R. v. Bykovets

R. v. Bykovets
Collection
Supreme Court Judgments
Date
2024-03-01
Neutral citation
2024 SCC 6
Case number
40269
Judges
Wagner, Richard; Karakatsanis, Andromache; Côté, Suzanne; Rowe, Malcolm; Martin, Sheilah; Kasirer, Nicholas; Jamal, Mahmud; O’Bonsawin, Michelle; Moreau, Mary
On appeal from
Alberta
Subjects
Constitutional law
Notes
Case in Brief SCC Case Information
Decision Content
SUPREME COURT OF CANADA
Citation: R. v. Bykovets, 2024 SCC 6
Appeal Reheard: December 11, 2023 Judgment Rendered: March 1, 2024 Docket: 40269
Between:
Andrei Bykovets Appellant
and
His Majesty The King Respondent
- and -
Director of Public Prosecutions, Attorney General of Ontario, Attorney General of British Columbia, Canadian Civil Liberties Association and British Columbia Civil Liberties Association Interveners
Coram: Wagner C.J. and Karakatsanis, Côté, Rowe, Martin, Kasirer, Jamal, O’Bonsawin and Moreau JJ.
Reasons for Judgment: (paras. 1 to 92)
Karakatsanis J. (Martin, Kasirer, Jamal and Moreau JJ. concurring)
Dissenting Reasons: (paras. 93 to 165)
Côté J. (Wagner C.J. and Rowe and O’Bonsawin JJ. concurring)
Note: This document is subject to editorial revision before its reproduction in final form in the Canada Supreme Court Reports.
Andrei Bykovets Appellant
v.
His Majesty The King Respondent
and
Director of Public Prosecutions,
Attorney General of Ontario,
Attorney General of British Columbia,
Canadian Civil Liberties Association and
British Columbia Civil Liberties Association Interveners
Indexed as: R. v. Bykovets
2024 SCC 6
File No.: 40269.
Hearing: January 17, 2023.
Present: Wagner C.J. and Karakatsanis, Côté, Brown, Martin, Jamal and O’Bonsawin JJ.
Rehearing: December 11, 2023.
Judgment: March 1, 2024.
Present: Wagner C.J. and Karakatsanis, Côté, Rowe, Martin, Kasirer, Jamal, O’Bonsawin and Moreau JJ.
on appeal from the court of appeal of alberta
Constitutional law — Charter of Rights — Search and seizure — Police investigating fraudulent online transactions — Police contacting payment processing company to request internet protocol (“IP”) addresses associated with transactions — Payment processing company voluntarily providing IP addresses to police and accused consequently arrested — Whether reasonable expectation of privacy attaches to IP address — Whether request by state to third party for IP address constitutes search — Canadian Charter of Rights and Freedoms, s. 8 .
During an investigation into fraudulent online purchases from a liquor store, police contacted the third-party processing company that managed the store’s online sales and obtained the IP addresses used for the purchases. Police then obtained a production order compelling the Internet service provider (“ISP”) to disclose the name and address of the customer for each IP address. Police used this subscriber information to seek and execute search warrants. B was arrested.
B challenged the request by police to obtain the IP addresses from the processing company, alleging it violated his right against unreasonable search and seizure under s. 8 of the Charter . The trial judge held that the police’s request to the processing company was not a search under s. 8 of the Charter because B did not have a reasonable expectation of privacy in his IP address; therefore, B’s s. 8 right was not engaged. B was convicted of 14 offences related to the fraudulent online purchases. The majority of the Court of Appeal agreed that B had no reasonable expectation of privacy in his IP addresses and dismissed B’s conviction appeal. The dissenting judge would have allowed the appeal, on the basis that a reasonable expectation of privacy attached to the IP addresses.
Held (Wagner C.J. and Côté, Rowe and O’Bonsawin JJ. dissenting): The appeal should be allowed and a new trial ordered.
Per Karakatsanis, Martin, Kasirer, Jamal and Moreau JJ.: If s. 8 of the Charter is to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses. An IP address is the crucial link between an Internet user and their online activity. Viewed normatively, it is the key to unlocking a user’s Internet activity and, ultimately, their identity. Thus, an IP address attracts a reasonable expectation of privacy. Accordingly, a request by the state for an IP address is a search under s. 8 of the Charter .
