IP Addresses - Do Police Have a Right to Use as Evidence?

Author: Marc Ste. Marie

Introduction

The internet has become part of our everyday life in today’s society. Browsing the internet for hours at a time is not an uncommon practice. When someone uses the internet, they leave their fingerprint in the form of an Internet Protocol Address (IP Address). “An IP address is a string of numbers assigned to an internet-connected device. Think of it like an address on a house. Your computer network uses the IP address to communicate with other computers, websites, and all parts of cyberspace.”^[1] Software company Norton goes further and explains that, “Essentially, IP addresses are how computers on the internet recognize one another. Your internet service provider (ISP) assigns IP addresses to your internet-connected devices, and every IP address is unique.” ^[2] Although IP addresses contain very personalized data, what level of privacy can Canadians expect when it comes to the collection of this information? This question was examined in the case of R.v.Bykovets. There were several fraudulent online purchases from a liquor store, and the police used a third-party processing company that managed the liquor store’s online sales to obtain all the IP addresses for all of their sales. Police were able to obtain a list of the names and addresses of each customer connected to the IP addresses. With this list of names, the police obtained a warrant and arrested Bykovets.^[3] I believe that an internet user’s IP address should be private, and I believe that section 8 of the Canadian Charter of Rights and Freedoms should protect an internet user from having their IP address used as evidence. This blog will explore both of these perspectives within the context of the Bykovets case.

Canadian Charter of Rights and Freedoms- Section 8

Section 8 of the Charter states that “Everyone has the right to be secure against unreasonable search or seizure.”^[4] Where section 8 of the Charter is not clear, it is whether or not section 8 also protects a person’s online fingerprints, such as an IP address, from being searched and seized unreasonably.  The Bykovets case raised questions that all current internet users should know, such as whether an internet user’s IP address should be public knowledge, with no right to privacy. Further to this question, should the police have access to all internet users’ IP addresses to be used as they see fit, including when needed for evidence? The Supreme Court of Canada (SCC), in Bykovets, when referring to section 8 of the Charter, stated that

“Its principal object is the protection of privacy, including informational privacy, that is, the claim of individuals, groups, or institutions to determine for themselves when, how and to what extent information about them is communicated to others. Personal privacy is vital to individual dignity, autonomy, and personal growth. Its protection is a basic prerequisite to the flourishing of a free and healthy democracy.”^[5]

The specific language used by the SCC would suggest that section 8 of the Charter would also protect an internet user’s IP address, yet both the Alberta Court of Queen’s Bench and the Alberta Court of Appeal ruled against Bykovets and said that his Section 8 Charter rights were not violated, and they allowed his IP address to be used as evidence. However, given the nature of the sensitive information on an IP address, it is my opinion that protecting individual privacy must be paramount.

IP Addresses And The Right To Privacy

An internet user’s IP address can reveal several privacy concerns, and knowing the identity of the person associated with an IP address could cause serious harm to that person. The SCC acknowledged that,

“Online activities can reveal information that goes directly to a user’s biographical core. Websites offering dating services or adult pornography can give the state a depiction of the user’s sexual preferences. An Internet user’s history on medical, political, or other similar online chatrooms can reveal their health concerns or political views. If an IP address is not protected, this information is freely available to the state without the protection of the Charter, whether or not it relates to the investigation of a particular crime.”^[6]  

While I can agree that the internet is a dangerous place, and personal information can easily be hacked and siphoned by cyber criminals, I do not believe the ability to identify an internet user by obtaining their IP address from a third party should be allowed by anyone, let alone police officers, to use as evidence.

