
Criminal Lawyers in Child Pornography Possession
Technical defense under Art. 189.5 CP. Demonstrating absence of intent and lack of storage will
Last updated:
Child Pornography Possession: Art. 189.5 of the Criminal Code
The offence of possession of child pornography for personal use (Art. 189.5 CP) sanctions with 3 months to 1 year of prison or 6 to 12 months' fine those who acquire or possess pornographic material in whose elaboration minors or persons with disabilities have been used. The protected legal interest is the sexual indemnity of minors in its transversal dimension: the criminalization of mere demand for material seeks to close the chain of child sexual exploitation by reducing the economic incentive for its production. The provision, introduced by LO 5/2010 and reformed by LO 1/2015, complies with the Lanzarote Convention and Directive 2011/93/EU. Consolidated Supreme Court case-law clarifies the typical elements: effective possession of material, knowledge of its illicit nature, and will to possess it, expressly excluding automatic downloads, browser cache files without deliberate conservation, and those involuntarily received.
The commissive modalities and technical scenarios are diverse. Conscious and organized possession implies deliberate storage in personal folders, renaming files, organization by themes or labels; it constitutes the most clearly reproachable typical modality. Possession in cloud storage systems (Dropbox, Google Drive, OneDrive, MEGA) with automatic synchronization to personal devices equally integrates the type, but raises evidentiary questions about effective account ownership. Files in browser temporary cache (cookies, temporary files, thumbnails) raise jurisprudential debate: the Supreme Court has established that files found exclusively in cache, without organization or deliberate storage, do not prove typical possession. Automatic unsolicited downloads through P2P programs, received in WhatsApp/Telegram groups, or introduced by third parties with device access, exclude intent when absence of knowledge is proven.
The penalties and accessory consequences, although less than in production or distribution modalities, are significant. The alternative principal penalty is 3 months to 1 year of prison or 6 to 12 months' fine. When the imposed sentence does not exceed 2 years and the accused has no prior records, Art. 80 CP allows sentence suspension avoiding actual imprisonment, although this does not exempt from accessory consequences. The mandatory registration in the Central Sex Offenders Registry (RD 1110/2015) for periods up to 30 years, the disqualification to work with minors in any sphere (education, pediatric healthcare, sports, entertainment, school transport), supervised release of up to 5 years (Art. 192 CP), and civil liability for moral damages are unavoidable consequences. The destruction of electronic devices seized as instrument of the offence applies under Art. 127 CP.
Technical defense is built on four axes. First, the absence of intent in possession: the criminal type requires effective knowledge and will; when files come from automatic browser downloads, files stored in cache without deliberate conservation, unsolicited receipts in messaging groups, messages with automatic preview (WhatsApp, Telegram), or pop-ups during browsing, computer expert evidence can prove the absence of acquisition will. Second, the challenge of authorship attribution: in devices shared in households with multiple users, vulnerable or password-less wifi networks, unauthorized remote access, active malware that used the equipment without titular's knowledge, the in dubio pro reo principle operates when certain identification is not proven. Third, the evidentiary nullity due to chain of custody defects: absence of write blocker during initial cloning, discrepant hashes between original and copy, documentary defects in device traceability, configure nullities. Fourth, the nullity of home search or content examination: judicial authorization for home search does not automatically cover the examination of content of computers found (Art. 588 sexies a Criminal Procedure Act); content examination requires specific authorization.
In current forensic practice, possession investigations mostly arise from automatic provider alerts (Microsoft, Google, Meta, Apple) through technologies like PhotoDNA and Content Safety API, which are transmitted to NCMEC and Spanish national authorities (BIT-National Police, GDT-Civil Guard). International operations coordinated by Europol and Interpol generate massive proceedings with hundreds of simultaneous investigated persons. Organic Law 8/2021 on integral protection of childhood, the Budapest Convention on Cybercrime, Organic Law 1/2025 on Justice Service Efficiency and constitutional case-law on electronic evidence configure a demanding procedural scenario. At Alonso Sala, our criminal lawyers specialized in child pornography possession coordinate multidisciplinary teams with internationally certified forensic computer experts (EnCE, GCFE, CHFI) performing exhaustive forensic audits, identifying cache files versus deliberately stored files, detecting active malware on download dates, examining user session attribution, and articulating technical defenses that can determine acquittal, sentence suspension when Art. 80 CP circumstances concur, and minimization of impact on the defendant's professional trajectory and record.
Defense Strategies in Child Pornography Possession
Cache Files: Involuntary Download
Browser cache temporarily stores everything viewed online. If files were found exclusively in system temporary folders without deliberate organization, we defend the absence of voluntary storage act.
Automatic P2P Downloads
Programs like eMule or Torrent clients download fragmented files and share them automatically (seeding). The user may have searched for legal content and the program downloaded misleadingly named files. Forensic analysis demonstrating automatic downloads and default folders is the key defense evidence.
Vulnerable WiFi Network
If the router used WEP encryption (easily vulnerable), had no password, or had WPS enabled, anyone within range could have used the connection for illicit downloads. Network forensic analysis demonstrating vulnerability and absence of MAC records strengthens reasonable doubt.