Section 8 of the Charter guarantees the right to be secure against unreasonable search or seizure. Its principal object is the protection of privacy, including informational privacy, that is, the claim of individuals, groups, or institutions to determine for themselves when, how and to what extent information about them is communicated to others. Personal privacy is vital to individual dignity, autonomy, and personal growth. Its protection is a basic prerequisite to the flourishing of a free and healthy democracy.
To establish a breach of s. 8, a claimant must first show that there was a search or seizure. A search occurs where the state invades a reasonable expectation of privacy. An expectation of privacy is reasonable where the public’s interest in being left alone by the government outweighs the government’s interest in intruding on the individual’s privacy to advance its goals, notably those of law enforcement. Courts analyze an expectation of privacy by considering many interrelated but often competing factors, which can be grouped together under four categories: (1) the subject matter of the search; (2) the claimant’s interest in the subject matter; (3) the claimant’s subjective expectation of privacy; and (4) whether the subjective expectation of privacy was objectively reasonable. In the case at bar, the parties agreed that B had a direct interest in the IP addresses and a subjective expectation of privacy in their informational content.
With respect to the subject matter of the search, it is defined not only in terms of the information itself, but also the tendency of information sought to support inferences in relation to other personal information. A court must take a holistic view of the subject matter and must be especially careful in describing the subject matter of a search touching electronic data. The approach must not be mechanical, and it must reflect technological reality. The subject matter of the search in the instant case was the information that IP addresses could reveal about specific Internet users including, ultimately, their identity. Recognizing that police wanted the IP address — as the link between a specific subscriber and location and particular Internet activity — to obtain more information about the user lets the court assess the expectation of privacy in relation to all the information this IP address tends to reveal.
With respect to whether a subjective expectation of privacy is objectively reasonable, courts must look to the totality of the circumstances. While there is no definitive list of factors, courts have often focussed on control over the subject matter, the place of the search, and the private nature of the subject matter. In the informational privacy context, the claimant’s control over the subject matter is not determinative. The Internet requires that users reveal subscriber information to their ISP to participate in this new public square, and Canadians are not required to become digital recluses in order to maintain some semblance of privacy in their lives. Nor is the place where the search occurred detrimental to a reasonable expectation of privacy in such a context. Online spaces are qualitatively different from physical spaces. The information the Internet harbours can reveal much more than information subject to the limits of physical space. Therefore, a lack of physical intrusion reveals little about the reasonableness of an expectation of privacy.
As to the private nature of the subject matter, s. 8 seeks to protect a biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state. The biographical core is not limited to identity, but includes information which tends to reveal intimate details of the lifestyle and personal choices of the individual. Section 8’s emphasis on such information means that a reasonable expectation of privacy is assessed normatively rather than simply descriptively. It cannot be assessed according to only one particular use of the evidence; nor can its reach be determined according to the police’s specific intention in seeking the information. Rather, the purpose of s. 8, appreciated normatively, requires asking what information the subject matter of the search tends to reveal. As the link that connects specific Internet activity to a specific location, an IP address may betray deeply personal information, even before police try to link the address to the user’s identity. Moreover, activity associated with the IP address can be correlated with other online activity associated with that address available to the state. An IP address can also set the state on a trail of Internet activity that leads directly to a user’s identity, even without a warrant compelling an ISP to disclose the name and address of the customer for the IP address. Access to IP addresses without judicial pre-authorization poses intense privacy risks.
Defining a reasonable expectation of privacy is an exercise in balance. In this case, the balance weighs in favour of extending a reasonable expectation of privacy to IP addresses. The intensely private nature of the information an IP address may betray strongly suggests that the public’s interest in being left alone should prevail over the government’s interest in advancing its law enforcement goals. The Internet has exponentially increased both the quality and quantity of information stored about Internet users, spanning the most public and the most private human behaviour. The Internet has not only allowed private corporations to track their users, but also to build profiles of their users filled with information the users never knew they were revealing. By concentrating this mass of information with private third parties and granting them the tools to aggregate and dissect that data, the Internet has essentially altered the topography of privacy under the Charter . It has added a third party to the constitutional ecosystem, making the horizontal relationship between the individual and the state tripartite. Though third parties are not themselves subject to s. 8, they mediate a relationship which is directly governed by the Charter — that between defendant and police. This shift has enhanced the state’s informational capacity.
