The Supreme Court has ruled that the police need permission to obtain an IP address – IT and the Internet

In a recent Supreme Court of Canada (“SCC”) decision, Rv Bykovets2024 SCC 6, the majority of the court concluded that police must obtain a search warrant to access Internet Protocol (“IP”) addresses.

The majority held that failure to obtain a search warrant before obtaining an IP address from a third-party service provider is a violation Canadian Charter of Rights and Freedoms (tea
“Charter”) the right to be protected from unreasonable search and seizure.

The Bykovets decision expands on the 2014 decision Rv Spencer, 2014 SCC 43, in which the SCC held that there is a reasonable expectation of privacy in an ISP’s “subscriber information” (which includes the name, address, and contact information attached to an IP address) and that a request for subscriber information in this context amounted to search. Following spencer police cannot obtain subscriber information from ISPs—or Internet activity associated with IP addresses from third-party websites—without prior court authorization (often referred to as “Spencer command”).

The Bykovets decision expands the scope of what digital information attracts a reasonable expectation of privacy to include not only subscriber information attached to an IP address, as decided in Spencerbut the IP address itself.Most have reasoned that as a link that connects a particular Internet activity to a particular location, an IP address can reveal deeply personal information. Accessing IP addresses without prior judicial authorization therefore poses major privacy risks.

Background

In the course of investigating fraudulent online purchases, police contacted the third-party processing company that managed the retailer’s online sales and requested and obtained the IP addresses used to make the purchases. With that information, the police then obtained a production order forcing ISPs to release subscriber information attached to IP addresses. Police used subscriber information to obtain and execute search warrants, leading to Bykovets’ arrest and multiple criminal charges.

Bykovets contested the police request to obtain IP addresses from the processing company, claiming that the disclosure of the IP address violated his right to protection against unreasonable search and seizure under Section 8 of Act No. Charter.

The trial judge concluded that the police request of the processing company for the IP address did not constitute a “search” under § 2(1)(a). 8 of Charter because Bykovets did not have a reasonable expectation of privacy in its IP address (requirement for section 8 Charter the right to be employed). Bykovets was convicted of 14 of the 33 crimes he was charged with. He appealed the sentence to the Alberta Court of Appeal.

A majority of the Alberta Court of Appeal agreed with the judge that Bykovets had no expectation of privacy in his IP addresses and dismissed his appeal against the conviction. A dissenting judge would have allowed the appeal based on the reasonable expectation of privacy associated with IP addresses.

Bykovets appealed to the SCC.

decision of the Supreme Court

By a narrow 5-4 margin, the SCC agreed that police obtaining IP addresses from a processing company without a search warrant constituted an illegal search in violation of Bykovets section 8. Charter rights.

The majority held that an IP address as the subject of a search cannot be characterized as an “abstract string of numbers”. Rather, it opens the door to private personal information where the IP address links to other related online information collected and analyzed by third parties. The majority stated:

Viewed normatively and in context, an IP address is the first piece of digital information that can lead the state to trace an individual’s Internet activity.”

The majority further stated that requiring a search warrant to obtain an IP address is a burden that the State could easily overcome. Achieving law enforcement objectives while preventing free access to information not relevant to an investigation is made possible through section 8 Charter protection.

Importantly, the majority recognized that the Internet introduced private, third-party corporations into a “constitutional ecosystem.” Although these third parties are not subject to section 8 Charterthey mediate the relationship between the defendant and the state and, as such, expand the state’s potential access to private information.

The majority reasoned that judicial oversight through the search warrant process necessarily narrowed the state’s online reach and wrested control over the release of personal information from the hands of private corporations.

Conversely, a minority would hold that the Bykovets IP addresses do not raise a reasonable expectation of privacy because the search revealed nothing more than the IP addresses and associated ISPs. The minority also found that the requirement to obtain a Spencer guarantees that it provides adequate protection to individuals by ensuring that the police cannot obtain subscriber information from ISPs without prior court authorization.

The appeal was allowed and a new trial ordered.

The main things to take with you

  • The SCC reaffirmed the principle of law that government bodies requesting private data from third parties may constitute a search under Section 8 of Act No. Charter.

  • The SCC recognized the expanding role of third-party corporations in the state-individual relationship enabled by the Internet.

  • This decision may have broader implications for how we treat digital information and information for which there is a reasonable expectation of privacy.

  • This decision opens the door to potential Chartercalls where the police obtained an IP address without a court warrant.

The content of this article is intended to provide a general guide to the issue. Professional advice should be sought regarding your particular situation.

Leave a Comment