inferences I was prepared to draw from Detective Young’s evidence and from that material, but this was not caused by any lack of honesty on his part. Detective Bray 45 Detective Bray attended the defendant’s house in Salisbury on 7 September 2022 at around 8.30am and participated in the execution of the search warrant. His evidence was directed to the physical circumstances in which the desktop computer was found in a room in the house which he described as a “study” and the steps taken by police upon entering that room. 21 He observed that there was other computer-related equipment in the room, including a 3D printer, a laptop in a bag that was not set up, an internet modem, computing magazines, a large number of boxes containing computer-related items, plus paperwork and associated records. He also noted that there were paper documents on or around the desk, including a printed email and another document in the defendant’s name positioned under the right-hand monitor on the desk with a medication bottle sitting on it. 46 Detective Bray described the computer as powered on, logged-in and connected to three monitors via a “tower”.22 He accessed the internet browser- history on the Mozilla Firefox browser, which was open, and observed a list of prior web entries on the computer screen, including entries he regarded as significant because they showed the titles of what he considered were pornographic-related webpages or searches in the history view (with terms like “first anal” and “preteen panties”).23 Detective Bray also observed that there was a YouTube video open on the central monitor, entitled “Americans being idiots …”.24 21 T19-21. 22 T22. 23 T156 and Exhibit P1A. 24 T231.26. -- 10 of 42 -- [2026] SADC 44 9 47 He photographed the computer screens and the surrounding area of the room.25 Detective Rex 48 Detective Rex was also in attendance at the search of the house on 7 September 2022. He was responsible for logging of the desktop computer and other devices seized. 49 Detective Rex also gave evidence about his observations at the time of the search. Relevantly, he described a bedroom in the home as being possibly that of a teenage boy.26 50 He also described the room in which the computer was found as a “study” containing a variety of items.27 He indicated features of the room from which it could be inferred that it was a room accessible to other occupants of the house, and confirmed no password was required to access the computer at the time of police attendance.28 He recalled Detective Bray just moving the mouse and the screen then opening up with what appeared in the photos taken of the screens at that time.29 51 He observed that the study was not just a computer space and also contained what appeared to be a musical organ or keyboard, shelves with an audio speaker, an audio mixing desk, plus items like paintbrushes, a model aeroplane, and what appeared to be bottles of alcohol on top of the shelving. During cross-examination he characterised the room as a “multi-use space” rather than just being a study.30 Mr Abdalla 52 Mr Abdalla, a digital evidence specialist with the South Australian Police, gave expert evidence concerning the forensic imaging of the computer and the interpretation of artefacts extracted from that forensic imaging. He explained the operation of the digital forensic software, known as Magnet Axiom,31 and the manner in which it parses32 existing data generated by browsers and operating 25 Exhibits P1 and P1A. 26 T38, T40. 27 T34, T37. 28 T40. 29 T39-40. 30 T38-39. 31 Magnet Axiom was described as a widely used forensic tool that processes forensic images, parses and categorises data (such as, web history, searches, images, logins) and presents material in a graphical interface for investigators. See T53-4. 32 Mr Abdalla explained “parsing” and “carving” as two different recovery methods used in digital forensics as displayed in Axiom-generated reports, with different implications about where the data came from and whether it had been deleted. For “parsing” the item was found on the computer through Axiom’s processing of the imaged drive and does not involve reconstruction. For “carving” the file has been deleted (or is not present as a normal intact file entry as for a parsed artefact) and so the file is carved out of unallocated disk space (often associated with deleted items) and it might also be carved out of documents or compressed items (such as from PDFs or zipped or other compressed containers, including embedded images in documents). If an image is carved, Mr Abdalla said that he could not determine whether it was originally a standalone picture or part of a video and so there is a degree of uncertainty about the original context of carved artefacts. See T54-55, T105-106. -- 11 of 42 -- [2026] SADC 44 10 systems. He confirmed that the relevant hard drive, referred to as “Drive D”, from the desktop computer was successfully imaged and hash-verified so that it could be used by investigators in this case.33 53 Mr Abdalla identified and explained the compiled forensic reports before the court originally in MFI P2 (and later becoming Exhibit P2) that were prepared by him at the request of Detective Young and based upon artefacts tagged by Detective Young. He gave evidence about the reports of the Mozilla Firefox and Opera web browser-history, the distinction made between typed searches and non- typed access, URLs, visit counts, timestamps, the database sources (for example, “SQlite”34), and “IDs”. Mr Abdalla described how search terms, such as those charged, appear in the data; how users can move from search results to videos or images; and how subsequent URLs are generated by clicking results or tabs with references to “web”, “videos” and “images”. 54 Mr Abdalla explained cached images and recovered files. In relation to cached images, Mr Abdalla explained that images may be stored automatically by browsers as part of routine operation to enable acceleration of browsing.35 He confirmed that cached images do not need to be viewed or even be viewable by the user,36 and therefore they may never have been consciously viewed by a user. In cross-examination Mr Abdalla also agreed that the presence of cached images does not, of itself, establish intention or deliberate engagement with the content of those images; and that often cached images cannot be traced to a specific website with any certainty.37 55 During cross-examination, Mr Abdalla also accepted that desktop computers can be shared by different users, Windows 10 can be configured without passwords and browser logins do not prove who was at the keyboard at a particular time.38 He also agreed that the forensic reports (produced using Axiom) were not a full chronology of all computer activity and contained only those items that Detective Young had chosen to tag.39 He agreed that some of the records are duplicate representations of the same activity viewed through different Axiom categories.40 He further accepted that many URLs do not prove what content was actually displayed and confirmed that he did not visit any of the URLs (relevant to the charged and uncharged searches) himself and he could not say whether any of the 33 Hash verification was described as a mathematical fingerprint used to confirm that the image is an exact copy of the original hard drive. See T48-51. 34 “Places.sqlite” was identified as a database within Mozilla Firefox, from which Axiom extracted web- history information. So in the reports at Exhibit P2 any file path ending in “Places.sqlite” displays where on the computer the browser-history database sits. The “location/ID” references then describe which record or row inside that database contains the specific history entry. See T64-65, T92-94 and T111-112. 35 T103, T112. 36 T112, T114. 37 T113-114. 38 T107-109. 39 T109, T115, T117, T119-120, T123. 40 T115. -- 12 of 42 -- [2026] SADC 44 11 specific webpages contained CEM.41 Further, he confirmed that it is possible for one user account to be used by multiple users, and Windows 10 (used in the defendant’s computer) can be signed into without needing a password.42 56 Mr Abdalla was also questioned about whether he found any evidence of malware on the computer.43 He acknowledged that he found one piece of malware but was not able to explain what it does and accepted that it is theoretically possible other malware existed.44 Detective Young 57 Detective Young was also in attendance at the search of the defendant’s home on 7 September 2022. He has 22 years of policing experience, with about 10 years as a detective.45 He has been involved in an estimated 50 investigations involving child protection and exploitation-related matters, including managing offenders through the ANCOR unit.46 His experience involved reviewing devices and storage media, including examining browser activity and stored files to identify material relevant to such investigations. 58 He gave evidence that on arrival at the house for the search both the defendant and his spouse were wearing dressing gowns.47 59 During the search Detective Young had remained with the defendant in the kitchen until his colleagues called on him to look at the recent history on the computer screen that Detective Bray had identified. He identified the computer in the photographs at Exhibit P1 and the recent internet browser-history image shown in that set of images (and also at Exhibit P1A).48 60 He was the investigating officer for the case and undertook the substantive forensic review of the computer image. After seizure of the computer devices he had submitted them to the Digital Evidence Section for forensic imaging. He reviewed the image contents using Magnet Axiom and manually tagged artefacts he considered relevant.49 To undertake this task he applied filters, including for file size thresholds and skin-tone percentage.50 Once items were tagged the reports generated were only of those tagged items.51 Exhibit P2 was the extracted report bundle reflecting those items he had tagged during the review. He explained that the tabs in the report bundle reflected different filtered or tagged groupings (for 41 T119, T123. 42 T108. 43 T130-132, T143-144. 44 T130-132, T143-144, T147-148.. 45 T159. 46 Australian National Child Offender Register. 47 T162. 48 T163-164. 