By: Ulfa Ismail
What if law enforcement could use IP addresses to hunt through your internet activity without a warrant? This is no longer the case thanks to R. v. Bykovets.
Background
In September 2017, Calgary Police began investigating a set of fraudulent online purchases from the liquor store, Co-op Wine Spirits Beer. The store’s online sales were managed by the third-party payment processing company, Moneris. In their investigation, police first went to Moneris directly and requested the internet protocol (IP) addresses associated with transactions they suspected were fraudulent. Moneris agreed and voluntarily provided the police with two IP addresses.
An IP address is a string of numbers associated with a specific computer or computer network. IP addresses allow computers to send and receive information.
With IP addresses themselves essentially being a code, police needed to take the extra step of obtaining a specific production order called a Spencer warrant. A Spencer warrant compels an Internet Service Provider (ISP), in this case Telus, to disclose subscriber information. Subscriber information refers to the name and home address registered to a given IP address.
After Calgary police obtained a Spencer warrant , they connected the IP addresses with Mr. Andrei Bykovets, the appellant in this case, and his father. After searching the residences of both individuals, Mr. Bykovets was arrested and given 33 charges related to the possession and use of third parties’ credit cards and personal identification documents as well as the possession and storage of firearms.
Procedural Posture
At trial, Mr. Bykovets argued that police obtaining the raw IP addresses (i.e. the string of code) from Moneris violated his section 8 Charter rights. section 8 outlines the right against unreasonable search and seizure. In his view, the police should not have requested and received his IP address directly from Moneris without first obtaining a warrant. The act of obtaining his IP address did, in Mr. Bykovets' view, constitute a search and thus, qualified for section 8 protections.
The trial judge held that police obtaining IP addresses from Moneris could not be defined as a search. Mr.Bykovets had no reasonable expectation of privacy in his IP address given that IP addresses do not reveal any personal or biographical information about a user. Subscriber information, on the other hand, did reveal biographical information such as a person's name and address. Since the police had later obtained the appropriate production order before accessing subscriber information, Bykovets’ section 8 rights were not violated. Bykovets was convicted of 14 offences related to fraudulent online purchases.
Court of Appeal of Alberta
In 2022, Mr.Bykovets’ appeal was heard at the Court of Appeal of Alberta. The majority of the court agreed with the trial judge and held that Bykovets had no reasonable expectation of privacy to his IP address. Furthermore, the little information an IP address can reveal, such as the approximate region a user resides in, was far outweighed by the concerns of maintaining security and suppressing crime.
With this, the court dismissed the appeal.
Supreme Court of Canada
In 2024, Mr. Bykovets's appeal to the Supreme Court of Canada was heard. The main question before the court was whether a person had a reasonable expectation of privacy to their IP address.
The majority disagreed with the lower court’s decision and held that IP addresses should be protected under section 8, requiring law enforcement to seek judicial authorization before obtaining an IP.
The majority detailed that although a user's subscriber information could not be accessed without a production order, law enforcement can essentially side-step the Charter and learn of a person's identity with access to their IP address alone.
An IP address is linked to a user's internet activity. With the sheer amount of data collected while a person is surfing the internet, police can access biographical information and identify an internet user by using IP addresses to search through a user’s internet activity. Biographical information, that is, information which reveals a person's identity or the intimate details of their lives, is protected under section 8 as per the Supreme Court’s 1993 decision in R. v. Plant.
Since the police were capable of revealing Mr.Bykovets’ personal information with his IP address alone, he had a reasonable expectation of privacy to his IP. The court allowed Bykovets’ appeal, setting aside his convictions and ordering a new trial.
Four out of nine justices, forming the dissent, disagreed that police had conducted a search when obtaining the IP addresses. In fact, Calgary Police being unable to identify Bykovets as a suspect before receiving a production order demonstrated that the existing jurisprudence, protecting a person's subscriber information, was sufficient in maintaining Canadian’s section 8 rights.
Implications and Insights
This case is interesting as it demanded justices develop a more technical understanding of the technologies involved.
This case was a 5-4 split between the majority and dissenting justices, oftentimes an indication that the subject matter is highly disputable. Both opinions combined provided a well-rounded analysis of the case. That being said, the majority was, arguably, more successful in accurately contextualizing the revealing nature of IP addresses in our modern age.
The majority and dissenting judges looked at the case differently. The majority looked at things normatively and focused on understanding how the internet activity linked to an IP address can reveal personal and sensitive information about a person.
On the other hand, the dissenting focused on the specific case of Mr.Bykovets, in which police focused on their law enforcement tasks and did not uncover Mr.Bykovets’ identity nor the intimate details of his life with his IP alone. In the dissenting view, requiring police to obtain a warrant before collecting IP addresses would tragically slow down law enforcement and the administration of justice
While the dissenting judges’ concerns can be sympathized with, this case goes far beyond Mr.Bykovets. In this instance, Calgary police did not use the IP addresses they received to dig through internet activity unrelated to the financial transactions being investigated. However, access to an IP address provides police with the ability to extensively search through internet-activity data. A user’s internet activity can expose information such as the social media and email accounts they log in to as well as their search history. All this often reveals a person's name and other sensitive information.
Think about the detailed profiles digital platforms often create for the average internet user. Oftentimes, these platforms accurately predict our interests, political leanings, age, location and gender.
Worth noting also is the disproportionate risk state surveillance poses to individuals such as those who belong to minority groups and those who engage in political activism digitally. Without a warrant, law enforcement can unfairly target certain internet users and access their personal information.
All this to say, the risk of state surveillance is not distant nor unrealistic. It is perfectly within the state’s capabilities. The majority’s decision in this case has rightfully reduced the risk state surveillance poses to Canadians.
Works Cited
Mitchell, Cory. “IP Address: Definition, How It Works, and Examples.” Investopedia, 2024. https://www.investopedia.com/terms/i/ip-address.asp.
Scc-csc.ca. “R. V. Bykovets - SCC Cases,” 2024. https://decisions.scc-csc.ca/scc-csc/scc-csc/en/item/20302/index.do.
See a document version of this article, including citations here: https://docs.google.com/document/d/15UyeWzPCytDFUSt3fmWxXNWnnUp82IlZGxo3VS0rdY0/edit?usp=sharing
Comments