(Ottawa) The Supreme Court of Canada says police need judicial authorization to obtain a computer’s IP address because this identification number constitutes a “crucial link between an Internet user and their online activity” , and that it is a search.
The country’s highest court issued a closely divided, five-to-four decision Friday in a case that began in 2017, when Calgary police were investigating fraudulent online transactions at a liquor store.
The liquor store’s third-party payment processing company had voluntarily handed over two IP addresses – “digital identifiers” assigned by an internet service provider – to police.
Police then obtained a court order requiring the internet service provider to disclose the names and addresses of customers linked to those IP addresses.
Police finally obtained warrants to search two residences, leading to the arrest of Andrei Bykovets, who was later convicted on multiple charges.
The trial judge rejected the argument that the police request to obtain IP addresses violated the Canadian Charter of Rights and Freedoms’ guarantee against “unreasonable searches and seizures.” She concluded that an Internet user did not have a “reasonable expectation of privacy” with regard to his IP address.
The Alberta Court of Appeal upheld the decision, but by two judges to one, prompting Mr. Bykovets to take his case to the country’s highest court.
The Supreme Court, in its majority judgment, allowed Mr. Bykovets’ appeal, quashed the convictions and ordered a new trial.
Judge Andromache Karakatsanis, who wrote the majority judgment, explains that the IP address is “the key giving access to a user’s internet activity and, ultimately, to their identity”. This address therefore “raises a reasonable expectation of respect for private life” and “a request for an IP address made by the State constitutes a search” within the meaning of the Charter.
IP addresses are not just meaningless numbers, she writes. As a nexus that connects internet activity to a specific location, they can betray deeply personal information, including the identity of the device user, without ever triggering the requirement for a search warrant.
Justice Karakatsanis therefore concludes that if the Charter provision prohibiting unreasonable searches “must significantly protect the online privacy of Canadians in today’s largely digital world,” it must also protect their IP addresses. .