top of page
  • Voltaire Staff

Computer IP addresses deserve privacy protection: Canada Supreme Court

The Supreme Court of Canada in a recent ruling has declared that the police must obtain judicial authorisation to access a computer user's internet protocol (IP) address, terming it a key link between individuals and their online activities. The decision comes with a motive to stop the occurrence of fraudulent online transactions.

The top court’s decision, in 5 vs 4 mandate on Friday, stems from a case initiated in 2017, wherein Calgary police probed fraudulent online transactions originating from a liquor store, reported CP24.

The store's payment processor voluntarily provided police with two IP addresses. Subsequently, police obtained a production order requiring the service provider to reveal the names and street addresses of the customers associated with those IPs. With this information, police obtained warrants to search two residences, resulting in the arrest of Andrei Bykovets, who was later convicted on multiple charges.

The trial judge dismissed the claim that the police's request for IP addresses violated Bykovets's Charter of Rights, which safeguards against unreasonable search and seizure.

Despite the Alberta Court of Appeal majority rejecting Bykovets's appeal, he escalated the case to the Supreme Court.

The highest court upheld Bykovets's appeal, overturned his convictions, and mandated a new trial.

Writing for a majority of the court, Justice Andromache Karakatsanis said an IP address "is the key to unlocking a user's internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy."

IP addresses aren't merely random digits, Karakatsanis explained.

Serving as the bridge between online actions and a precise location, they can reveal highly personal details, like the user's device identity, all without necessitating a warrant. She stressed that for the Charter to effectively safeguard Canadians' online privacy in today's digital age, it must extend protection to their IP addresses.

In her ruling, Karakatsanis emphasised the importance of equipping police with investigative tools to address online crime. However, she disagreed that an IP address is useless without a subsequent warrant to obtain a name and street address.

She said that an IP address serves as a direct link between specific online activity and a particular location, potentially revealing personal information even before linking it to a user's identity.

The judge noted that activity associated with an IP address can be correlated with other online activities accessible to the state, particularly concerning when combined with data from third parties.

"If an IP address is not protected, this information is freely available to the state without the protection of the Charter whether or not it relates to the investigation of a particular crime," the judge said.

The four dissenting judges argued that the appeal should be rejected, asserting that Bykovets had no reasonable expectation of privacy regarding the IP addresses stored on the credit card processor's servers and the internet service provider they exposed.



bottom of page