Skip to content
AS
Alonso Sala
CRIMINAL LAWYERS
ES

Criminal Lawyers in Child Pornography Possession

Technical defense under Art. 189.5 CP. Demonstrating absence of intent and lack of storage will

Last updated:

Child Pornography Possession: Art. 189.5 of the Criminal Code

The offence of possession of child pornography for personal use (Art. 189.5 CP) sanctions with 3 months to 1 year of prison or 6 to 12 months' fine those who acquire or possess pornographic material in whose elaboration minors or persons with disabilities have been used. The protected legal interest is the sexual indemnity of minors in its transversal dimension: the criminalization of mere demand for material seeks to close the chain of child sexual exploitation by reducing the economic incentive for its production. The provision, introduced by LO 5/2010 and reformed by LO 1/2015, complies with the Lanzarote Convention and Directive 2011/93/EU. Consolidated Supreme Court case-law clarifies the typical elements: effective possession of material, knowledge of its illicit nature, and will to possess it, expressly excluding automatic downloads, browser cache files without deliberate conservation, and those involuntarily received.

The commissive modalities and technical scenarios are diverse. Conscious and organized possession implies deliberate storage in personal folders, renaming files, organization by themes or labels; it constitutes the most clearly reproachable typical modality. Possession in cloud storage systems (Dropbox, Google Drive, OneDrive, MEGA) with automatic synchronization to personal devices equally integrates the type, but raises evidentiary questions about effective account ownership. Files in browser temporary cache (cookies, temporary files, thumbnails) raise jurisprudential debate: the Supreme Court has established that files found exclusively in cache, without organization or deliberate storage, do not prove typical possession. Automatic unsolicited downloads through P2P programs, received in WhatsApp/Telegram groups, or introduced by third parties with device access, exclude intent when absence of knowledge is proven.

The penalties and accessory consequences, although less than in production or distribution modalities, are significant. The alternative principal penalty is 3 months to 1 year of prison or 6 to 12 months' fine. When the imposed sentence does not exceed 2 years and the accused has no prior records, Art. 80 CP allows sentence suspension avoiding actual imprisonment, although this does not exempt from accessory consequences. The mandatory registration in the Central Sex Offenders Registry (RD 1110/2015) for periods up to 30 years, the disqualification to work with minors in any sphere (education, pediatric healthcare, sports, entertainment, school transport), supervised release of up to 5 years (Art. 192 CP), and civil liability for moral damages are unavoidable consequences. The destruction of electronic devices seized as instrument of the offence applies under Art. 127 CP.

Technical defense is built on four axes. First, the absence of intent in possession: the criminal type requires effective knowledge and will; when files come from automatic browser downloads, files stored in cache without deliberate conservation, unsolicited receipts in messaging groups, messages with automatic preview (WhatsApp, Telegram), or pop-ups during browsing, computer expert evidence can prove the absence of acquisition will. Second, the challenge of authorship attribution: in devices shared in households with multiple users, vulnerable or password-less wifi networks, unauthorized remote access, active malware that used the equipment without titular's knowledge, the in dubio pro reo principle operates when certain identification is not proven. Third, the evidentiary nullity due to chain of custody defects: absence of write blocker during initial cloning, discrepant hashes between original and copy, documentary defects in device traceability, configure nullities. Fourth, the nullity of home search or content examination: judicial authorization for home search does not automatically cover the examination of content of computers found (Art. 588 sexies a Criminal Procedure Act); content examination requires specific authorization.

In current forensic practice, possession investigations mostly arise from automatic provider alerts (Microsoft, Google, Meta, Apple) through technologies like PhotoDNA and Content Safety API, which are transmitted to NCMEC and Spanish national authorities (BIT-National Police, GDT-Civil Guard). International operations coordinated by Europol and Interpol generate massive proceedings with hundreds of simultaneous investigated persons. Organic Law 8/2021 on integral protection of childhood, the Budapest Convention on Cybercrime, Organic Law 1/2025 on Justice Service Efficiency and constitutional case-law on electronic evidence configure a demanding procedural scenario. At Alonso Sala, our criminal lawyers specialized in child pornography possession coordinate multidisciplinary teams with internationally certified forensic computer experts (EnCE, GCFE, CHFI) performing exhaustive forensic audits, identifying cache files versus deliberately stored files, detecting active malware on download dates, examining user session attribution, and articulating technical defenses that can determine acquittal, sentence suspension when Art. 80 CP circumstances concur, and minimization of impact on the defendant's professional trajectory and record.

