Canadian police need a search warrant to get your IP address: Supreme Court

Share post:

How private is your internet address? Very, says the Supreme Court of Canada.

Police can’t just walk into a company and demand a suspect’s IP address by saying a Canadian resident doesn’t have an expectation of privacy of that information, the court ruled today. An IP address is vital enough that every resident expects it to be private, and it can’t be handed to police without a court order, the nation’s top court concluded.

“If s. 8 of the Charter [which says everyone has the right to be secure against unreasonable search and seizure] is to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses,” the court ruled in a 5-4 decision. “An IP address is the crucial link between an internet user and their online activity. Viewed normatively, it is the key to unlocking a user’s internet activity and, ultimately, their identity. Thus, an IP address attracts a reasonable expectation of privacy.”

Here’s the background: In 2017, Calgary police investigating fraudulent online purchases at a liquor store demanded a credit card processor hand over IP addresses for certain transactions. With the two IP addresses, police then got a production order from a judge compelling Telus to disclose the name and address of its customers at each IP address. Using this subscriber information, police got search warrants which led to a person being arrested and ultimately convicted of 14 offences.

The accused was convicted at trial, a decision upheld by the Alberta Court of Appeal. Both courts rejected his argument that his rights had been violated.

The case went to the Supreme Court to answer a question: Was obtaining the IP addresses a lawful search? No, said the majority.

Requiring that police obtain prior judicial authorization before obtaining an IP address “is not an onerous investigative step,” the court ruled. “Where the IP address, or the subscriber information, is sufficiently linked to the commission of a crime, judicial authorization is readily available.”

The court ordered the accused to face a new trial.

This isn’t the first time the Supreme Court has dealt with companies handing over internet-related data. In a 2014 decision, it unanimously ruled that Canadian internet providers can’t turn over basic subscriber information to police without a search warrant.

The minority in this case argued an IP address alone doesn’t have private information. “Without more, all an IP address reveals to the police is a user’s ISP [internet service provider] — hardly a particularly private matter, let alone core biographical information,” the minority judges wrote. The accused had little control over his IP addresses, which an ISP can change at will and without notice, the judges said. And, they noted, the search wasn’t carried out at the accused’s home, but at the credit card company.

That wasn’t persuasive to the majority. “In the informational privacy context, the claimant’s control over the subject matter [the IP address] is not determinative,” they wrote. “The internet requires that users reveal subscriber information to their ISP to participate in this new public square, and Canadians are not required to become digital recluses in order to maintain some semblance of privacy in their lives.”

“Defining a reasonable expectation of privacy is an exercise in balance,” said the majority. “In this case, the balance weighs in favour of extending a reasonable expectation of privacy to IP addresses.

“The intensely private nature of the information an IP address may betray strongly suggests that the public’s interest in being left alone should prevail over the government’s interest in advancing its law enforcement goals. The internet has exponentially increased both the quality and quantity of information stored about internet users, spanning the most public and the most private human behaviour. The internet has not only allowed private corporations to track their users, but also to build profiles of their users filled with information the users never knew they were revealing.

“By concentrating this mass of information with private third parties and granting them the tools to aggregate and dissect that data, the internet has essentially altered the topography of privacy under the Charter. It has added a third party to the constitutional ecosystem, making the horizontal relationship between the individual and the state tripartite. Though third parties are not themselves subject to s. 8, they mediate a relationship which is directly governed by the Charter — that between defendant and police. This shift has enhanced the state’s informational capacity.”

RCMP Sgt. Kerry Shima, acting officer in charge of Alert ICE, the internet child exploitation unit for Alberta, told CBC News that the ruling will slow down the unit’s investigations.

“This definitely throws a wrench into the machine. It’s going to put a lot of children at risk,” he said.

Shima said the ruling means police will not be able to act swiftly to tackle most of their cases in an “efficient manner.”

“It gives a wide berth for offenders on the internet and it gives an opportunity for people to hide even better and avoid detection,” Shima said.

The post Canadian police need a search warrant to get your IP address: Supreme Court first appeared on IT World Canada.
Howard Solomon
Howard Solomonhttps://www.itworldcanada.com
Currently a freelance writer, I'm the former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including ITBusiness.ca and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.

Featured Tech Jobs

SUBSCRIBE NOW

Related articles

Cyber Security Today, April 19, 2024 – Police bust phishing rental platform, a nine-year old virus found on Ukrainian computers, and more

This episode reports on a threat actor targeting governments in the Middle East with a novel way of hiding malware is going international

Controversial expansion of US surveillance powers nears Senate vote

The US Senate is poised to vote on a significant expansion of Section 702 of the Foreign Intelligence...

Pornhub operator broke Canadian privacy law, watchdog rules

Site trusted word of boyfriend that woman agreed to have intimate images of her uploaded. It agreed after her complaint to delete the images, but they continued

Canada’s privacy watchdog investigating hack at Global Affairs

Inquiry will look into adequacy of data safeguards at the federal

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways