Police now need a warrant to get a person's IP address, Supreme Court rules

The Supreme Court of Canada made a key privacy ruling Friday that means police must now first have a warrant or court order to obtain the numbers mak‐ ing up a person or organi‐ zation's IP address.

The top court was asked to consider whether an IP ad‐ dress alone, without any of the personal information at‐ tached to it, was protected by an expectation of privacy un‐ der the Charter.

In a five-four split deci‐ sion, the court said a reason‐ able expectation of privacy is attached to the numbers making up a person's IP ad‐ dress, and just getting those numbers alone constitutes a search.

Writing for the majority, Justice Andromache Karakat‐ sanis wrote that an IP ad‐ dress is "the crucial link be‐ tween an internet user and their online activity."

"Thus, the subject matter of this search was the infor‐ mation these IP addresses could reveal about specific internet users including, ulti‐ mately, their identity."

Writing for the four dis‐ senting judges, Justice Suzanne Côté disagreed with that central point, saying there should be no expecta‐ tion of privacy around an IP address alone.

The court's decision is based on the case of Andrei Bykovets, who was convicted of 14 online fraud offences, for purchases made from an Alberta liquor store.

In 2017, the Calgary Police Service investigating the al‐ leged crime discovered that the store's online sales were managed by Moneris, a thirdparty payment processing company.

Police contacted Moneris and asked for the IP address associated with the pur‐ chases, without providing a court order or warrant. Moneris gave two IP ad‐ dresses to the police.

Appeal court dismissed privacy claim

Calgary police then went to the internet service provider (ISP) with a court order to get the names and addresses as‐ sociated with the IP ad‐ dresses. One address be‐ longed to Bykovets, the other belonged to his father.

Police used the names and addresses to get a war‐ rant to search their resi‐ dences. Bykovets was ar‐ rested and charged with pos‐ session of a third party's credit card and identity docu‐ ments.

At trial, Bykovets argued that he was the victim of an unreasonable search and seizure, a violation of Section 8 of the Charter of Rights and Freedoms, because he had an expectation of privacy with respect to his IP ad‐ dress.

The trial judge disagreed, saying there is no expecta‐ tion of privacy related to an IP address and so the Charter was not violated.

The Alberta Court of Ap‐ peal majority decision sided with the trial judge, but one judge of the appeal court dis‐ agreed, saying there is an ex‐ pectation of privacy associ‐ ated with IP addresses.

Protecting online pri‐ vacy in a digital world

In the Supreme Court ma‐ jority decision, Karakatsanis said that only considering the information associated with an IP address to be protected by the Charter and not the IP address itself "reflects piece‐ meal reasoning" that ignores the broad purpose of the Charter.

The ruling said the privacy interests cannot be limited to what the IP address can re‐ veal on its own "without con‐ sideration of what it can re‐ veal in combination with oth‐ er available information, par‐ ticularly from websites."

It went on to say that be‐ cause an IP address unlocks a user's identity, it comes with a reasonable expecta‐ tion of privacy and is there‐ fore protected by the Charter.

"If [the Charter] is to meaningfully protect the on‐ line privacy of Canadians in today's overwhelmingly digi‐ tal world, it must protect their IP addresses," the ruling said. third-party

The dissenting opinion

Justice Côté, writing on be‐ half of justices Richard Wag‐ ner, Malcolm Rowe and Michelle O'Bonsawin, ac‐ knowledged that IP ad‐ dresses "are not sought for their own sake" but are "sought for the information they reveal."

"However, the evidentiary record in this case estab‐ lishes that an IP address, on its own, reveals only limited information," she wrote.

Côté said the biographical personal information the law was designed to protect are not revealed through having access to an IP address. Police must use that IP ad‐ dress to access personal in‐ formation that is held by an ISP or a website that tracks customers' IP addresses to determine their habits.

"On its own, an IP address does not even reveal brows‐ ing habits," Côté wrote. "What it reveals is a user's ISP - hardly a more private piece of information than electricity usage or heat emissions."

Côté said placing a rea‐ sonable expectation of pri‐ vacy on an IP address alone upsets the careful balance the Supreme Court has struck between Canadians' privacy interests and the needs of law enforcement.

"It would be inconsistent with a functional approach to defining the subject matter of the search to effectively hold that any step taken in an investigation engages a reasonable expectation of privacy," the dissenting opin‐ ion said.

'It's going to put a lot of children at risk': RCMP

Vibert Jack, litigation director at the B.C. Civil Liberties As‐ sociation, told CBC News he's very happy with the court's decision and called it an im‐ portant ruling on online pri‐ vacy.

"The idea that Canadians wouldn't have an expectation of privacy in their IP ad‐ dresses is a very scary propo‐ sition for us and we are glad that the court recognized the importance of going the oth‐ er way on this one," Jack told CBC News.

The idea that police could obtain an IP address without any judicial oversight is "fran‐ kly outrageous," Jack added.

RCMP Sgt. Kerry Shima, acting officer in charge of Alert ICE, the internet child exploitation unit for Alberta, told CBC News that "in virtu‐ ally every case" an IP address "kick-starts" their investiga‐ tions.

"It used to be pretty straightforward. This defi‐ nitely throws a wrench into the machine. It's going to put a lot of children at risk," he said.

Shima said the ruling means police will not be able to act swiftly to tackle most of their cases in an "efficient manner."

"It gives a wide berth for offenders on the internet and it gives an opportunity for people to hide even bet‐ ter and avoid detection," Shima added.