For the purposes of the disciplinary proceedings before the Tribunal, the respondent admitted the fact of the conviction and that the conduct amounted to professional misconduct. However, there was a factual dispute between the parties as to the period of time during which the respondent possessed and accessed the material. This issue was relevant to characterising the seriousness of the misconduct and as to the appropriate disciplinary action.

Held, finding that the respondent's conduct constituted professional misconduct:

• The respondent downloaded various applications and browsers in order to communicate with like-minded individuals sharing CEM and to access and possess CEM.
• As to the dispute on the facts, the respondent embarked on a deliberate course of action to access and possess CEM and possessed and stored CEM from at least March 2010 to November 2015.
• It is not necessary for the Tribunal to make a finding that the respondent was, or is, a paedophile.
• The respondent's conduct demonstrates that he lacks the good character and integrity to practise as a professional in relation to children and other vulnerable persons. His conduct is such as to bring the medical profession into disrepute, and is detrimental to the reputation of, and the public's trust and confidence in the medical profession.

Administrative and disciplinary - Health practitioner - Professional misconduct - Substantial departure from standards reasonably expected of a medical practitioner - Fitness and propriety - Possession of child exploitation material - Criminal charges - Tribunal's findings of professional misconduct on different factual basis to factual basis of guilty plea

Health Practitioner Regulation National Law (South Australia) Act 2010 ss 5, 193, 196

Criminal Law Consolidation Act 1935 s 63A

Child Sex Offenders Registration Act 2006 s 6

Briginshaw v Briginshaw [1938] HCA 34; (1938) 60 CLR 336

Basser v Medical Board of Victoria [1981] VicRp 88; [1981] VR 953

Marin v Chiropractic Board of Australia [2019] SADC 17

Neat Holdings v Karajan Holdings Pty Ltd [1992] HCA 66; (1992) 110 ALR 449

1. This decision relates to a complaint brought by the Medical Board of Australia pursuant to s 193 of Schedule 2 to the Health Practitioner Regulation National Law (South Australia) Act 2010 (National Law), dated 13 November 2018.

2. The complainant alleges that the respondent engaged in professional misconduct within the meaning of s 196(1) of schedule 2 of the National Law, namely that he engaged in conduct that was substantially below the standard expected of a medical practitioner and engaged in conduct that is inconsistent with him being a fit and proper person to hold registration in the profession.

3. The Tribunal notes that after Dr Yu was arrested and charged by SA Police for serious criminal offences the Board placed extensive practice conditions on his registration. He is currently not entitled to work in medical practice unless the Board approves the place and circumstances of that practice. We were informed that he is not currently working as a medical practitioner and has not been working in the profession since the date of his arrest.

4. In November 2015 the respondent was found in possession of "child exploitation material" (CEM) following an investigation by the FBI and SAPOL. CEM is the terminology used in the Criminal Law Consolidation Act 1935 (CLCA).

5. The term "child exploitation material" is defined in the CLCA to mean:

material that describes or depicts a child under, or apparently under, the age of 17 years engaging in sexual activity; or consists of, or contains, the image or representation of (or what appears to be the image or representation of) a child under, or apparently under, the age of 17 years, or the bodily parts of such a child, or in the production of which such a child has been or appears to have been involved; ... and that is of a pornographic nature.

6. This is not a criminal prosecution under the CLCA; this is a disciplinary proceeding. We have used the term 'CEM' throughout these reasons, but we consider the terminology to be somewhat legalistic. We have on occasion used the term "child pornography". To be clear, when we use the term CEM we mean material that is defined as such in the CLCA, but which is understood by the general public to be "child pornography" i.e. a visual depiction via videos and photographs of children engaged in sexually explicit poses or conduct, and/or being sexually abused and exploited.

7. In the CLCA, CEM is categorised by reference to the severity of the material (i.e. in accordance with the CETS classification standard).[1] Dr Yu was found in possession of 238 photographs and 20 videos depicting children between the ages of 14-17 and one child of about 12 years of age (displaying nudity but no sexual activity - category one CEM). However, those photos and videos were, by definition, of a pornographic nature.

8. He was also found in possession of 53 photographs and 33 video files involving sexual penetration in various forms of children (category 4 CEM), which material was clearly pornographic in nature.

9. Offences under s 63A of the CLCA can be "basic" or "aggravated". An aggravated offence is one involving a child under the age of 14 years of age. A basic offence is one involving a child under the age of 17 years of age (but not below 14 years of age).

10. In November 2015 Dr Yu was charged with two offences: an offence of 'possess child exploitation material' (CEM) contrary to s 63A of the CLCA (basic offence) and an aggravated form of that offence. The latter offence was eventually withdrawn. He was subsequently convicted of the basic offence and sentenced to a period of imprisonment in March 2017.

11. The respondent was sentenced in March 2017 for the basic offence after entering a plea of guilty in the Magistrates Court of South Australia on 3 March 2016. According to the sentencing remarks, the delay in finalising sentencing in the Magistrates Court was brought about because Dr Yu was originally charged with a major indictable charge (an aggravated offence of possess CEM), which was subsequently withdrawn in the District Court on 9 August 2016.

12. Adjournments were also sought by the respondent's counsel to enable Dr Yu to obtain specialist reports from Dr Begg (a psychiatrist) and Mr Elmer (a psychologist) and to attend therapy with Mr Elmer.

13. Dr Yu was eventually sentenced to a period of 16 months imprisonment reduced to 9 months and 18 days following his plea of guilty (the maximum penalty for the offence at the time was a sentence of 5 years imprisonment). This sentence was suspended upon the respondent entering into a bond for a period of two years subject to conditions including that he be of good behaviour, not engage in child related work and not use the Internet to access child exploitation material, or for any purpose that could lead to a criminal charge.

14. Dr Yu has admitted the fact of the criminal charge, the conviction and sentence and the majority of the allegations particularised on the complaint brought by the Medical Board.

15. Dr Yu does not admit the allegation particularised at paragraph 1.5.1 of the complaint (set out in paragraph 17 of the statement of reasons in italics).

16. Dr Yu also accepts that it is open to the Tribunal to find that the admitted conduct constitutes professional misconduct as defined in s 5 of the National Law.

17. It is appropriate to here set out the conduct alleged on the complaint:

(a) On the relevant dates, the respondent was registered by the Medical Board of Australia under Division 1 of Part 7 of the National Law to practice as a medical practitioner in the medical profession.

(b) On 20 November 2015, police officers searched the home of the respondent and seized his personal computer.

(c) As police officers conducted forensic screening of his personal computer, the respondent made admissions, under caution that he;

• - possessed child exploitation material (CEM)
• - had downloaded the material from an Internet forum named "Playpen" (of which he was a registered user) and which he had accessed using software called "The TOR project", which enables anonymous electronic communication.

(d) Upon analysis of the computer, officers located 558 files of relevance to the investigation, comprising 48 image files, 60 videos and 17 system files. Of these:

• - 238 image files and 20 video files were classified as category one child exploitation material (involving child nudity but no sexual activity). These images and video files depicted children apparently aged between 14 and 17 years, save for one video file which depicted a female who was assessed as being about 12 years of age.
• - 53 image files and 33 video files which were classified as category four child exploitation material (involving sexual penetration in various forms involving children).

(e) As to the dates of the original creation of these files:

• - the earliest file (an image file) had been stored on 11 September 2007 (particular 1.5.1) (this particular is in dispute).
• - the files had been stored on the computer prior to the end of 2011 save for;
  1. one category one image file downloaded on 18 March 2012; and
  2. the 17 system files (identified as "temporary system root files") which are being created between 12 October 2015 and 19 November 2015).

(f) The respondent had accessed those files for the purpose of his sexual gratification up until the day prior to the search.

(g) On 3 March 2016, the respondent pleaded guilty to the offence in the Magistrates Court of South Australia.

(h) On 29 March 2017, the respondent was convicted and sentenced as follows:

The starting point for the sentence was 16 months imprisonment, that sentence was reduced by 40% to 9 months and 18 days.

The sentence was suspended upon the respondent entering into a bond for a period of two years, subject to conditions, including that the respondent: be of good behaviour, not engage in child related work and, not use the Internet to access child exploitation material, or for any purpose that could lead to a criminal charge.

18. The complainant alleges that this conduct in its totality amounts to professional misconduct within the meaning of s 5 of Schedule 2 to the National Law because: it is unprofessional conduct that amounts to conduct that is substantially below the standard reasonably expected of a medical practitioner of an equivalent level of training or experience; and/or it is conduct that is inconsistent with the practitioner being a fit and proper person to hold registration in the profession.

Factual dispute as to particulars of conduct: relevance of the factual dispute to the finding of professional misconduct: splitting the case

19. By his plea of guilty in the Magistrates Court the respondent admits the essential elements of the conduct alleged on the complaint. He also admits that the essential elements of the conduct amount to professional misconduct as defined under the National Law and that such a finding is open to the Tribunal. He admits all allegations as particularised by the Board, apart from particular 1.5.1 on the complaint.

20. Despite the extensive admissions made by Dr Yu there remains a factual dispute regarding the allegation made in particular 1.5.1 on the complaint. This relates to an allegation that the earliest file (being an image file) had been stored (on the respondent's computer) on 11 September 2007.

21. However, the relevance of this particular, and of the dispute about this issue, goes to a wider argument about the period of time during which the respondent had possessed the child exploitation material (CEM) the subject of the complaint. This in turn, says the complainant, is relevant to the true characterisation of Dr Yu's conduct, the seriousness of his conduct and in turn his prospects for rehabilitation and his risk to the public.

22. The complainant argues that it is necessary for the Tribunal to make detailed findings about the underlying factual basis of the alleged professional misconduct in order to evaluate the extent and duration during which Dr Yu was interested in CEM, his level of insight, his sexual motivation, interest and attraction towards children, the degree of risk he poses to children, and his prospects for rehabilitation.

23. The Board's case is that the expert evidence from their witness, Detective Marsland, is capable of establishing a decade-long pattern of possession and use of (access to) child pornography by the practitioner. The complainant argues that the making of such findings will in turn assist the Tribunal in an assessment of what is necessary to protect the public in terms of an appropriate disciplinary sanction.