Search Warrant Nullity
Entry and search requires a motivated judicial order. If the order doesn't specify devices, police exceeded authorization scope, or computer search was conducted without specific judicial authorization (different from home search warrant), all obtained digital evidence is void and acquittal is mandatory.
KEY EVIDENCEDigital Evidence in Possession Cases
In possession crimes, digital evidence is everything. There are no witnesses, no victim testimony. Everything depends on what's found on the hard drive and how it was obtained.
Police compare file hashes with international databases (ICSE/Interpol). A matching hash proves the file but not who downloaded it or when.
Creation metadata (date, time, capture device) can indicate self-production or external origin. Absence of camera metadata points to download, not production.
Windows Event Viewer logs, browser logs, and access history help reconstruct who was using the computer at the time of downloads.
Why Choose Us for Possession Defense?
Because the difference between conviction and acquittal isn't in the Criminal Code, but on the hard drive. Our team combines legal expertise with forensic computer experts who analyze every byte of seized evidence.
- checkIn-house computer experts with digital forensic analysis experience.
- checkDefense strategy built from technical evidence, not just from law.
- checkSystematic challenge of chain of custody in every proceeding.
- checkConfidentiality and discreet case management.
Child Pornography in Spain: Complete Legal Defense Guide
Child pornography offenses in Spain are governed by Art. 189 of the Criminal Code, with penalties ranging from 3 months (simple possession) to 9 years in prison (aggravated production/distribution). Online grooming is separately criminalized under Art. 183 CP. These crimes are investigated with specialized digital forensic tools and international cooperation through Europol, Interpol, and the ICSE database. Defense requires both deep legal knowledge and technical digital forensic expertise.
Penalty Table: Art. 189 CP & Related Offenses
| Offense | Article | Penalty |
|---|---|---|
| Production of child pornographic material | Art. 189.1.a | 5 – 9 years |
| Distribution / dissemination | Art. 189.1.b | 1 – 5 years |
| Aggravated (victim <16, organization, profit) | Art. 189.2 | 5 – 9 years |
| Facilitating minors' access to pornography | Art. 189.4 | 6 months – 1 year |
| Simple possession (personal use) | Art. 189.5 | 3 months – 1 year |
| Grooming (online contact with sexual purpose) | Art. 183 | 1 – 3 years |
| Grooming + physical meeting | Art. 183.2 | 1 – 3 years (aggravated) |
Critical Defense Strategies
Chain of Custody Challenge
If the seized device was handled without write blockers, stored without seal, or analyzed without documented protocols, the entire digital evidence can be invalidated. This is the most powerful defense tool available.
Absence of Intent (Dolo)
Possession requires knowledge and will. Automatic P2P downloads, browser cache files, and malware infections can all store illicit material without user knowledge. Forensic analysis proving involuntary storage is essential.
IP ≠ Person Identification
An IP address identifies a connection, not a person. Vulnerable WiFi networks (WEP, no password, WPS enabled), shared routers, and VPN usage all prevent conclusive identification of the downloader.
Reclassification: Distribution → Possession
P2P programs share files automatically (seeding). If the user was unaware of this mechanism, distribution charges can be reclassified as simple possession, reducing the penalty from 5 years to 1 year.
Key Supreme Court Rulings
The Supreme Court established that files found exclusively in browser cache, without organization, renaming, or deliberate storage in personal folders, do not constitute the intentional possession required by Art. 189.5 CP. The prosecution must prove voluntary storage act.
The TS ruled that examining digital device contents requires a specific judicial order separate from the home search warrant (Art. 588 sexies a LECrim). Evidence obtained from computers found during a home search without specific device authorization is void.
The Court analyzed whether automatic seeding in P2P programs constitutes distribution. It held that if the accused can demonstrate unawareness of the sharing mechanism and low technical profile, distribution intent may not be proven, allowing reclassification to possession.
The Digital Forensic Process
Seizure
Device sealed on-site with photographs and chain of custody document initiated.
Forensic Cloning
Bit-by-bit copy using write blocker. SHA-256 hash generated for original and clone comparison.
Hash Comparison
File hashes compared against ICSE (Interpol) and NCMEC databases to identify known illicit material.
Timeline Reconstruction
System logs, user sessions, and file metadata analyzed to determine who, when, and how files arrived.
FAQ: Child Pornography Possession
Is possessing child pornography a crime even without sharing?expand_more
What if the files arrived on my device automatically?expand_more
Does browser cache count as possession?expand_more
Do police need a warrant to search my computer?expand_more
Can I avoid prison if I plead guilty?expand_more
Can my partner be investigated for the same files?expand_more
How long does such an investigation take?expand_more
Can deleted files be recovered?expand_more
Could malware have downloaded files without my knowledge?expand_more
Does using a VPN protect me from investigation?expand_more
How is it determined whether the person in the material is a minor?expand_more
Will my employer find out about the investigation?expand_more
What are online 'sting' operations?expand_more
Do you need specialised legal assistance?
The judicial system is complex. We have the criminal-law specialisation and technical resources required to take on the defence.