Protecting Privacy at the Expense of Victims’ Rights: R v Bykovets

Author: Anonymous

The internet has forever altered the criminal landscape, making it easier for offenders to collect, share and trade child sexual abuse material (CSAM) across both the regular and dark web. Between 2014 and 2022, there were 15,630 reports from police of online sexual offences against children and 45,816 reports of online CSAM in Canada.^[i] Keep in mind that it is estimated that police data does not account for most of these occurrences,^[ii] and these crimes are notoriously underreported by victims.^[iii] According to the Ontario Court of Appeal, before the internet, “it was much more challenging and riskier to produce, distribute and acquire” CSAM.^[iv] Committing crimes in digital spaces presents far fewer risks of detection.^[v] These horrific offences violate the dignity and privacy of the victims who are depicted. The problem is not shrinking. Law enforcement simply does not have the resources to fight these offenders. If these crimes are not detected, investigated and prosecuted, vulnerable victims will pay the price. Moreover, if the courts hinder police attempts to be Charter-compliant in their investigations, this only incentivizes the commission of these offences, which has an unfathomable cost to victims. In this blog, I argue that this problem is a collateral result of the Supreme Court decision in R v Bykovets, 2024 SCC 6.

Background/Legal Context

The main concern of Bykovets is whether police can lawfully obtain an IP address without a court order and still comply with s. 8 of the Charter.^[vi] Section 8 protects all residents of Canada from unreasonable search and seizure by the state. To constitute an unreasonable search, the claimant must have an objectively reasonable expectation of privacy in relation to the subject matter of the search (the IP address).

The majority of the SCC held that the appellant had an objectively reasonable expectation of privacy regarding his IP address (and the information associated with it). The appeal was allowed and a new trial ordered.

The case began with police in Alberta investigating someone who was purchasing online gift cards from a liquor store using fraudulent credit information. In the course of their investigation, police obtained the two IP addresses associated with the fraudulent purchases through a request from a third-party payment processing company. Seemingly, the third-party was managing the store’s online sales.^[vii] From there, police obtained a production order requiring the disclosure of subscriber information related to the IP addresses, which were registered to the accused and his father.

It should be noted at the outset that at the time of this investigation, in Canada, it was standard that police would obtain a suspect’s IP address without judicial authorization. However, for the next investigative step beyond obtaining the IP address, namely getting the subscriber information, a court order was necessary. To that point, the SCC in R v Spencer^[viii] unanimously agreed that there was a reasonable expectation of privacy attached to subscriber information from Internet Service Providers (ISPs).^[ix] 

The accused, Andrei Bykovets, challenged the admissibility of the evidence stemming from the IP addresses on the grounds that the police violated his s. 8 – Charter rights by conducting an unreasonable search. A voir dire was held to determine if the evidence should be excluded at trial.

Both Crown and defence counsel agreed that the accused had a direct interest in the subject matter of the police’s search as well as a subjective expectation of privacy in relation to their informational content, but there remained a question of whether this expectation was objectively reasonable.^[x] The trial judge held that there was not a reasonable expectation of privacy on the grounds that “…on their own, IP addresses do not provide a link to, or any other information about, an Internet user…”.^[xi] The majority of the Alberta Court of Appeal panel dismissed the defence’s appeal for essentially the same reasons as the trial judge.^[xii]

Case Analysis

The Crown submitted that the accused had no reasonable expectation of privacy in his IP address, because an IP address can be changed on a whim by an ISP without notice to the user.^[xiii] As the minority of the SCC stated in this case, an IP address ^[1]is not something that the user has meaningful control over.^[xiv] Control (or loss of control) is a factor that has historically been considered in a s. 8 analysis, although this aspect alone would not be determinative.^[xv]Further, the police did not intend to acquire more information than was needed to procure a production order. Police sought only the unique set of numbers contained in the address, and no further information about the user’s online habits.^[xvi] The framework in Spencer, according to the Crown, adequately protected the accused’s personal information.^[xvii]

