Possessing child exploitation material (child pornography)
If you’ve been charged with possessing child exploitation material, or possessing child abuse material, it is most often because of police received a tipoff about a specific IP address, username, or email address being used for child pornography, or by tracking IP addresses of people downloading torrents.
For example, we have seen many cases of apps like Kik or websites such as MEGA (mega.nz) reporting users sharing illegal material. In other cases, police use specialist software such as the Child Exploitation Tracking System (CETS) and its Australian counterpart ANVIL to monitor peer-to-peer file sharing networks like BitTorrent and identify IP addresses sharing known CEM. Tools such as RoundUp and Peer Spectre are also used by the AFP and Queensland Police to monitor peer-to-peer file sharing networks like BitTorrent and identify IP addresses sharing known CEM. The resulting logs typically form the basis of the search warrant application — they get police to your door, but the charges themselves are based on what is actually found on your devices during the subsequent forensic examination.
Once the IP address can be matched to a street address, police then apply for a search warrant, which is usually executed by Taskforce ARGOS (a specialist unit), or a local Child Protection Investigation Unit (CPIU). A team of police then arrive at your doorstep early one morning and conduct a preliminary analysis of your computers, hard drives, USBs, phones and other electronic devices using in-field triage software — commonly ADF Solutions (Digital Evidence Investigator or Triage Investigator) — to determine whether devices contain CEM and whether a full forensic extraction is warranted.
Mobile phones are typically extracted on-scene or shortly after using Cellebrite UFED (Universal Forensic Extraction Device), the industry-standard tool used by Australian law enforcement to pull data from smartphones including messages, images, app data, deleted files and location history. All seized devices are then taken for full laboratory analysis.
Any admissions made by you during the search warrant or later interview can be used against you. If evidence is found on any devices, then you will be charged with an offence or several offences, depending on what the data reveals. The forensic analysis of the material will then form the basis on which a court will sentence you, or a jury will be asked to find you guilty.
Other common charges we encounter include:
- section 474.22: using a carriage service to access, transmit, or solicit child abuse material
- section 228B: making child exploitation material
- section 218B: grooming
- section 228C: distributing child exploitation material
What is considered child exploitation material?
Child exploitation material (CEM) is the Queensland term for what is commonly known as child pornography. Child abuse material (CAM) is the term used for charges under the Commonwealth criminal code.
In Queensland, the definition of CEM includes photos, videos, stories, and drawings which depict a person under 16 years in a sexual context, or an offensive or demeaning context, or being subjected to cruelty, abuse or torture. The material has to cause a reasonable adult offence in order for it to be illegal.
Queensland charges commonly include possessing child exploitation material, distributing child exploitation material, and making CEM available.
Under Commonwealth legislation, the definition of CAM is slightly wider and includes material involving a child under 18 years of age (as opposed to 16 in Queensland). Commonwealth charges include using a carriage service to access child abuse material, or make child abuse material available, or distribute child abuse material. More serious charges can include aggravated possession of child abuse material, or aggravated offences involving conduct on 3 or more occasions to 2 or more people.
Penalties and sentencing
The maximum penalties have steadily increased over the years, with maximum penalties of 14 years for possessing CEM and 15 years for using a carriage service for CAM. Some charges carry even higher maximum penalties of up to 25 or 30 years.
The law now says that actual imprisonment must be imposed unless there are exceptional circumstances. See our article explaining what this means here: Child pornography (CEM) — the new offences and changes to sentencing. This is the same position for Commonwealth offences as well, with some Commonwealth offences having mandatory minimum sentences starting at 7 years.
In addition to any penalty imposed by the court, there are also mandatory reporting obligations imposed after conviction of a CEM or CAM offence (as a “reportable offender”), which is often referred to as being on the sex offenders register. You can read all about the reporting regime here.
Analysis and grading of material
Sentencing for CEM charges is primarily based on an analysis of the quantity and seriousness of the material downloaded, accessed, created, or distributed. That means the court will consider the total amount of images and videos, but with a primary focus on the category of material (i.e. how offensive it is).
For Commonwealth charges like using a carriage service to access or distribute child abuse material, there may not be images or videos which can be categorised, because they were deleted, or only existed in a temporary format. Therefore, the court will look at other factors such as the length of time the offending occurred over and the amount and type of files shared or accessed (if that evidence is available).
Categorisation of child exploitation material
LACE reports in Queensland CEM cases — what they are and why they matter
Police use a categorisation system now known as the Australian Child Abuse Categorisation System (ACACS), also referred to as the Interpol Baseline Scale (IBS). The ACACS/IBS scale involves categorising material into either Category 1 or Category 2 (see table below).