49 T164-167. 50 T165-166. 51 T166-167. -- 13 of 42 -- [2026] SADC 44 12 example, with different keyword filters, timeline style groupings, and identity- related material).52 61 He gave evidence that he tagged certain items (including user accounts and PDF documents) directed to establishing the likely user of the computer and said he found no evidence of other users storing their own documents on the machine.53 A printed booklet of tagged PDFs was tendered (Exhibit P5) being those PDF documents.54 62 In cross-examination, Detective Young accepted that the tagging process was selective and dependent upon his investigative judgment; that the reports produced reflected only tagged material; and that the forensic data could not identify who was physically at the keyboard at any given time. 63 During cross-examination Detective Young agreed that there was no analysis of the modem or router.55 He also accepted that tabs in the report labelled with a “search term” tag did not necessarily reflect a typed search (and some were visits to pages or titles which included the filtered words).56 He also accepted that he had associated some subsequent web visits with an earlier search result based upon inferences he had drawn about timing and context. Detective Young also accepted in cross-examination that he had not previously encountered certain non-criminal or alternative meanings (with cultural, media or fashion contexts rather than being pornographic) for some of the charged search terms.57 64 Detective Young also confirmed that he generally did not visit many URLs in the report because he thought doing so could risk unnecessarily accessing prohibited content; he noted that it was not his practice to pursue every link for that reason, though he acknowledged that some domains do contain benign and mainstream material.58 He noted that the webpage content for one particular record he visited on the day he gave evidence (being 17 July 2025) (Exhibit D7) at least currently showed only innocuous content (with the caveat that the page content at the time of the relevant charged search is unknown).59 65 In re-examination, Detective Young was asked about whether the particular child-focused search terms identified in the report were commonly encountered on mainstream lawful adult pornography websites. He said that, in his experience, mainstream adult pornography sites commonly use a “teen” category to refer to persons who are legally adults, but he could not confirm that age-specific terms 52 T167-168. 53 T176-178. 54 T177. 55 T180. 56 T180. 57 T185-186. 58 T190-192. 59 T191. -- 14 of 42 -- [2026] SADC 44 13 such as “pre-teen” or “tweenie” were commonly used on such lawful sites.60 He said he had not personally encountered those age-focused terms on mainstream lawful adult pornography websites in the course of his work, and that his experience of them was predominantly in the context of investigations involving CEM.61 Other documentary and forensic material 66 In addition to the oral evidence, the prosecution relied upon a body of documentary and forensic material, comprising both admitted exhibits and items received provisionally. This material included photographs taken at the premises on 7 September 2022 depicting the state of the desktop computer at the time of the search (Exhibits P1 and P1A); a compiled forensic examination report generated using Magnet Axiom containing browser-history artefacts, search records and attribution-related material (Exhibit P2);62 a floor-plan of the premises (Exhibit P4); and a bundle of PDF documents stored on the computer bearing the defendant’s details (Exhibit P5). A chronological aide-mémoire reorganising selected artefacts drawn from Exhibit P2 was provided for convenience only and marked for identification (MFI P2A). 67 The prosecution also relied upon a separate photographic report of cached images extracted from the computer, received provisionally as MFI P8, replacing an earlier withdrawn images report, and a Statement of Agreed Facts (MFI P9 and MFI P9A). 68 One defence exhibit was admitted, being a webpage showing a news article about an Italian Restaurant tendered during cross-examination of Detective Young for contextual purposes (Exhibit D7). 69 The extent to which any of this material could properly be relied upon where it was said to constitute DCE remained to be determined under s 34P of the Evidence Act 1929 (SA). Admissibility of discreditable conduct evidence 70 Before turning to consider the substantive issues, it is necessary for me to determine whether certain DCE which the prosecution sought to adduce is admissible or subject to limited use. 71 The prosecution filed a notice pursuant to s 34P of the Evidence Act seeking to adduce evidence of: 60 T193. 61 T193. 62 Exhibit P2 had earlier in the proceedings been marked for information MFI P2 as the defence had objected to its admission into evidence challenging the functionality of the Magnet Axiom Software (FDN 48). By day 4 of the trial that objection was withdrawn (refer to email dated 17 September 2025 from Mr O Greeves) and the forensic report was admitted into evidence marked Exhibit P2. -- 15 of 42 -- [2026] SADC 44 14 • the six charged internet searches engaging cross-admissibility issues;63 • a broader body of uncharged internet searches conducted on the same desktop computer between 17 June and 5 September 2022;64 • a set of cached images extracted from the computer’s hard drive; 65 and • photographs taken on 7 September 2022 depicting the state of the computer and the Mozilla Firefox browser-history displayed at the time police attended the premises.66 72 For clarity, the s 34P notice (as amended) identified the categories of material the prosecution sought to rely upon. Whether any such material was tendered and admitted, and the permissible use (if any) to be made of it under s 34P, remained matters for determination in these reasons. 73 Procedurally, after the prosecution case concluded, the prosecution invited the Court to determine the objection to DCE, and sought to amend the s 34P notice so that the period of uncharged search terms extended to include 7 September (the day of the search). The defence did not oppose that amendment (no prejudice), while noting that the photographed browser-history view did not itself establish that the relevant search entries were made on 7 September rather than earlier. With the 7 September photos already tendered and admitted as Exhibits P1 and P1A,67 it remains for me to consider whether and for what permissible use they may be used as DCE under s 34P – that is, to the extent they reflect historical searches on the Mozilla Firefox internet browser. 74 In these reasons, references to the “charged search” artefacts and “uncharged searches” within Exhibit P2 are not intended to suggest that the exhibit was only partially admitted. Rather, those expressions are used to distinguish between material within Exhibit P2 that forms the subject of the charged counts and material relied upon by the prosecution as alleged discreditable conduct. The admissibility and permissible use of those components have been assessed separately in accordance with s 34P. 75 The fact that Exhibit P2 was admitted does not determine the purposes for which all of its contents may be used. To be clear, material within the exhibit that 63 Exhibit P2 (charged search artefacts contained in the compiled forensic examination reports) and described in MFI P2A (charged search artefacts set out in a chronological version of compiled forensic examination reports – provided as an aide mémoire). 64 Exhibit P2 (uncharged internet searches in the compiled forensic examination reports) and described in MFI P2A (uncharged search artefacts set out in a chronological version of compiled forensic examination reports – provided as an aide mémoire). 65 MFI P8, being a corrected version of images set out in MFI P3 (withdrawn). 66 Appearing in the set of photos taken during the search of the house tendered by the prosecution as ExhibitP1 and the enlarged version of the screens in Exhibit P1A. 67 Exhibits P1 and P1A. -- 16 of 42 -- [2026] SADC 44 15 does not satisfy the statutory requirements of s 34P, following the analysis below, has not been relied upon in determining any fact in issue. 76 The question of the admissibility of the DCE-material also infects the Statement of Agreed Facts, which was tendered by the prosecution and formally admitted by the defendant,68 because the agreed facts refer to the compiled forensic examination reports.69 It was accepted during the course of submissions that the agreed facts were not intended to operate independently of the admissibility of the underlying DCE-material. Rather, they assumed the admissibility of Exhibit P2 and were directed to matters of process, extraction and attribution, rather than to proving the substantive content of that material. 77 Consistently with the judge‑alone nature of the trial, I permitted the parties to provisionally address the DCE-material on the assumption it was “in play” and indicated I would determine its admissibility and permissible use in my reasons for decision, particularly given the threshold difficulty that material is only “discreditable” in the s 34P sense if it tends to suggest the defendant engaged in it, and that question itself is intertwined with the disputed attribution issue. Legal principles for admissibility of DCE 78 Discreditable conduct evidence is evidence tending to suggest that a defendant has engaged in discreditable conduct, whether or not constituting an offence, other than conduct constituting the offence charged.70 In Kane (A Pseudonym) v The King,71 Doyle JA observed that discreditable conduct is not limited to conduct which constitutes a criminal offence, and that it connotes conduct which is wrongful or morally repugnant in some way, such that it reflects poorly upon the defendant (and is of a level of seriousness or consequence that it might cause a jury to engage in impermissible reasoning).72 79 Section 34P(1) of the Evidence Act provides that DCE cannot be used to suggest that the defendant is more likely to have committed the offence because he or she has engaged in discreditable conduct and is inadmissible for that purpose ("impermissible use"). This impermissible use is often referred to as “bad person reasoning”73 because it springboards the trier of fact to draw an inference of guilt without proper reasoning of the relevant facts.74 Subject to s 34P(2), DCE is inadmissible for any other purpose. 