opinion of Cst. MacDonald. The issuing justice could have accepted
Cst. MacDonald’s testimony and proceeded on the basis that
PhotoDNA was used.
( iii) The time discrepancy
The trial judge’s reasons
 The trial judge found a time discrepancy on the face of the
NCMEC Report. This finding provided considerable support for
her view that the Microsoft information in the NCMEC Report
should not be considered reliable without verification.
 The NCMEC Report indicates the time when each file was
uploaded to SkyDrive, and the time when the Microsoft incident
report was generated about the file being uploaded. The discrepancy is that the incident reports are indicated to have been
generated before the files were uploaded to SkyDrive. For
example, report #1432170 shows an upload time of 23:46 GMT
and an incident time of 16:46 GMT, a difference of seven hours.
Obviously, Microsoft could not have started generating a report
about a file being uploaded seven hours before the file was actually
 On his first day of testimony, Cst. MacDonald was unable
to explain this time discrepancy. On his second day of testimony,
Cst. MacDonald proffered a table showing the upload times and
the incident times from all 41 entries in the NCMEC Report. In
each case, the incident time was precisely seven hours before the
upload time. Cst. MacDonald knew that Microsoft’s law enforcement team that generated these kinds of reports was located in
the State of Washington, and the NCMEC Report, in identifying
Microsoft as the Internet service provider, provided a street
address for Microsoft Corporation in Redmond, Washington. Cst.
MacDonald offered his opinion that the incident dates were
indicated in local time at Microsoft headquarters, i.e., Pacific
Time, whereas the upload times were indicated in Greenwich
Mean Time. He testified that there is precisely a seven-hour
difference between Pacific Time and Greenwich Mean Time, and
suggested the NCMEC Report should have indicated the incident
times as PDT, not GMT.
 The trial judge considered this to be unreliable amplification evidence because it had not been “verified or confirmed with
Microsoft”. The trial judge said Cst. MacDonald conceded that
the NCMEC Report did not state where it was prepared, and his
“new theory” was “based upon his personal theory and his
assumptions”. He should have confirmed with Microsoft that
his explanation was sound.