R v Bykovets: Police Require Judicial Authorization Before Seeking IP Addresses in Criminal Investigations

Introduction

In R v Bykovets, 2024 SCC 6 [Bykovets], the majority of the Supreme Court of Canada (the “Supreme Court”) recently held that internet protocol (“IP”) addresses attract a reasonable expectation of privacy and are, therefore, protected by s. 8 of the Canadian Charter of Rights and Freedoms [Charter] against unreasonable search or seizure.

This means that the police must now seek judicial authorization before obtaining an individual’s IP address from private third parties. The decision signals the priority that the Supreme Court has placed on safeguarding Canadians’ privacy rights.

Background

Section 8 of the Charter guarantees “the right to be secure against unreasonable search or seizure”. Its principal object is the protection of privacy, or the individual’s “right to be left alone”. A “search” within the meaning of s. 8 of the Charter occurs when the state invades a reasonable expectation of privacy.

Mr. Bykovets argued that the police violated his s. 8 Charter rights by seeking and receiving from the third-party payment processer, Moneris, two IP addresses that were involved in the purchase of virtual gift cards from a liquor store using fraudulent credit card information. The two IP addresses were key to the police identifying Mr. Bykovets, and to him ultimately being convicted of 14 offences.

The Supreme Court adopted the following definition of an IP address:

An IP address is a unique identification number. IP addresses identify Internet-connected activity and enable the transfer of information from one source to another. They are necessary to access the Internet. An IP address identifies the source of every online activity and connects that activity (through a modem) to a specific location. And an Internet Service Provider (ISP) keeps track of the subscriber information that attaches to each IP address.

Internet Service Providers, such as Sasktel, keep track of subscriber information linked to IP addresses, including names and contact information. The Supreme Court previously unanimously held in R v Spencer, 2014 SCC 43 [Spencer], that a reasonable expectation of privacy attaches to this subscriber information associated with an IP address. In Bykovets, the majority ruled that a reasonable expectation of privacy extends to the IP address itself.

Lower Courts’ Decisions

The trial judge held that the police’s request to Moneris was not a search under s. 8 of the Charter because Mr. Bykovets did not have a reasonable expectation of privacy in his IP address.

Mr. Bykovets appealed to the Alberta Court of Appeal. The majority of the Alberta Court of Appeal dismissed Mr. Bykovets’ appeal, agreeing with the trial judge that Mr. Bykovets had no reasonable expectation of privacy in his IP address because, standing alone, it reveals nothing about a person’s lifestyle or core biographical information.

Supreme Court’s Decision

Mr. Bykovets appealed to the Supreme Court. The issue before the Supreme Court was: Does a reasonable expectation of privacy attach to an IP address?

In considering this issue, the Supreme Court needed to answer two main questions:

(1) Is there an expectation of privacy in an IP address?; and

(2) If so, is the expectation of privacy reasonable?

In assessing whether there is an expectation of privacy in an IP address, the Supreme Court considered the subject matter of the alleged search to identify the privacy interests at issue. The question that guided the Supreme Court’s assessment of this was: “what were the police really after?”.

Writing for the majority, Karakatsanis J. emphasized that IP addresses aren’t just a string of numbers. IP addresses allow the state to draw inferences about individuals' identities and online activities. The majority highlighted that the police's goal in seeking the IP address in this case was not really the IP address itself. Rather, the police were seeking information that an IP address can reveal about a specific Internet user, including their online activity and ultimately their identity (Bykovets at paras 41-42). This is information that can be “deeply personal” (Bykovets at para 41).

Next, the Supreme Court considered whether the expectation of privacy was reasonable. An expectation of privacy is reasonable where the public’s interest in being left alone by the government outweighs the government’s interest in intruding on the individual’s privacy to advance its goals, notably those of law enforcement.

The reasonable expectation of privacy analysis revolves around the potential of the IP address to reveal an individual’s biological core to the state, and not whether the IP address reveals information about the individual in any given case.

In addressing the reasonable expectation of privacy with respect to IP addresses, Karakatsanis J., for the majority, noted that individuals can choose to share some information for a limited purpose or to a limited number of people and still retain a reasonable expectation of privacy over that information.

Critically, in the majority’s view, while an IP address, on its own, does not reveal much about an individual, IP addresses are the “key to unlocking a user’s Internet activity and, ultimately, their identity” (Bykovets at para 28). When an IP address is connected with other information available from third parties, an IP address can “betray deeply personal information in itself, even before police try to link the address to the user’s identity”.

Given the potential for intrusion into deeply revealing personal information, the majority of the Supreme Court concluded that the “burden imposed on the state by recognizing a reasonable expectation of privacy in IP addresses pales compared to the substantial privacy concerns implicated”. In the majority’s view, requiring the police to obtain judicial authorization before obtaining an IP address is not an onerous step.

Key Takeaways

The majority’s decision is clear: s. 8 of the Charter must protect IP addresses to meaningfully protect Canadians’ online privacy in “today’s overwhelmingly digital world” (Bykovets at para 28).

Accessing an IP address enables the police to access information about an individual which can range from dating history, social media usage, to shopping habits. It can set the state on a trail of anonymous Internet activity that leads directly to a user’s identity. The majority’s decision recognizes the potential for an IP address to be the key to unlocking a user’s Internet activity and, ultimately, their identity.

The majority of the Supreme Court was also clear that private third-party corporations should not be left to decide how and when to reveal to the police personal information. Judicial oversight is therefore necessary, but not overly burdensome, to ensure that the decision to disclose information is returned to the purview of the Charter.

Bykovets has extended the Supreme Court’s decision in Spencer by adding the requirement for prior judicial authorization to obtain an IP address itself. From a practical perspective, this means that the police will require prior judicial authorization before requesting IP addresses from private third-party corporations. This adds an additional step that police will have to take when seeking to identify a suspect in an investigation based on their Internet activity. The majority’s decision as a whole signals the priority that the Supreme Court has placed on safeguarding Canadians’ privacy rights.

Jessica Bihun is a member of the McDougall Gauley Defence Group. The McDougall Gauley Defence Group regularly reviews judicial authorizations, including issues regarding their client’s rights and the legality of searches involving their client’s cases.