The reports produced using this scale are known as LACE reports, which is a reference to the program used to grade material — BlueBear LACE (Law Enforcement Against Child Exploitation). This software primarily uses hash values of files to match them against a database of previously categorised files.
| LACE Category | Description |
|---|---|
| Category 1 (INTERPOL Baseline) |
Real prepubescent child under 13, involved in (or witnessing) a sexual act, with a focus on genitals or anal region |
| Category 2 (Other Illegal) |
Any other illegal files involving children under 16, including written or animated CEM |
The LACE report is much more than a category tally
A common misconception, sometimes reflected in the prosecution’s approach to disclosure, is that a LACE report is simply a sentencing tool to show how many files fall into Category 1 or Category 2. This misunderstands what the report actually contains and what it is used for.
The BlueBear LACE software is a purpose-built forensic tool used by approximately 49 law enforcement agencies worldwide. It does not merely count and classify files. It extracts files from seized devices, records their properties and location on the device, matches files against hash value databases of known material, and can assist with facial detection for victim identification purposes.
The LACE report produced by that process provides, for each file, a record of:
- File type — whether the file is an image, video, document or other format;
- File properties — including file name, file size and creation or modification dates;
- Device location — where on the seized device the file was stored, including folder paths;
- Hash values — the unique digital fingerprint assigned to each file, used to match it against known databases of classified material; and
- Metadata — additional embedded data about how and when a file was created, accessed or transferred.
Why the LACE report matters to your CEM defence in Queensland
This information is essential at every stage of a CEM proceeding, well before any question of sentencing arises. A defence lawyer reviewing a LACE report is able to:
- Assess whether each file actually meets the legal definition of CEM or CAM —
- Under s207A of the Criminal Code (Qld), CEM is material that depicts or describes a person apparently under 16 years in a sexual context, an offensive or demeaning context, or being subjected to cruelty, abuse or torture, in a way likely to cause offence to a reasonable adult.
- Under s473.1 of the Criminal Code Act 1995 (Cth), child abuse material (CAM) is defined more broadly as material that depicts a person who is, or appears to be, under 18 years of age engaged in sexual activity, in a humiliating, degrading or offensive context, or being subjected to torture, cruelty or physical abuse — notably, without the requirement that the material cause offence to a reasonable adult.
- Where a defendant faces both state and Commonwealth charges, the applicable definition will differ depending on the charge, and this distinction can be significant in assessing the strength of the case against each file identified in the LACE report.
- Identify and challenge misclassified files — hash value matching is not infallible. Database errors and false positives occur, and a file may be matched to a hash associated with known CEM without the file itself being illegal. In our experience, many files are incorrectly included in reports that are cached, thumbnails or system-generated files that a user could never knowingly possess. Without reviewing the LACE report, a defence lawyer cannot identify these errors.
- Negotiate with the prosecution to reduce charges — where files are misclassified or borderline, early review of the LACE report allows the defence to make targeted submissions to police prosecutors or the DPP to have charges reduced or discontinued before a committal hearing.
- Prepare cross-examination of the forensic officer — including challenging the reliability of the hash database used, the manner of extraction, or whether file metadata supports the prosecution’s account of knowing possession.
- Make submissions on whether a prima facie case exists — at the committal stage, the defence is entitled to know the full scope of the alleged offending. The LACE report is the primary tool by which that assessment is made.
- Advise their client properly on plea — since September 2020, Queensland law requires a sentence of actual imprisonment for CEM offences unless exceptional circumstances exist. The decision whether to plead guilty, contest charges, or seek to resolve matters by negotiation is one of the most consequential decisions a defendant will make. That decision cannot be properly made without the defence lawyer first reviewing the LACE report in full.
In short, the LACE report is not just a sentencing document — it is the foundational forensic record of the case against a defendant, and it is indispensable to the proper conduct of the defence from the moment charges are laid.
Other forensic reports used in CEM cases
The LACE report is not the only forensic document generated in a CEM investigation. Depending on the devices seized and the nature of the charges, police may produce a number of additional reports — each of which must be obtained and carefully reviewed by your defence lawyer.
Cellebrite Physical Analyser report (UFED report)
Generated from a Cellebrite UFED extraction of a mobile phone or tablet, this report contains everything police have extracted from the device — call records, messages, images, videos, app data, browser history, deleted files, and geographic location data. It is often the primary evidence in distribution charges, particularly those involving messaging apps like Telegram, Kik, WhatsApp, or Signal, where police will rely on message logs to show material was sent or received. The report also records the timestamps of when files were created, accessed, or transferred — information that is critical to challenging a charge of knowing possession. In our experience, Cellebrite reports frequently contain material that assists the defence, including evidence of automated downloads, cached files, and communications context that the prosecution may not highlight.
