Reasonable Expectation of Privacy in IP Addresses? SCC to Decide R v Bykovets

There have been a number of landmark cases where the Supreme Court of Canada (“SCC”) considered and provided guidance on “the limits on informational privacy in the digital age” (Bykovets, para 1). In particular, in R v Spencer, 2014 SCC 43 [Spencer], the SCC established that police must obtain judicial authorization through a search warrant or production order to acquire the identity of the specific user associated with a specific internet protocol (“IP”) address. In R v Bykovets, 2022 ABCA 208 [Bykovets], the Court of Appeal of Alberta (“ABCA”) further explored the question of whether internet users should have a reasonable expectation of privacy in their IP addresses, with the majority answering in the negative. Because the appeal related to an indictable offence and there was a dissent on a question of law at the ABCA, the accused appealed the ABCA’s decision as of right, and the SCC heard the appeal on January 17, 2023. This case comment on Bykovets will summarize the facts of the case, explore the conclusions of the trial judge and the reasoning of both the ABCA majority and dissent, analyze the primary issue in the case, and reflect on the future SCC decision to come.

Facts 

In September 2017, the Calgary Police Service (“CPS”) began investigating fraudulent online gift card purchases after learning that the credit card data of several individuals had been used without their permission (Bykovets, para 7; R v Bykovets, 2020 ABQB 70 [Trial Decision], para 5). Moneris, the company that processed the online transactions, provided the police with the two IP addresses that the fraudsters used for their purchases (Bykovets, para 7).

The CPS then conducted a publicly available internet search and learned that TELUS had issued the two IP addresses (Bykovets, para 9). The police subsequently applied for and received a production order for the IP addresses’ subscriber information and retrieved the names and addresses of the subscribers from TELUS (Bykovets, para 9). The subscribers were Mr. Bykovets and his father (Bykovets, para 9).

After identifying and locating Mr. Bykovets and his father, the CPS obtained a warrant and lawfully searched their house, seizing instruments of forgery, fraudulent identification documents, and card data of innocent victims (Bykovets, para 10). While executing the warrant, the police initially delayed Mr. Bykovets’ right to counsel but later gave him the opportunity to talk to counsel (Bykovets, para 11).

The Trial Judge’s Decision

Mr. Bykovets faced 33 charges under the Criminal Code, RSC 1985, c C-46 that generally related to possession and use of third parties’ credit cards and personal identification documents (Trial Decision, para 1). At the Court of Queen’s Bench of Alberta, Mr. Bykovets filed an application asking the court to exclude all evidence acquired by the police from trial on the basis that the police violated his rights under the Canadian Charter of Rights and Freedoms [Charter] (Trial Decision, para 2). Among other Charter claims, he argued that the police violated his “right to be secure against unreasonable search or seizure” under section 8 and his “right on arrest or detention to retain and instruct counsel without delay and to be informed of that right” under section 10(b) (Trial Decision, para 2).

The trial judge rejected Mr. Bykovets’ section 8 claim because she found that he did not have a reasonable expectation of privacy in an IP address (Bykovets, para 3). The trial judge did accept Mr. Bykovets’ argument under section 10(b) but nevertheless did not exclude the evidence after conducting the required balancing analysis (Bykovets, paras 4-5). Mr. Bykovets appealed the trial judge’s decision to the ABCA.

The ABCA’s Majority Decision

Reasonable Expectation of Privacy

At the ABCA, Mr. Bykovets argued that section 8 of the Charter requires the court to consider and determine “what are the police really after” when they search for digital information (Bykovets, para 14). According to the appellant, the police were “really after” the name and address of the person associated with the IP address when they sought the IP addresses from Moneris (Bykovets, para 14). By obtaining the IP addresses without judicial authorization, the police breached the reasonable expectation of privacy that the appellant had in his name and address (Bykovets, para 14).

The majority of the ABCA rejected Mr. Bykovets’ arguments. It distinguished the facts of this case from Spencer, where the police did not have judicial authorization before obtaining the IP address and its subscriber data (Bykovets, para 17). In Spencer, the police found the identity of a man using the internet to download child pornography and the address where he was committing the crime, all without a court order (Bykovets, para 17). In this case, before obtaining the court order, the police only knew that an unknown person was using an identified IP address to commit fraud from an unknown address (Bykovets, para 17).

The majority also explored the nature of an IP address to refute the appellant’s position. An IP address is “an abstract number” that does not reveal any biographical or confidential information of an internet user (Bykovets, para 21). The only way that the police can gain access to such information is by seeking and obtaining judicial authorization following Spencer (Bykovets, paras 20-21). Therefore, privacy interests are not triggered by the mere investigative step of acquiring an IP address, which does not reveal any sensitive information about an internet user (Bykovets, para 22).

In conclusion, the majority agreed with the trial judge’s holding that the police were only “really after” IP addresses when they requested the IP addresses from Moneris; the police did so with the hope that they would be able to gain authorization to obtain the names and addresses associated with the IP addresses in their next investigative step (Bykovets, para 26). Accordingly, the majority dismissed Mr. Bykovets’ ground of appeal under section 8 (Bykovets, para 30).

Delay of Right to Counsel

Mr. Bykovets also argued that the trial judge should have excluded the police’s evidence because the police delayed his right to counsel under section 10 of the Charter during the execution of the search warrant (Bykovets, paras 31-32). While the majority acknowledged that the police did delay the appellant’s right to counsel, it found that the impact of the breach on the appellant’s Charter-protected interests was minimal (Bykovets, para 34). The majority held that the trial judge did not err in her consideration of this ground of appeal (Bykovets, para 37).