Defense Strategies in Child Pornography Possession

cached

Cache Files: Involuntary Download

Browser cache temporarily stores everything viewed online. If files were found exclusively in system temporary folders without deliberate organization, we defend the absence of voluntary storage act.

download

Automatic P2P Downloads

Programs like eMule or Torrent clients download fragmented files and share them automatically (seeding). The user may have searched for legal content and the program downloaded misleadingly named files. Forensic analysis demonstrating automatic downloads and default folders is the key defense evidence.

wifi_tethering

Vulnerable WiFi Network

If the router used WEP encryption (easily vulnerable), had no password, or had WPS enabled, anyone within range could have used the connection for illicit downloads. Network forensic analysis demonstrating vulnerability and absence of MAC records strengthens reasonable doubt.

gavel

Search Warrant Nullity

Entry and search requires a motivated judicial order. If the order doesn't specify devices, police exceeded authorization scope, or computer search was conducted without specific judicial authorization (different from home search warrant), all obtained digital evidence is void and acquittal is mandatory.

KEY EVIDENCEDigital Evidence in Possession Cases

In possession crimes, digital evidence is everything. There are no witnesses, no victim testimony. Everything depends on what's found on the hard drive and how it was obtained.

HASH (SHA-256)

Police compare file hashes with international databases (ICSE/Interpol). A matching hash proves the file but not who downloaded it or when.

EXIF Metadata

Creation metadata (date, time, capture device) can indicate self-production or external origin. Absence of camera metadata points to download, not production.

System Logs

Windows Event Viewer logs, browser logs, and access history help reconstruct who was using the computer at the time of downloads.

shield

Why Choose Us for Possession Defense?

Because the difference between conviction and acquittal isn't in the Criminal Code, but on the hard drive. Our team combines legal expertise with forensic computer experts who analyze every byte of seized evidence.

  • checkIn-house computer experts with digital forensic analysis experience.
  • checkDefense strategy built from technical evidence, not just from law.
  • checkSystematic challenge of chain of custody in every proceeding.
  • checkConfidentiality and discreet case management.

Child Pornography in Spain: Complete Legal Defense Guide

Child pornography offenses in Spain are governed by Art. 189 of the Criminal Code, with penalties ranging from 3 months (simple possession) to 9 years in prison (aggravated production/distribution). Online grooming is separately criminalized under Art. 183 CP. These crimes are investigated with specialized digital forensic tools and international cooperation through Europol, Interpol, and the ICSE database. Defense requires both deep legal knowledge and technical digital forensic expertise.

Penalty Table: Art. 189 CP & Related Offenses

OffenseArticlePenalty
Production of child pornographic materialArt. 189.1.a5 – 9 years
Distribution / disseminationArt. 189.1.b1 – 5 years
Aggravated (victim <16, organization, profit)Art. 189.25 – 9 years
Facilitating minors' access to pornographyArt. 189.46 months – 1 year
Simple possession (personal use)Art. 189.53 months – 1 year
Grooming (online contact with sexual purpose)Art. 1831 – 3 years
Grooming + physical meetingArt. 183.21 – 3 years (aggravated)

Critical Defense Strategies

Chain of Custody Challenge

If the seized device was handled without write blockers, stored without seal, or analyzed without documented protocols, the entire digital evidence can be invalidated. This is the most powerful defense tool available.

Absence of Intent (Dolo)

Possession requires knowledge and will. Automatic P2P downloads, browser cache files, and malware infections can all store illicit material without user knowledge. Forensic analysis proving involuntary storage is essential.

IP ≠ Person Identification

An IP address identifies a connection, not a person. Vulnerable WiFi networks (WEP, no password, WPS enabled), shared routers, and VPN usage all prevent conclusive identification of the downloader.

Reclassification: Distribution → Possession

P2P programs share files automatically (seeding). If the user was unaware of this mechanism, distribution charges can be reclassified as simple possession, reducing the penalty from 5 years to 1 year.

Key Supreme Court Rulings

Doctrina TSCache files do not prove intentional possession

The Supreme Court established that files found exclusively in browser cache, without organization, renaming, or deliberate storage in personal folders, do not constitute the intentional possession required by Art. 189.5 CP. The prosecution must prove voluntary storage act.