The five-judge majority found that the Crown’s interpretation of s. 8 was too narrow. Specifically, the majority focused on the accused’s privacy rights with regard to the personal information that may be divulged by a person’s IP address. An IP address, according to the SCC, “may betray deeply personal information — including the identity of the device’s user — without ever triggering a warrant requirement.”^[xviii] The majority’s opinion was predicated on, in their view, the personal nature of the information an IP address reveals to police. Here, the majority was not concerned solely with what is revealed by the sequence of numbers alone, but rather, the information attached to that address as it relates to a person’s online activity, saying: “This information can strike at the heart of a user’s biographical core and can ultimately be linked back to a user’s identity, with or without a Spencer warrant. It is a deeply intrusive invasion of privacy.”^[xix]

The majority briefly acknowledges the societal importance of protecting children from online predators and the “insidious” nature of rapidly advancing technology to facilitate certain sexual offences, specifically CSAM-related offences and child luring.^[xx] However, the majority states that this interest must be balanced with the privacy rights citizens are afforded under s. 8 of the Charter. They believe that the burden imposed on police if the SCC recognized a reasonable expectation of privacy in IP addresses does not outweigh the privacy concerns and that this burden is “not onerous”.^[xxi]

The four judges in dissent held that the IP addresses registered to the accused and his father did not give rise to a reasonable expectation of privacy. In contrast to the extreme invasion of privacy illustrated by the majority, in the dissent’s view, “On its own, an IP address does not even reveal browsing habits”.^[xxii] The dissent distinguishes their opinion from the majority’s in that the majority’s analysis encompasses such information that is not actually contained within the IP address itself, but that instead must be obtained through further steps in an investigation that would ultimately lead to the identification of a suspect.^[xxiii] In the minority’s view, the majority erred in giving an overbroad definition to the first factor of the test for establishing a reasonable expectation of privacy (the “subject matter” of the search).^[xxiv] The overbroad definition resulted from the majority giving significance to personal information (even information that flowed by inference) that was not in and of itself disclosed by the raw numbers comprising an IP address.^[xxv]

Critical Reflection

I disagree with the majority’s finding that police requesting an IP address from a service provider when the address is unaccompanied by other, more personal information about the subscriber is an intrusion of a person’s privacy that goes to the “biographical core” of personal information. The majority opinion expressed substantial concerns about the information about a subscriber’s online activity that could be gleaned from an IP address by third-party websites like Google.^[xxvi] However, in my opinion, the dissent is more correct in its handling of the issue. The majority should have considered whether the accused’s expectation of privacy was reasonable in the context of how the IP address was being used by the police. In this case, the police did not use the tracking employed by a third-party website to identify the accused; rather, they sought the IP addresses as part of their investigation, for which further action would be taken.^[xxvii]Subsequent investigation, where police obtained personal (subscriber) information about the accused, which is indisputably subject to a reasonable expectation of privacy, was authorized by a production order.^[xxviii] There were no procedural differences in this investigation that meaningfully distinguish this case from the facts in Spencer.^[xxix]

It cannot be denied that in the modern day, our personal information is inextricably tied to our digital identities, and we should be confident that this information is safeguarded from unreasonable search by the state. However, the dissent in this case offered a sounder analysis, and I share their more pronounced concerns about the increasing risks associated with technology, stating at the beginning of their introductory reasons: “In this digital age, concerns about online privacy are prevalent. So are concerns about online crime”.^[xxx] The practical outcome of this case is that police will now have to seek judicial authorization before requesting IP addresses from service providers. Though the majority treats this as a small concession,^[xxxi] I agree with the dissent, noting that this will put a greater burden on an already overburdened legal system.^[xxxii]

The majority does not explore the idea of police warnings to third-party holders of private information to encourage Charter-compliance.^[xxxiii] This would be a practical alternative to constrain both entities so that they respect s. 8 – Charter rights during investigations of online crimes without requiring investigators to seek a court order, since in many instances it is a time-consuming and cumbersome process for police to put together materials in support of a court order.^[xxxiv] Police are expected to respect s. 8 – Charter rights in numerous scenarios where case law does not dictate a warrant-requirement, and to comply with the Charter at all times throughout their investigations. So, it is not inconceivable that police could easily warn (in writing) a third party not to disclose anything other than strictly the numbers of the IP address itself. The warning could be crafted carefully to avoid third-party spontaneous disclosures.^[xxxv] A strong warning from police to third parties would go a long way towards eliminating the impetus for the majority to offer their ratio about IP addresses. Further, even without the benefit of the majority’s reasons in Bykovets, a proper understanding of Spencer informs investigators that it is a breach of s. 8 to shop around an IP address (and no accompanying court order) to unsuspecting ISPs to determine associated names and addresses (or even “digital breadcrumbs”) to uncover the identity of an online perpetrator.^[xxxvi]

