R v Bykovets: Police Protocol for Internet Protocol

In R v Bykovets, 2024 SCC 6, the Supreme Court of Canada (“SCC”) decided that Canadians have a reasonable expectation of privacy in their Internet Protocol (“IP”) addresses. As a result, law enforcement and investigative agencies will require judicial authorization to compel disclosure of IP addresses, or else be found to breach section 8 of the Canadian Charter of Human Rights and Freedoms [Charter]. Section 8 of the Charter, which protects against unreasonable search or seizure, is the primary restriction on the government’s ability to infringe on the privacy interests of Canadians.

Factual Background

Mr. Bykovets was convicted of fraud for conducting an online credit card scheme (Bykovets, para 15). When law enforcement learned of the fraudulent transactions, to catch the perpetrator, they first went to Moneris, the financial institution which facilitated the transaction, and asked for the IP address of the party that committed the fraudulent transaction (Bykovets, para 16). Moneris complied and provided the IP addresses, which police used to run through a public database online that returns the internet service provider (“ISP”) that controls the IP (Bykovets, para 16).

Police then applied for judicial authorization to compel the ISP to provide the details of the person the IP address was registered to (Bykovets, para 16). This is a step required under s. 8 based on R v Spencer, 2014 SCC 43 [Spencer], referred to as a “Spencer warrant.” Once the police had the information which included the names and addresses of Mr. Bykovets and his father, they used the information to gather information which supported the charges and conviction of Mr. Bykovets for fraud (Bykovets, para 17).

Procedural History

At the trial level, Mr. Bykovets argued that the police violated s. 8 of the Charter when they requested the IP address associated with the fraudulent transaction from Moneris. To demonstrate this was a search that engaged s. 8, Mr. Bykovets had to show (Bykovets, para 31):

1.     The subject matter of the search; 
2.     His interest in the subject matter; 
3.     His subjective expectation of privacy; and 
4.     Whether the subjective expectation of privacy was objectively reasonable 

The trial judge dismissed the Charter claim, finding there was no reasonable expectation of privacy and therefore no search (Bykovets, para 23).

On appeal, in R v Bykovets, 2022 ABCA 208 [Bykovets ABCA], the ABCA agreed with the trial court, adopting most of the reasons provided. They found that the IP address alone reveals nothing of a person’s lifestyle or core biographical information. The appellate court found that the little information derivable from the IP address was outweighed by “legitimate countervailing concerns” for safety, security and suppression of crime (Bykovets, para 25, citing Bykovets ABCA, para 22).

In dissent, Veldhuis JA would have allowed the appeal. She found that the subject matter of the search should have been approached with more normativity, finding that the search was for “the identity of an internet user which corresponds to a particular IP address that is linked to particular, monitored internet activity” (Bykovets, para 26, citing Bykovets ABCA para 77).

Majority – The IP has a Role in Revealing Private Information

Writing for the majority in a 5-4 split decision, Karakatsanis J decided a reasonable level of privacy attends an IP address (Bykovets, para 3), which means there was a search as defined in s. 8 Charter jurisprudence (Bykovets, para 31). The decision relied on inferences from judicial notice about the potential use of IP addresses (Bykovets, para 58). 

There are 4 elements to proving a reasonable expectation of privacy outlined above, but only points 1 and 4 were in dispute and are detailed below: (1) the subject matter of the search; and (4) whether the subjective expectation of privacy was objectively reasonable.

Subject Matter of Search

The majority stressed that an analysis of the search’s subject matter goes beyond the scrutiny of law enforcement’s intentions and should include the sought information’s tendency to support inferences related to personal information (Bykovets, para 38). To the majority, it is not determinative that the IP address does not reveal any information on its own as opposed to alongside other information, requiring additional information from other sources before any private information is revealed (Bykovets, para 28). To illustrate this, the majority refers to R v Reeves, 2018 SCC 56 [Reeves], where the seizure of a computer breached s. 8 because the subject matter sought was the informational content on the computer and not the computer itself (Bykovets para 39, Reeves para 41). To find a reasonable expectation of privacy, it is enough for the searched or seized item to be the means to the private information and not the private information itself (Bykovets, para 41). 

Through expert evidence that attended the trial, the majority highlighted that private information, including online activity and identity, can be revealed through a Spencer warrant, but there are other methods of using the IP address (Bykovets, para 43). Police were not after IP addresses in the abstract but after the information that IP addresses tend to reveal (Bykovets, para 41). Therefore, The subject matter is the IP address as a key to acquiring more information about a particular Internet user, including their online activity and identity (Bykovets, para 43). 

Objectively Reasonable Expectation of Privacy

Following R v Patrick, 2009 SCC 17 [Patrick], the majority did not limit themselves to consider what the police sought to uncover in this case, but also considered the information the subject matter “tend[s] to uncover” (Patrick para 32, Bykovets para 53).