EnCase / FTK reports (computer forensic reports)
Where a desktop computer, laptop, or external hard drive is seized, police typically use EnCase (by OpenText) or FTK (Forensic Toolkit, by Exterro) to conduct a deep forensic analysis of the device. These tools examine the entire file system including deleted files, unallocated space, internet history, and file access timestamps. The resulting reports can show precisely when files were accessed, whether they were deliberately saved or merely cached by a browser or application, and whether files were subsequently deleted — all of which can be central to a defence of lack of knowledge or lack of control.
Magnet AXIOM reports
Magnet AXIOM is a comprehensive forensic platform increasingly used by Australian law enforcement to analyse computers, mobile devices, and cloud-based data. It is particularly powerful for recovering social media artefacts, messaging history, and internet browser activity, and is often used alongside Cellebrite to verify mobile extractions and recover additional data. Where an AXIOM report has been generated, it must be disclosed and reviewed — it frequently contains evidence about how material was accessed and whether that access was intentional.
CETS / ANVIL reports (peer-to-peer monitoring reports)
Before the search warrant is even executed, Queensland Police and the AFP may have been monitoring peer-to-peer file sharing networks for weeks or months using the Child Exploitation Tracking System (CETS) and its Australian equivalent ANVIL. These systems generate logs recording the IP address, the files allegedly shared, and the timestamps of that activity. Where police rely on this material to support a distribution charge, the CETS or ANVIL report must be disclosed and scrutinised. The reliability of these logs, including whether the IP address was correctly attributed, whether the files shared were actually CEM, and whether the accused was the person using the device at the relevant time, can all be challenged.
Why all of these reports must be obtained
In our experience, many defendants are committed to trial — and some plead guilty — without ever having seen the full suite of forensic reports generated in their case. This is a serious problem. An experienced CEM lawyer will identify every report that should exist, demand its production, and scrutinise each one before any advice on plea is given.
Why you need George Criminal Lawyers
We are the leaders in this area of law, and achieve results unmatched by any other firm in Queensland. In fact, we are so good that this page and our articles have been widely copied and reproduced by other firms. Unfortunately, for clients who choose other firms, the mistake isn’t realised until they are being escorted out of court and into a concrete prison cell.
It is vital that you have a lawyer who not only understands the law, but — most importantly — the technological aspects of the evidence. This includes an extensive understanding of torrent software such as uTorrent and BitTorrent, apps such as Telegram, Kik, Signal, and WhatsApp, and anonymising technology such as VPNs and Tor.
It is also vital that your lawyer understands technical aspects of operating systems include cache files, deleted files, temporary internet files and private browsing data.
Forensic computer reports are frequently ignored by lawyers because they don’t understand them, which means they don’t carefully examine evidence that can prove or disprove the allegations against you, or help negotiate the facts. Even the more simple LACE reports are misunderstood by inexperienced lawyers, who overlook important details such as the number of unique files, duplicates, and deleted files. It is vital that this evidence is carefully scrutinised, because it can mean the difference between a cold concrete jail cell, or not.
Our specialised approach to CEM and CAM offences
Our Approach
When it comes to pleading guilty and being sentenced, our approach is tailored to your specific circumstances because we realise there is no “one size fits all” approach for these types of matters.
We carefully consider your background, employment and education, and investigate your mental health and any issues with drugs and alcohol. Our close working relationships with leading psychologists and psychiatrists developed over many years means we can produce reports to the court which address every necessary consideration when it comes to sentencing, such as psychiatric diagnosis, offence-specific treatment undertaken, and risk of re-offending.
We refer you to experts right from the beginning of your matter to ensure that by the time you face a District Court Judge you have done everything possible to show exceptional circumstances exist and avoid being sent to prison.
If you want to contest the charges against you, then our extensive technical and legal experience in this area means you have the best possible chance of being found not guilty. We understand how to read, analyse and argue against digital forensic data obtained by police. For example, we had a client found not guilty after a trial in the Brisbane District Court based on our careful cross-examination and analysis of metadata being relied on by the prosecution.
Our careful and meticulous approach to every CEM matter can mean the difference between actual jail or not. We have achieved results unmatched by many others, such as a good behaviour bond for accessing CEM in New South Wales, and a fine without conviction for possessing CEM in Queensland (as recently as 13 July 2023).
We have connections to the best criminal barristers in Queensland, and we know exactly what needs to be done to defend you. Don’t make a mistake and choose the wrong law firm to represent you. With George Criminal Lawyers on your side, you can rest assured that your future is in the safest possible hands.
Contact us now to get started. Your future depends on it.