68 Exhibit MFI P9 and MFI P9A (Statement of Agreed Facts). 69 Exhibit P2. 70 Section 34P(1) of the Evidence Act. 71 [2024] SASCA 70. 72 Ibid at [50]. 73 Also “rank propensity reasoning”: see R v Falzon (2018) 264 CLR 361at [42]. 74 R v Garner; R v Webb (2021) 140 SASR 454 at [31]-[34]. -- 17 of 42 -- [2026] SADC 44 16 80 Sub-section (2) provides: Discreditable conduct evidence may be admitted for a use (the permissible use) other than the impermissible use if, and only if – (a) the judge is satisfied that the probative value of the evidence admitted for a permissible use outweighs any prejudicial effect it may have on the defendant; and (b) in the case of evidence admitted for a permissible use that relies on a particular propensity or disposition of the defendant as circumstantial evidence of a fact in issue – the evidence has strong probative value having regard to the particular issue or issues arising at trial. 81 Evidence that under Division 3 of Part 3 of the Evidence Act is not admissible for one use must not be used in that way even if the evidence is relevant and admissible for another use.75 In determining whether DCE is admissible under sub- paragraph (2)(a), the judge must have regard to whether the permissible use of the evidence is, and can be kept, separate and distinct from the impermissible use so as to remove any appreciable risk of the evidence being used for that purpose.76 The judge must (including when sitting without a jury) identify and explain the purpose for which any DCE may, and may not, be used.77 Subject to the dispensing power,78 reasonable notice must be given by a party seeking to adduce DCE for a propensity purpose in accordance with the rules of court.79 82 The approach to be adopted by a judge in considering the admissibility of DCE was discussed by Hinton J in R v Heinze.80 Section 34P has been amended since that decision, but the approach in Heinze continues to provide useful guidance:81 It should be observed that, unlike ss 97 and 98 of the Evidence Act 1995 (Cth), s 34P of the Evidence Act 1929 steers away from the use of labels to describe chains of reasoning reliant upon evidence of discreditable conduct. The focus is upon use. Descriptive labels mask analysis and risk error. The nature of the evidence with which s 34P is concerned has traditionally been treated with great care by the common law because of the prejudicial risk associated with its admission – the risk that the trier of fact will be persuaded to convict because the accused has offended in the past (the impermissible use). Section 34P approaches the risk of prejudice arising from the impermissible use by requiring that the prosecutor articulate clearly the use or uses for which he or she intends to deploy discreditable conduct evidence. That way a trial Judge can determine: i. whether the permissible use or uses proffered fall within s 34P(2)(a) only or ss 34P(2)(a) and (b); 75 Section 34Q of the Evidence Act. 76 Section 34P(3) of the Evidence Act. 77 Section 34R of the Evidence Act. 78 Section 34P(5) of the Evidence Act. 79 Section 34P(4) of the Evidence Act. 80 [2017] SASCFC 155. 81 Ibid at [71] (footnotes omitted). -- 18 of 42 -- [2026] SADC 44 17 ii. the probative value the evidence attracts; iii. the risk of its impermissible use; iv. if the proffered use is one falling within s 34P(2)(a), whether the probative value of the evidence admitted for the permissible use or uses substantially outweighs any prejudicial effect it may have on the defendant. In arriving at this conclusion the Judge is to consider whether the permissible use or uses is/are, and can be kept, sufficiently separate and distinct from the impermissible use so as to remove any appreciable risk of the evidence being used for that (the impermissible use) purpose; v. if the proffered use is one falling within s 34P(2)(b), whether in addition to the probative value of the evidence substantially outweighing any prejudicial effect it may have, it has strong probative value having regard to the particular issue or issues arising in the trial; vi. whether despite the evidence being admissible, reason arises to exclude it nonetheless in the exercise of the residual discretion; vii. superintend the use of the evidence in the event of its admission in the light of the basis for its admission (i.e. for the articulated permissible use or uses); and viii. fashion the appropriate direction required by s 34R. 83 As with the admission of any evidence, in assessing the probative value of a particular item of evidence for the purposes of s 34P, it is necessary to identify the particular issue or issues to which it is said to be relevant, and the use sought to be made of the evidence.82 The impermissible and permissible uses of the evidence must be identified, and once the permissible uses are identified, the probative value of the evidence must be assessed in accordance with s 34P(2). 84 The assessment of the probative value does not occur in a vacuum and can only be assessed in the context of all of the evidence on which the prosecution relies and to which it has a relevant connection.83 The evidence is taken at its highest for the purposes of the assessment.84 The focus of the task when considering admissibility is on the capacity of the evidence to rationally affect the assessment of the probability of the existence of a fact in issue.85 The task includes consideration of what is open for the fact finder to conclude.86 85 Even where a non-propensity use is proposed, the Court must be satisfied that: • the evidence has probative value in relation to that permissible use; 82 Garner & Webb at [33]. 83 Ibid. 84 IMM v The Queen (2016) 257 CLR 300 at [44]. 85 Ibid at [38] – [41]. 86 Ibid. -- 19 of 42 -- [2026] SADC 44 18 • the probative value outweighs any prejudicial effect; and • the permissible use can be kept separate from impermissible reasoning. 86 Where tendency or disposition is relied upon, the probative value must be strong and must not depend upon assuming the truth of the fact in issue. Importantly for this case, where the identity of the actor is itself the fact in issue, DCE cannot be used to establish that identity by reference to similarity, repetition or alleged disposition. 87 These principles apply with full force in judge-alone trials. The absence of a jury does not permit a relaxation of analytical discipline or an assumption that impermissible reasoning can be safely ignored.87 Prosecution’s submissions on the DCE-material 88 The prosecution articulated two principal permissible uses of the DCE- material. 89 First, it was said that the evidence was admissible as part of the circumstantial case on identity. The prosecution submitted that the material demonstrated that the desktop computer was being used by a single person who repeatedly searched for sexually explicit material concerning young girls, making it more likely that that person was the defendant rather than another occupant of the house. 90 Secondly, the prosecution submitted that the evidence demonstrated a tendency or disposition on the part of the user conducting the searches, namely a sexual or erotic interest in children and a preparedness to act on that interest by searching for such material online. The prosecution submitted that this tendency bore upon the questions of both authorship of the charged searches and the user’s intention in conducting the searches. 91 The prosecution further submitted that the risk of impermissible reasoning was mitigated in a judge-alone trial because self-directions are made pursuant to s 34R of the Evidence Act to avoid any propensity reasoning (in this case, being about the user having both an erotic interest in children and a preparedness to act on that interest) from being infected with the impermissible “bad person” reasoning for the purposes of s 34P(3) of the Evidence Act. The defence objection to admission of the DCE-material 92 The defence objected to both the admission and use of the DCE-material. 93 The defence submitted that s 34P is engaged only where evidence tends to suggest that an accused is engaged in discreditable conduct, and that none of the material upon which the prosecution sought to rely was attributable to the 87 Section 34R of the Evidence Act. -- 20 of 42 -- [2026] SADC 44 19 defendant. As such, the defence said that across the board the material may be discreditable in character, but it did not tend to show it was the defendant, as opposed to anyone else occupying the house, who had conducted the charged searches. 94 The defence submitted that attribution was the central disputed issue in the proceeding and that none of the impugned material tended to identify the defendant as the person who engaged in the conduct relied upon by the prosecution, as distinct from another possible user of the computer. It was submitted that the prosecution’s reasoning impermissibly assumed what it sought to prove. The defence submitted reliance on similarity, pattern and aggregation involved precisely the kind of “bootstrap reasoning” warned against in R v Fleming; R v Maher:88 To seek to prove a fact in issue by a chain of reasoning which assumes the truth of that fact is, of course, a fallacy, repugnant alike to logic and to the practical processes of criminal courts.89 95 The defence submitted that unless attribution could first be established by admissible evidence not dependent upon propensity reasoning, the proposed uses necessarily failed. The defence said that this DCE-material did not tend to prove that the defendant engaged in any of the charged or uncharged searches and did not satisfy the s 34P permissibility criteria. Consideration of admissibility and use of DCE 96 I am reminded that s 34P requires close attention to use, not labels. As explained in Heinze,90 the Court must identify precisely how the DCE is proposed to be used and must avoid descriptive labels that mask analytical error. 