24. The Board's counsel, Mr Jacobi, also argues that it will assist the Tribunal to reject any evidence placed before it by Dr Yu at the sanction stage which is based on an incorrect factual basis. For instance, by way of reference to the sentencing remarks in the Magistrates Court (which the Board says are based on a different and less serious factual basis than that which they allege) and to any psychological reports which are based on an incorrect factual basis that is contrary (and less serious) to the particulars of the conduct which the Board invites the Tribunal to find.

25. The complainant sought to introduce this evidence to the Tribunal by way of two affidavits of Detective Marsland and by way of evidence to be adduced from the Detective. At the outset of the proceedings the respondent objected to the tender of the affidavits and the receipt of all of this evidence.

26. The respondent's counsel, Mr Dadds, noted that the majority of allegations were admitted, although there remained what he described as "a minor dispute as to the date of the earliest storage of one category 1 image file (11 September 2007)".

27. Mr Dadds opposed the introduction of the whole of the evidence from Detective Marsland (detailed in two lengthy affidavits) at the initial stage of the hearing regarding the factual findings to support a finding of professional misconduct. The respondent's counsel argued that the evidence of the expert witnesses at the disputed facts hearing as to the conduct should be limited to the discrete topic of the use of .Zip files relevant to the minor factual dispute about particular 1.5.

28. However, we note that Mr Dadds agreed (in his written submission) that there is a "remaining dispute on the facts". He submitted that this was as to "the degree of IT literacy/sophistication/'determination' required (by Dr Yu) to access and store CEM".

29. Mr Dadds argued that the broader factual basis is only relevant to sanction. His initial submission was that the hearing be separated into two discrete parts. He submitted that the Tribunal is authorised to: (a) hear a matter, (b) make a finding about classification of the proved conduct and (c) hear submissions as to sanction. He said the process is "logically sequential" and that the Tribunal was 'essentially at the third stage of the process now, given that the majority of the conduct is admitted, as is the legal characterisation of that conduct'.

30. Mr Dadds argued that, because Dr Yu had admitted the majority of the allegations particularised on the complaint, it was open to the Tribunal to immediately make a finding of 'professional misconduct' based on those admitted particulars. He submitted that the remaining factual findings will only become relevant at the 'sanction stage'.

31. The Tribunal agrees that the findings to be made on the disputed facts are clearly relevant to sanction. However, the Tribunal also agrees with the complainant's contention that the exact factual circumstances of the conduct need to be established first, within the context of the allegation that the 'practitioner's conduct amounts to professional misconduct'.

32. In our view it is simply artificial to separate the evidence on the factual dispute about the exact nature and extent of the conduct (which includes, but is not limited to the allegation as to the earliest storage date of CEM) into a sanction hearing only.

33. As we indicated at the outset of the hearing, we are of the view that, firstly, the Tribunal must make clear factual findings about the whole of the practitioner's conduct and whether that supports a finding of professional misconduct. Thereafter, the Tribunal can move to hear submissions and evidence about sanction based on those factual findings. Involved in the latter process is an assessment of the risk posed to the public and the profession based on the established conduct of the practitioner (amongst other considerations).

34. Accordingly, the Tribunal agreed with the complainant's submission that it was appropriate for the complainant to lead this evidence in a disputed facts hearing at the outset to avoid the risk of the complainant "splitting its case".

35. Further, we observe that this is not a guilty plea in a criminal prosecution. The mere fact that a practitioner admits that certain conduct amounts to professional misconduct (or unprofessional conduct) does not bind the Tribunal to make such a finding.

36. It is for the Tribunal to make the relevant findings about whether the established conduct amounts to professional misconduct. In order to do so we must consider the admitted conduct, make findings about any conduct in dispute, and then reach a conclusion as to the characterisation of the established conduct, in accordance with the National Law.

37. The complainant must make out its case to the necessary standard of proof.

38. We note that the relevant standard of proof is the balance of probabilities, having regard to the observations set out in the decision of Briginshaw v Briginshaw[2] and other cases concerning the standard of proof for decisions to be made by disciplinary tribunals, as have been referred to us.[3]

39. We are very conscious that the allegations in this matter are extremely serious, and the findings that we make could have severe consequences for the practitioner. It is therefore necessary for us to take great care in analysing and weighing the evidence and in reaching a decision, for which we must have a comfortable level of satisfaction, taking into account the seriousness of the allegations.

40. This is particularly the case where inferences are to be drawn from complex facts as is the task in this case. We are conscious that this case was a difficult one in that respect, dependent as it was on a forensic assessment of a computer, the expert analysis of metadata and the intricacies of certain software applications and programmes, in order to reach certain conclusions as to Dr Yu's past online conduct.

41. Where we have made findings we have done so on the balance of probabilities and have reached a comfortable level of satisfaction taking into account the Briginshaw principles.

42. We remind ourselves that it is not for the respondent to prove or disprove anything. The onus of proof in disciplinary proceedings is squarely on the complainant.

43. The respondent has not given evidence to the Tribunal as to the disputed facts but has admitted many allegations through his counsel. That is absolutely his right and we draw no conclusions from his failure to give evidence before the Tribunal. But it does mean that Dr Yu's version of events as set out in the record of interview and by way of questions put in cross examination of the expert witnesses has not been tested by cross examination of Dr Yu. Accordingly, we have not had the opportunity to assess Dr Yu's credit or otherwise analyse his version of events.

44. Mr Dadds submits that we should give the benefit of the doubt to Dr Yu on certain facts i.e. to essentially proceed on a version of facts most favourable to the respondent (for instance in regard to answers given by Dr Yu in the police record of interview as to the extent and frequency of his access to the child exploitation material). Such would be the approach in a criminal court on a guilty plea.

45. However, this is a disciplinary proceeding brought in the public interest. We must make findings on the balance of probabilities with due to regard to Briginshaw based on all of the evidence before us.

46. Dr Yu's counsel acknowledges that the police record of interview (ROI) is a hearsay account by Dr Yu of his online actions and motivation. Many of the answers provided by Dr Yu were significant admissions against interest upon which the complainant relies (i.e. that he accessed CEM for his personal sexual gratification and had done so since he was a minor). However, the complainant invites us to give less weight to other answers given by Dr Yu in the ROI that may be considered to be a less than fulsome account of what had occurred in his online activities.

47. We approach the answers given by Dr Yu in the ROI with appropriate caution, noting the circumstances of the interview and the objective facts established on the evidence to our satisfaction. We have attributed the appropriate weight to his answers in the ROI in the context of our other factual findings.

48. To be clear, in our view, there is no proper basis to suggest that we should proceed on a version of events most favourable to the respondent simply because he has admitted much of the conduct and accepts that the admitted conduct amounts to professional misconduct. The exact nature of the conduct was in dispute.

49. We will proceed on the basis of certain admissions and our factual findings.

50. The Tribunal admitted various documents by consent, namely the contents of the agreed book of documents (MB1).

51. This included: Medical Board investigation materials, including police statements, the transcript of the police record of interview with Dr Yu, the Information setting out the charge, the factual summary for the purpose of sentencing (prepared by the DPP), the Magistrate's sentencing remarks, the suspended sentence bond, a child offender register notice with reporting obligations, AHPRA immediate action correspondence, the Code of Conduct for doctors and excerpts from the relevant legislation.

52. At the disputed facts hearing the Tribunal admitted the following documents into evidence:

53. Various emails between the respondent and the Tribunal registry as to admitted facts and disputed facts (MB2).

54. Two affidavits (with attachments) of Detective Marsland, contained in the complainant's supplementary book of documents (MB3).

55. Extensive oral evidence from Detective Marsland expanding on his affidavit evidence. During the course of his evidence further material was tendered, namely a USB stick containing the EXCEL printout of files stored on Dr Yu's computer (MB4) and a printout from the internet entitled "Transferring Electronic Evidence in File containers" published by Meridian Discovery Inc. (MB5)

56. The respondent called Mr Mark Gare, an expert forensic computer analyst, to give evidence. His report, dated 2 July 2019, was admitted into evidence and marked BY1.

57. The evidence traversed by both experts covered a range of topics concerning technical aspects of computers and involved some significant complexity (including the detail of the operation of certain computer applications and the interpretation of 'metadata' from computer files that had been 'decompressed' by decompression software, the focus being on whether the expert evidence could establish when the files were created, downloaded, stored and viewed by Dr Yu).

58. Expert evidence was also adduced from the two experts about various computer applications and the operation of the "dark web". We were invited to draw conclusions about the knowledge and computer skills required to access the dark web (and the various forums contained in that environment), and download CEM. We heard about the secretive and clandestine activities engaged in by users of the dark web, the consequent difficulty in gaining access to that environment, and we were invited to draw conclusions about the lengths or extent to which Dr Yu went to conceal his behaviour, including by using certain software to erase data from his computer.

59. The dispute on the facts (as particularised) is arguably quite nuanced.

60. However, the complainant submitted that the factual findings it invites the Tribunal to make go beyond the particulars, are important, and have a significant bearing on the outcome of the proceedings.

61. The respondent's counsel suggested that the dispute on the particulars is one of "semantic subtlety". However, the respondent's counsel also agreed that the resolution of the full factual dispute is important to properly inform the Tribunal as to the appropriate sanction.

62. The complainant invites findings, on the basis of the evidence adduced at the disputed facts hearing, that the respondent had engaged in the activity of deliberately and actively accessing the dark web, copying, then downloading CEM files, adding them to his computer hard drive and concealing those files in a deliberate attempt to avoid detection.

63. The complainant invites a finding that the purpose of Dr Yu's conduct in this regard was to enable his clandestine viewing of the contents of the downloaded files for his personal sexual gratification, and that he had engaged in this activity for a considerable period of time.

64. Mr Jacobi submitted that the totality of the evidence demonstrates that Dr Yu engaged in a prolonged, sustained and sophisticated course of conduct involving deliberate intent to obtain, possess and view CEM. He submitted that the Tribunal can be satisfied on the evidence that Dr Yu has a longstanding sexual interest in children involving accessing, possessing and use of CEM extending for over a decade (from before 2003, when Dr Yu was a minor, until November 2015 when he was arrested).

