Child Pornography (Art. 189 CP): Criminal Defence

The offence relating to child pornography (Art. 189 of the Criminal Code) is one of the most heavily prosecuted at international level. Police operations usually begin with alerts from service providers (Google, Microsoft) or infiltration of P2P networks.

How These Investigations Begin

Most proceedings do not start with a complaint by an individual but with an automated alert. Service providers detect suspicious files hosted on their platforms and report them to the authorities, while specialised police units monitor P2P networks for known material. Once an IP address located in Spain has been identified, the investigating court can authorise the identification of the subscriber and, where appropriate, a search of the home.

That search is usually the first time the person concerned learns of the investigation. Computers, phones, hard drives and cloud accounts are seized for examination. How the person reacts at that moment — and, above all, what they say without a lawyer present — can shape the entire case.

The Difference Between Possession and Distribution

The Criminal Code draws a clear distinction:

• Possession: holding files on a hard drive or in the cloud. A penalty of 3 months to 1 year in prison, or a fine.
• Distribution or dissemination: sharing, selling or sending the files. It is far more serious, with penalties of 1 to 5 years in prison.

Beware of P2P: programs such as eMule or BitTorrent automatically share what is downloaded. The prosecution often charges distribution on this basis. The technical defence must show that there was no "intent to disseminate", only to download (which would be unpunishable personal consumption or simple possession).

The Computer Forensic Report

The defence in these cases is fundamentally technical. It is vital to analyse the hard drive in order to:

1. Verify whether the files were downloaded voluntarily or are "cookies/temporary files".
2. Check whether there was access by third parties (malware, trojans).
3. Determine the real age of the people in the images ("virtual" or simulated pornography vs real).

Chain of Custody and the Forensic Copy

Seized devices must be cloned through a forensic copy whose integrity is guaranteed by hash values, so that the material analysed is identical to the original. Any gap in the chain of custody — devices stored without sealing, analyses performed directly on the original drive, copies that do not match the recorded hash — can be challenged by the defence and may render the evidence unusable.

The defence is also entitled to appoint its own expert to review the forensic copy, verify the methodology used by the police laboratory and present an independent report at trial.

Common Defence Lines

Building on the forensic analysis, the usual defence strategies include:

• Lack of knowledge or intent: files located in temporary folders, caches or incomplete downloads do not prove a conscious decision to possess the material.
• Access by third parties: malware, remote-access trojans or other people using the same device or connection may explain the presence of the files without any involvement of the accused.
• No intent to disseminate: in P2P cases, showing that sharing was an automatic default setting of the program — and not a deliberate choice — supports reclassifying the facts from distribution to simple possession, with a far lower penalty.
• Nature of the material: an expert assessment of the age of the persons depicted, or of whether the images are real or simulated, can take the conduct outside the scope of the offence.

Why Early Specialist Advice Matters

By the time a search takes place, the investigation has usually been under way for months. The first statement before the police or the investigating judge is therefore decisive: anything said without a prior technical analysis of the devices may close defence avenues that the forensic evidence would otherwise have kept open. Exercising the right not to testify until the defence has studied the case file is, in most cases, the prudent course.