Weighed against these substantial privacy concerns is society’s sometimes conflicting but legitimate interest in the need for safety and security. Police should have the investigative tools to deal with crime that is committed and facilitated online. However, requiring that police obtain prior judicial authorization before obtaining an IP address is not an onerous investigative step. Where the IP address, or the subscriber information, is sufficiently linked to the commission of a crime, judicial authorization is readily available. Recognizing that an IP address attracts s. 8 protection aims to make sure police investigations better reflect what each reasonable Canadian expects from a privacy perspective and from a crime control perspective. Judicial oversight narrows the state’s online reach and removes the decision to disclose information — and how much to disclose — from private corporations and returns it to the purview of the Charter .
Per Wagner C.J. and Côté, Rowe and O’Bonsawin JJ. (dissenting): The appeal should be dismissed. B did not have a reasonable expectation of privacy in the IP addresses on the credit card processor’s servers and the ISP they revealed. The police did not need judicial authorization before asking the processor for the IP addresses in order to determine the ISP associated with them. However, this conclusion does not foreclose the possibility that someone may have a reasonable expectation of privacy on different facts.
Section 8 of the Charter is meant to protect against state intrusion on an individual’s privacy and comes into play only where a person’s reasonable expectations of privacy are somehow diminished by an investigatory technique. The reasonable expectation of privacy test is fact-specific and contextual and depends on the totality of the circumstances of a particular case. The test is normative, not descriptive. Its objective is to determine what degree of privacy one ought to have, not what degree of privacy one actually has.
Identifying the subject matter of the search is a key question in the totality of the circumstances analysis. To identify the subject matter of the search, the court must examine the connection between the police investigative technique and the privacy interest at stake. It must consider not only the nature of the precise information sought, but also the nature of the information that it reveals. The court is concerned with the capacity of the precise information sought to give rise to inferences or to reveal further information. These inferences and this further information form part of the true subject matter of the search. Once the subject matter of the search is identified, the question then becomes whether a subjective expectation of privacy in the subject matter of the search is objectively reasonable. Whether an expectation of privacy is reasonable depends on several factors. These may include the place of the search, control over the subject matter of the search, the private nature of the subject matter, whether the subject matter was in public view, whether the subject matter was abandoned, whether the subject matter was already in the hands of third parties, whether the search method was intrusive in relation to the privacy interest at stake, whether the search method was itself unreasonable, and whether the search exposed core biographical information. Not all factors will be relevant to the analysis in a particular case and no single factor is determinative.
In the instant case, the factors relevant to the reasonableness inquiry are the private nature of the subject matter, control over the subject matter, and the place of the search. The private nature of the subject matter of a purported search can support a finding that an expectation of privacy is reasonable. The issue is not simply whether the subject matter itself is private, but also whether it can reveal other essential private information. This factor is of particular importance with respect to informational privacy interests. Where informational privacy alone is at stake, it may be all but essential that the information itself be private in order for a reasonable expectation of privacy to exist. Control over the subject matter of the search generally supports a finding that there was a reasonable expectation of privacy, while lack of control may weigh against such a finding. The place of the search informs the reasonableness of any expectation of privacy in it. The idea of place essentially relates to the concept of territorial privacy and necessarily assumes less significance in cases which engage informational privacy.
There is disagreement with the majority’s assessment of the subject matter of the supposed search in the instant case. The majority includes in the subject matter every step leading up to the ultimate identification of the suspect, notwithstanding the fact that such information is not revealed by the IP addresses alone, according to the evidence in the record. The correct way to characterize the subject matter of the search is to describe it as the IP addresses and the ISP revealed by them.
B’s subjective expectation of privacy in the subject matter of the search was not objectively reasonable. The IP addresses at issue were not private and did not, on the facts of the case, reveal private information. Without more, all an IP address reveals to the police is a user’s ISP — hardly a particularly private matter, let alone core biographical information. In addition, the factor of control points away from a finding that B’s expectation of privacy was reasonable. B had little control over the IP addresses, which an ISP can change at will and without notice. An Internet user who leaves behind IP address data completely loses control over what happens to those numbers. Finally, the alleged search was not carried out at B’s home. The place of the search was the credit card processor’s database. Its location does not enhance the objective reasonableness of B’s subjective expectation of privacy.
Cases Cited
By Karakatsanis J.