65. To be clear: the Board does not merely rely on the facts supporting the criminal charge of possession of CEM on 20 November 2015 (the criminal offence). The Board's case is that the criminal charge and the additional evidence adduced in the Tribunal supports a finding of prolonged sexual interest in children by Dr Yu preceding 20 November 2015, involving accessing (or viewing) CEM via the dark web, followed by downloading and storing the CEM on his personal computer from as early as 2007, for the purpose of later viewing the CEM for his personal sexual gratification.

66. As to the duration of active interest in CEM the Board invites us to rely upon Dr Yu's admission to police as to the earliest point of his accessing (or viewing) CEM (ROI p 28-29 MB1 - when he was a minor i.e. in at least 2003) and the objective evidence before us of possession of CEM over an extensive period, based on an analysis of Dr Yu's computer hard drive obtained by SAPOL (the allegation at particular 1.5.1 that the earliest image file was stored on his computer on 11 September 2007). As to the end point of the active interest, the Board also relies on Dr Yu's admission that he accessed, or viewed, some of the CEM as recently as the date before his arrest.

67. The admitted allegation on the complaint, at particular 1.5.2, that storage of some of the CEM occurred 'prior to the end of 2011' is, of course, lacking in specificity as to the earliest point of possession or storage. The complainant argues that the earliest point of possession (storage) of CEM is that which is detailed in paragraph 1.5.1 on the complaint (an image file) which the complainant alleges had been "stored (or downloaded) on 11 September 2007".

68. The complainant argued that a finding about the earliest storage (or possession) date (i.e. four years earlier than the admitted earliest date of possession) matters; it is important, the Board argues, because that finding goes to the issue of the objective seriousness of the conduct; i.e. how sustained, preoccupied, or entrenched Dr Yu's involvement was in accessing, possessing and viewing child pornography.

69. The complainant argued that the significance of this evidence is that findings made by the Tribunal about the exact circumstances of, and motivation for, the conduct is important to enable the Tribunal to reach an understanding about the true nature and extent of the respondent's conduct, which is said amounts to professional misconduct. This, in turn, will be relevant to the Tribunal's findings about his fitness and propriety and will impact on its considerations about the appropriate sanction.

70. We accept that proof of possession of CEM carries with it the arguable inference that the respondent went to some deliberate and concerted effort to access, download and store images of CEM for later repeat viewing for the purpose of his personal sexual gratification.

71. Conversely, proof of accessing, or mere viewing, of CEM on online internet forums may arguably fall into a less serious category of sexually disturbed behaviour; that is, it might be open to the respondent to argue that the inference to be drawn from mere viewing behaviour is of a transitory, or irregular, or less sustained involvement in CEM (depending of course on the evidence, if any, about the extent of the access).

72. Importantly, the complainant urges us not to accept the version of events accepted by the Magistrate for the purpose of sentencing on the guilty plea in the Adelaide Magistrates Court and set out in the Magistrate's remarks on penalty (MB1 p 89-93). The Board invites the Tribunal to reject that version of the facts where it differs to the conduct established to the requisite standard of proof before the Tribunal.

73. Mr Jacobi submitted that the reason that the Tribunal should not accept the findings of the Magistrate is because some of those findings were, in turn, based on the respondent's admission to a much shorter period of downloading and viewing the stored CEM and on the contents of two professional reports submitted to the Magistrate's Court (which reports were also predicated on a shorter period of involvement by Dr Yu in CEM).

74. The Board argues that the Magistrate sentenced on the basis of agreed facts, counsel's submission on the plea and on the contents of the report of Dr Jules Begg, psychiatrist and Mr Mark Elmer, psychologist. The Board objects to the tender of those reports to the Tribunal. The reports are not currently before the Tribunal and will be the subject of further argument when the matter is relisted on the question of sanction.[4]

75. The Magistrate noted that Dr Begg's opinion was based on his understanding that Dr Yu's "viewing" of (stored) CEM had 'occurred in the year before his arrest' (i.e. in 2014), but that Mr Elmer stated 'it' (accessing) had been 'for the last few years'. In the face of this uncertainty as to the duration of the conduct, the Magistrate relied on a submission put to the Court through Dr Yu's counsel (on instructions) that 'it' (possession or accessing of stored CEM) had 'only started in 2014'.[5]

76. The Board argues that the expert medical reports extend to the provision of an opinion about the motivation for Dr Yu's conduct, his risk of reoffending and his prospects for rehabilitation based on the (untested and disputed) explanation for his conduct provided to the experts by Dr Yu. We agree.

77. Counsel for the Board submits that the evidence before the Tribunal (contained in the agreed book of documents, the supplementary documents admitted into evidence,[6] the oral evidence adduced at the hearing of Detective Marsland and other exhibits), allow findings to be made by the Tribunal about the full extent of the conduct of Dr Yu contrary to the findings which formed the basis of the facts on which Dr Yu was sentenced. We agree with that proposition.

78. The respondent, by his admissions in the proceedings before the Tribunal, now concedes that the factual basis upon which he was sentenced for the offence of "possess child exploitation material (basic offence)" in the Magistrates Court, is not accurate. That is, the Magistrate's finding that Dr Yu's involvement in possessing and viewing CEM 'started in 2014', is incorrect.

79. It is also clear from the admissions before us that Dr Yu accepts that the Magistrate's finding (MB1 p 92) that he accessed only adult pornography in his "formative years" is also incorrect. The respondent now admits before the Tribunal that he first accessed child exploitation material when he was a minor (i.e. in at least 2003).[7]

80. As to the earliest date of possession of CEM: Dr Yu now admits in these proceedings that the majority of the video and image files detailed in paragraph 1.4 of the complaint had been stored on his computer (possessed) prior to the end of 2011, excluding one category one image file downloaded on 18 March 2012 and 17 system files (identified as "temporary system root files"), which had been 'created' between 12 October 2015 and 19 November 2015.

81. However, Dr Yu still takes issue with the allegation that one image file (photograph) was stored on his computer (or possessed) as early as September 2007.

82. Extensive expert evidence was taken over two days from both Detective Marsland and from Mr Gare about computer applications, browsers, metadata and the like. It is not necessary to set that evidence out in detail. We have given very detailed analysis to all of the evidence.

83. We propose to summarise the topics traversed in the evidence of both experts, set out our findings on the salient points in the evidence, and reference the transcript and exhibits as necessary to support our conclusions.

84. Detective Marsland is a Detective Senior Sgt of Police. He provided expert evidence to the Tribunal about police investigation techniques, the operation of the "dark web", the operation of computers and computer programmes and the forensic analysis of the files found on Dr Yu's computer. Some of that evidence was given 'in camera' given the sensitivities applicable to covert police investigation of such crimes.

85. We found him to be an excellent expert witness; he was careful and clear and made concessions where appropriate.

86. He has extensive experience as a detective with the Special Crime Investigation Branch and particularly in relation to the forensic analysis of computers.

87. He gave opinion evidence based on his years of experience as a police officer investigating the activities of individuals accessing and disseminating child exploitation material on the Internet. He has conducted hundreds of investigations in relation to individuals downloading and accessing child pornography.

88. He gave opinion evidence about the technical skills required by a person to access a website called "Playpen", which in 2015 was a website containing child exploitation material.

89. Detective Marsland's evidence was that the Playpen site was accessed from Dr Yu's computer via a direct URL name (or web address) and is based in a 'hidden area' of 'the onion router' (TOR) anonymity network (generically called 'the dark web'). We heard about various 'TOR specific browsers' (a web browser that anonymises the user's browsing activities and makes it impossible to trace the identity or location of the user) and computer applications, including 'U-Torrent' software (allowing peer to peer access between computers), types of compression software, (including 7.zip which was found on Dr Yu's computer) used to 'zip' files or compress them into one file of a smaller size, and forensic computer cleaning devices (C-Cleaner) used to purge Windows-based computers of file data.

90. We heard from Detective Marsland that the various browsers, applications and computer cleaning devices were located on Dr Yu's computer and are applications commonly used by persons sharing child exploitation material who are attempting to remain secretive and conceal their online activities.

91. We heard evidence from Detective Marsland about his knowledge of the user and access requirements of site moderators and members of child exploitation sites such as 'Playpen'. Those practices include vetting activities to ensure that persons attempting to access child exploitation websites are motivated or legitimate users of that material and not 'robots' or law enforcement authorities.

92. Detective Marsland gave extensive evidence about the analysis of Dr Yu's computer using a particular automated electronic forensic application. He prepared an excel spread sheet detailing files stored on the computer said to contain CEM. This was produced to the Tribunal.

93. He drew various conclusions from his analysis of the 'metadata' attached to the files, particularly as to when files were created and/or modified by the user. The latter topic was the subject of extensive cross examination and some of the conclusions drawn by Detective Marsland about this issue are in dispute.

94. Mr Gare is a director of a private company which conducts independent litigation support and technical investigations with a focus on forensic investigations services. He has presented expert witness evidence in numerous trials in South Australia relating to the investigation of the legal access to corporate and other resources via Internet gateways. He is an expert regarding forensic computer investigation and provided extensive evidence before the Tribunal in relation to this matter.

95. We were impressed with the extent of Mr Gare's expertise, his detailed knowledge of various computer applications and his ability to interpret metadata attached to computer files. He, like Detective Marsland, was an excellent and credible witness, who was prepared to make appropriate concessions when required.

96. The respondent's primary purpose in calling Mr Gare was to comment on file compression software used to 'zip' files and the inferences, if any, which can then be drawn from metadata about when the CEM found on Dr Yu's computer was created/downloaded/stored on his computer.

97. Mr Gare contradicted certain aspects of Detective Marsland's evidence about conclusions which the Detective had reached (from the interpretation of the metadata) concerning 'file created' and 'file modified' dates. However, Mr Gare agreed that those conclusions depended on the type of file compression software which had been used to zip certain files.

98. Mr Gare gave evidence about the ready availability of alternative compression software (Win.zip) which would affect the detail of the metadata as to dates stored/created, the ability for a person to access the 'Playpen' website via alternative 'open means', the ready availability of "TOR" software browser programmes to consumers for legal purposes (i.e. to enable anonymised browsing), the common use of U-Torrent software by consumers to enable easier downloading of documents, images and videos, and the ease of accessing and downloading of those various applications and software programmes.