Conclusion

Although the focus of this case was online fraud, this decision will have ramifications for various online investigations. It will affect how investigations are conducted into a spectrum of online criminal activity, including law enforcement’s ability to detect online child sexual abuse and exploitation.^[xxxvii] In her dissent, Justice Côté refers to the concurring opinion of Justice Karakatsanis in R v Mills, 2019 SCC 22, a mere five years earlier. ^[xxxviii] Karakatsanis J. (who wrote for the majority in Bykovets) championed the cause of child victims in that landmark ruling on Charter-privacy concerning online luring.^[xxxix] To essentially undermine judicial support for the investigation of online child sexual offences in Bykovets diminishes the concurring reasons in Mills to nothing more than nice-sounding language with no practical benefit to victims.

In 2022, the rate of online sexual offences against children that were reported by police doubled in less than a decade.^[xl] With constant advances in technology and offenders becoming more sophisticated, this problem will only worsen over time. It does not appear that the majority gave the fallout of this decision due consideration when balancing the rights of the accused with the societal interest in seeing these crimes prosecuted and preventing sexual predators from continuing their despicable crimes in online spaces. Where there are increasing concerns about online crime, law enforcement must have the legal authority as well as the necessary tools to fight these crimes in an

Endnotes

^[i] Statistics Canada, “Online child sexual exploitation: A statistical profile of police-reported incidents in Canada, 2014 to 2022” (2024) online: <https://www150.statcan.gc.ca/n1/pub/85-002-x/2024001/article/00003-eng.htm>

^[ii] Ibid.

^[iii] Statistics Canada, “Profile of Canadians who experienced victimization during childhood, 2018” (2022) online:<https://www150.statcan.gc.ca/n1/pub/85-002-x/2022001/article/00016-eng.htm>.

^[iv] R v Pike, 2024 ONCA 608 at para 144.

^[v] Ibid.

^[vi] R v Bykovets, 2024 SCC 6 at para 18.

^[vii] Ibid at paras 16 and 97.

^[viii] R v Spencer, 2014 SCC 43.

^[ix] Supra note 6 at para 2.

^[x] Ibid at para 33.

^[xi] Ibid at para 23.

^[xii] Ibid at para 25.

^[xiii] Ibid at para 5.

^[xiv] Ibid at para 154.

^[xv] Ibid at paras 46 and 142.

^[xvi] Ibid at para 5.

^[xvii] Ibid.

^[xviii] Ibid at para 9.

^[xix] Ibid at para 10.

^[xx] Ibid at para 11.

^[xxi] Ibid at para 86.

^[xxii] Ibid at para 129.

^[xxiii] Ibid at para 138.

^[xxiv] Ibid, the test is mentioned at paras 31 and 119.

^[xxv] Ibid at paras 128 and 164.

^[xxvi] Ibid, see reference to the expert report submitted at trial at paras 100-103 and 132.

^[xxvii] Ibid at para 134.

^[xxviii] Ibid.

^[xxix] Ibid at para 135.

^[xxx] Ibid at para 93.

^[xxxi] Ibid at paras 85 and 86.

^[xxxii] Ibid at para 160.

^[xxxiii] Ibid at para 89.

^[xxxiv] Ibid at para 160.

^[xxxv] Ibid at para 135.

^[xxxvi] Ibid at paras 69, 89, 132 and 134.

^[xxxvii] Ibid at para 160.

^[xxxviii] Ibid at paras 84, 139 and 160.

^[xxxix] R v Mills, 2019 SCC 22, involving an online police operation with an undercover officer posing as a 14-year-old girl.

^[xl] Supra note 1.