Referred to: R. v. Spencer, 2014 SCC 43, [2014] 2 S.C.R. 212; Hunter v. Southam Inc., [1984] 2 S.C.R. 145; R. v. Marakah, 2017 SCC 59, [2017] 2 S.C.R. 608; R. v. Reeves, 2018 SCC 56, [2018] 3 S.C.R. 531; R. v. Tessling, 2004 SCC 67, [2004] 3 S.C.R. 432; R. v. Edwards, [1996] 1 S.C.R. 128; R. v. Jones, 2017 SCC 60, [2017] 2 S.C.R. 696; R. v. Ward, 2012 ONCA 660, 112 O.R. (3d) 321; R. v. Cole, 2012 SCC 53, [2012] 3 S.C.R. 34; R. v. Plant, [1993] 3 S.C.R. 281; R. v. Dyment, [1988] 2 S.C.R. 417; R. v. Ramelson, 2022 SCC 44; R. v. Vu, 2013 SCC 60, [2013] 3 S.C.R. 657; R. v. Patrick, 2009 SCC 17, [2009] 1 S.C.R. 579; R. v. Morelli, 2010 SCC 8, [2010] 1 S.C.R. 253; R. v. Spence, 2005 SCC 71, [2005] 3 S.C.R. 458; State v. Simmons, 190 Vt. 141 (2011); Breyer v. Bundesrepublik Deutschland, C-582/14, EU:C:2016:779; Vidal‑Hall v. Google Inc., [2015] EWCA Civ 311, [2016] Q.B. 1003; Quebec (Attorney General) v. 9147-0732 Québec inc., 2020 SCC 32, [2020] 3 S.C.R. 426; R. v. Mills, 2019 SCC 22, [2019] 2 S.C.R. 320; R. v. Friesen, 2020 SCC 9, [2020] 1 S.C.R. 424; R. v. Wong, [1990] 3 S.C.R. 36.
By Côté J. (dissenting)
R. v. Spencer, 2014 SCC 43, [2014] 2 S.C.R. 212; R. v. Evans, [1996] 1 S.C.R. 8; R. v. Edwards, [1996] 1 S.C.R. 128; R. v. Tessling, 2004 SCC 67, [2004] 3 S.C.R. 432; R. v. Reeves, 2018 SCC 56, [2018] 3 S.C.R. 531; R. v. Marakah, 2017 SCC 59, [2017] 2 S.C.R. 608; R. v. Ward, 2012 ONCA 660, 112 O.R. (3d) 321; R. v. Trapp, 2011 SKCA 143, 377 Sask. R. 246; R. v. Kang‑Brown, 2008 SCC 18, [2008] 1 S.C.R. 456; R. v. Gomboc, 2010 SCC 55, [2010] 3 S.C.R. 211; R. v. Plant, [1993] 3 S.C.R. 281; R. v. Vu, 2013 SCC 60, [2013] 3 S.C.R. 657; R. v. Stairs, 2022 SCC 11; R. v. Mills, 2019 SCC 22, [2019] 2 S.C.R. 320; Breyer v. Bundesrepublik Deutschland, C‑582/14, EU:C:2016:779; Vidal‑Hall v. Google Inc., [2015] EWCA Civ 311, [2016] Q.B. 1003; Altimo Holdings v. Kyrgyz Mobil Tel Ltd, [2011] UKPC 7, [2012] 1 W.L.R. 1804; Hunter v. Southam Inc., [1984] 2 S.C.R. 145; R. v. Feeney, [1997] 2 S.C.R. 13; R. v. McNeil, 2009 SCC 3, [2009] 1 S.C.R. 66; R. v. O’Brien, 2023 ONCA 197, 166 O.R. (3d) 114; R. v. Ilia, 2023 ONCA 75, 523 C.R.R. (2d) 128; R. v. Allen, 2020 ONCA 664, 396 C.C.C. (3d) 1; R. v. West, 2020 ONCA 473, 392 C.C.C. (3d) 271; R. v. Caza, 2015 BCCA 374, 376 B.C.A.C. 258; R. v. Smith, 2005 BCCA 334, 199 C.C.C. (3d) 404; R. v. Friesen, 2020 SCC 9, [2020] 1 S.C.R. 424; R. v. Find, 2001 SCC 32, [2001] 1 S.C.R. 863; R. v. McGregor, 2023 SCC 4; R. v. Sharma, 2022 SCC 39; R. v. Spence, 2005 SCC 71, [2005] 3 S.C.R. 458; In re The Board of Commerce Act, 1919, and The Combines and Fair Prices Act, 1919, [1922] 1 A.C. 191.
