Recently the Marshall Defense Team had the opportunity to speak with Randall Karstetter, Chief Data Forensics Expert at Data Forensics Lab in Auburn, Washington. Mr. Karstetter has decades of experience in data forensics and has been providing expert testimony in criminal cases involving computers, cell phones, networks, and other forms of technology for nearly two decades. His practice has led to him being recognized as a digital forensic expert in District and Superior Courts across Washington. He recently presented at the Internet Crimes Against Children Conference about what his work on more than 100 cases charging child pornography offenses has taught him.
Because we often handle criminal matters arising from contentious divorces and cases involving defendants wrongly accused of sexual offenses, we were particularly interested in Mr. Karstetter’s presentation. He reports that about 20% of the cases he’s investigated involving possession of child pornography have been dropped or have ended in an acquittal. He has seen an alarming number of innocent persons charged. The defendants in these cases are usually adamant that they are not guilty.
Mr. Karstetter’s experience shows how individuals get charged with life-changing crimes they didn’t commit and how forensic evidence can exonerate them. His experience may inspire the wrongly-accused to fight for their rights by inspiring hope of achieving justice.
Based on his many investigations of cases involving child pornography charges, Mr. Karstetter said most of the wrongful charges fall into one of two categories:
- cases where the charged individual was careless while browsing and unintentionally downloaded child sexual material; and
- cases where somebody else downloaded the illegal materials, sometimes intentionally for r to seek revenge or to get the upper hand in a contentious divorce case.
Let’s look at these two categories separately.
Persons Who Unintentionally Downloaded Child Pornography
How Does Someone Accidentally Acquire Child Pornography?
One of our first questions was whether there is a “typical case” of an innocent-but-charged person that Mr. Karstetter sees. He said that in his cases where the charges have been dropped or the defendant has been acquitted, the case often arose because the person was just “being stupid” and clicking on things they shouldn’t have clicked on.
Fortunately, the law requires prosecutors to prove that a person accused of a child pornography crime, such as possession of depictions of a minor engaged in sexually explicit conduct, knowingly possessed the digital or physical materials depicting a minor engaged in sexually explicit conduct. The word “knowingly” is crucial. For individuals accused of using technology to access illegal materials, the legal requirement of knowledge may be their biggest ally in proving their innocence.
One of Mr. Karstetter’s cases involved a young soldier in Yakima County. He was discovered downloading child pornography from the Limewire Peer-to-Peer network. The young man was preparing for deployment to Iraq by downloading batches of adult pornography to take with him. He ended up with 74 pornographic images of minors that he didn’t want and hadn’t been seeking. As is often the situation when possession of child pornography charges are filed but should not have been, The officer tasked with investigating computer crimes for Yakima County at that time had only recently transferred from patrol to becoming the department’s computer expert and only had a couple weeks of training. (Mr. Karstetter reports that, in his experience, wrongful charges of possession of child pornography are often filed when the investigating police officer is new in the job or has not been well trained.),After obtaining a search warrant to search the soldier’s residence, the officer seized the soldier’s computer. Charges were then filed despite the soldier’s adamant insistence that he wasn’t seeking materials involving minors.
The keyword, in this case, might be “ignorant” or “careless” but certainly not “knowingly.” Mr. Karstetter was able to prove this.
Much of his investigative work involves building timelines for cases and looking to see whether there the accused person habitually sought sexually explicit content showing underage minors. In the soldier’s case, there were thousands of adult pornography files still on the computer, but virtually all illegal content had been deleted during or after the downloading process. This showed what was meant to be kept and what was not. (Even “deleted” files can often be recovered by law enforcement. As the soldier’s case shows, deleting is no protection against prosecution.)
Also notable was the lack of searches for underage content. According to Mr. Karstetter, this was unlike nearly every case where an individual is indeed guilty of possessing or distributing child pornography.