As the majority did not accept either of Mr. Bykovets’ grounds of appeal, the appeal was dismissed (Bykovets, para 38).

The Dissenting Judgment

In her dissent, Justice Veldhuis found that the trial judge erred in her analysis under section 8 of the Charter (Bykovets, para 55).

Justice Veldhuis agreed with the trial judge that the determination of the section 8 issue depended on whether the appellant had a reasonable expectation of privacy in his assigned IP address (Bykovets, para 58). However, Justice Veldhuis found that the trial judge failed to take the required normative approach when analyzing the issue (Bykovets, para 62). Under R v Wong, [1990] 3 SCR 36 [Wong], courts must consider “whether giving their sanction to the particular form of unauthorized surveillance in question would see the amount of privacy and freedom remaining to citizens diminished to a compass inconsistent with the aims of a free and open society” (Trial Decision, para 33, citing Wong, para 46). Had the trial judge conducted a proper normative inquiry, she would have found that seeking an IP address is ultimately aimed at gathering information to reveal the identity of an internet user, similar to seeking subscriber information from an Internet Service Provider (“ISP”) (Bykovets, para 62). The trial judge made an error by not considering the possibility that an IP address could reveal further details about the user of that IP address (Bykovets, para 71).

Justice Veldhuis also looked to the established SCC jurisprudence on section 8 Charter protection and found that the SCC not only examined “the nature of the precise information sought” in those cases but also “the nature of the information that it reveals” (Bykovets, para 75, emphasis in original). In this case, the police sought the IP addresses, not for their own sake, but to identify and locate the fraudsters (Bykovets, para 76). Taking “a broad and functional approach” in her analysis, Justice Veldhuis found that the nature of the precise information sought and the nature of the information that it reveals was not simply the IP address but the identity of the internet user associated with that IP address (Bykovets, para 77).

Justice Veldhuis further found that Mr. Bykovets had a reasonable expectation of privacy in the IP addresses because they were “linked to a particular, monitored internet activity that could disclose biographical core information” (Bykovets, para 94). Therefore, by obtaining the IP addresses without judicial authorization, the police breached the appellant’s reasonable expectation of privacy attached to his IP address stemming from section 8 of the Charter.

Given her findings on the section 8 issue, Justice Veldhuis did not address the appellant’s ground of appeal under section 10(b) of the Charter (Bykovets, para 55). Justice Veldhuis would have allowed the appeal and ordered a new trial, as the parties did not introduce any evidence or make any arguments on the remedy for a section 8 breach (Bykovets, para 55).

Analysis & Future SCC Decision

Because the appellant appealed to the SCC as of right based on Justice Veldhuis’ dissent, the only issue that the SCC considered at the hearing was the section 8 issue. When making its decision, the SCC should side with the ABCA’s majority; it would not be prudent for the SCC to establish a reasonable expectation of privacy in IP addresses for internet users.

The nature of IP addresses does not support attaching a reasonable expectation of privacy to IP addresses. As explored by the majority, an IP address alone does not reveal any identifiable information of an internet user. In other words, even if the police obtain an IP address, the user associated with that IP address maintains anonymity.

It is true that an IP address can lead to the revealing of an internet user’s personal information if the IP address’s subscriber information is sought from an ISP. However, it is important to distinguish possibility from certainty; it is a mere possibility that the police can obtain personal information that corresponds to an IP address, not a certainty. In order to have a chance to gain access to such information, the police have to take the extra investigative step of obtaining that information from an ISP. If the police do not pursue that extra step, an IP address simply remains a set of numbers, and there should not be any reasonable expectation of privacy attached to it.

The decisions of the trial judge and the ABCA majority reflected the reality of IP addresses. Both applied the judicial authorization required under Spencer to the extra investigative step of retrieving subscriber information from an ISP because that is where the reasonable expectation of privacy of an internet user should start coming into play. Applying the judicial authorization requirement to that step allows it to play a key gate-keeping function by permitting police to secure personal information only when warranted. The requirement under Spencer should alleviate Justice Veldhuis’ concerns about the nature of the information that an IP address can reveal; it can reveal confidential information, but courts will be there to safeguard that information as necessary.

Another concern that arose was “the proper balance [that] must be struck between individual privacy and legitimate police investigative techniques” (Bykovets, para 22). Applying Spencer to the earlier investigative step of obtaining an IP address would make it unnecessarily difficult for the police to acquire the IP address in the first place. Instead, following the approach of the trial judge and the ABCA majority would allow the police to pursue their investigation within certain limits and, at the same time, protect internet users whose identities will not be revealed unless warranted via judicial authorization. Their approach balances the privacy interests of internet users and the pursuit of “safety, security, and the suppression of crime” (Bykovets, para 22). In contrast, following Justice Veldhuis’ approach would skew the balance in favour of privacy interests and unduly broaden the scope of the reasonable expectation of privacy.

Considering all of the above, it would be unreasonable and unnecessary for the SCC to attach a reasonable expectation of privacy to IP addresses. The trial judge and the ABCA majority appropriately considered the factors at play; the SCC should not disrupt the balance that the ABCA majority achieved and should uphold the majority’s decision.