Statutes and Regulations Cited
Canadian Charter of Rights and Freedoms , s. 8 .
Criminal Code , R.S.C. 1985, c. C‑46, ss. 487.015(1) , 691 to 693 .
Supreme Court Act , R.S.C. 1985, c. S‑26, s. 40(3) .
Authors Cited
Austin, Lisa M. “Getting Past Privacy? Surveillance, the Charter , and the Rule of Law” (2012), 27 C.J.L.S. 381.
Austin, Lisa M. “Technological Tattletales and Constitutional Black Holes: Communications Intermediaries and Constitutional Constraints” (2016), 17 Theoretical Inquiries L. 451.
Canada. Office of the Privacy Commissioner. What an IP Address Can Reveal About You: A report prepared by the Technology Analysis Branch of the Office Privacy Commissioner of Canada. Gatineau, 2013.
Cockfield, Arthur J. “Who Watches the Watchers? A Law and Technology Perspective on Government and Private Sector Surveillance” (2003), 29 Queen’s L.J. 364.
Hasan, Nader, et al. Search and Seizure. Toronto: Emond Montgomery, 2021.
Hogg, Peter W., and Wade K. Wright. Constitutional Law of Canada, 5th ed. Supp. Toronto: Thomson Reuters, 2022 (updated 2023, release 1).
Kennedy, Pagan. “William Gibson’s Future Is Now”, The New York Times, January 13, 2012 (online: https://www.nytimes.com/2012/01/15/books/review/distrust-that-particular-flavor-by-william-gibson-book-review.html).
Magotiaux, Susan. “Out of Sync: Section 8 and Technological Advancement in Supreme Court Jurisprudence” (2015), 71 S.C.L.R. (2d) 501.
Matsumi, Hideyuki. “Predictions and Privacy: Should There Be Rules About Using Personal Data to Forecast the Future?” (2017), 48 Cumb. L. Rev. 149.
Olivetti Rason, Nino, and Sara Pennicino. “Comparative Law in the Jurisprudence of the Supreme Court of Canada”, in Giuseppe Franco Ferrari, ed., Judicial Cosmopolitanism: The Use of Foreign Law in Contemporary Constitutional Systems. Boston: Brill/Nijhoff, 2019, 140.
Panneck, Travis. “Incognito Mode Is in the Constitution” (2019), 104 Minn. L. Rev. 511.
Sharpe, Robert J., and Kent Roach. The Charter of Rights and Freedoms, 7th ed. Toronto: Irwin Law, 2021.
Slane, Andrea. “Privacy and Civic Duty in R v Ward: The Right to Online Anonymity and the Charter ‑Compliant Scope of Voluntary Cooperation with Police Requests” (2013), 39 Queen’s L.J. 301.
Tene, Omer. “What Google Knows: Privacy and Internet Search Engines”, [2008] Utah L. Rev. 1433.
APPEAL from a judgment of the Alberta Court of Appeal (Veldhuis, Schutz and Crighton JJ.A.), 2022 ABCA 208, 55 Alta. L.R. (7th) 76, 509 C.R.R. (2d) 213, [2023] 5 W.W.R. 51, [2022] A.J. No. 738 (Lexis), 2022 CarswellAlta 1454 (WL), affirming a decision of Ho J., 2020 ABQB 70, 10 Alta. L.R. (7th) 103, 453 C.R.R. (2d) 347, [2020] A.J. No. 135 (Lexis), 2020 CarswellAlta 174 (WL). Appeal allowed, Wagner C.J. and Côté, Rowe and O’Bonsawin JJ. dissenting.
Heather Ferg and Sarah Rankin, for the appellant.
Rajbir Dhillon, for the respondent.
David W. Schermbrucker and Allyson Ratsoy, for the intervener the Director of Public Prosecutions.
Andrew Hotke, for the intervener the Attorney General of Ontario.
Micah B. Rankin and Michael Barrenger, for the intervener the Attorney General of British Columbia.
Anil K. Kapoor and Cameron Cotton O’Brien, for the intervener the Canadian Civil Liberties Association.
Daniel J. Song, K.C., and Vibert M. Jack, for the intervener the British Columbia Civil Liberties Association.