The majority relied on judicial notice and the perspectives of interveners to conclude (Bykovets, para 58):

1. Activity associated with the IP address can be deeply revealing (Bykovets, para 61). If the IP had been used through Moneris for more revealing information such as adult pornography websites, the fact of the purchase would have been revealed (Bykovets, para 63).
2. The state would be able to pre-emptively collect IP addresses and compare their database with information they solicit from 3rd parties, revealing private online activity associated with each IP address (Bykovets, paras 64-67)
3.  Using information revealed, the police could infer the identity of Internet users (Bykovets, para 68).

Based on these factors, the majority held that Spencer warrants are not sufficient to protect against privacy concerns related to IP addresses (Bykovets, para 69).

Balancing State’s Interest in Law Enforcement Against the Expectation of Privacy

The majority held that the intensely private nature of Internet activity potentially revealed through IP addresses outweighs state interests for law enforcement (Bykovets, para 72). Massive third-party websites have altered the privacy landscape, adding “a third party to the constitutional ecosystem” (Bykovets, para 78). Moreover, in the SCC’s view, it is not an onerous burden to require the police to seek pre-authorization before obtaining IP addresses (Bykovets, para 85).

Dissenting – On Judicial Notice and State Interests

The dissenting justices treated the subject differently, finding that an IP address does not even reveal browsing habits on its own according to the evidentiary record. It reveals a user’s ISP (Bykovets, para 129). Thus, the subject matter was the identity of the ISP and the numbers of the IP address itself (Bykovets, para 140)

Law enforcement’s ultimate investigation may have been to find identity, but since that information was not revealed by the IP addresses alone, it cannot be the subject matter of the search (Bykovets, para 128).

The dissent found it important to note that the police did not seek third-party information to reveal activity associated with the IP address, and that this may change the analysis (Bykovets, para 135). However, the dissenting judges stated the court should wait for a case where the possibility is on the record to pursue such an analysis.

The dissent’s major disagreement with the majority’s approach to the privacy interest’s objective reasonableness was that they determined that objective reasonability must be found using the evidentiary record (Bykovets, para 149). This difference led the dissent to rely less on judicial notice and evidentiary submissions from interveners, resulting in a shift across all categories of analysis of the reasonable expectation of privacy (Bykovets,  paras 161-163).

The dissent also changed the balancing exercise between state interests and privacy rights, pointing out that the step is onerous as it puts another strain on police and judicial resources (Bykovets, para 160), especially in online crime scenarios which often relate to sexual offences against children (Bykovets, para 160)

Analysis

The majority’s position is a potential win for privacy rights. They make a strong case for how serious potential abuses of IP addresses could become for the privacy interests at stake in similar cases. The judgment, therefore, aims to prevent large-scale future deliberate state offences but is detached from the situation before the court. The police got the Spencer warrant before any privacy interests were meaningfully infringed.

Disengaged from the Dissent’s Criticisms

The majority hypothesized potential state privacy infringement through the correlation of activities related to an IP address by using a purpose-built database. A project like this would involve a large, expensive, and challenging undertaking by the government. While not inconceivable, I believe the dissent is right to refuse to assume that the potential for that kind of large-scale abuse is realistic. The Court should be reluctant to assume villainous state behaviour is realistic without supporting facts on the record, especially when it would take such deliberate and wrongful action on the government’s part. 

In my view, disposing of the less realistic state breaches leaves only the majority’s suggested situation of (1) private information revealed tied to the IP address through the third party required to provide the information and (2) information that third parties might volunteer to the state.

From that point, the case can still support the finding that an objectively reasonable privacy interest was present and breached. However, the majority’s biggest issue is that they disregard the potential negative effects of requiring judicial authorization by not engaging with the dissent’s criticism. The dissent quotes substantial case law to support their finding that judicial authorization is an onerous burden on the system. 

However, instead of dealing with this objection directly, the majority simply asserts that it is not an onerous step. In the age of tele-warrants, it’s quick and simple (Bykovets, paras 12, 86). The majority provides no citation to counter the support of the dissent on this point. Efficient resource use is not a glamorous basis for tipping the balance on an issue, but it is nonetheless a tangible problem that needs more attention. 

I think the majority still could have made their case while engaging more directly with the dissent’s criticisms. The balancing would have looked like a much closer call, but it’s beneficial to recognize the challenge of drawing this boundary of Charter-protected interests.

Conclusion

The Canadian government must now acquire judicial authorization before searching for IP addresses, including through solicitation. With judicial authorization, any search will be found to violate a blanket reasonable expectation of privacy people have in their IP addresses. The Court has also signalled a turn away from giving serious consideration to the strain judicial authorization can put on the resources of police and courts.