Doctrina TSSpecific judicial authorization for device search

The TS ruled that examining digital device contents requires a specific judicial order separate from the home search warrant (Art. 588 sexies a LECrim). Evidence obtained from computers found during a home search without specific device authorization is void.

Doctrina TSP2P automatic sharing and distribution intent

The Court analyzed whether automatic seeding in P2P programs constitutes distribution. It held that if the accused can demonstrate unawareness of the sharing mechanism and low technical profile, distribution intent may not be proven, allowing reclassification to possession.

The Digital Forensic Process

1

Seizure

Device sealed on-site with photographs and chain of custody document initiated.

2

Forensic Cloning

Bit-by-bit copy using write blocker. SHA-256 hash generated for original and clone comparison.

3

Hash Comparison

File hashes compared against ICSE (Interpol) and NCMEC databases to identify known illicit material.

4

Timeline Reconstruction

System logs, user sessions, and file metadata analyzed to determine who, when, and how files arrived.

quiz

FAQ: Child Pornography Possession

Is possessing child pornography a crime even without sharing?expand_more
Yes. Art. 189.5 CP punishes mere possession of child pornographic material for personal use with 3 months to 1 year in prison, or a fine. Distribution is not required. However, the penalty is substantially lower than distribution (1-5 years) or production (5-9 years).
What if the files arrived on my device automatically?expand_more
The crime requires intent (knowledge and will). If files were automatically downloaded to the browser cache, arrived via WhatsApp group, or a P2P program downloaded them without your conscious intervention, defense can argue absence of intent. Forensic computer analysis proving involuntary download is the central evidence.
Does browser cache count as possession?expand_more
This is one of the most debated points. The Supreme Court has established that files found exclusively in browser cache, unorganized and without deliberate storage, do not prove intentional possession. However, if files were also found in organized folders or external storage devices, the cache argument weakens.
Do police need a warrant to search my computer?expand_more
Yes. Accessing device content requires a specific judicial order (Art. 588 sexies a LECrim). Authorization for home search does not automatically cover examining computer content. If police reviewed your computer without specific authorization, evidence may be void.
Can I avoid prison if I plead guilty?expand_more
If the sentence is 3 months to 1 year with no prior record, the sentence can be suspended. However, conviction still means Sex Offender Registry registration, disqualification from working with minors, and criminal records. If acquittal chances exist due to lack of intent, fighting the trial is preferable.
Can my partner be investigated for the same files?expand_more
Yes. When devices are seized in shared households, all inhabitants may be investigated. Key defense is determining who had access and habitual use of the specific device. User sessions, personal passwords, and creation metadata are decisive.
How long does such an investigation take?expand_more
Child pornography investigations tend to be very long. From provider alert to search can take 6-18 months. From device seizure to complete forensic analysis, another 6-12 months. Trial can take 2-4 years from initial report.
Can deleted files be recovered?expand_more
Yes. Police use specialized forensic tools (EnCase, FTK, Cellebrite) that can recover deleted files as long as they haven't been overwritten. Defense can question reliability of partial recoveries.
Could malware have downloaded files without my knowledge?expand_more
Yes. Trojans and malware exist that use infected computers to store and distribute illicit material without the user's knowledge. Forensic analysis can detect active malware present during download dates, strengthening the absence of intent defense.
Does using a VPN protect me from investigation?expand_more
Not necessarily. While VPN makes initial IP identification harder, once identified through other means, VPN usage can be interpreted as evidence of awareness of illegality. Many VPN providers also cooperate with authorities and hand over connection logs.
How is it determined whether the person in the material is a minor?expand_more
Age determination is done through forensic expert analysis (physical development, secondary sexual characteristics). If the victim cannot be identified, the forensic medical report on the image is the determining evidence. Defense can challenge the report if there are reasonable doubts about age.
Will my employer find out about the investigation?expand_more
Not necessarily. Judicial investigation is secret and the employer is not notified. However, if police search your office or seize professional devices, it may become known. Our firm manages procedural confidentiality as an absolute priority.
What are online 'sting' operations?expand_more
These are investigations where police infiltrate exchange platforms, identify IPs of users downloading material with known hashes, and request internet providers to identify the account holder. Defense verifies that judicial authorization covered the specific platform and that IP identification was correct.

Do you need specialised legal assistance?

The judicial system is complex. We have the criminal-law specialisation and technical resources required to take on the defence.

call