The judgment of Karakatsanis, Martin, Kasirer, Jamal and Moreau JJ. was delivered by
Karakatsanis J. —
I. Introduction
[1] The Internet has shifted much of the human experience from physical spaces to cyberspace. It has grown to encompass public squares, libraries, markets, banks, theatres, and concert halls, becoming the most expansive cultural artifact our species has ever created. Along with our shopping mall and our town hall, for many of us, the Internet has become a constant companion, through which we confide our hopes, aspirations, and fears. Individuals use the Internet not only to find recipes, pay bills, or get directions, but also to explore their sexualities, to map out their futures, and to find love.
[2] These new realities have forced courts to grapple with “a host of new and challenging questions about privacy” (R. v. Spencer, 2014 SCC 43, [2014] 2 S.C.R. 212, at para. 1). In Spencer, this Court determined that a reasonable expectation of privacy attaches to subscriber information — the name, address, and contact information — associated with an individual Internet Protocol (IP) address. A request for this information by the state is a “search” under s. 8 of the Canadian Charter of Rights and Freedoms .
[3] This appeal asks whether an IP address itself attracts a reasonable expectation of privacy. The answer must be yes.
[4] An IP address is a unique identification number. IP addresses identify Internet-connected activity and enable the transfer of information from one source to another. They are necessary to access the Internet. An IP address identifies the source of every online activity and connects that activity (through a modem) to a specific location. And an Internet Service Provider (ISP) keeps track of the subscriber information that attaches to each IP address.
[5] But because IP addresses consist of numbers that can usually be changed by an ISP without notice, the Crown submits — and the majority of the Court of Appeal agreed — that an IP address does not attract a reasonable expectation of privacy. Here, the Crown contends that police were after no more than the collection of numbers that would ultimately allow them to obtain the production order contemplated by Spencer. Thus, the Crown reasons, the state did not infringe on the appellant’s right to privacy because Spencer sufficiently protected his personal information.
[6] I respectfully disagree. This analysis runs counter to this Court’s jurisprudence under s. 8 of the Charter . We have never approached privacy piecemeal, based on police’s stated intention to use the information they gather in only one way. The right against unreasonable search and seizure, like all Charter rights, must receive a broad and purposive interpretation, reflective of its constitutional source. Since Hunter v. Southam Inc., [1984] 2 S.C.R. 145, we have held that s. 8 seeks to prevent breaches of privacy, rather than to condemn or condone breaches based on the state’s ultimate use of that information. Privacy, once breached, cannot be restored.
[7] To that end, our Court has applied a normative standard to reasonable expectations of privacy. We have defined s. 8 in terms of what privacy should be — in a free, democratic, and open society — balancing the individual’s right to be left alone against the community’s insistence on protection. This normative standard demands we take a broad, functional approach to the subject matter of the search and that we focus on its potential to reveal personal or biographical core information (R. v. Marakah, 2017 SCC 59, [2017] 2 S.C.R. 608, at para. 32).
[8] Informational privacy is particularly critical — and particularly challenging. Our jurisprudence recognizes that computers are unique and present privacy risks that differ from s. 8’s traditional objects. Thus, this Court has determined that s. 8 generally prevents police from seizing a computer without a warrant — even though the device itself provides no information without judicial permission to search its contents — because seizing the computer gives the state the means through which to access its content (R. v. Reeves, 2018 SCC 56, [2018] 3 S.C.R. 531, at para. 34).
[9] Casting the subject matter of this search as an abstract string of numbers used solely to obtain a Spencer warrant goes against these precedents. IP addresses are not just meaningless numbers. Rather, as the link that connects Internet activity to a specific location, IP addresses may betray deeply personal information — including the identity of the device’s user — without ever triggering a warrant requirement. The specific online activity associated with the state’s search can itself tend to reveal highly private information. Correlated with other online information associated with that IP address, such as that volunteered by private companies or otherwise collected by the state, an IP address can reveal a range of highly personal online activity. And when associated with the profiles created and maintained by private third parties, the privacy risks associated with IP addresses rise exponentially. The information collected, aggregated and analyzed by these third parties lets them catalogue our most intimate biographical information. Viewed normatively and in context, an IP address is the first digital breadcrumb that can lead the state on the trail of an individual’s Internet activity. It may betray personal information long before a Spencer warrant is sought.