97 In the present case, attribution is the threshold issue for the purposes of s 34P. DCE can only have probative value if it tends to suggest that the defendant engaged in the conduct relied upon. Discreditable conduct evidence cannot be used to establish its own probative foundation through repetition, similarity or accumulation.91 It was observed by Brennan J in Sutton v The Queen:92 It is a canon of logic, rather than of law, that one cannot prove a fact by a chain of reasoning which assumes the truth of that fact. That canon has a particular application in determining the cogency and hence the admissibility of similar fact evidence. When the Crown seeks to tender similar fact evidence as the foundation for inferring a fact to be proved in a trial, it is erroneous to assume the truth of the fact to be proved in determining the cogency of the evidence. That is a proposition of general application; it is not limited to the facts of Perry or to cases bearing a close factual similarity to it. … 88 (2017) 129 SASR 27 at [34] – [43], citing Perry v The Queen (1982) 150 CLR 580. 89 Perry at 612 (Brennan J). 90 Heinze at [71]. 91 Fleming v Maher at [34]-[43]. 92 (1984) 152 CLR 528 at 552. -- 21 of 42 -- [2026] SADC 44 20 98 Unless at least one impugned act can be attributed to the defendant without reliance on propensity or pattern reasoning, the foundation required for cross-admissibility or tendency reasoning is absent. The prosecution properly accepted in closing that it needed to “get one through the door”.93 That concession correctly recognises that the law does not permit multiple unexplained acts to be used to prove identity where identity itself is the unresolved question. 99 I now turn to consider the admissibility and use of each category of DCE- material. Internet browser-history photograph 100 The prosecution relied on a photograph taken during the execution of the search warrant on 7 September 2022 depicting the Mozilla Firefox browser-history pane open on the computer screen.94 That photograph was admitted without objection as part of the contextual evidence of the search, showing the state of the computer as it appeared to police at that time. 101 The prosecution subsequently sought to rely on the browser‑history entries visible in that photograph as DCE pursuant to s 34P of the Evidence Act. The prosecution articulated two related permissible uses. First, that the photograph had a straight circumstantial use under s 34P(2)(a), demonstrating that the computer had been used to conduct searches involving similar subject matter on more than one occasion, thereby reducing the likelihood of coincidence or inadvertence. Secondly, and with some caution, that the photograph also provided a foothold for a tendency‑based use under s 34P(2)(b), namely to support an inference that the same user who conducted the historical searches depicted in the photograph was also responsible for the charged searches. From this the prosecution submitted the Court could infer that the same person who was responsible for the entries visible in the photograph was also responsible for similar searches conducted in the days immediately preceding the execution of the search warrant – some being the charged searches. 102 On that basis, it was argued that proof of authorship in respect of one recent search (connected temporally and by similarity of search terms) could be used to support attribution of the remaining counts by reason of similarity, frequency and temporal proximity. The prosecution also pointed to the similarity of the search terms in the browser-history with other artefacts in Exhibit P2 (and also set out for convenience in a chronological form in a separate documents showing internet searches for similar terms).95 The prosecution sought to press the probative value of the depicted browser-history on the basis that it demonstrated a link to the 93 T246. 94 Exhibits P1 and P1A. 95 MFI P2A. -- 22 of 42 -- [2026] SADC 44 21 presence of the defendant at the house on the morning of the search, noting that his spouse was present at that time but his teenage son was not. 103 The defence objected to the use of the photograph for either a circumstantial or tendency purpose on the basis that it did not tend to establish who conducted the searches depicted, or when those searches were conducted. The defence pointed to the 7 September 2022 photograph of the browser-history not showing any dates or times for the relevant historical entries and on that basis maintained that it could not be used to establish authorship, even for those uncharged searches. The defence contended there was no proof that the browser-history entries were attributable to the defendant rather than another person with access to the computer. The defence submitted that any reasoning which treated the photograph as an “anchor” for attribution necessarily assumed the fact in issue and involved impermissible bootstrap reasoning. 104 To my mind, the threshold difficulty with the browser‑history photograph is that, although it establishes that certain entries were present in the Mozilla Firefox browser-history when police opened the history pane on 7 September 2022, it does not establish: • the date or time at which the searches were conducted; • whether the searches were conducted on 7 September 2022 or on earlier dates; or • the identity of the person who conducted them. 105 Those limitations are critical. To the extent the probative force of the photograph depends upon treating the entries as reflecting recent searches conducted by the defendant shortly before police attendance, that conclusion cannot be reached without assuming the very fact in dispute. The photograph does not itself supply an evidentiary basis for attributing the searches to the defendant rather than another occupant of the house with access to the computer. 106 For that reason, I reject any reliance on the browser‑history photograph for a propensity or tendency use under s 34P(2)(b). The evidence cannot properly be used to reason that the defendant has a particular disposition or sexual interest, or that because of such a disposition he is more likely to have conducted the charged searches. To do so would involve circular reasoning prohibited by the authorities. 107 That said, I am satisfied that the photograph has a limited, non‑propensity circumstantial use within the meaning of s 34P(2)(a). For that confined purpose, the photograph is capable of demonstrating that the browser-history contained entries with terms bearing similarity to some of the terms used in the charged searches and that such entries were not isolated artefacts appearing on a single date. Used in that way, the photograph provides contextual background to the -- 23 of 42 -- [2026] SADC 44 22 forensic material extracted from the computer and assists in understanding the environment in which the charged browsing activity is said to have occurred. 108 The probative value of the photograph for this narrow purpose is modest. It does not establish authorship or exclusivity of use, and it cannot be used to infer that the defendant personally conducted the searches depicted. Its value lies principally in demonstrating continuity of subject matter within the browser artefacts across time. This is so even when I have regard to other circumstantial evidence concerning the police observations about: (i) the teenage son not being present at the house on the morning of the search; (ii) the defendant and his partner wearing dressing gowns that morning - which the prosecution contended would allow me to infer that the teenage son had not been at the house before the police arrived because they would not have taken him to school in their dressing gowns; and (iii) the nature of the YouTube video that was open on the central screen at the time of the search – which the prosecution submitted indicated an adult male user and would allow me to infer that the most recent user was the defendant thereby connecting him to the browser-history. I will return to this other circumstantial evidence when considering the issue of attribution. 109 Against the limited probative value of the browser-history photograph must be weighed the potential prejudicial effect of that evidence. There is a real risk that the photograph could invite moral or character‑based reasoning disconnected from the unresolved issue of attribution, particularly if used as an implicit foundation for inferring identity. However, when confined to the limited circumstantial purpose identified above, that risk is capable of being controlled. 110 Weighing these considerations, I am satisfied that the probative value of the browser‑history photograph for this confined circumstantial use outweighs its prejudicial effect within the meaning of s 34P(2)(a). 111 I direct myself that the browser-history photograph may be used only as confined circumstantial evidence. As such, I may use it to understand what was observable on the computer screen at the time police searched the house, and to consider whether the presence of similar search terms on more than one occasion tends to reduce the likelihood of coincidence or accidental appearance. I must not use the photograph as evidence indicating that the defendant has a sexual interest in children, a tendency or disposition to act on that interest, or that he is the kind of person who would commit offences of the kind charged. Further, I must not reason that, because the browser-history entries appeared, the defendant is more likely, as a matter of character propensity, to have committed the charged acts. I must assess the photograph bearing in mind its limitations, including the absence of evidence as to when the historical entries were made, and who made them. I only give the evidence such weight as is justified by those limitations and by the other evidence in the case. -- 24 of 42 -- [2026] SADC 44 23 Uncharged searches 112 The broader body of internet searches between 17 June and 5 September 2022 which the prosecution sought to adduce comprised various terms with unsavoury, or potentially unsavoury, connotations.96 The prosecution alleged these terms had child-sex meanings. The defence disputed that all of these terms conveyed such meanings, with some of the terms also having lawful or innocuous meanings. A non-exhaustive list of these terms is set out in Annexure C. 113 In relation to the admissibility and use of uncharged searches the prosecution relied on: (i) similarity of the uncharged search terms to each other and to the terms used in the charged searches (see terms in Annexures B and C); (ii) their repetition and frequency over an extended period from 17 June to 5 September 2022; (iii) their temporal clustering, including searches occurring late at night and in the early hours of the morning; (iv) the use of the same browsers, predominantly Mozilla Firefox, sometimes Opera; (v) the presence of cached images broadly consistent with the subject matter of the searches; and (vi) the browser-history displayed on the computer monitor on 7 September. From those matters, the prosecution invited the Court to draw the inference that: (a) the searches were deliberate rather than accidental; and (b) it was more likely that they were conducted by a single user, namely the defendant, rather than by multiple unidentified users. 