Supreme Court to decide if police need warrant to obtain IP address

Civil liberties groups argue that there should be more constraints around how the police track people online

Article content

The Supreme Court of Canada will hear arguments Tuesday on whether police need a court order to obtain an individual’s IP address, in a case civil liberties groups say has Canadians’ online privacy at stake.

Article content

“As more of our lives move online, now is a reasonable time to think through what should be the constraints on state power when it comes to watching what we do online. At its core, this case is about that,” Brenda McPhail, the director of privacy, technology and surveillance at the Canadian Civil Liberties Association, said in an interview.

Article content

The CCLA argued in court documents that “people expect to access the internet without police obtaining a record of their access without warrant. They expect to be free from police post-hoc surveillance unless warranted.”

The case in front of the Supreme Court, R v Bykovets, centres around an Alberta man convicted of using unauthorized credit card data to buy gift cards online, and then using those gift cards to make purchases in store.

Article content

After a grocery store flagged suspicious purchases to Calgary Police, the police service contacted Moneris — the company managing the grocery store’s online sales — to obtain the IP addresses involved in the transactions. After Moneris provided the IP addresses, the police applied to the court to obtain a production order to compel the internet provider to identify the subscriber.

It’s already established law that police need a production order to obtain subscriber information from telecom companies. The issue in front of the Supreme Court now is whether law enforcement should also have to go to court in order to obtain the IP address.

An IP address identifies each device connected to the internet. “Here, the numbers over which the appellant asserts a reasonable expectation of privacy are and — numbers that expose nothing about the appellant’s core biographical details, private life, or online browsing habits,” the Crown said in its court filing.

Article content

It argued that “a privacy interest is raised when the police try to link an IP address to subscriber information,” and the police in this case lawfully applied for a production order to do so.

But the CCLA says that information in an IP address is similar to that found in cell tower data, which police need court authorization to access.

It argued an IP address is “much more” than just a series of numbers separated by periods. It contains information about location and the users’ internet service provider, and as such, “provides the basis for the police to identify an internet user.”

“One cannot transmit or receive information online without generating an IP address. People expect to transact their activities understanding that the police will only be able to access their internet activities if a judge permits,” the CCLA said.

Article content

The British Columbia Civil Liberties Association said in its own court filing that in this case, the police “simply contacted” Moneris who then provided two IP addresses.

“If s. 8 of the Charter does not protect IP addresses from being disclosed to the police without prior judicial authorization, then the potential identification of an internet user will depend on whether a corporate intermediary chooses to cooperate with law enforcement or to safeguard individual privacy,” it argued.

An expert report in the case pointed out that third-party websites—such as Google and Facebook — track activity related to IP addresses. They don’t have access to the identity of the person using the IP address the way internet providers do, but the individual could theoretically be identified through that online activity — for instance, in the case of someone logging into an email address using their name and looking up directions to a nearby store, the report outlined.

Article content

Such identification would only be possible if the “individual seeking to learn the identity of a particular internet user, is able to access the information logged by the third-party company or companies,” the report noted.

BCCLA litigation director Vibert Jack said in an emailed statement that while “Facebook and Google were the two examples provided by the defence expert in this case, any website you visit could use your IP address to track your online activity and create a personal profile about you.”

Jack said he wasn’t personally aware of a case where this type of information was shared with the police, but “it is clear that the risk is real.”

Before the 2014 Supreme Court ruling that said police must get court approval to obtain the identity of a subscriber from an ISP, “it was common for internet service providers to hand over” subscriber information “just based on a request from the police.”

Jack said it “stands to reason that companies will do the same with the type of information being examined in this case unless the Supreme Court steps in to protect our privacy once again.”


Postmedia is committed to maintaining a lively but civil forum for discussion and encourage all readers to share their views on our articles. Comments may take up to an hour for moderation before appearing on the site. We ask you to keep your comments relevant and respectful. We have enabled email notifications—you will now receive an email if you receive a reply to your comment, there is an update to a comment thread you follow or if a user you follow comments. Visit our Community Guidelines for more information and details on how to adjust your email settings.

Leave a Reply