[10] And the Internet has concentrated this mass of information with private third parties operating beyond the Charter ’s reach. In this way, the Internet has fundamentally altered the topography of informational privacy under the Charter by introducing third-party mediators between the individual and the state — mediators that are not themselves subject to the Charter . Private corporations respond to frequent requests by law enforcement and can volunteer all activity associated with the requested IP address. Private corporate citizens can volunteer granular profiles of an individual user’s Internet activity over days, weeks, or months without ever coming under the aegis of the Charter . This information can strike at the heart of a user’s biographical core and can ultimately be linked back to a user’s identity, with or without a Spencer warrant. It is a deeply intrusive invasion of privacy.
[11] Weighed against society’s legitimate interest in privacy is society’s legitimate interest in “[s]afety, security and the suppression of crime” (R. v. Tessling, 2004 SCC 67, [2004] 3 S.C.R. 432, at para. 17). While the right to be left alone must keep pace with technological developments, the way in which crime is committed and investigated also evolves. Easy access to the Internet and user anonymity combine to facilitate the commission of crime and challenge effective law enforcement. Clearly, the particularly insidious nature of much online crime, including child pornography and luring, presents serious and pressing social harm. Police must have the tools to investigate these crimes. And when an IP address (or subscriber information) is clearly linked to a crime — as it obviously can be for child pornography or luring — prior judicial authorization is readily available. A production order for an IP address would require little additional information to what police must already provide for a Spencer warrant. Both society’s interest in effective law enforcement and its interest in protecting the informational privacy rights of all Canadians must be respected and balanced.
[12] On balance, the burden imposed on the state by recognizing a reasonable expectation of privacy in IP addresses is not onerous. This recognition adds another step to criminal investigations by requiring that the state show grounds to intrude on privacy online. But in the age of telewarrants, this hurdle is easily overcome where the police seek the IP address in the investigation of a criminal offence. Section 8 protection would let police pursue the Internet activity related to their law enforcement goals while barring them from freely seeking the IP address associated with online activity not related to the investigation. Judicial oversight would also remove the decision of whether to reveal information — and how much to reveal — from private corporations and return it to the purview of the Charter .
[13] As a crucial component inherent in the structure of the Internet, an IP address is the key that can lead the state through the maze of a user’s Internet activity and is the link through which intermediaries can volunteer that user’s information to the state. Thus, s. 8 ought to protect IP addresses. Doing so would safeguard the first “digital breadcrumb” and shroud the trail of an Internet user’s journey through cyberspace; it would further s. 8’s purpose of preventing potential infringements of privacy rather than circumscribe its scope according to the state’s stated intentions about how it will use this key.
[14] I would allow the appeal. There is a reasonable expectation of privacy in an IP address. A request by the state for an IP address constitutes a search.
II. Background
[15] The appellant, Andrei Bykovets, was convicted of 14 offences for using unauthorized credit card data to buy gift cards online, using those gift cards to make purchases in store, and possessing material related to credit card fraud.
[16] During the Calgary Police Service’s investigation into fraudulent online purchases from a liquor store, police learned that the store’s online sales were managed by Moneris, a third-party payment processing company. Police contacted Moneris to obtain the IP addresses used for the transactions, and Moneris voluntarily identified two. Police then obtained a production order compelling the addresses’ ISP to disclose the subscriber information — the name and address of the customer — for each IP address, as required by Spencer. One was registered to the appellant, the other to his father.
[17] Police then used this subscriber information to seek and execute search warrants for the residential addresses of the appellant and his father. The appellant was arrested, convicted after a trial, and his convictions were confirmed on appeal.
[18] Before trial, the appellant alleged that the police’s request to Moneris violated his right against unreasonable search and seizure under s. 8 of the Charter . The key issue on the voir dire was whether the appellant had a reasonable expectation of privacy in his IP address.
[19] Defence counsel submitted a forensic investigator’s expert report providing a technical summary of IP addresses and their functions. The report showed that there are internal and external IP addresses. External IP addresses are used to transfer information across the Internet from one source to another through a modem rented from the ISP. An external IP address is much like the street address of an individual’s house. Without one, a user can neither send nor receive data. A modem or router also assigns an internal IP address to each device on a local network, roughly equivalent to the individual rooms in a house.
[20] IP addresses can also be static or dynamic. Most are dynamic, meaning that the ISP can change a user’s external IP address without notice and for any number of reasons. ISPs keep a record of which subscriber each external IP address was assigned to and for what time period.