99. The respondent's counsel submitted that the effect of Mr Gare's evidence was to cast doubt on the evidence of Detective Marsland about the conclusions which he had drawn about the dates of downloading, or storage of CEM files on Dr Yu's computer.

100. Further, the respondent's counsel submitted that Mr Gare's evidence supports an argument that the inferences invited by the Board as to the relative knowledge, technical skills, IT sophistication, determination and persistence displayed by Dr Yu by the mere fact of the existence of various software programmes, applications and so forth on his computer were not available, or were unsafe as they were based on 'inexact proofs, indirect testimony or indirect inferences'.[8]

101. Essentially the respondent's argument is that it is open to the Tribunal to find that Dr Yu was not a sophisticated consumer of CEM.

102. We make the following findings based on all of the evidence before us, including admissions (noting that the facts are not in dispute):

We find all of the allegations set out on the complaint in paragraph 1 and particulars 1.1 - 1.8 proven to the requisite degree (excluding particular 1.5.1 which we address below).

103. As to the allegations in dispute, we make the following findings based on all of the evidence before us, including the evidence of Detective Marsland (much of which was un-contradicted and in some parts accepted by Mr Gare) and the clear inferences which we find are available to be drawn from that evidence.

104. We note that we have no direct evidence before us as to the specifics of Dr Yu's online activities. This is because Dr Yu has not made admissions about the specific detail of his online activities and he has not given evidence in the Magistrate's Court or in the Tribunal about such matters so that his credit can be assessed and specific findings made in that respect. That is Dr Yu's right and we draw no inference from his failure to do so.

105. However, as detailed above, we agree with Mr Jacobi that any conclusions to be drawn from Dr Yu's hearsay accounts in the ROI and any speculative propositions or technical possibilities put to the expert witnesses by Mr Dadds about a contrary unproven version of the facts should be treated with significant caution.

106. Our findings are based on our satisfaction to the requisite degree about the evidence adduced by the Board and the clear inferences which are open to be drawn from that evidence.

107. We have drawn certain inferences from the evidence before us as to the contents of Dr Yu's computer based on the evidence of the expert witnesses as to what conclusions we might reach from the existence of certain applications and files on his computer.

108. We have also drawn certain inferences from the evidence of Detective Marsland based on his extensive knowledge of the online activities of individuals who access CEM. Where the evidence of the experts was at odds as to the behaviour of individuals sharing CEM online we preferred the evidence of Detective Marsland; we did so given his extensive policing experience and investigation of hundreds of criminal offences regarding online access to and possession of child pornography. We also preferred his evidence on some technical issues over that of Mr Gare; although the experts were generally in agreement about the technical issues.

109. We make the following findings based on the basis of the admitted facts, the agreed book of documents, tendered material and the additional evidence of Detective Marsland and Mr Gare:

A. Dr Yu Downloaded various applications and browsers in order to communicate with like-minded individuals sharing CEM and to access and possess CEM

110. We find that the respondent did the following:

(a) Utilised and downloaded an application called 'Utorrent' to enable 'peer to peer' file sharing. We accept that the Torrent software enables peer to peer communications or access between computers to allow, as in this case, direct access to child pornographic material. This allows CEM files to be accessed on the internet and downloaded.

(b) Had msn messenger chat installed: this enabled instant chatting with individuals producing or sharing CEM.

(c) Had a 'cloud storage' service called Dropbox installed on his PC: this enabled storage of any downloaded CEM files on 'the cloud'; such files are not stored on the computer itself. The contents of Dr Yu's Dropbox account were not accessed by the police.

111. He searched for and downloaded a 'TOR' ('the onion router') specific browser. SA Police located the browser "TOR.exe" on his computer.

112. We accept Detective Marsland's evidence that the TOR specific browser (TOR.exe) is one which is in common use by those accessing CEM online. It enables anonymous online browsing so that a person's 'IP address' cannot be detected.

113. We find that Dr Yu was aware that CEM could not be accessed via the usual 'open' internet browser search engines, such as Safari or Chrome, or via Google.

114. Dr Yu admits, and we find, that he knew about the existence of (TOR) software for enabling anonymous searching and communication on the internet.

115. When first interviewed by police Dr Yu admitted downloading the TOR specific browser to "look at what the dark web was" and then he "pretty much solely used (it) for... looking at child porn".[9] This clearly demonstrates in our view both his knowledge of the illegality of his online activities and the need to engage in that activity in a way that would enable him to avoid detection.

116. Based on his admissions and online activities we find that he was aware of what the dark web was and he knew about the "hidden area" of the TOR dark web. It is clear that he knew that accessing CEM on the internet and possessing CEM was an illegal activity.

117. Downloading the TOR.exe browser indicates a clear understanding, knowledge and intent to use such software to enable him to hide his illegal online activities to access child pornography so that he could not be detected by law enforcement authorities.

118. We find that he specifically downloaded the TOR.exe browser, not through curiosity or boredom or for legal online browsing purposes, but with the intent of accessing CEM and to hide his online activities. The inference that we have drawn about his motivation for downloading the TOR browser is obvious and inescapable on the evidence before us.

119. We accept, as both Detective Marsland and Mr Gare stated, that TOR specific browsers are easy to learn about, access and download and can be used for legal online searches and activities; but in our view this is irrelevant because Dr Yu was knowingly engaging in illegal activities online.

120. We are of the view that the fact that limited technical expertise or computer knowledge was required to download the TOR specific browser is of little relevance to questions about Dr Yu's motivation for downloading the browser.

121. We find that Dr Yu took deliberate and active steps to download a browser application that would enable him to engage in secretive online activities to access and obtain child pornography.

122. We are well satisfied to make this finding; it is an inevitable and overwhelming conclusion on the facts before us.

(e) Acquired information to access the 'Playpen' website

123. Dr Yu admits being a registered user of the Playpen website (allegation 1.3.2 of the complaint).

124. We accept the evidence of Detective Marsland that the Playpen website does not host CEM (videos or photograph files) itself, rather it is a 'forum site' aimed at introducing or connecting persons who have a mutual interest in accessing or sharing CEM online. Once connected via the website the users can communicate with each other with a view to sharing CEM.[10]

125. We find that Dr Yu accessed the Playpen website via a site specific search using an URL (unique resource locator or website address) that he had located on the internet. We accept Detective Marsland's evidence that this was the only avenue to access the website.

126. Detective Marsland stated, and we accept, that the URL can be located via an 'open' internet search on a browser such as Google (but that search would need to be targeted by searching on specific terms such as "child pornography sites on the dark web"), or obtained via other means (e.g. by having it appear on an adult porn site or shared in an online 'chat room' by a person who has access to it).

127. Whilst Dr Yu was a little vague in the record of interview about where he located the URL for the Playpen site in the police record of interview he did state that: "I'm not sure when I first found out about it - but just though googling and things like that..."not googling, but on chat sites"... "Normal, er, adult porn (sites).").[11]

128. It is unnecessary to reach a specific conclusion in that respect as we accept that, having obtained the URL, he must have manually entered, or deliberately copied and pasted, the full website address into a TOR specific browser.[12] To be clear: the website 'link' would not be displayed elsewhere on the internet, only the website URL would be available. It would not have been possible to simply click on a link that took him directly to the website.[13]

129. We are well satisfied to find that such an exercise involved a deliberate and determined decision by Dr Yu to access a particular website in order to interact with individuals sharing child pornography. We find that he found out about this via his online chatting activities on adult porn sites or via active, precise searching on Google (see above).

130. We find that it was impossible for Dr Yu to just 'land' on or wander onto the site via an 'open' internet browsing activity whilst accessing an adult porn site accessible via an open internet browser.

131. Dr Yu admits to having had an interest in CEM since he was a minor.[14] We are well satisfied to find that by copying and pasting the URL into a specific type of browser he actively (but secretly) searched for this website knowing that it hosted a forum of like-minded individuals dealing in online child pornography.

132. We find that he did so because (as he admits) he was sexually motivated to do so; he had accessed and viewed CEM for his own personal sexual gratification and had first done so "many years ago...when he was underage".[15]

133. We reject any suggestion that he unintentionally stumbled onto the 'Playpen forum' and the CEM sharing sites.

(f) Joined the Playpen CEM website as a member

134. Having obtained the direct URL name for the Playpen website (see above) we accept the evidence of Detective Marsland and the admissions of Dr Yu that he signed up for an account with a user-name (infil1) and a password (LOGANLOGAN).[16]

135. We accept the evidence of Detective Marsland and positively find that persons seeking to access Playpen were 'vetted' by the site moderators. This would have been done to ensure that the applicant for membership/access to hard-core content was not a law enforcement officer or a 'robot' used by investigators.

136. It is obvious to the Tribunal that the site moderators would have taken every possible step to evade detection. Mr Gare agreed that vetting of applicants to such sites occurs and that the more sinister or hard-core the content (i.e. "access to higher classifications such as penetrative sex") the greater level of vetting required.[17]

137. Both parties agree that it is unnecessary for the Tribunal to positively find that Dr Yu was, or was aware, that he was being vetted. We agree with that proposition, however, we note that Dr Yu knew that he was seeking access to a website that trafficked in child exploitation material, including sexually explicit videos and photographs of children. That is why he went there in the first place. We find that he was aware that he was engaging in an illegal activity. We agree with Mr Jacobi's submission that it is absurd to suggest that the site moderators would not vet applicant's for membership.

138. Dr Yu is an intelligent, educated man; he has a medical degree. We find that it is an inescapable inference on the evidence before us that Dr Yu was aware that he might be vetted, although we accept that he may not have known the exact details of any vetting.

(g) Chatted with other users on the Playpen to obtain URL's to other CEM sites

139. We accept the evidence of Detective Marsland that through the Playpen site Dr Yu had access to a chatroom which enabled him to connect with people who could direct him to other sites where he could access CEM.

