In the recent case of R. v. Bykovets, [2024] S.C.J. No. 6, the Supreme Court of Canada ruled that police officers must obtain a warrant to request individuals’ IP addresses from websites. The Court decided that the police commit a breach of privacy rights where they make such requests to third-party Internet platforms/websites without having obtained prior judicial authorization beforehand.
This ruling applies to the IP addresses associated with transactions conducted via online banking, IP addresses associated with videos uploaded to online streaming media, IP addresses associated with postings on social media, et cetera. Police who make such requests to third-party websites without first getting permission from a judge will usually be found to have violated section 8 of the Canadian Charter of Rights and Freedoms.
Section 8 of the Canadian Charter of Rights and Freedoms guarantees everyone in Canada the freedom from unreasonable search and seizure. The purpose behind this guarantee is the protection of privacy.
Accordingly, a fundamental step in determining whether a "search" or "seizure" occurred within the meaning of section 8 of the Charter is a determination of this question:
whether the accused had a reasonable expectation of privacy in the thing searched/taken by the police.
The Court thus considered in R. v. Bykovets whether people have a reasonable expectation of privacy in the IP addresses associated with their online activities. The Court determined they do. The Supreme Court determined that IP addresses are closely associated with very personal information, and that courts must monitor the police’s trail towards digitized personal information starting with the first step in that trail – the IP address.
Every device capable of accessing the Internet does so with a unique number known as an IP address. The IP address is associated with a modem. Internet Service Providers (ISPs), such as Bell or Rogers, assign a unique IP address to each specific modem. By way of example: for every online transaction a website processes, it records the IP address associated with that sale. As such, the website then keeps a number that can later be used to prove which modem was used to make that transaction. Where the police suspect that such a transaction was fraudulent, they begin an investigation by
first requesting the IP address from that website
obtaining the IP address where the website complies with the police’s request
determining the Internet Service Provider associated with that IP address
obtaining a warrant for the Internet Service Provider to produce the subscriber information associated with that IP address (e.g. name and address of the subscriber)
obtaining a warrant to search the home address revealed by the Internet Service Provider, as well as the computers (or other electronic devices) found within the home.
Obtaining an IP address is the police’s first step in identifying their target suspect.
In order to determine the identity of the user of that IP address, the Internet Service Provider must give up the subscriber information (e.g. name and physical address) associated with the IP address’s modem. In 2014, the Supreme Court of Canada decided in R. v. Spencer, [2014] S.C.J. No. 212, that such a request to an Internet Service Provider for subscriber information constitutes a search. As discussed, this is because a subscriber has a reasonable expectation that his or her internet activity will be kept private.
People’s interests, sexual activities, financial transactions, geographic locations, and lifestyles can be determined by reviewing their online activities. Much of the things that go to our “biographical core” is kept on computers and the Internet. The Court emphasized just how ubiquitous the Internet has become in our lives, and it recognized the privacy implications of that.
Because obtaining subscriber information from an Internet Service Provider is a step taken toward discovering such private information, police must first explain to a judge why they should have legal access to that information. The judge must decide whether to give police the green light before they can take such a step and ask the Internet Service Provider for that subscriber information.
While this reasoning applied to subscriber information in R. v. Spencer, the same reasoning was applied to IP addresses in R. v. Bykovets.
The Court reasoned that the police’s request for an IP address is the first breadcrumb towards obtaining information that is intensely private. The Court noted that, although police usually seek a warrant for subscriber information from Internet Service Providers to determine the location of the target computer, it is possible to obtain this private information from online platforms themselves once the police learn the IP address. The Court noted that
“[t]hird-party companies, such as Google or Facebook, can track the external IP addresses of each user who visits their site and log this information to varying degrees. These companies can determine the identity of those individual users based on their Internet activity on their sites.”
Sometimes, such third-party companies may record names or other information that is associated with an IP address. A possible effect, therefore, is a police ability to obtain from third-party companies private information of users just by providing the IP to that company (so long as the company voluntarily complies and releases whatever information they have associated with the IP).
Before this Supreme Court decision in R. v. Bykovets, police could have simply bypassed the warrant requirement for requests to Internet Service Providers if these third-party websites were able and willing to assist. The courts will now be tasked with monitoring this activity.
In a nutshell, the issue as to whether Internet users have a reasonable expectation of privacy to their IP addresses was answered by the Supreme Court as follows:
The "reasonable expectation of privacy" analysis revolves around the potential of a particular subject matter to reveal an individual's biographical core to the state, not whether the IP addresses revealed information about the appellant on [the facts of this particular case].
In the vast majority of cases going forward, police will be required to take an additional step to get the ball rolling. They will have to explain to judges why they wish to ask a third-party website for the IP address associated with a particular post, upload, transaction, et cetera. Failure to do so will almost certainly be considered an unreasonable search, which will endanger the Crown prosecutor’s ability to use the evidence derived from the subsequent computer searches in that investigation. Such missteps can lead to acquittals of people accused of child pornography, child luring, identity theft, credit card fraud, and many other crimes that have become much more commonplace on the internet.
This blog is for general informational purposes only. Matthew Wolfson does not distribute legal advice through this blog. As such, this blog does not constitute legal or other professional advice, and no attorney-client relationship is created between the reader and Matthew Wolfson.
Have a legal question? Send an email to ask@criminallawottawa.com
Bình luận