114 The prosecution submitted that such use of the evidence was available as either straight circumstantial reasoning pursuant to s 34P(2)(a) or as tendency evidence, once authorship of at least one search was established, pursuant to s 34P(2)(b). For tendency, the prosecution sought to use the uncharged search terms to prove that the defendant had a sexual interest in pre-teen or underage girls and a preparedness to act on that interest by actively searching for sexualised material involving children. The prosecution accepted that there was no direct evidence of authorship of the searches, but submitted that authorship could be built incrementally, beginning with the 7 September 2022 browser-history and then extending backwards by similarity, repetition and common themes. 115 The defence contended that the uncharged searches were equivocal and were not shown to be the acts of the defendant rather than another occupant of the house with the availability of shared access to the computer (no passwords, profiles or technical controls or other corroborating activity to identify the user at any of the relevant times), and some of those uncharged searches and related artefacts were not properly characterised as discreditable because they were within lawful categories or had ambiguous meanings further weakening any tendency inference; 116 The similarity, repetition and temporal clustering of the uncharged searches are capable of demonstrating that the charged searches were not random or accidental. However, those features do not, of themselves, identify who conducted them. In a household where other occupants had access to the computer and where no technical restrictions limited use, similarity and repetition do not resolve 96 Uncharged search artefacts in Exhibit P2 and also described in MFI P2A. -- 25 of 42 -- [2026] SADC 44 24 attribution unless authorship is independently established. To reason from similarity of content to identity of the user in those circumstances involves circular reasoning: it assumes that the defendant authored the searches in order to conclude that the defendant authored them. 117 To the extent the prosecution relied upon the uncharged searches for a non-propensity circumstantial use under s 34P(2)(a), the probative value of the evidence depends upon its capacity to increase the probability that the defendant was the person who conducted the charged searches. In the absence of evidence identifying the defendant as the author of any of the uncharged searches, that probative value is weak. The same features relied upon by the prosecution — similarity, repetition and frequency — are equally consistent with the conduct of another user of the computer. Without an independent foothold establishing authorship, the uncharged searches do not materially advance the attribution inquiry. I do not admit them for any circumstantial use. 118 The prosecution also relied upon the uncharged searches as tendency evidence within the meaning of s 34P(2)(b), contending that they revealed a disposition or preparedness on the part of the user to seek out unlawful material involving children, and that such a disposition made it more likely that the defendant conducted the charged searches and did so with the requisite intent. That reasoning presupposes proof that the defendant engaged in the uncharged conduct. Without proof of authorship, the uncharged searches cannot rationally be said to reveal the defendant’s tendencies rather than the behaviour of an unidentified user of the computer. Evidence relied upon to establish a tendency cannot supply its own foundation by accumulation or repetition where identity is the contested fact in issue. 119 In the absence of proof identifying the defendant as the author of at least one uncharged search by admissible means independent of propensity reasoning, the probative value of the remaining uncharged searches cannot be elevated by their similarity or frequency. Accordingly, the threshold conditions for admissibility under s 34P(2)(b) are not satisfied. 120 My rejection of the prosecution’s propensity-based reliance on the uncharged searches does not entail a rejection of the forensic material as a whole. I have not excluded, and do not disregard, the forensic artefacts relating to the charged searches themselves. Those artefacts are admissible and are assessed on their own merits, including their provenance, timing and technical characteristics. What I reject is the use of uncharged searches to supply attribution or intent by way of pattern or tendency reasoning in circumstances where authorship of those uncharged searches has not been established Cached images 121 Although the cached images were derived from the same forensic source as Exhibit P2, they were extracted and tendered provisionally as MFI P8 as a separate -- 26 of 42 -- [2026] SADC 44 25 photographic report, and their admissibility and permissible use must therefore be assessed independently. 122 The cached images constitute evidence that is potentially discreditable in character. Although the defence ultimately did not maintain an objection to their tender, s 34P of the Evidence Act imposes a statutory admissibility gateway that requires the Court to determine whether such evidence is capable of admission for a permissible use. In the absence of a permissible use, the material cannot be relied upon, irrespective of whether objection is taken. 123 I viewed the cached images only for the limited purpose of determining their admissibility and permissible use. 124 The prosecution did not press the cached images as independent tendency evidence within the meaning of s 34P(2)(b). Rather, their case was that the images were capable of a circumstantial, non-propensity use under s 34P(2)(a), namely to increase the probability that the same user who conducted the impugned searches was also responsible for accessing material consistent with those searches, and that this user was the defendant. 125 The prosecution submitted that the cached images (MFI P8) were probative circumstantially because they were located in the browser cache associated with Mozilla Firefox, confirming that the computer had been used to access web content which included alleged illegal material (records 3 and 6), with the remaining images displaying a consistent theme matching the search patterns of the user. 126 The defence pointed to the evidence that revealed cached images may be stored automatically by browsers without deliberate access or viewing so that the user would not have seen them, and emphasised that most of those images were not discreditable in the sense that they displayed lawful catalogue or stock images of children. 127 The central fact in issue remains the identity of the person who conducted the charged searches. The probative value of the cached images for that purpose lies in their capacity, if any, to circumstantially increase the probability that the defendant was that user. 128 To my mind that probative value is, however, very limited. I accept that the evidence established that cached images are downloaded automatically by internet browsers as part of routine operation and may be stored without deliberate user action or conscious viewing by the user. There is no reliable evidence that the user intentionally accessed, viewed, or selected the cached images. 129 Further, having reviewed each of the cached images in MFI P8 for admissibility purposes, most can fairly be described as lawful or innocuous material, including catalogue-style images of children in swimwear or underwear that do not depict unlawful content. Taken at their highest, such images are capable only of indicating that a user of the computer may have accessed or -- 27 of 42 -- [2026] SADC 44 26 inadvertently encountered lawful material involving children. That inference does not materially assist in identifying who the user was, nor does it advance the attribution of the charged searches. 130 Only two cached images were identified by the prosecution as potentially unlawful (records 3 and 6). Those images were downloaded hours apart from the charged searches, during periods without demonstrated related activity, and there is no evidence establishing what browsing activity caused their caching. The absence of temporal proximity significantly weakens their probative value. Further, having viewed those images, I am left in genuine doubt as to whether they in fact depict a child at all. 131 Accordingly, even taken at its highest, the cached image material does not materially increase the probability that the defendant was the person who conducted the charged searches. Its probative value for the articulated circumstantial purpose under s 34P(2)(a) is correspondingly weak. 132 Against that limited probative value must be weighed the significant prejudicial effect of the images. To my mind, they carry a real risk of emotional impact, moral disapproval, and impermissible reasoning untethered from the unresolved issue of authorship. In particular, there is a substantial risk that the images would be used, consciously or unconsciously, to reason that the defendant is the kind of person who would engage in the charged conduct, contrary to s 34P(1). 