[21] A user’s ISP can be determined by entering their IP address into an IP lookup website. The police can then request subscriber information for the assigned IP address from the ISP, as contemplated by Spencer. That said, the expert explained that one may still take steps to determine a user’s identity, without resorting to an ISP, through the information logged on the website of a third-party company. Third-party companies, such as Google or Facebook, can track the external IP addresses of each user who visits their site and log this information to varying degrees. These companies can determine the identity of those individual users based on their Internet activity on their sites (expert report, reproduced in A.R., at p. 311). The effect is compounded when information from multiple sites is collected (p. 312).
[22] Thus, in the expert’s view, if those seeking to identify a particular Internet user have access to information logged by third-party companies, “it is not necessary to obtain ISP-held subscriber information in order to accurately identify a particular internet user” (p. 312).
III. Decisions Below
A. Court of Queen’s Bench of Alberta, 2020 ABQB 70, 10 Alta. L.R. (7th) 103 (Ho J.)
[23] The trial judge held that the police’s request to Moneris was not a search under s. 8 of the Charter because the appellant did not have a reasonable expectation of privacy in his IP address. Considering the factors laid down by this Court in Tessling, she defined the subject matter of the alleged search as IP addresses sought for the purpose of furthering the investigation. She considered the expert report and reasoned that, on their own, IP addresses do not provide a link to, or any other information about, an Internet user (para. 44).
[24] As a result, the appellant’s subjective expectation of privacy in his IP address was not reasonable because the IP address did not disclose a “biographical core of personal information” without access to a third-party website (para. 56). The trial judge saw “little to be gained from a normative perspective” by “requiring the police to seek judicial authorization” when accessing the IP address itself rather than when accessing the subscriber information connected to that IP address (para. 64, citing Spencer).
B. Court of Appeal of Alberta, 2022 ABCA 208, [2023] 5 W.W.R. 51 (Schutz and Crighton JJ.A., Veldhuis J.A. Dissenting)
[25] The majority of the Court of Appeal dismissed the appeal, largely for the reasons of the trial judge. Schutz and Crighton JJ.A. agreed that the appellant had no reasonable expectation of privacy in his IP address because, standing alone, it reveals nothing of a person’s lifestyle or core biographical information. What little information the IP address communicated was overwhelmed by “legitimate countervailing concerns”: “. . . safety, security, and the suppression of crime . . .” (para. 22).
[26] In dissent, Veldhuis J.A. would have allowed the appeal because the trial judge did not “undertake her analysis with the normative approach in mind” (para. 62). Properly characterized, the subject matter of the search was not the IP address itself, but “the identity of an internet user which corresponds to a particular IP address that is linked to a particular, monitored internet activity” (para. 77).
[27] Veldhuis J.A. concluded that the appellant’s expectation of privacy in that subject matter was reasonable. A person communicating financial information to make an online purchase would expect the IP address used to remain private, and that information was of a private nature because it could identify an Internet user “without any requirement for reasonable suspicion or grounds to support judicial authorization” (para. 88). Thus, a reasonable expectation of privacy attached to these IP addresses because “they were linked to a particular, monitored internet activity that could disclose biographical core information” (para. 94).
IV. Analysis
[28] This appeal raises a single issue: Does a reasonable expectation of privacy attach to an IP address? In my view, the answer is yes. As I will explain, an IP address is the crucial link between an Internet user and their online activity. Thus, the subject matter of this search was the information these IP addresses could reveal about specific Internet users including, ultimately, their identity. To find that s. 8 does not extend to an IP address because police collected it only to obtain a Spencer warrant ignores the information it can reveal without a warrant. Such an analysis reflects piecemeal reasoning based on how the state intends to use the information in a specific case, contrary to the broad, purposive approach required by s. 8’s constitutional status. Nor can the analysis be limited to the privacy interests affected by what the IP address can reveal on its own, without consideration of what it can reveal in combination with other available information, particularly from third-party websites. Viewed normatively, an IP address is the key to unlocking a user’s Internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy. If s. 8 is to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses.
A. Legal Framework
[29] Section 8 of the Charter guarantees “the right to be secure against unreasonable search or seizure”. Its principal object is the protection of privacy, or the individual’s “right to be left alone” (R. v. Edwards, [1996] 1 S.C.R. 128, at para. 67). Personal privacy is vital to individual dignity, autonomy, and personal growth (R. v. Jones, 2017 SCC 60, [2017] 2 S.C.R. 696, at para. 38). Its protection is a basic prerequisite to the flouris