Police now need a warrant to get a person's IP address, Supreme Court rules

The Supreme Court of Canada made a key privacy ruling Friday that means police must now first have a warrant or court order to obtain the numbers making up a person or organization's IP address.

The top court was asked to consider whether an IP address alone, without any of the personal information attached to it, was protected by an expectation of privacy under the Charter.

In a five-four split decision, the court said a reasonable expectation of privacy is attached to the numbers making up a person's IP address, and just getting those numbers alone constitutes a search.

Writing for the majority, Justice Andromache Karakatsanis wrote that an IP address is "the crucial link between an internet user and their online activity."

"Thus, the subject matter of this search was the information these IP addresses could reveal about specific internet users including, ultimately, their identity."

Writing for the four dissenting judges, Justice Suzanne Côté disagreed with that central point, saying there should be no expectation of privacy around an IP address alone.

The court's decision is based on the case of Andrei Bykovets, who was convicted of 14 online fraud offences, for purchases made from an Alberta liquor store.

In 2017, the Calgary Police Service investigating the alleged crime discovered that the store's online sales were managed by Moneris, a third-party payment processing company.

Police contacted Moneris and asked for the IP address associated with the purchases, without providing a court order or warrant. Moneris gave two IP addresses to the police.

Appeal court dismissed privacy claim

Calgary police then went to the internet service provider (ISP) with a court order to get the names and addresses associated with the IP addresses. One address belonged to Bykovets, the other belonged to his father.

Police used the names and addresses to get a warrant to search their residences. Bykovets was arrested and charged with possession of a third party's credit card and identity documents.

At trial, Bykovets argued that he was the victim of an unreasonable search and seizure, a violation of Section 8 of the Charter of Rights and Freedoms, because he had an expectation of privacy with respect to his IP address.

The trial judge disagreed, saying there is no expectation of privacy related to an IP address and so the Charter was not violated.

The Alberta Court of Appeal majority decision sided with the trial judge, but one judge of the appeal court disagreed, saying there is an expectation of privacy associated with IP addresses.

Protecting online privacy in a digital world

In the Supreme Court majority decision, Karakatsanis said that only considering the information associated with an IP address to be protected by the Charter and not the IP address itself "reflects piecemeal reasoning" that ignores the broad purpose of the Charter.

The ruling said the privacy interests cannot be limited to what the IP address can reveal on its own "without consideration of what it can reveal in combination with other available information, particularly from third-party websites."

It went on to say that because an IP address unlocks a user's identity, it comes with a reasonable expectation of privacy and is therefore protected by the Charter.

"If [the Charter] is to meaningfully protect the online privacy of Canadians in today's overwhelmingly digital world, it must protect their IP addresses," the ruling said.

The dissenting opinion

Justice Côté, writing on behalf of justices Richard Wagner, Malcolm Rowe and Michelle O'Bonsawin, acknowledged that IP addresses "are not sought for their own sake" but are "sought for the information they reveal."

"However, the evidentiary record in this case establishes that an IP address, on its own, reveals only limited information," she wrote.

Côté said the biographical personal information the law was designed to protect are not revealed through having access to an IP address. Police must use that IP address to access personal information that is held by an ISP or a website that tracks customers' IP addresses to determine their habits.

"On its own, an IP address does not even reveal browsing habits," Côté wrote. "What it reveals is a user's ISP — hardly a more private piece of information than electricity usage or heat emissions."

Côté said placing a reasonable expectation of privacy on an IP address alone upsets the careful balance the Supreme Court has struck between Canadians' privacy interests and the needs of law enforcement.

"It would be inconsistent with a functional approach to defining the subject matter of the search to effectively hold that any step taken in an investigation engages a reasonable expectation of privacy," the dissenting opinion said.

'It's going to put a lot of children at risk': RCMP

Vibert Jack, litigation director at the B.C. Civil Liberties Association, told CBC News he's very happy with the court's decision and called it an important ruling on online privacy.

"The idea that Canadians wouldn't have an expectation of privacy in their IP addresses is a very scary proposition for us and we are glad that the court recognized the importance of going the other way on this one," Jack told CBC News.

The idea that police could obtain an IP address without any judicial oversight is "frankly outrageous," Jack added.

RCMP Sgt. Kerry Shima, acting officer in charge of Alert ICE, the internet child exploitation unit for Alberta, told CBC News that "in virtually every case" an IP address "kick-starts" their investigations.

"It used to be pretty straightforward. This definitely throws a wrench into the machine. It's going to put a lot of children at risk," he said.

Shima said the ruling means police will not be able to act swiftly to tackle most of their cases in an "efficient manner."

"It gives a wide berth for offenders on the internet and it gives an opportunity for people to hide even better and avoid detection," Shima added.