140. We accept that via the chatroom he would have been provided with site specific URL addresses for sites that interested him to access other file storage areas or websites on cloud storage containing pornographic videos and photos of children.[18]

141. Again, according to Det. Marsland, those URLs were unsearchable via any other means and we find that Dr Yu had to deliberately type those or copy those URL addresses into the TOR browser.

142. One such site was "the Magic Playground", which Dr Yu admits accessing.[19]

143. By reference to information provided by other like-minded individuals or descriptors on files we accept Detective Marsland's evidence that Dr Yu was then able to search on sites in his specific area of CEM interest (for instance using word searches). URL links would have been provided to Dr Yu for data held offsite on other cloud storage services.[20]

144. We accept the evidence that the files would have been directly viewed from the cloud or downloaded to Dr Yu's computer. As detailed above, a Torrent service (such as UTorrent - located on Dr Yu's computer) would have then been used to either directly send files between users or the service could be used to search for files individually or in 'compressed folders' based on keyword searches or by individual username searches.

145. Another example of cloud services includes Dropbox (located on Yu's computer).

(h) Transferred files primarily in compressed file format and had decompression software installed on his computer

146. We note from Detective Marsland's evidence and accept that the video and image files could be downloaded individually or as a group of files. Individual files or groups of files could be compressed into smaller file packages using compression software. We accept that the compressed files download faster and allow the content to be accessed more readily once on the local computer.[21]

147. We also accept the expert evidence that, if a person is trying to conceal his activities, another benefit of compressing files is that compressed files are able to pass though 'gateways' on the internet without electronic searches being able to detect the contents of the file packets (the .zip files hides the actual file names and 'checksums' from scrutiny).[22]

148. We accept that the police investigation of Dr Yu's computer revealed that he had the compression software programme 7-Zip version 9.20 installed on his computer.

149. We find that Dr Yu was regularly using 7-Zip compression software to compress and decompress zipped files.

150. We also find that sometimes he may have used another type of application called WinZip. We expand on these findings below

151. The fact that Dr Yu was downloading and saving compressed files packages is apparent from an examination of the spreadsheet produced by Detective Marsland.

152. We find that if the files have been decompressed from the one .zip file the individual files will all bear the same file path name.[23] The same conclusion can be reached from an examination of the metadata attached to the group of files with the file path name 'Interesting family' at rows 421 - 520 on the spreadsheet.

153. Finally, Dr Yu admits to downloading .zip files using TOR/dark web in the form of encrypted, password protected file sets.

154. Given the existence of a vast amount of CEM on his PC we find that Dr Yu primarily downloaded files or groups of files in .zip files for faster downloading and in order to conceal his activities from law enforcement authorities. We find that this behaviour is consistent with all of his clandestine online activities regarding his accessing of CEM.

(i) Had CCleaner installed on his computer to remove file data information

155. Dr Yu had downloaded an application called CCleaner onto his computer (a forensic computer cleaning device used to purge windows based PCs of all file data including browsing history and to uninstall programmes).

156. We accept Detective Marsland's' evidence that CCleaner is an unusual application to see on a personal computer (the inference being it is not in common use) and that, in his experience, it is used in conjunction with other applications by those accessing CEM. He said it is in predominant use by those accessing CEM. It is shared on CEM forums as being the best programme to utilise (to purge computers of files).[24]

157. We accept the evidence of Detective Marsland that only a limited number of files were located in the 'cache' (a temporary storage facility on the computer where the recently viewed system files detailed at rows 559 - 575 were located). That evidence supports the fact that Dr Yu was viewing some CEM from 'the cloud' without downloading and storing the files.

158. Detective Marsland concluded, and we accept, that given that the files found in the cache only went back to 12 October 2015 (row 568), a reasonable inference to draw, consistent with Dr Yu's extensive interest in CEM is that some deletion activity had taken place on his PC to remove earlier files from the 'cache'.[25]

159. We find that Dr Yu deliberately downloaded this application to assist with concealing some of his illegal online activities.

(B) Dr Yu embarked on a deliberate course of action to access and possess CEM

160. We accept that Dr Yu's ability to download the above applications would not have required extensive computer knowledge or skills.

161. Many of these applications and the TOR specific browser are common applications; most of them are freely available. The applications are themselves not sinister; some of them they may have been used by Dr Yu at other times for legal purposes. The mere fact that a person is using the individual applications or browsers does not indicate that such a person is accessing the dark web to download child pornography.

162. However, the combination of all of those applications and browsers is also consistent with a person who is accessing the dark web, communicating with others and downloading illegal files, in an environment where he is actively trying to hide his illegal online activities.

163. Detective Marsland stated that the "existence of these applications aroused my suspicion that the computer needs further analysis".[26] His experience is that those applications or programmes including the TOR specific browser and CCleaner are often utilised by persons sharing CEM and those who are attempting to remain discrete in their online activities.[27] They are part of a "suite that...was purely the sole...distribution package for the majority of CEM in general".[28]

164. We find that, combined with his admitted online activities of accessing CEM on the dark web after obtaining information via chat rooms, the personal computer 'application picture' of Dr Yu's PC was consistent with a person who was knowingly and actively engaging in accessing and possessing CEM online.

165. We find it to be an inescapable inference that those applications were acquired and used by Dr Yu to primarily support his online illegal activity of accessing and possessing child pornography and to avoid detection.

166. We find that Dr Yu installed and used these applications in combination because he knew it was illegal to access and possess CEM. This finding is an inevitable inference from the known facts.

167. We reject the suggestion made by the respondent's counsel that, because the computer knowledge and technical skills required to download the various applications (which are mostly free programmes) is not all that challenging or sophisticated, this demonstrates that Dr Yu was not determined and persistent in his efforts to acquire child pornography.

168. The fact that his illegal online activities (together with those of many others) were finally detected by the FBI and relayed to SAPOL does not negate the fact that he took all possible steps to hide his online activities. We reject the contrary submission from the Respondent's counsel. It is clear on the evidence of Detective Marsland that the lengths that producers, dealers and users of CEM go to in order to cover their tracks is sophisticated and extensive.

169. Dr Yu's computer 'application picture' points to a deliberate intent and knowledge of the illegality of accessing and possessing CEM.

170. In summary, we find that Dr Yu had deliberately embarked on a course of action in a determined manner to download and utilise the various computer applications in order to support his clandestine online activity of accessing CEM. We reject the submission from the respondent's counsel that the degree of determination and persistence required to acquire the relevant computer applications was not significant. We accept the evidence of Detective Marsland that:

"It is important to note that all of the above actions cannot be accidentally achieved. They require a level of competence, IT knowledge, and intention to source, collect and view child exploitation material. The process takes time, and requires a number of online friendships to be created with like-minded individuals, or access to particular sites and chat forums to be able to become involved in this form of undercover file sharing."[29]

(C) Dr Yu possessed and stored CEM from at least March 2010

171. The terminology used on the complaint and in evidence about the "creation", "storage" and "downloading" of files, and about 'the cache' and 'system files' is technical and was somewhat confusing. The terminology on the complaint was eventually clarified in evidence by Detective Marsland and Mr Gare.

172. We accept that reference to the creation of a file may be a reference to when an image or video file is first saved and named on the original storage device by the original creator, or, it could be a reference to the creation of the file on the storage medium of the end-user (i.e. if the image has been downloaded from elsewhere).

173. Mr Jacobi for the Board clarified, that when used at paragraph 1.5 of the Complaint ("As to the date of the original creation of these files") the Board intends that to be a reference to the original creation of the files on Dr Yu's PC: i.e. when Dr Yu opened and saved (or stored) the files to his personal computer.

174. The 'file created date' detailed on the spreadsheet annexed to the Marsland affidavit may represent something else again. We heard that, in some circumstances, the 'file created date' detail in the metadata can change. This evidence was quite technical and complex and took some time for the experts to explain in their evidence.

175. The 'file created date' might mean the date when the file was first created and stored on the original storage device by the original creator, or it could represent the date when, having downloaded it, the end-user opens and stores it on their PC. The expert evidence at the hearing revealed that the 'file created' date detail or 'timestamp' may change depending on how the file is moved around on the internet (i.e. whether it is compressed into a .zip format and what compression software is used to decompress it). We expand on this below.

176. The downloading of a file is the action of transmitting a file from one computer system to another i.e. for a user to 'request' the file from another computer and to receive it.

177. A downloaded file or file package may or may not be "stored" or saved to the computer desktop.

178. The storage of a file is the action of opening the downloaded file (and this may also require decompressing a .zip file format) and then saving the opened file to the user's computer hard drive. In doing so the user may change the file name.

179. In the complaint, the Board, at particular 1.5.2 uses the word "stored" to equate to the original creation/saved date of the files by Dr Yu.

180. The download date and the storage date might be the same date or a different date (depending on the conduct of the end-user who may, for example, not progress to opening and saving a downloaded file for some days, or at all). But the download date clearly must always predate the storage date.[30]

181. The modification of a file is the action of saving and naming or renaming a file.

182. The file modified date detailed on the spread sheet is the date that the file was last modified and saved. Depending on the type of compression software used this might reflect the date when the file was last saved by the person who initially saved/named the file or it could reflect when the file was last modified by the end-user.

183. The cache is a special storage space on the computer for temporary files and may contain cache data or cached files.[31]

184. A system file represents files appearing in a "thumbnail format" which means they are temporarily stored on a computer in the cache. To appear in a thumbnail in the cache the file must have been opened and viewed. If system files are not also found in a file storage location on a PC it means the files have been deleted after viewing or have been viewed from an online cloud storage location (e.g. from Dropbox or online chat servers). However, even if viewed on an online cloud storage location the computer will automatically 'cache' that data into a system file on the computer.[32]

185. The spreadsheet annexed to Detective Marsland's affidavit details 576 files.

186. The Board invites us to accept, and Dr Yu admits, that of the 576 files detailed in the spreadsheet 558 separate image, video and system files containing CEM 'of relevance to the investigation" (particular 1.4 of the complaint) were located on Dr Yu's computer hard drive.

187. Of the 558 files, 481 files were image files (photographs) containing CEM, 60 files were video files containing CEM and 17 were CEM "system files". This is admitted by Dr Yu.

