R v Bykovets: A Proactive Approach to Digital Privacy

In R v Bykovets, 2024 SCC 6 [Bykovets], a 5-4 majority of the Supreme Court of Canada (“SCC”) found that Internet Protocol (“IP”) addresses are protected by the right against unreasonable search and seizure in section 8 of the Canadian Charter of Rights and Freedoms [Charter]. Henceforth, police will require a search warrant to compel disclosure of IP addresses, even when they are not immediately linked to a user’s name and contact information.

In his comment on Bykovets earlier this year, Stephen Fulford noted that the majority opinion speculated into potential state privacy infringement based on evidence that was not before the court. I agree, but add that the dissent, too, hypothesized a scenario that was not factually supported. In light of these competing hypotheticals, the majority justifiably affirmed a proactive approach to digital privacy based on the recognition that “[p]rivacy, once breached, cannot be restored” (Bykovets, para 6).

Facts and Procedural History

Officers of the Calgary Police Service contacted Moneris, a third-party payment processing company, to request IP addresses associated with fraudulent online purchases (Bykovets, para 16). Moneris provided two IP addresses. As required by the SCC’s decision in R v Spencer, 2014 SCC 43 [Spencer], police then obtained an order compelling the IP addresses’ Internet Service Provider (“ISP”) to disclose their associated subscriber information, identifying Mr. Bykovets and his father. After searching the two individuals’ homes, police arrested Mr. Bykovets for credit card fraud and related offences (Bykovets, paras 17, 99).

Mr. Bykovets was convicted at trial. He unsuccessfully claimed that the police had violated his right against unreasonable search and seizure under section 8 of the Charter when they requested the IP addresses from Moneris (Bykovets, para 18). The trial judge dismissed the Charter claim, finding that the police’s request did not constitute a search because Mr. Bykovets had no reasonable expectation of privacy in his IP address (Bykovets, para 23). 

The majority of the Alberta Court of Appeal upheld the conviction based on reasoning largely similar to the trial judge’s (Bykovets, para 25). The appeal court stressed that the IP address alone did not reveal any of Mr. Bykovets’s core biographical information, such as his name or street address.

However, Veldhuis JA dissented (Bykovets, para 26). She found that the proper subject matter of the search was not the IP address alone, but the identity of the user corresponding to that address. Since Mr. Bykovets had a reasonable expectation of privacy in such information, and police had conducted the search without first obtaining a warrant, the appeal should be allowed.

Decision

The sole issue on appeal was whether the police’s request to Moneris constituted a search (Bykovets, para 30). In other words, did Mr. Bykovets have a reasonable expectation of privacy in his IP address?

A majority of the SCC answered yes. In doing so, they considered the four factors outlined by R v Tessling, 2004 SCC 67 [Tessling] (para 32; Bykovets, para 31):

1. the subject matter of the search
2. the claimant’s interest in the subject matter
3. the claimant’s subjective expectation of privacy
4. whether the claimant’s expectation of privacy was objectively reasonable

Acknowledging that these factors are “interrelated” (Bykovets, para 31), the majority’s analysis centred on its finding that Mr. Bykovets’s expectation of privacy in his IP address was objectively reasonable. Even though the IP address itself did not contain personal information, its potential to reveal core biographical information created a legitimate privacy interest (Bykovets, para 7). The state could infer an individual’s private information by collecting and collating IP addresses associated with various online activity, or, more realistically, asking third-party companies for the data gleaned from their efforts to do the same (Bykovets, para 9). As a result, a privacy interest in IP addresses themselves is a logical extension of the privacy interest in ISP-held subscriber information already affirmed by Spencer (Bykovets, paras 2-3).

Writing for the majority, Karakatsanis J stressed the “broad and purposive interpretation” of section 8 rights demanded by their constitutionality and endorsed a “normative standard,” which attempts to enforce “what privacy should be” (Bykovets, para 7, emphasis in original). For this reason, the Charter should restrict the state’s access to private online data held by third parties (Bykovets, para 89), even when those third parties often disclose it freely (Bykovets, para 65). This effort to exert judicial control over the “tripartite” relationship between individuals, the government, and private companies also distinguishes Canada from the US, where the “third-party doctrine” negates the expectation of privacy for information held by third parties (Bykovets, paras 78, 47).

The determinative point that split the SCC was the first Tessling factor, or how to define the subject matter of the search. The majority adopted the appellant’s position that the police were “really after” the connection between specific internet activity and the identity of the user (Bykovets, para 35). In so arguing, Karakatsanis J emphasized the need to avoid “piecemeal” reasoning that relies too heavily on the police’s intention to use information a certain way—in this case, merely to obtain a Spencer warrant (Bykovets, para 6).

Meanwhile, the dissent adopted the Crown’s position that the search concerned only the IP address and the ISP associated with it, not Mr. Bykovets’s personal identity (Bykovets, paras 36, 128). Côté J acknowledged the court’s “broad and functional approach” (Bykovets, para 122) but stressed that the subject matter of the search “must still be anchored to what can be drawn from the evidence” (Bykovets, para 126).