Original Rulings by Lower-Level Courts in Bykovets

To establish a breach of section 8 of the Charter, “a claimant must show there was a search or seizure, and that the search or seizure was unreasonable. Only the first requirement — whether the request for the IP addresses was a search — is at issue here.”^[7] In 2020, the Alberta Court of Queen’s Bench ruled against Bykovets’s arguments that his section 8 Charter rights had been breached. The Court found that Bykovets had his section 7 and section 10 Charter rights breached, but not his section 8 Charter rights.^[8] In 2022, the Alberta Court of Appeal upheld the rulings from the previous ruling from 2020, and agreed with the trial judge that Bykovets’s section 8 Charter rights were not violated when police used his IP address to obtain evidence against him regarding fraudulent online purchases from a liquor store. On appeal, the majority of the Court dismissed the action, with Justices Schutz and Crighton JJ.A. agreeing that,

 “The appellant had no reasonable expectation of privacy in his IP address because, standing alone, it reveals nothing of a person’s lifestyle or core biographical information. What little information the IP address communicated was overwhelmed by “legitimate countervailing concerns”: “. . . safety, security, and the suppression of crime”.^[9]

Supreme Court Decision in Bykovets

In a decision made on March 1^st, 2024, the majority of Judges at the SCC agreed that Bykovets did, in fact, have his Section 8 Charter rights violated when the Calgary police unreasonably searched and obtained his IP address. It was a five-to-four decision; however, the majority was in Bykovets' favour. The SCC analyzed the expectation of privacy

“by considering many interrelated but often competing factors, which can be grouped together under four categories: (1) the subject matter of the search; (2) the claimant’s interest in the subject matter; (3) the claimant’s subjective expectation of privacy; and (4) whether the subjective expectation of privacy was objectively reasonable.”^[10]

 The SCC used the interrelated and competing factors to overturn both of the earlier decisions from the Alberta Court of Queen’s Bench and the Alberta Court of Appeal. To conclude their rationale behind their decision, the SCC stated that,

“The reasonable and informed person concerned about the long‑term consequences of government action for the protection of privacy would conclude that IP addresses should attract a reasonable expectation of privacy. Extending s. 8’s reach to IP addresses protects the first “digital breadcrumb” and therefore obscures the trail of an Internet user’s journey through cyberspace.”^[11]

This is a landmark decision that will ultimately change the way police attempt to obtain evidence in the form of an IP address going forward in Canada. It is a decision in which I firmly believe the SCC correctly affirms and has made it clear going forward that section 8 of the Charter will protect against unreasonable searches and seizures of an IP address, especially when police use the IP address as evidence, as they did against Bykovets.

Conclusion

In conclusion, it is safe to say we all spend more time on the internet than we would probably like to admit. Every single time we log onto the internet, we are interconnected to it with our own personal IP address. Computers on the internet recognize an internet user from their IP address. An internet user can use the internet for a variety of reasons, which need to be protected by privacy, or they could suffer harm in their everyday life. I am of the opinion that an internet user’s IP address should be private because an internet user may need to use the internet for medical reasons, financial reasons, and many other private reasons. Moreover, I am of the opinion that section 8 of the Charter should protect an internet user from having their IP address used as evidence because there should never be a reason for police to reasonably search or seize a person’s IP address without a proper, executed warrant. Anything else would be a privacy concern; it would breach an internet user’s section 8 Charter rights regarding unreasonable search and seizure.

Endnotes:

^[1] Clare Stouffer, “Norton, What is an IP address? A definition + how to find it” (20 November 2023), online: <ca.norton.com>.

^[2] Ibid.

^[3] R. v. Bykovets, 2024 SCC 6 [Bykovets].

^[4] Canadian Charter of Rights and Freedoms, s 8, Part 1 of the Constitution Act, 1982, being schedule B to the Canada Act, 1982(UK), 1982, c 11.

^[5] Bykovets supra, note 3 at para 5.

^[6] Ibid at para. 63.

^[7] Ibid at para. 30.

^[8] R v Bykovets, 2020 ABQB 70.

^[9] R v Bykovets, 2022 ABCA 208.

^[10] Ibid at para. 31.

^[11] Ibid at para. 91.