188. We were not advised by the Board which of the 18 files detailed in the spreadsheet either did not contain CEM material or are not included in the 'relevant files', but we note that it is not necessary for us to reach any conclusion about that for the purpose of the current proceedings.

189. We find that the relevant files were downloaded by Dr Yu to his computer via the dark web on a range of dates.

190. We also accept (as explained in detail by Mr Gare) that the 'file created date' or storage date for any file detailed in the spreadsheet (compressed or otherwise) does not necessarily marry with the date that the file or file package was downloaded.

191. Downloading an individual file/zipped file package, unzipping a zipped file, storing/saving and viewing a file are all different activities.

192. Accordingly, we find that it is not open for us to find on the evidence before us that the files were unzipped/decompressed or stored by Dr Yu on the same day or around the same time that they were downloaded. Some may have been, but there is no direct or indirect evidence available to reach such a conclusion. Therefore the 'download date' and the 'storage date' might be different.

193. However, we find that all of the files were obviously downloaded at a time prior to the time that they were stored/saved. This is logical and is consistent with the expert evidence.

Files transferred individually and not compressed

194. We accept that some of the files may have been downloaded and saved individually (files detailed at rows 556, 557 and 558 for example). These files may or may not have been transferred in a compressed file format (we will return to this).

195. If not transferred in a compressed file format we accept the evidence of Detective Marsland that the 'file created date' detailed in the spreadsheet represents the date or time the file was created or stored in the specific computer system i.e. in Dr Yu's PC.[33]

196. We also accept Detective Marsland's evidence that the 'file modified date' for such files represents the date that Dr Yu last saved or modified the file on his PC.[34] This date might change, for example, Dr Yu might have saved or modified the original file by changing the name when saving it; the file modified date will time-stamp any 'modification' activity.

197. We infer, although we had no evidence about this, that if downloaded in such a manner it would not be unexpected to see identical file created and file modified dates (the files being opened and then saved by Dr Yu simultaneously).

198. If some of the files were not transferred in a compressed file format we accept that there is no complexity about interpreting the metadata regarding 'file created' and 'file modified' timestamp dates. This is the conclusion that the Board submits that we should reach about the "earliest storage date".[35]

Files transferred in a compressed file format; types of compression software; timestamp metadata

199. We find that most files detailed in the spreadsheet were downloaded by Dr Yu in a compressed file format (in a.zip file often containing many individual files). We reach this conclusion as such files have common file path names and dates which indicates that they were downloaded in a .zip file (a compressed file format).[36] Both expert witnesses confirmed this to be the case.

200. Such file groups were clearly 'zipped' as they are grouped in folders within the file directory and have common file path names. It is apparent from an examination of the 'file created' metadata that individual files were separately unpacked or decompressed by the computer programme from the compressed package on the same date over a certain time period (each separated by minutes, we assume depending on the size of the file).

201. We conclude that downloading files of CEM in a compressed file format was done by Dr Yu both for ease of moving large folders/files and to avoid detection (as detailed above).

202. After downloading a .zip file we find that Dr Yu used compression software to unzip (or decompress) the zipped files. Once unzipped the files were 'stored' on Dr Yu's computer.

203. We accept the expert evidence before us that the metadata regarding 'file system time stamps' for the 'file creation date' may alter depending on the type of file compression software in use. Both Gare and Marsland agreed with this view.

204. The Board tendered an article by Meridian Discovery entitled "Transferring electronic evidence in file containers" (MB5) to further explain this.

205. As referred to above, as with non-compressed files, we accept that the 'file created date' in the metadata for compressed files may reveal information about the date that files were created or stored by the person who downloaded the files (i.e. indicating the first time that file name and extension was placed in the 'end-user's' storage medium) and the 'file modified date' may reveal information about when the file was last modified and saved (i.e. indicating when the file was modified by the 'end-user' on their PC).

206. Therefore, logically, one would expect to see an earlier 'file created date' followed by a later or identical 'file modified date' in the metadata for the individual files in the spreadsheet.

208. Many files have a 'file created date' which is a later date that the 'file modified date'.

209. Without explanation this aspect of the file metadata appears counterintuitive or anomalous.

210. However, the experts both clarified (and it was further detailed in the article tendered and marked 'MB5') that when files are compressed into a .zip file some compression software preserves the original 'file creation' and the 'file modified' dates even after decompressing files, but other compression software alters the 'file created date' but preserves the 'file modified date'.

211. We accept the evidence that WinZip compression software (a popular and readily available type of compression software) operates by default to preserve all of the original metadata attached to the file(s) from the site where the file is initially obtained from.

212. The expert evidence is that it is possible to manually change those default settings, but we find that this would require technical skill, effort and motivation to do so. There is no evidence before us to indicate that Dr Yu did, or was motivated to, interfere with the file timestamp date settings on the files. We reject that having occurred as purely speculative and quite improbable.

213. However, not all compression software operates to preserve all of the file metadata from the compressed package. We accept the expert evidence that 7-Zip does not work in the same way as WinZip.[37]

214. 7-Zip compression software always preserves the original 'file modified' date but never preserves the original 'file created' date.

215. Therefore, if 7-Zip is used to decompress a file, a new 'file created date' will be attached to the file once decompressed. If 7-Zip is used to decompress files the 'file created date' will be a date later in time than the 'file modified date'. The file created timestamp will essentially be 'stripped off' the relevant files when decompressed. Meridian explains that "This can result in a loss of valuable file system metadata."[38]

216. In such a case the new 'file created date' will represent the date the file is stored/saved on the "end-user's" computer.

217. The 'file modified date' will be the preserved date representing the date that the item was last modified in the original packet that was downloaded i.e. the date last modified by the individual on the site where the file was obtained from.

218. This is significant regarding the interpretation of some of the metadata information on the spreadsheet; it assists us to draw conclusions from that evidence about what type of compression software Dr Yu was using and when the decompressed files were saved or stored on his PC.

219. In summary, this means that if the files had been decompressed with 7-Zip software the 'file created' date will always be later in time than the 'file modified' date in the metadata. If we accept that 7-Zip was used to decompress files, then this makes sense of many of the otherwise inexplicable or anomalous dates in the metadata attached to various files in the spreadsheet.

220. This also means that, logically, in a file transferred with 7-Zip compression software the downloading activity always takes place sometime before (and we infer probably close to) the file created date.[39]

Findings as to compression software used by Dr Yu and findings as to date created/stored

221. We accept the evidence that some compression software like WinZip is automatically installed on windows computers. However, the expert's agreed that on the type of computer that Dr Yu had, WinZip was not automatically installed. Both experts agreed that if he wanted to use it, Dr Yu would have needed to download and install it on his PC.

222. WinZip compression software was not installed on Dr Yu's PC when the PC was seized. Detective Marsland said certain settings must also be installed when using WinZip to maintain the relevant dates in the metadata.[40]

223. 7-Zip compression software was on his computer when it was seized. We find this to be particularly significant.

224. We find that the obvious inference from all of the evidence is that Dr Yu needed to have compression software readily available and installed on his computer in order to assist with what we find to be his regular activity of downloading and accessing child pornography.

225. The evidence before us is that he had a vast amount of CEM on his computer and was actively viewing child pornography on the day prior to his arrest.[41]

226. It was suggested by Mr Dadds in cross examination of Detective Marsland, and in written submissions, that Dr Yu may have used WinZip or another type of compression software sometime in the past but had uninstalled it with CCleaner prior to the PC being seized by police.

227. We accept on the evidence of Detective Marsland that Dr Yu had most likely used CCleaner to remove files in the past.

228. We note that some of the file metadata timestamp activity was unusual, is inconsistent with the use of 7-Zip, and is potentially consistent with the use of WinZip.[42]

229. Therefore, we cannot rule out the proposition that WinZip had sometimes been used by Dr Yu in the past to compress/decompress files and was then deleted or uninstalled.

230. In particular, we agree with the submission that we cannot exclude the possibility that WinZip may have been used for those compressed files in the spreadsheet that do not display the post-dating 'file created' timestamp date behaviour of other decompressed file packages.

231. However, we are well satisfied to find that the overwhelming inference from the evidence before us is that 7-Zip compression software was actually used by Dr Yu to decompress a vast number of the compressed files (at least 253 files).

232. Our findings in this respect are supported by the unusual 'file created' date behaviour revealed in the spreadsheet regarding many of the files.[43]

233. Detective Marsland explained this in his evidence and Mr Gare also conceded that the date behaviour in the metadata of certain file groups was consistent with the use of 7-Zip.[44]

234. This is a significant finding because, as we have indicated, the type of compression software used to unzip files affects the metadata relating to the 'created' date and the 'modified' date; this in turn is relevant to our findings about the duration for which the respondent had possessed or stored CEM.

235. From the metadata and the evidence about the activities of downloading and unzipping files it is clear that many of the files with a 'file created' date post-dating the 'file modified' date were downloaded by Dr Yu either on, or just before, the 'file created' date.

236. We are comfortably satisfied to find that the 'file created' date regarding those particular files is the actual date of unzipping and saving or "storage" of the relevant files on Dr Yu's computer.

237. As discussed, we are satisfied on the evidence before us to make that finding because the particular characteristic of the application 7- Zip (when compared to WinZip) was such that when it was used to decompress (or open) a compressed folder then, for each of the items or folders within the one compressed folder, it always created on its default setting a "file creation date" contemporaneous with the time and date of its storage on the hard drive. Therefore, in those cases where Dr Yu unzipped files in the one compressed file (with the same path name) with that particular application, the file creation date is timestamped to postdate the file modified date.

238. This explains what is seen in much of the spreadsheet in relation to the files with a file created date in 2010 and explains what might otherwise be thought to be an error (i.e. that the 'file created' date is more recent than the 'file modified' date). This file date feature is consistent with the fact that the application 7-Zip was in fact used by Dr Yu to decompress a vast number of the files.

239. Such an example, which was explained by Detective Marsland and accepted by Mr Mark Gare, are the 98 files referenced in rows 422 to 520 of the spreadsheet bearing the 'file created' date 22 April 2010 and a 'file modified' date of 25 February 2009, in a folder entitled "Interesting family".[45]

240. We are comfortably and reasonably satisfied to find that the 'file created date' for the 98 files in rows 422 to 520 (of 22 April 2010) represents the actual date of storage of the files by Dr Yu. The date represents the date that he 'originally created the files' (to use the vernacular of particular 1.5.2).

