BACKGROUND
Andrei Bykovets was convicted of multiple offences for using unauthorized credit card data to buy gift cards online, using those gift cards to make purchases in-store and possessing material related to credit card fraud.
During the investigation, police contacted a third-party payment processing company at one of the online stores where the purchases occurred to obtain the IP addresses used for the transactions. The company voluntarily provided two IP addresses. A production order compelling the name and address of the customer was then obtained and this information was used for search warrants at the residential addresses. This led to Mr. Bykovets’ arrest.
Before trial, Mr. Bykovets alleged that the police request for the IP addresses violated his right to be free from unreasonable search and seizure pursuant to s.8 of the Charter. A voir dire was held to determine whether Mr. Bykovets had a reasonable expectation of privacy in his IP address. An expert report was produced providing a technical summary of IP addresses and their functions.
Court of Queen’s Bench of Alberta (2020 ABQB 70)
The trial judge held that the request for IP addresses was not a search under s.8 of the Charter because Mr. Bykovets did not have a reasonable expectation of privacy in his IP address. The trial judge considered the expert report and found that IP addresses do not provide a link to, or any other information about an Internet user. As a result, because IP addresses do not disclose a biographical core of personal information on their own, Mr. Bykovets’ subjective expectation of privacy was unreasonable.
Court of Appeal of Alberta (2022 ABCA 208)
The Court of Appeal of Alberta dismissed the appeal agreeing there is no reasonable expectation of privacy in IP addresses because, on their own, IP addresses do not reveal anything about a person’s lifestyle or core biographical information. The Court of Appeal found that, in any event, any information the IP address held was superseded by “legitimate countervailing concerns” like “safety, security, and the suppression of crime” (para 22).
Supreme Court of Canada (2024 SCC 6)
The Supreme Court of Canada allowed Mr. Bykovets’ appeal, set aside his conviction, and ordered a new trial finding that an IP address attracts a reasonable expectation of privacy such that s. 8 is engaged.
The Court first considered whether the request for an IP address was a search under s.8 of the Charter, which required a consideration of the subject matter of the search. In that regard, the Court found that lower courts’ description of the subject matter as “IP addresses to further their investigation” was artificially narrow and failed to capture the privacy interests at stake.
The Court observed the constitutional right to privacy is not described in the case law according to the state’s declared intention or to one particular use of the information. Rather, the subject matter inquiry typically takes a broad and functional approach “examining the connection between the police investigative technique and the privacy interest at stake” (citing R v Spencer, 2014 SCC 43 at para 26). The Court cautioned that care is required when describing the subject matter of a search involving electronic data.
In this case, the police were not looking for IP addresses on their own, as this would be of no use to them. Rather, the police sought the information an IP address can reveal, including online activity and one’s identity. The Court noted that an IP address is a tool that allows the state to draw immediate and direct inferences about the user behind specific Internet activity – with or without a warrant. As such, the Court described the subject matter of the search as “an IP address as the key to obtaining more information about a particular Internet user including their online activity, and ultimately, their identity as the source of that information” (para 43).
The Court then considered whether the expectation of privacy in an IP address was reasonable. Althoughan individual may have control over the subject matter (i.e., choose to not use internet services to avoid divulging information), the Court held this is non-determinative with respect to a reasonable expectation of privacy, especially because this case involves the internet. With the internet, the only way to retain control over personal information is to make no use of internet services at all, which is not a meaningful choice.
The Court recognized there is a unique and heightened privacy interest in personal computer data due to its potential to expose deeply revealing information, some of which can be retained unknowingly. Although the intended restriction of the use of information may have been well intentioned, a reasonable expectation of privacy analyzes the potential of a subject matter to reveal an individual’s biographical core, not whether this occurred in this case.
The Court decided IP addresses attract a reasonable expectation of privacy for three reasons:
- Activity exposed by an IP address can be deeply revealing. For example, here, the activity involved financial transactions. IP addresses linked to financial websites may disclose a wealth of personal information like the health supplements one uses, the restaurants a person frequents, etc. An internet user’s history on chatrooms, dating, and pornographic sites may reveal sexual preferences, political views, or other information.
- Activity associated with an IP address can be correlated with other online activity associated to the IP address. If the information revealed by an IP address can be correlated against third party information, the scope of the information that could be revealed is enormous. For example, many websites collect extremely personal information like search and location history. The Court recognized that many choose to use the internet anonymously and behave differently online than they would in person. As such, “those who use the internet should be entitled to expect that the state does not access this information without a proper constitutional basis” (para 67).
- An IP address can lead directly to a user’s identity. An IP address is the “first digital breadcrumb” that can lead the state to valuable personal information.
Notably, the Court held that the highly private nature of information that can be revealed by an IP address supports the position that the public’s interest in being left alone prevails over the state’s interest in law enforcement. In particular, the Court noted that information from the internet can be compiled, dissected, analyzed, and compared with other data points to reveal information that one would not have anticipated when the original data was collected. Private corporations can track their users, build profiles, and use information to predict things about an individual like what they will purchase, and what kind of job they might take. The Court noted it is common knowledge that social media sites use IP addresses to personalize ads and infer information about users (like their age, gender, and interests). The Court stated that “the Internet has essentially altered the topography of privacy under the Charter” (para 78).
The Court recognized the internet has modified how crime occurs, and that police need investigative tools to combat crime online. However, obtaining prior judicial authorization before seeking an IP address is not, in the Court’s view, an onerous step and would not unduly interfere with the state’s ability to deal with the crime. Requiring judicial pre-authorization narrows the state’s online reach and prevents it from acquiring details that are irrelevant to the investigation. Finally, judicial oversight prevents private corporations from deciding when and how much personal information to disclose. The Court concluded: “Extending s.8’s reach to IP addresses protects the first ‘digital breadcrumb’ and therefore obscures the trail of an Internet user’s journey through cyberspace” (para 91).
CONCLUSION
The majority’s decision in Bykovets will affect how online crime investigations occur. Police must obtain judicial authorization prior to requesting an IP address to ensure that internet investigative evidence is obtained in accordance with the Charter and admissible in court.
If you require additional information or further assistance, please contact David McKnight and Naomi Krueger.
Subscribe to RSS Feed