Following the digital breadcrumbs

In a 5-4 decision in R. v. Bykovets, the Supreme Court of Canada ruled that police must get a warrant before accessing IP addresses during an investigation.

"As a crucial component inherent in the structure of the Internet, an IP address is the key that can lead the state through the maze of a user's Internet activity and is the link through which intermediaries can volunteer that user's information to the state," Justice Andromache Karakatsanis wrote for the majority. "Thus, s. 8 ought to protect IP addresses. Doing so would safeguard the first 'digital breadcrumb' and shroud the trail of an Internet user's journey through cyberspace; it would further s. 8's purpose of preventing potential infringements of privacy rather than circumscribe its scope according to the state's stated intentions about how it will use this key."

The decision builds on the court's 2014 decision in Spencer that ruled that information attaching itself to an IP address has a reasonable expectation of privacy. This now extends to the IP address itself.

Kyla Lee, a lawyer with Acumen Law Corporation in Vancouver and chair of the CBA's criminal justice section, admits surprise at the outcome because IP addresses have attracted little privacy interest in the past.

"They gave a really good description of why we have privacy rights, and how they have to be viewed by the courts, that is going to inform a lot of section 8 and privacy-related applications in the future," Lee says, pointing to the court's comment about how once breached, privacy rights cannot be restored.

"Our Court has applied a normative standard to reasonable expectations of privacy," Karakatsanis wrote. "We have defined s. 8 in terms of what privacy should be—in a free, democratic, and open society—balancing the individual's right to be left alone against the community's insistence on protection. This normative standard demands we take a broad, functional approach to the subject matter of the search and that we focus on its potential to reveal personal or biographical core information."

Lee appreciates this view of privacy, and hopes it will be good for the defence bar.

David Fraser, a partner with McInnes Cooper in Halifax, calls the decision significant, particularly after efforts in parliament to try and circumvent Spencer by doing away with a production order requirement for that information.

"Our modern society, in which so much of what we have to do is online, and so many things are mediated by third parties," Fraser says. "In your travels online, you are exposing your IP address all over the place—that's part of how the internet works. The cops like to say that the IP address doesn't tell you anything about the suspect other than their internet service provider, but with that information, they can get a Spencer order."

In its latest ruling, the court notes that IP addresses allow an investigator to connect dots using "first digital breadcrumbs," as Justice Karakatsanis put it.

"That was a good phrasing, because all of this is breadcrumbs, and this will be an important case," Fraser says. "There will be a lot of interesting incremental consequences to this that are beyond IP addresses."

The decision also emphasizes the notion that our lives are intermediated by third parties, says Fraser. It shouldn't be up to them to decide whether or what to disclose to the police.

"A warrant requirement is absolutely critical, and private companies shouldn't be doing that balancing, and it shouldn't be up to the cops to ask for it," Fraser says. "You need a justice of the peace or a judge to balance the equities and determine whether or not that should happen. That has wider-reaching implications."

Vibert Jack, the litigation director of the BC Civil Liberties Association, which intervened in the case, calls the ruling an important victory for online privacy rights.

"The court was very receptive to the arguments that we made, especially raising concerns about the vast amount of information that corporations collect about online users and the risks of allowing them to share that information to police without any judicial oversight," Jack says.

He is also heartened by language in the decision suggesting the court views the difference between privacy interests online and in the physical world. It has been using expansive language in that regard of late.

"We're hopeful that the court will continue to recognize the increased risks to our privacy interests in the online world and ensure that the law keeps up to date with new technologies and new police tactics, as they have done in this case," Jack says.

According to Lee, the 5-4 split leaves the decision open to being revisited, particularly as technology evolves, which could mean further privacy protections.

Fraser also notes that the Spencer ruling was unanimous. "I wonder if [Bykovets] will be read as a result more narrowly, applying only to online searches or investigations, or if there will be a broader application, and if the split will mean that it is confined to a narrow set of circumstances, and if there was a different set of circumstances but the same principles could go the other way," Fraser says.

For her part, Lee wonders how the decision will impact cases already in the system involving private subscriber information obtained in the same way as in the Bykovets case.

Lee suggests that there could be a delay in completing trials due to the need for additional voir dires and scheduling them on specific issues. "These trials involving digital evidence are necessarily going to necessarily take a little bit longer because of these additional challenges," she says. "But this probably also means that maybe fewer cases are going to come before the courts."