241. We reach this conclusion because we are comfortably satisfied that 7-Zip was used to decompress those particular files.

242. This same date characteristic applies to an individual file created/stored on 2 March 2010 (row 522); the file decompressed and stored on 26 March 2010 (row 521); the 63 files decompressed and stored bearing the 'file created' date 26 June 2010 file path name ending "Maddie" (rows 322 to 384); and the 90 files decompressed and stored bearing the "file created" date 27 September 2010 file path name ending "Japan_4_u_ba_k" (rows 231 to 320).

243. We are well satisfied to find that the 2010 files detailed above were decompressed from .zip files and that the compression software used by Dr Yu to decompress the 2010 compressed files and file packages was 7-Zip.

244. Therefore, we find that the file created dates for those files represent the dates when those files were unzipped and saved or 'stored' by Dr Yu on his PC (the 'original creation date' referred to in particular 1.5).

Finding as to storage date of remainder of compressed files

245. For the remainder of the compressed files, with a 'file created' date either pre-dating or identical to the 'file modified' date in the compressed file or package of files, we cannot reach the same conclusion regarding the type of compression software used, or the storage date (see for example files at row 1 - 128).

246. This is because we cannot satisfactorily find that the compression software used to unzip those files was 7-Zip. In fact we find it was probably not 7-Zip as the date behaviour in the metadata is not indicative of 7-Zip.

247. This means the 'file created' dates for those files may represent either the dates in the original package before the files were transferred, or it may mean the dates were manually changed.[46]

248. The same can be said of the files in the one file package, bearing the same file path name "Ay Papi", but having three different 'file created' and 'file modified' dates (e.g. files from rows 129-211).[47] This is so even though the characteristics of a post-dated "file created" date is evident for those files.

249. As Mr Gare stated, with those files the doubt arises about the use of 7-Zip because of the three different date ranges for "file created" within the one decompressed file package. This is not consistent with the behaviour of 7-Zip. Although, we note, given the post-dating date behaviour of the files once decompressed, it appears not to be consistent with the use of WinZip either.

250. In any event, we find that the evidence about the storage dates for that package of files remains unclear and we cannot be satisfied to interpret the metadata.

251. If WinZip was in fact used, the "file created" dates could represent the date that was preserved from the original package of files, not the date that Dr Yu stored the files on his PC.

252. Apart from the metadata there is no other evidence about the specific dates of storage of files other than Dr Yu's admission that all files were stored before the end of 2011.

253. Given the inconclusiveness of the evidence about the interpretation of the timestamp aspects of the metadata regarding the remaining compressed files (i.e. apart from the 2010 files) we cannot reach the same firm conclusions as to the specific storage dates for the remaining compressed file packages simply based on the metadata.

254. The proof regarding the earliest storage of the relevant file detailed at particular 1.5.1 is based on the forensic investigation of Dr Yu's computer detailed in the spreadsheet that was produced by Detective Marsland.

255. We note that Dr Yu formally admits that a large number of files were stored prior to the end of 2011 (particular 1.5.2) but denies the allegation regarding the earliest stored file as set out in particular 1.5.1.

256. The 'file created data' that gives rise to the allegation of storage first occurring on 11 September 2007 is a single file contained in row 557 of the spreadsheet.

257. The Board invites us to conclude that this file "does not appear to be part of any zipped group of files with shared names, or part of any series of files. It is isolated from other files in its own folder. It is titled "only at REAL STREET ANGELS".

258. The metadata reveals an identical file "created date" and "file modified "date of 11 September 2007.

259. We agree with the Board's submission that this file in row 557 is not clearly a file that was contained within a group of compressed files (i.e. a compressed file package).

260. However, we are not able to find that the file was not downloaded in a compressed file format. That is, we are not able to comfortably conclude that the individual file was not downloaded by itself in a compressed file format (like the individual files in rows 521 and 522 which, as we detail above, we have concluded were compressed files because of the date behaviour in the metadata).[48]

261. It is not just groups of files that are downloaded in a compressed format.[49]

262. If file 557 was downloaded in a compressed file format then, given the identical date timestamps for 'file created' and 'file modified' for this file, we cannot draw the same conclusions that 7-Zip was used as we did for the 2010 files. Further, we cannot exclude the possibility that, if the file was compressed, WinZip compression software may have been used.

263. Accordingly, we cannot draw any conclusions about the date attributes of the metadata for this file (which by contrast gives us clear information about the 'file created'/storage date for the files in rows 521 and 522).[50]

264. We conclude that the file in row 557 may have been downloaded as an individual file, or it may have been downloaded via a compression software programme such as WinZip that preserved the original timestamp metadata.

265. There is no way to reach a definitive conclusion about this; we consider that we simply cannot make findings about this to the requisite degree as the evidence in this regard is inexact and inconclusive.

266. Further, we note the submission advanced by Mr Dadds that it is unusual that Dr Yu continues to maintain his position about particular 1.5.1 in the context of his other comprehensive admissions. We think it is relevant to note that the particular file in row 557 is a single (category one) image file. This category is the least serious type of CEM depicting children with no sexual activity.

267. If 2007 was date of storage of this one file then it appears to be a real "outlier". We consider this to be inconsistent with the established pattern of Dr Yu's CEM storage behaviour demonstrated by the dates of storage of the other material in the spreadsheet.

268. As an aside, we note that the individual file detailed in row 558 has the file timestamp date behaviour to suggest that it was a compressed file and that 7-Zip was used to compress and decompress it ('file created' date 26 May 2009 c.f. 'file modified' date 26 July 2003). That file suggests a storage date by Dr Yu of 26 May 2009. However, unlike the 2010 files, this was not part of the Board's case, was not addressed in the written submissions and was not put to either of the expert witnesses for comment. We consider that it would be unfair to the respondent for us to make a finding about the storage date of that particular file now.[51]

269. Given that we cannot make any positive findings about the format in which the file at row 557 was downloaded, (and, if it was compressed, due to the date timestamp behaviour we certainly cannot conclude that 7-Zip was used), we cannot draw any inferences from the "file created" date regarding the storage date of this file.

270. We agree with the initial conclusions of Mr Gare set out in his report at page 4 that the 'file created' date for the 2007 file may be the date that was ascribed to the file by the original creator of the file and preserved to the metadata via the compression software programme.[52]

271. Bearing in mind the standard of proof in these proceedings, and the inconclusive nature of the evidence about the metadata attributes of this file, we are not satisfied to the requisite degree to make a finding that 11 September 2007 was the earliest storage date of CEM files on Dr Yu's PC.[53]

272. However, we are satisfied to the requisite degree to find that the earliest storage dates established on the evidence before us range between 2 March 2010 (row 522) and 26 June 2010 (rows 322-384).

273. We also accept Dr Yu's admission that (excluding the files detailed in 1.5.2 i and ii) all of the files detailed on the spreadsheet were stored on the computer 'prior to the end of 2011' (particular 1.5.2).

Summary of findings as to Particulars 1.5.1 and 1.5.2 and earliest storage date

274. Consistent with the evidence before us, including Dr Yu's admission before the Tribunal and in the police record of interview[54] we find that one category one image file was stored and downloaded on 18 March 2012 and 17 system files (identified as 'temporary system root files') were 'created' between 12 October 2015 and 19 November 2015 (particulars 1.5.2 i and 1.5.2 ii).

275. These files are detailed on the spreadsheet at rows 559 to 576. They each contain 'file modified dates' between 12 October 2015 and 19 November 2015.

276. The files with the most recent "file created" dates (i.e. the 2015 system files) were the subject of questions in the police record of interview. Dr Yu admitted downloading those files the day before his arrest (on 19 November 2015). One of those files bore the files name "Boy 9 yo and woman" (as detailed at row 560 of the spreadsheet). The date of his downloading of the material matched the "file creation date" in the spreadsheet. This date is identical to the file modified date in this example.

277. Consistent with Dr Yu's admission before the Tribunal we find that all of the remaining files (detailed between rows 1 - 558 on the spreadsheet; excluding the 2010 files) were stored at various unknown times prior to the end of 2011. (Particular 1.5.2).

278. We are not satisfied and are not able to find that the 'earliest storage date' was 11 September 2011 (Particular 1.5.1).

279. However, as detailed above, we are comfortably satisfied to find that a large number of the files containing child pornography were downloaded, unzipped/decompressed and stored/saved (i.e. created) on Dr Yu's computer between March and September 2010. Those dates represent the earliest storage dates.

Findings as to Dr Yu's use or access of stored CEM files and access to online CEM

280. Finally, we agree with the Board's written submission that it is appropriate, having heard all the evidence, for us to make findings about the respondent's access to, or use of, the child pornography that he possessed, or had stored on his computer.

281. We note that Mr Dadds in cross examination of Detective Marsland focused on the fact that the file metadata did not provide information about the "access date" of the files in the spreadsheet.

282. However, we note that the respondent has admitted particular 1.6 on the complaint that he had accessed the files detailed in the complaint for the purpose of his sexual gratification up until the day prior to the search.

283. The respondent admits in the police record of interview (ROI) that he first accessed CEM when underage (i.e. some time prior to November 2003).

284. Dr Yu stated in the ROI that he 'mostly accessed' CEM in the last 'couple of years' (i.e. from 2013-2015) and, through his counsel in the Magistrate's Court on the plea, that his 'accessing' of child pornography "started in 2014". Although he admitted accessing CEM in the ROI and in the criminal proceedings, it is now clear on the evidence before the Tribunal that both of those statements are false as to the commencement date for this conduct.

285. Dr Yu further stated in the record of interview that he had accessed CEM in 'about February 2015' (consistent with the information provided by the FBI) and that he had accessed CEM on 'other occasions', including on the day prior to the police attending with the warrant i.e. on 19 November 2015.

286. He admitted to having downloaded videos the previous day (19 November 2015), knowing they contained child pornography. He saved them to a folder called "the Tor project".

287. He told police that his computer was not set up with offsite storage (like the cloud or anything),[55] although he was found to have the Dropbox application (a cloud storage application) installed on his PC.

