How private is your internet address? Very, says the Supreme Court of Canada.
Police can’t just walk into a company and demand a suspect’s IP address by saying a Canadian resident doesn’t have an expectation of privacy of that information, the court ruled today. An IP address is vital enough that every resident expects it to be private, and it can’t be handed to police without a court order, the nation’s top court concluded.
“If s. 8 of the Charter [which says everyone has the right to be secure against unreasonable search and seizure] is to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses,” the court ruled in a 5-4 decision. “An IP address is the crucial link between an internet user and their online activity. Viewed normatively, it is the key to unlocking a user’s internet activity and, ultimately, their identity. Thus, an IP address attracts a reasonable expectation of privacy.”
Here’s the background: In 2017, Calgary police investigating fraudulent online purchases at a liquor store demanded a credit card processor hand over IP addresses for certain transactions. With the two IP addresses, police then got a production order from a judge compelling Telus to disclose the name and address of its customers at each IP address. Using this subscriber information, police got search warrants which led to a person being arrested and ultimately convicted of 14 offences.
The accused was convicted at trial, a decision upheld by the Alberta Court of Appeal. Both courts rejected his argument that his rights had been violated.
The case went to the Supreme Court to answer a question: Was obtaining the IP addresses a lawful search? No, said the majority.
Requiring that police obtain prior judicial authorization before obtaining an IP address “is not an onerous investigative step,” the court ruled. “Where the IP address, or the subscriber information, is sufficiently linked to the commission of a crime, judicial authorization is readily available.”
The court ordered the accused to face a new trial.
This isn’t the first time the Supreme Court has dealt with companies handing over internet-related data. In a 2014 decision, it unanimously ruled that Canadian internet providers can’t turn over basic subscriber information to police without a search warrant.
The minority in this case argued an IP address alone doesn’t have private information. “Without more, all an IP address reveals to the police is a user’s ISP [internet service provider] — hardly a particularly private matter, let alone core biographical information,” the minority judges wrote. The accused had little control over his IP addresses, which an ISP can change at will and without notice, the judges said. And, they noted, the search wasn’t carried out at the accused’s home, but at the credit card company.
That wasn’t persuasive to the majority. “In the informational privacy context, the claimant’s control over the subject matter [the IP address] is not determinative,” they wrote. “The internet requires that users reveal subscriber information to their ISP to participate in this new public square, and Canadians are not required to become digital recluses in order to maintain some semblance of privacy in their lives.”
“Defining a reasonable expectation of privacy is an exercise in balance,” said the majority. “In this case, the balance weighs in favour of extending a reasonable expectation of privacy to IP addresses.
“The intensely private nature of the information an IP address may betray strongly suggests that the public’s interest in being left alone should prevail over the government’s interest in advancing its law enforcement goals. The internet has exponentially increased both the quality and quantity of information stored about internet users, spanning the most public and the most private human behaviour. The internet has not only allowed private corporations to track their users, but also to build profiles of their users filled with information the users never knew they were revealing.
“By concentrating this mass of information with private third parties and granting them the tools to aggregate and dissect that data, the internet has essentially altered the topography of privacy under the Charter. It has added a third party to the constitutional ecosystem, making the horizontal relationship between the individual and the state tripartite. Though third parties are not themselves subject to s. 8, they mediate a relationship which is directly governed by the Charter — that between defendant and police. This shift has enhanced the state’s informational capacity.”
RCMP Sgt. Kerry Shima, acting officer in charge of Alert ICE, the internet child exploitation unit for Alberta, told CBC News that the ruling will slow down the unit’s investigations.
“This definitely throws a wrench into the machine. It’s going to put a lot of children at risk,” he said.
Shima said the ruling means police will not be able to act swiftly to tackle most of their cases in an “efficient manner.”
“It gives a wide berth for offenders on the internet and it gives an opportunity for people to hide even better and avoid detection,” Shima said.