133 Weighing these considerations, I am not satisfied that the probative value of the cached images admitted for the proposed circumstantial use outweighs their prejudicial effect within the meaning of s 34P(2)(a). The material is therefore not admissible for that use, and I have not relied upon it in determining any fact in issue. Cross-admissibility between counts 134 As to cross-admissibility of the charged acts, the prosecution submitted that if any one charged search is proved to be attributable to the defendant, it becomes more likely that the defendant conducted the other charged searches because of the similar subject matter and common internet browser characteristics, with five of the six charged searches utilizing the Mozilla Firefox search engine. The prosecution advanced these uses as both circumstantial use under s 34P(2)(a), and, once one of the searches is proved to have been conducted by the defendant, being “in the door”, as supporting a tendency or propensity inference under s 34P(2)(b). 135 Cross-admissibility between counts cannot arise unless attribution is established in respect of at least one count by admissible means. It is not sufficient to say that similar acts make each other more likely when the identity of the actor is the unresolved issue. Without identifying the defendant as a user in respect of at least one count, I am not satisfied that the evidence of one charged act -- 28 of 42 -- [2026] SADC 44 27 circumstantially increases the probability that the defendant was the person committing another of the charged acts. To permit cross-use in these circumstances would involve reasoning from the similarity of the acts to the identity of the actor in a circular manner. The evidence therefore has no probative value on the issue of authorship for cross-admissibility purposes, and I do not admit it. DCE infecting the Statement of Agreed Facts 136 In light of my conclusions on the admissibility of the DCE contained in Exhibit P2, it is necessary to determine the extent to which the agreed facts may properly be taken into account. 137 To the extent that the agreed facts merely record procedural matters—such as the seizure of devices, the generation of forensic images, and the preparation of reports—they remain uncontroversial and of limited contextual relevance. However, to the extent that the agreed facts depend upon, assume, or implicitly rely upon the admissibility of the DCE itself, they cannot be used as a substitute for, or back-door means of relying upon, material which is not admitted. 138 Accordingly, I have confined my use of the agreed facts (MFI P9) to those matters that are logically independent of the DCE, and I have not treated the agreed facts as supplying probative content where the underlying forensic material has not been admitted. 139 I turn now to consider the issue of attribution. Has the prosecution proved that the defendant conducted the impugned searches? 140 The primary question in this case is whether the prosecution proved beyond reasonable doubt that it was the defendant who conducted the six charged internet searches. If that is not established then the prosecution has not proven its case and I must find the defendant not guilty. 141 The prosecution bears the onus of proving beyond reasonable doubt that the defendant was the person who conducted each of the six charged internet searches. 142 The prosecution case is circumstantial. No single strand of circumstantial evidence was relied upon as conclusive; rather, it was submitted that a combination of factors, considered together, established authorship to the requisite standard. 143 The question is not whether the defendant could have been the user, or whether he was a likely user, but whether the evidence excludes as a reasonable possibility that another person with access to the computer performed the charged searches. A possibility is “reasonable” if it is rationally open on the evidence; it need not be more probable than not. -- 29 of 42 -- [2026] SADC 44 28 144 When the case against an accused person rests substantially on circumstantial evidence, a verdict of guilty cannot be returned unless the circumstances are such as to be inconsistent with any reasonable hypothesis other than the guilt of the accused.97 For the trier of fact to be satisfied beyond a reasonable doubt of the guilt of an accused person it is necessary not only that his guilt should be a rational inference but that it should be the only rational inference that the circumstances enable the trier of fact to draw.98 145 Having rejected the use of DCE as an attribution tool in respect of each count, I assess attribution only by reference to admissible evidence. As I have noted above, some of the prosecution evidence was received provisionally during the trial on the basis that I would rule on its admissibility or use with my reasons for decision. As such, when the parties made their closing submissions, they were permitted to assume the DCE-material formed part of the evidence before the Court while having regard to the prospect that it may ultimately be ruled inadmissible or to have a limited use. Having now ruled on the admissibility and use of the DCE-material I am careful not to have regard to material ruled inadmissible or to have only limited regard to material that is subject to a limited use ruling. 146 I now turn to address each strand of attribution evidence relied upon by the prosecution and the matters raised by the defence. Ownership of the desktop computer 147 The prosecution relied on the agreed facts and the “attribution” PDF documents in Exhibit P5 (being documents found on the computer storage as being authored by the defendant) to submit that the defendant owned and used the desktop computer and that he needed it for work, supporting an inference of his regular and personal use.99. The defence did not dispute ownership. 148 I find that the defendant did own the computer and did use it regularly, including for his work. 149 The defence contended that ownership establishes only opportunity, but not authorship of historical activity. I accept that contention. Ownership of a device is a neutral starting point. It establishes neither exclusive use nor authorship of particular acts in circumstances where others had access to the computer. 97 Peacock v The King (1911) 13 CLR 619 at 634. 98 Ibid at 661; quoted with approval in Barca v The Queen (1975) 133 CLR 82 at 104–105 (Gibbs, Stephen and Mason JJ). 99 T236-7; MFI P9, number 8. -- 30 of 42 -- [2026] SADC 44 29 150 Therefore the fact that the defendant owned the computer and was a regular user of it provides only a very weak circumstantial thread in proving the defendant conducted the charged searches. Location of the computer within the home 151 The prosecution relied on photographs and surrounding items found next to the computer, such as work papers, medical paperwork, and other items in proximity to the desktop as indicating that the computer space was associated with the defendant and it was an area was not likely to be freely shared. The prosecution submitted that this evidence proved that the computer was located in what functioned as the defendant’s work or study space. 152 The defence relied on the evidence of Detective Rex who had described the room as a multi-use space containing a mixture of items and accessible to other occupants of the house. 153 On the evidence, I am satisfied that the room was not an area that was restricted only to the defendant. I find that it was accessible to other household members, and the prosecution did not satisfy me that the varied contents of the room were exclusively associated with the defendant; noting the additional items in the room included the model aeroplane, a 3D printer, a musical instrument and other equipment and documents. 154 This finding materially weakens any inference that historical computer activity in that room must be attributed to the defendant. Powered-on state at the time of the search warrant 155 The prosecution submitted that as the computer was found powered on, logged in and apparently in use when police attended for the search on the morning of 7 September 2022, with the Mozilla Firefox browser open, an inference should be drawn that the defendant was the user of the relevant Windows profile and the Mozilla Firefox browser environment associated with most of the charged browsing activity. 156 Further, the prosecution relied on the fact that at the time of the search the police found the central monitor in a logged-in state with the Mozilla Firefox browser open to a YouTube video entitled “Americans being idiots. Fools around the world 2022”. The prosecution submitted this evidence supported the inference that the computer had been used immediately prior to the arrival of the police at the house, and, further, that the video choice suggested a male user. 157 As the defendant was the only male present at the house when the police arrived, the prosecution submitted that it could be inferred that he had been using the computer that morning. The prosecution submitted this as one circumstance among others, including the user account evidence and it being the defendant’s work environment, contributing to identifying the defendant as having conducted the charged searches. -- 31 of 42 -- [2026] SADC 44 30 158 The defence did not dispute the evidence about the computer being logged- in and active, or the presence of the open YouTube video, at the time of the police search. But the defence said that there was no reliable basis on the evidence for drawing any inferences about the YouTube video content being of a “male interest”.100 159 I find that the computer was powered on and accessible when the police arrived. However, I do not make any finding that the defendant was the one using the computer at or about the time the police arrived at the house on the morning of the search. I accept the contention of the defence that there was no reliable evidence upon which an inference could be properly drawn that the YouTube video was suggestive of there being a male user of the computer. 160 My finding establishes that the computer had been used recently by someone at the time, or shortly before, the police arrived to search the house. However, this finding does not significantly advance the prosecution’s case that the defendant authored any of the charged searches, which occurred on a much earlier date (Count 1) or on different days immediately preceding the police search of the house (Counts 2–6). 