Canada Supreme Court: no search warrant, no IP

From now on, Canadian police will need to obtain a search warrant to access an IP address, a landmark ruling by the Supreme Court has determined.

The case was brought by convicted cybercriminal Andrei Bykovets, who was found guilty of 14 cases of online fraud after police tracked him down using IP addresses obtained from the website where he made the illicit purchases using stolen credit card details.

“Police then obtained a production order compelling the internet service provider to disclose the name and address of the customer for each IP address,” said the Supreme Court.

This allowed police to arrest and charge Bykovets in 2017, but in an interesting twist, he has earned himself a shot at a retrial after successfully pleading that the IP addresses should never have been obtained without search warrants in the first place.

The legal foundation for the case was Section 8 of the Canadian Charter of the Constitution Act of 1982, which states: “Everyone has the right to be secure against unreasonable search or seizure.”

The presiding judge in the initial case was not persuaded by this argument, ruling that “the police’s request to the processing company was not a search” under Section 8 “because B[ykovets] did not have a reasonable expectation of privacy in his IP address.”

However, Bykovets appealed the verdict, and eventually won the right to be tried again, thanks to 5-4 ruling in his favor from the nine-member Supreme Court led by Justice Andromache Karakatsanis, announced on March 1st.

Landmark ruling to protect privacy

The fresh ruling sets a landmark precedent under Canadian law, determining that if the law’s purpose “is to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses.”

The Supreme Court added: “An IP address is the crucial link between an internet user and their online activity. Viewed normatively, it is the key to unlocking a user’s internet activity and, ultimately, their identity. Thus, an IP address attracts a reasonable expectation of privacy.”

As such, the Supreme Court finds that “a request by the state for an IP address is a search” under Canadian law and therefore subject to the same binding terms as a physical search of a person’s home or property.

“Defining a reasonable expectation of privacy is an exercise in balance,” it added. “In this case, the balance weighs in favor of extending a reasonable expectation of privacy to IP addresses. The intensely private nature of the information an IP address may betray strongly suggests that the public’s interest in being left alone should prevail over the government’s interest in advancing its law enforcement goals.”

The court added that it did not believe imposing such a requirement would unduly impede future police work in the investigation of cybercrime.

“Police should have the investigative tools to deal with crime that is committed and facilitated online,” it said. “However, requiring that police obtain prior judicial authorization before obtaining an IP address is not an onerous investigative step. Where the IP address, or the subscriber information, is sufficiently linked to the commission of a crime, judicial authorization is readily available.”

More from Cybernews:

Apple explains how it will comply with EU laws and how bad they are

North Korea accused of hacking into chip makers​

Russian spies record secret German military talks by simply joining Webex call

Virgin Hotels breach exposes thousands

NASA crew nears ISS for scientific research

Subscribe to our newsletter