288. We have objective evidence before us that Dr Yu accessed CEM in the form of the 17 system files and the other files, which are detailed in Appendix A to the affidavit of Detective Marsland.[56] The evidence before the Tribunal is that these files were found in the "recently opened" details located in the registry of the windows operating system on Dr YU's computer.[57]

289. The detail of the recently opened files indicates that some of the files were accessed during that short period on more than one occasion.

290. We agree with the Board's submission that, based on Detective Marsland's evidence regarding the examination of the computer, some of the videos that appeared in the 'recently opened' folder were videos not otherwise saved in his library of stored CEM and do not appear in the spreadsheet. The 'Laura Billabong' videos are an example. This is consistent with Dr Yu viewing the videos offsite in 'the cloud' or online without downloading them.[58] We are satisfied that Dr Yu was viewing some videos via a cloud facility and/or online.

291. Even though Dr Yu's admissions in the ROI about when he 'mostly accessed' CEM is now known to be inconsistent with his admissions before the Tribunal and with the Tribunal's findings Mr Dadds invites the Tribunal to find that his admission in the ROI "was unlikely to have been a lie having regard to all the circumstances (including the many other evidently honest admissions against his interests) but rather an innocently inexact response in very demanding circumstances."[59]

292. We reject that submission. Given the Tribunal's findings about the actual possession dates (i.e. at least five years before he was arrested) we find that Dr Yu was either being deliberately vague or untruthful in the police ROI, or that he intentionally downplayed the extent of his involvement regarding the downloading, possession and access to child pornography. The same can be said of his instructions to his counsel in the Magistrates Court proceedings about his earliest access date, which bears no resemblance to either our findings, or his admissions in these proceedings.

293. Once the forensic investigation of the computer was revealed in the spreadsheet annexed to Detective Marsland's affidavit Dr Yu admitted in the Tribunal the allegation on the MBA complaint that he stored CEM "prior to the end of 2011"; and our findings are that the earliest established date of storage is March 2010.

294. In our view it is both inconsistent with his admitted interest in child pornography and illogical to suggest that, having gone to the trouble to find, download and store CEM via the dark web, he was not revisiting and accessing the library of CE material saved on his computer. We do not accept that such was the case.

295. We agree with the submission of counsel for the Board that the fact there is no "file access" data in the spread sheet does not equate with a proposition that there was no file access.

296. Mr Dadds takes issue in his written submission with the Board's written submission at paragraph 16 of its outline that Dr Yu 'admits he is a paedophile'. The Respondent's counsel argues that 'he does not admit that he is currently a paedophile'.

297. It is not necessary for us to make a finding that Dr Yu was, or is, a paedophile (we assume this to mean 'a person who is sexually attracted to children'.)[60] We may hear from the parties further about this at the sanction stage.

298. Dr Yu has admitted, and we have found, that he has had a long-standing interest (since he was himself a minor i.e. for over a decade) in covertly searching out, possessing and accessing a vast amount of online child pornography (including videos and photographs) for his own sexual gratification.

299. Of note we find that some of the CEM was category 4 on the CETS scale i.e. it involved sexual penetration of children (between children, or between children and adults), and as such this material was obviously sexually explicit, abusive and exploitative of children.

300. The forensic investigation by Detective Brevet Sergeant Fredella revealed that the CEM generally appeared to depict children apparently between the ages of fourteen and seventeen years of age and included penetrative sexual intercourse with adult males.[61]

301. We note that Dr Billy Yu admits that it is open to the Tribunal to find that the conduct alleged on the complaint amounts to 'professional misconduct' as defined in the National Law.

302. We are comfortably satisfied for the reasons set out above to find that Dr Billy Lee Yu's established conduct is both "substantially below the standard reasonably expected of a registered health practitioner" and is conduct that is "inconsistent with the practitioner being a fit and proper person to hold registration in the profession".

303. We agree with paragraphs 1.9.3 - 1.9.8 of the complaint that the conduct admitted and found proven amounted to: an offence under another Act (s 63A of the CLCA) which affects the practitioner's suitability to continue to practise the profession; is objectively serious criminal misconduct which warranted the imposition of an immediate term of imprisonment; involved the respondent's pursuit of sexual gratification in disregard of the interests of children depicted in the material; involved the participation (by downloading) in an activity that involved the abuse of children; demonstrates the respondent lacks the good character and integrity to practise as a professional in relation to children and other vulnerable persons; would bring the medical profession into disrepute; and would be detrimental to the reputation of, and the public's trust and confidence in the medical profession.

304. We take notice that as a result of his conviction the respondent is now a registrable offender within the meaning of s 6 of the Child Sex Offenders Registration Act 2006 (SA). He is a class 2 offender for the purposes of that Act. By operation of Part 5 of the Act, he is prohibited from applying for, or engaging in, certain kinds of child related work.

305. Under s 196(1) (b) of Schedule 2 of the National Law we find that the respondent's conduct in all of the circumstances amounts to professional misconduct as defined in s 5 of the National Law.

306. The matter is adjourned to a directions hearing for the parties' counsel to make submissions as to the further conduct of the matter regarding a sanctions hearing.

[1] MB3 Marsland affidavit 13/7/2018 paragraph 23 and MB1p 80 Det. Fredella affidavit.

[2] [1938] HCA 34; (1938) 60 CLR 336 esp. per Dixon at 362-363.

[3] Basser v Medical Board of Victoria [1981] VicRp 88; [1981] VR 953; Marin v Chiropractic Board of Australia [2019] SADC 17 at [99]-[100].

[4] However, we note that Mr Dadds submitted (at the conclusion of the evidence of the two witnesses) that he would not be pressing for the tender of Mr Elmer's report. He would propose to obtain a new report from Mr Elmer.

[5] MB1 p 90 (para 5 sentencing remarks); Mr Dadds has clarified in his second written submission to SACAT at para 26 that the detailed forensic analysis of the computer records was not made available to defence counsel by SAPOL before the matter was dealt with by the Magistrate's Court; the evidence about the now admitted storage dates of CEM (prior to 2011) was not revealed to Dr Yu's legal advisers via Detective Marsland's affidavit evidence until AHPRA had conducted a more extensive investigation (i.e. after the finalisation of the criminal matter). We accept that it was not for Dr Yu to establish the facts on the plea and defence counsel could properly rely on his instructions. However, his instructions do not now appear to be accurate.

[6] Two Affidavits of Detective Marsland.

[7] This ought to have been apparent in the criminal proceedings; Dr Yu admitted this during the course of the record of interview with SAPOL (MB1 p 16 - 45) and this admission was contained in the factual summary prepared by the DPP (MB1 - p86-88). However, as Mr Jacobi observed in submissions, this version of the facts was seemingly not pressed on the guilty plea by the DPP and the Magistrate accepted Dr Yu's version of the facts despite the other material before the court. In the absence of a challenge to the facts by the prosecution, we accept that the defendant was entitled to put this version and the Magistrate was entitled, on the plea, to proceed on the version of events that most favoured the defendant. (R v Maitland [1963] SASR 332; Law v Deed [1970] SASR 374; Weaver v Samuels [1971] SASR 116).

[8] Neat Holdings v Karajan Holdings Pty Ltd [1992] HCA 66; (1992) 110 ALR 449 at 449 - 450.

[10] Marsland affidavits and statement of witness dated 21/3/16.

[15] Ibid and p 32 and 33 MB1 (ROI p 44, 45).

[16] Admissions in ROI p 48 (p 38 MB1).

[20] Marsland affidavit 15 November 2019 para 5.

[22] BY1 - Gare report p 3 paragraph 3.

[23] See for example files detailed at rows 1 - row 128 all 128 individual files have the same "path name", ending in "amateur photos", but bear different "names" or descriptors e.g. "Yvette and image", 'Julie', 'Sue', 'Sandra' etc.

[25] T 22/11 P 49 and 62 - 63 Marsland.

[27] MB3 Affidavit of Det. Marsland dated 15 November 2019.

[29] Affidavit Detective Marsland dated 15 November 2019, paragraph 6 (MB3) was not determined or persistent in his efforts to acquire child pornography.

[31] When you download or read a file or a webpage the data is "cached" meaning it is temporarily stored on the computer. As detailed above the cache can be cleared or emptied using CCleaner.

[33] T 22/22/19 Marsland at p 94 and 95.

[34] Marsland affidavit 13 July 2018 para 24; Marsland affidavit 15 November 2019 para 7, T ibid.

[35] Mr Jacobi's written submission para 21.2.

[36] An example is the group of 128 image files all having a file path name ending in "Amateur photos" at Rows 1 - 128 of the spreadsheet.

[39] Mr Gare agreed with this proposition at T 22/11/19 p 125

[40] Affidavit Marsland 15 November 2019 parp8 and T 22/11/19 p 60.

[41] Affidavit of Marsland Appendix A - recently opened files. Although we accept those files were not downloaded merely viewed.

[42] Mr Gare at p 119 T 22/11/19 re Ay Papi file package.

[43] For the files in the one compressed file package with the same file path name.

[44] Mr Gare transcript page 120 on 22/11/ 2019.

[45] Mr Gare transcript page 119, 120 on 22/11/ 2019.

[46] Although we have no evidence that the dates were manually changed and we consider it unlikely.

[47] The NVIDIA/T/AY Papi path name of files referred to by Gare at p 119 T 22/11/19.

[48] Gare's evidence at p 89 T 22/1//19.

[49] We refer to our earlier findings about the advantages of using compression software to transfer CEM.

[50] T 22/11/19 Gare p127 and Gare report at para 6.1.5.

[51] The same comments apply to the group of files from a compressed file package at rows 532-555 with file created dates of 13 November 2009 and earlier file modified dates.

[52] Gare report para 6.1.5 and T p126 - Gare's answer in cross examination is based on an assumption that 7-Zip was used.

[53] We agree with the submission of Dr Yu's counsel regarding inexact proof for this file.

[57] Marsland statement of witness MB1 p 59 and Appendix A.

[59] Respondent's written submission page 11.

[60] Although, we note that the term has both a generic and a medical (psychiatric) definition.