161 Even if I had found (which I did not) that the defendant was the user of the computer on the morning of the police search, that fact would not have advanced the prosecution’s circumstantial case because it would not have established any material link to the earlier impugned searches. It would have given only tenuous support to the defendant being the author of the charged searches by identifying him as a user of the Mozilla Firefox browser on the computer. Browser artefacts and email associations 162 The prosecution identified each charged act by reference to Tab 1 of Exhibit P2: one in Opera keyword records (Count 1) and the remainder in the Mozilla Firefox history records (Counts 2-6), each with date and time and record numbers (see Annexure B). 163 The prosecution relied on the recorded browser-history as accurate artefacts of activity on the desktop computer associated with the defendant because a Google account record within Mozilla Firefox had an email address in the defendant’s name. This was the same email address appearing in other documents within the PDF attribution bundle of records (Exhibit P5). The prosecution submitted that the relevant browser profile for the charged searches was therefore the defendant’s profile. 164 The defence did not dispute this but contended that, though these were indicators consistent with the defendant’s use of the computer, they did not prove use at the material times for the charged searches. The defence contended that 100 T231, T243-4, T302. -- 32 of 42 -- [2026] SADC 44 31 proof of general use of the computer by the defendant does not resolve the question of who was using the computer at the specific times the charged searches were conducted. This is particularly so given that the charged searches occurred at different times over a period of months. 165 I find that all of the charged searches, other than for Count 1, appeared in the Mozilla Firefox records on the computer. Count 1 appeared in the Opera files stored on the computer. I also find that the Google and Mozilla Firefox web browser accounts were accounts linked to the defendant. 166 These findings establish an association between the defendant and the computer environment. However, I accept the defence’s contention that they do not establish contemporaneous use at the times of the charged searches. I therefore decline to make a finding that the defendant was the user of the computer at the time of any of the charged searches. 167 There is no time-based evidence to indicate that the defendant was logged into an account or otherwise personally interacting with the computer at the relevant times for any of the charged searches. Therefore, though the defendant is identified with the browser environment, to my mind this does not identify him as the user of the computer at the time of the charged searches. As explained by Mr Abdalla, browser artefacts cannot identify the user at the keyboard. In a household where I find there were multiple users who had access to the computer and that there were no technical (password) restrictions, the use of a particular browser does not to my mind meaningfully advance the circumstantial case on attribution. The Windows user profile name 168 It was uncontroversial that the username for the Windows profile on the computer was “Martin”. This was not a name otherwise identifiable with the defendant’s name. The prosecution submitted that a name for the Windows profile can be arbitrarily chosen, that no one in the household was named “Martin”, and that the internal account and the documents evidence pointed to the defendant as the true user notwithstanding the profile label. 169 The defence contended there was no evidence the Windows account identified as “Martin” was password protected and noted evidence suggesting no password entry was required by police when engaging with the computer during the search, supporting the possibility of shared access to the computer. I accept that submission, and find the use of the computer was not established to have been password protected. 170 I find that the Windows username profile was not in the name of the defendant or the other two occupants of the house (for anonymisation purposes I have not expressly identified them by name in these reasons). This fact therefore provides a relatively neutral component to determination of the identity issue because it does not incrementally advance nor impair the prosecution’s case. -- 33 of 42 -- [2026] SADC 44 32 Absence of contemporaneous identity-marker activity 171 The prosecution relied on documents stored on the computer which were associated with the defendant, including documents containing his name and materials consistent with his work or personal affairs (Exhibit P5). The prosecution submitted that these documents demonstrated that the computer was primarily used by the defendant, supporting an inference that he was also responsible for the browser activity. The defence accepted that the defendant used the computer, but submitted that these documents did not establish contemporaneous use at the times of the charged searches. 172 The defence submitted there was no evidence of work activity or any document activity by the defendant in close temporal proximity to the charged browsing entries such as to identify him as the user at those times. 173 A significant feature of the evidence is the absence of contemporaneous identity-marker activity tying the defendant to the computer at the times of the charged searches. There is no evidence that the defendant accessed work documents, engaged with emails or other personal material on the computer shortly before or after any of the searches forming Counts 1–6. This absence is consistent across all counts and weighs against the inference of authorship. 174 I accept that the documents demonstrate that the defendant was a user of the computer. They do not, however, establish authorship of specific historical browser activity. They do not prove the defendant performed the charged browsing activity at the particular dates and times alleged for the charged searches. Their probative value on attribution is therefore limited. No other regular user was identified 175 The prosecution relied on evidence that the defendant regularly used the computer, including, as mentioned, for work-related purposes. In addition to the PDF attribution records in Exhibit P5 which have been addressed above (refer to paragraphs 171 to 174 above), the prosecution relied on Detective Young’s evidence that, in reviewing the forensic image (using Axiom and his filtering and tagging process), he did not encounter material consistent with another regular user of the computer. 176 The defence submitted there was no clear evidence of how thoroughly Detective Young searched for other-user indicators. The defence said there was no difference between Detective Young observing that he did not find any evidence that people other than the defendant had items or documents stored on the computer and the notion that the computer did not in fact contain such evidence. The defence noted that it was not clear on the evidence whether Detective Young had in fact made any conscious search for the names of the other occupants of the house to see if they had any documents saved on the computer. The defence further contended that Detective Young’s conclusion was inconsistent with at least one -- 34 of 42 -- [2026] SADC 44 33 purported PDF attribution document in Exhibit P5, identified within the tagged attribution material, that was in fact an insurance document in the spouse’s name.101 Ultimately the defence argued that even if the defendant had been the dominant user of the computer, using it for his work, it does not logically follow that another occupant of the house was not a regular user of web browsers on the same computer. 177 To my mind, Detective Young’s evidence must be approached with caution. I find that: • his filtering and tagging process was selective and based on investigative judgment; • the forensic reports reflected only tagged artefacts; • not all material on the drive was examined in detail, and there is no evidence about dedicated searches being made in relation to turning up files and records related to the other occupants of the house; and • the forensic artefacts themselves could not identify who was at the keyboard at any given time. 178 Detective Young’s evidence is therefore properly characterised as him not identifying indicators of another regular user, not that there was no other user. I decline to make a finding that the defendant was the sole or dominant user of the computer, or that he was the user of the computer when the charged searches were conducted. When considered in light of the other occupants of the house having access to the computer, and the limitations of forensic attribution, this evidence does not exclude beyond reasonable doubt alternative hypotheses about other users conducting the charged searches. The son’s living arrangements 179 The teenage son’s age (being 14 years at the relevant time), and the usual living arrangements (being weekends and school holidays at the defendant’s home), were undisputed and set out in the agreed facts. 180 The prosecution submitted that the usual living arrangements and timing patterns of the charged searches made it unlikely that the teenage son was responsible for the searches. It was noted that other than the search relevant to Count 4, all of the searches were made in the early hours of the morning: Count 1 at 6.08am on Friday, 17 June 2022; Count 2 at 6.40am on Friday, 2 September 2022; Count 3 at 5.48am on Saturday, 3 September 2022; Count 5 at 2.47am on Sunday, 4 September 2022; and Count 6 at 7.06am on Monday, 5 September 2022. The search at Count 4 was made at 3.11pm on Saturday, 3 September 2022. 101 Exhibit P5, record 22, pages 50-56. -- 35 of 42 -- [2026] SADC 44 34 181 The defence emphasised there were three occupants of the house who all had access to the multi-use room and the computer. The defence contended that deviations to the “usual” arrangements for the teenage son to be at the house were unknown and not in evidence before the Court. 