Mr. Karstetter explained the ins and outs of what was occurring on the defendant’s computer to the judge. He showed that for every possible form of evidence that the user meant to acquire sexual depictions of minors, there wasn’t any such evidence. Ultimately, the judge issued a verdict of Not Guilty despite the existence of illegal materials because forensic evidence was able to show the timeline of how the illegal materials were accidentally acquired.
P2P Networks Often Lead to Accidentally Acquiring Child Porn
It’s important to remember that downloading videos through a P2P network is a common way for child pornography to become unknowingly downloaded. These networks create a shared folder on your hard drive containing downloaded files. These files are not always accurately named; their names may give no indication that the files contain child pornography. Because these folders are publicly accessible, they can be viewed by law enforcement, and they may recognize the file names from having encountered them in other child pornography investigations. (Much of the child pornography in circulation has been circulating for decades and has been given digital fingerprints known as “hash values” at the National Center for Missing and Exploited Children (NCMEC), where officers have access to those fingerprints.) Upon detecting child porn, the officers can get a search warrant.
People Who Are Charged for Child Pornography They Didn’t Download
Why Does Someone Else Download Child Porn to a Person’s Computer?
One of the most fascinating aspects of Mr. Karstetter’s work has been the cases where individuals were charged for possession of child pornography that was actually downloaded to the charged person’s computer by someone else. He has seen this in cases involving contentious divorces, defendants who were framed by someone trying to ruin their lives, and occasions where the accused person allowed their computer to be accessed by another individual who then downloaded pornographic depictions of minors without intending any harm to the person who ended up getting charged.
Mr. Karstetter has several tools to determine who was using the device during child pornography activity times. He uses these to build a timeline to prove who was or was not responsible for acquiring illegal files. Often the simple existence of sexually explicit depictions of a minor on a computer will lead inexperienced or unknowledgeable police officers to refer what they’ve found to prosecutors, and then the prosecutors immediately file charges. Mr. Karstetter’s deeper investigation into the acquisition of illegal content then leads to cases being overturned.
In particular, Mr. Karstetter mentioned the need to be alert for this in contentious divorces, especially those with child custody battles. Such divorces raise red flags for him during his investigations, especially when there’s no prior evidence of pedophilic behavior until a spouse “discovers” child porn on the soon-to-be ex-spouse’s computer. The accused may be confused during the investigation but will usually adamantly deny guilt. In these situations Mr. Karstetter will look for evidence that child porn was planted. In several instances, he’s been able to discover that it was. In one case he was even able to prove the identity of the person who did the downloading.
Is It Possible To Acquire Child Pornography From a Virus or Hacker?
The short answer to whether it’s possible to end up with child pornography on your computer from a virus is yes. Hackers have the ability to gain remote access to a computer and store or plant child pornography. There have even been cases where a virus was programmed to visit numerous child pornography sites every minute, or a malware program generated pop-ups containing illegal pornographic images.
Mr. Karstetter says he can “absolutely determine whether it’s a virus or malware that downloaded sexually explicit materials involving minors.” He’s had cases where this has happened. Fortunately, with forensic tools, an expert can build a timeline to prove the innocence of an individual who has been charged with possession of child pornography that was in fact acquired involuntarily by a computer program. In these instances, there is no user activity pointing towards pedophilic interest. In other words, the lack of searches using child pornography terms and the lack of content viewed leads to an investigation for how the illegal materials could have been unintentionally acquired. This might lead to an event log showing a remote connection or a program running in the background that’s downloading illegal content and saving it to the computer.
Even if there’s not a clear-cut virus or malware program that turns up in the investigation, the absence of evidence of interest in child sex could help prove that an individual did not knowingly possess child pornography.
If you are accused of possessing child pornography, the Marshall Defense Firm is here to help, whether you are facing criminal charges or a civil claim for damages. Our experienced, skilled defense attorneys would be happy to discuss the matter with you. Please contact us at 206.826.1400 or firstname.lastname@example.org to schedule a consultation.