(Ottawa) The Supreme Court of Canada has said that police need legal authority to obtain a computer's IP address because this identification number is “a vital link between an Internet user and their online activity,” and is a search.
The country's highest court on Friday issued a five-to-four decision in a case that began in 2017 as Calgary police investigated fraudulent online transactions at a liquor store.
The liquor store's third-party payment processing company voluntarily handed over two IP addresses — “digital identifiers” assigned by an Internet service provider — to police.
Police obtained a court order requiring the internet service provider to disclose the names and addresses of customers linked to those IP addresses.
Police eventually obtained warrants to search both residences, leading to the arrest of Andrey Bykovets, who was later convicted on multiple charges.
The trial judge rejected the argument that the police request to obtain IP addresses violated the Canadian Charter of Rights and Freedoms' guarantee against “unreasonable searches and seizures.” She concluded that an Internet user does not have a “reasonable expectation of privacy” with respect to his IP address.
The Alberta Court of Appeal upheld the decision, but two judges to one, prompting Mr. Bykovets to take his case to the country's highest court.
The Supreme Court, in its majority judgment, Mr. Bykovets allowed the appeal, quashed the convictions and ordered a new trial.
Judge Andromache Karakatsanis, who wrote the majority ruling, explained that an IP address is “the key that provides access to a user's Internet activity and ultimately their identity.” The address therefore “raises a reasonable expectation of respect for private life” and “a request for an IP address made by the State constitutes a search within the meaning of the Charter”.
IP addresses aren't just meaningless numbers, she writes. As a nexus connecting internet activity to a specific location, they can spoof deeply personal information, including device user identity, without ever triggering the need for a search warrant.
So Justice Karakatsanis concluded that a Charter provision prohibiting unreasonable searches “should significantly protect the online privacy of Canadians in today's increasingly digital world,” as it should also protect their IP addresses.