182 The defence correctly submitted that evidence of “usual” arrangements does not establish presence or absence of the teenage son on specific dates. No evidence was before the Court concerning where the son attended school or his attendance records, and there was no testimony from the son himself regarding his use of the computer. As such, to my mind, the prosecution did not adduce evidence capable of excluding the son as a reasonable possibility of using the computer on the dates and times relevant to Counts 1–6. 183 This strand does not materially advance attribution. The nature of impugned searches 184 The prosecution invited me to draw the inference that the nature of the search terms pointed away from a 14-year old boy and toward an adult male (like the defendant). The prosecution relied on the search terms being specific, technical and sexually explicit: including searches for “pre-teen pussy”; “tweeny first anal”; and “Lolita”. As such, the prosecution argued that these terms were not consistent with curiosity or experimentation by a teenage boy. 185 I am unable to accept that submission. In the absence of expert, empirical or other like evidence, inferences about the likelihood of particular conduct based on assumptions about age or gender are speculative and impermissible. There was no expert evidence before the Court about the nature of the charged searches being of a kind that an adult male would make, as opposed to a teenage boy or a female. There was no psychological, sociological or criminological evidence to support the prosecution’s submissions. There was no other statistical or research material or any police evidence supporting the gender and age-based submissions. 186 The prosecution properly conceded in submissions that no such evidence had been led and that the submission was necessarily limited. The prosecution invited me to rely upon “ordinary human experience” to draw the asserted inference from the perceived extremity, specificity or tone of the search terms. To do so would require me to substitute assumption for evidence. While courts are entitled to draw common-sense inferences from proved facts, that process has limits. An inference that depends upon generalised propositions about the sexual interests, maturity or internet behaviour of teenage boys, as compared with adult men, is not one that can safely be characterised as being within ordinary human experience. This is particularly so in the absence of any evidentiary foundation. Such reasoning risks the Court engaging in impermissible stereotyping or making normative assumptions about age and gender, rather than addressing the facts. -- 36 of 42 -- [2026] SADC 44 35 187 I therefore decline to draw any age-based or gendered inferences. I do not make any finding that the charged search terms were more likely to be made by an adult male than by a teenage boy or a female user. To the extent such submissions were advanced to exclude alternative users of the computer, they do not advance the prosecution case. 188 This conclusion does not involve any finding as to whether the search terms are capable of demonstrating an intention to obtain access to CEM, nor does it preclude reliance upon other circumstantial features said to bear upon attribution. It simply reflects that attribution cannot be assisted by age-based or gendered assumptions unsupported by evidence. Malware, hacking or third-party access 189 The defence contended the prosecution had not excluded hacking as a reasonable hypothesis consistent with innocence. The defence relied on evidence that malware detection is not foolproof, that hackers may sometimes leave no trace, and that network security was unknown. 190 The prosecution relied on evidence that most of the charged entries were human “typed” searches (where they were recorded in the forensic report as “typed”); that no remote access software was found; and that the flagged “potentially unwanted software” did not support a plausible theory that a remote third party caused the searches. The prosecution also submitted that there was no evidence of hacking or malware capable of generating the searches. 191 While keeping in mind that the defence bears no burden of proof, any reasonable hypothesis consistent with the defendant’s innocence must be grounded in something more than speculation or conjecture. Though I accept that no detection of malware is not conclusive of malware not being present, and the case being similar for hacking, I was not satisfied that there was anything in the evidence upon which a reasonable possibility of malware or hacking might be posed as a hypothesis consistent with the defendant’s innocence. There was no evidence of any remote access tools being used or other indicators of third-party control of the computer. To my mind, the mere theoretical possibility of the computer being compromised by third party access or malware is conjecture and does not amount to a reasonable possibility on the evidence. Conclusion on attribution 192 The attribution evidence establishes: (i) the computer was located in a shared space in the house; (ii) it was not password protected; and (iii) the defendant used it at least sometimes. It does not establish who was at the keyboard at the times relevant to each charged search. Absent contemporaneous user-linking artefacts, the Court cannot infer identity from computer association alone. 193 The prosecution submitted that the strands of attribution evidence must be considered together. I have done so, but in circumstances where: -- 37 of 42 -- [2026] SADC 44 36 • ownership and general use establish opportunity only; • the computer was accessible to others occupants of the house; • the forensic artefacts cannot identify the user of the charged searches; and • no contemporaneous identity-marker activity exists. 194 The cumulative effect of the evidence establishes likelihood, and does not provide proof beyond reasonable doubt. As repeatedly stated in the authorities, weak strands of circumstantial evidence do not strengthen one another merely by being aggregated. 195 The evidence gives rise to suspicion and may point to a likelihood that the defendant conducted the charged searches. However, likelihood is not proof beyond reasonable doubt. The criminal standard does not permit conviction on the basis of suspicion or likelihood, however strong. Where a rational alternative explanation remains open on the evidence, the prosecution has not discharged its burden. Here, I find that such an alternative rational explanation that another person with access to the computer conducted the charged searches remains open on the evidence. Accordingly, I am not satisfied beyond reasonable doubt that the defendant was the author of any of the charged searches. 196 Given my conclusion on attribution, it is neither necessary nor appropriate for me to now engage in a hypothetical exercise of determining whether the prosecution satisfied me beyond reasonable doubt that each element of the offence for each count had been proved. This is particularly so because of the centrality of the attribution issue to my rulings on the admissibility and use of the DCE. As such, I have declined to record alternative findings that would necessarily be based upon an uncertain hypothetical foundation. 197 I therefore acquit the defendant on all six counts. 198 For the avoidance of doubt, these reasons record no finding that the defendant accessed, possessed or viewed unlawful material. References to search activity and related material are addressed only to the extent necessary to determine the charges before the Court. Specific wording and imagery have been substantially confined to Annexures B and C that are redacted for publication purposes. Verdict 199 I find the accused not guilty of counts 1, 2, 3, 4, 5 and 6. -- 38 of 42 -- [2026] SADC 44 37 Annexure A - Summary of charges Count 1 Statement of Offence Obtaining access to child exploitation material (Section 63A(1)(b) of the Criminal Law Consolidation Act 1935). Particulars of Offence The defendant on the 17th day of June 2022 at Salisbury, obtained or took a step toward obtaining access to child exploitation material, intending to obtain access to child exploitation material. Count 2 Statement of Offence Obtaining access to child exploitation material. (Section 63A(1)(b) of the Criminal Law Consolidation Act 1935). Particulars of Offence The defendant on the 2nd day of September 2022 at Salisbury, obtained or took a step toward obtaining access to child exploitation material, intending to obtain access to child exploitation material. Count 3 Statement of Offence Obtaining access to child exploitation material. (Section 63A(1)(b) of the Criminal Law Consolidation Act 1935). Particulars of Offence The defendant on the 3rd day of September 2022 at Salisbury, obtained or took a step toward obtaining access to child exploitation material, intending to obtain access to child exploitation material. -- 39 of 42 -- [2026] SADC 44 38 Count 4 Statement of Offence Obtaining access to child exploitation material. (Section 63A(1)(b) of the Criminal Law Consolidation Act 1935). Particulars of Offence The defendant on the 3rd day of September 2022 at Salisbury, obtained or took a step toward obtaining access to child exploitation material, intending to obtain access to child exploitation material. Count 5 Statement of Offence Obtaining access to child exploitation material. (Section 63A(1)(b) of the Criminal Law Consolidation Act 1935). Particulars of Offence The defendant on the 4th day of September 2022 at Salisbury, obtained or took a step toward obtaining access to child exploitation material, intending to obtain access to child exploitation material. Count 6 Statement of Offence Obtaining access to child exploitation material. (Section 63A(1)(b) of the Criminal Law Consolidation Act 1935). Particulars of Offence The defendant on the 5th day of September 2022 at Salisbury, obtained or took a step toward obtaining access to child exploitation material, intending to obtain access to child exploitation material. -- 40 of 42 -- [2026] SADC 44 39 Annexure B - Summary of evidence from Exhibit P2 relevant to each count [SUPPRESSED] -- 41 of 42 -- [2026] SADC 44 40 Annexure C – charged and uncharged search terms [SUPPRESSED] -- 42 of 42 --