Based on its narrower understanding of the subject matter of the search, the dissent endorsed the lower courts’ view that Mr. Bykovets did not have an objectively reasonable expectation of privacy in his IP address. Côté J dismissed the majority’s findings regarding an IP address’s potential to reveal personal information. According to her, Karakatsanis J had supplemented the evidence on record with potential scenarios that were not before the court, which amounted to “taking judicial notice of […] contestable facts” (Bykovets, para 163).

Common Ground: any link between online activity and identity is private

Despite the appearance of a deep split in the court, both the majority and the dissent agreed on an important and pressing issue: Police must obtain a Spencer warrant to link an IP address to any personal information belonging to the user behind it.

The court relied on an expert report identifying two methods by which an IP address could be used to reveal a user’s personal information. The first method, which was contemplated by Spencer, involves asking the ISP associated with the IP address for the user’s subscriber information (Bykovets, para 21). In the second method, police may ask third parties for data held in their IP address logs, which companies use to infer users’ identities by tracking their online activity (Bykovets, para 132).

Importantly, both the majority and the dissent agreed that the second method would breach a protected privacy interest. By requiring search warrants to uncover an IP address initially, the majority sought to prevent law enforcement from circumventing Spencer in this manner. The dissent, however, simply believed the second method was already “indistinguishable from Spencer“ (Bykovets, para 135). Far from allowing police to circumvent Spencer, the dissent would have recognized a protected privacy interest whenever specific online activity is linked to a user’s identity, regardless of how that link is established.

Dueling Hypotheticals: proactive safeguard or procedural obstacle?

The court’s disagreement over the scope of the protected privacy interest was largely due to the majority and the dissent’s differing treatments of hypotheticals, not the facts of the case. In a particularly biting criticism of the majority reasons, Côté J wrote that “the effect of my colleague’s reasoning is to answer a question that is not asked, on the basis of factual scenarios different from the one in this case, in order to address a social problem that is not in issue here” (Bykovets, para 164).

In dispute was less whether Mr. Bykovets’s privacy interests were engaged than when. After receiving his IP address from Moneris, the police obtained a search warrant to request Mr. Bykovets’s subscriber information from his ISP. Ultimately, therefore, judicial authorization was given for breaching his privacy. Both the majority and the dissent were more concerned with what could happen in other cases if the requirement to obtain a warrant emerged earlier or later in the investigation process.

The majority focused less on what could happen when police obtain a search warrant late than what they could do without ever obtaining one. By collecting and comparing IP addresses used to make financial transactions (Bykovets, para 61) or access online dating services, pornography, medical information, or political chatrooms (Bykovets, para 63), police may gain access to “deeply personal information, even before [they] try to link the address to the user’s identity” (Bykovets, para 60). While no evidence of any such database was before the court, it is certainly plausible that police could create one. Companies like Google already use similar procedures to “collect massive amounts of […] information” that “can be of an extremely personal nature” (Bykovets, para 66).

Meanwhile, the dissent invoked its own hypothetical to justify its position, predicting grim outcomes if police were required to obtain warrants before gathering IP addresses (as they now are). While the majority insisted that such a requirement “is not onerous” (Bykovets, para 86), the dissent was skeptical. In particular, Côté J suggested that requiring a warrant at the earlier stage “would seriously thwart the police’s ability to investigate […] serious offences against children” (Bykovets, para 160). Effectively, she hypothesized a scenario in which police might further an investigation into offences against children by conducting a warrantless search for IP addresses, but then never needing to link those IP addresses to specific persons (which would require a warrant).

The dissent presented no evidence or case law, nor even a logical inference as to how such a situation could come about. Protecting children from sexual abuse is undeniably a noble goal. However, the dissent’s alleged connection between expanded police powers and “enhance[ed] protection” for children (Bykovets, para 160, quoting R v Mills, 2019 SCC 22, para 23) is neither logical nor better supported by the evidence than the police surveillance network contemplated by the majority.

There is merit in Côté J’s claim that the majority’s use of judicial notice did not meet the “strict” standard required by previous decisions (Bykovets, para 163; R v Find, 2001 SCC 32, para 48). However, the majority implicitly answered this charge by focusing on the unique fragility of privacy interests. “Privacy, once breached, cannot be restored” (Bykovets, para 6). By the time evidence of state privacy breaches appears on the record, it will already be too late. This indicates the need for a more generous approach to judicial notice to protect against privacy breaches before they happen.

Conclusion

The majority of the SCC took a proactive approach to digital privacy by finding a section 8 privacy interest in IP addresses and mandating that police obtain a warrant before collecting them. Although speculative, this approach was appropriate. The dissent presented few justifications for their position aside from judicial conservatism. More importantly, the fragility of digital privacy interests and the immense capacity for third parties to assist or inspire the government in breaching them justify a normative approach.