Case in Brief

R. v. Bykovets

The Supreme Court rules that a request by police for an IP address is a search within the meaning of section 8 of the Charter.

This appeal dealt with the question of whether an internet protocol (IP) address attracts a reasonable expectation of privacy, such that a request by the police to obtain it constitutes a search under section 8 of the Charter.  An IP address is a unique identification number and is necessary to access the Internet. It identifies Internet-connected activity and enables the transfer of information from one source to another. Companies that provide access to the Internet, referred to as Internet service providers, keep track of the user information that attaches to each IP address.

In 2017, the Calgary Police Services began an investigation into fraudulent online purchases from a liquor store and learned that the store’s online sales were managed by Moneris, a third-party payment processing company. The police contacted Moneris to obtain the IP addresses used for the transactions, and Moneris identified two. The police then obtained an order from the court compelling the addresses’ Internet service provider to disclose the name and residential address of the customer for each IP address. One was registered to Mr. Bykovets, and the other to his father. The police used this information to obtain and execute search warrants at their residences. Mr. Bykovets was arrested and charged with offences relating to, among others, the possession and the use of third parties’ credit cards and personal identification documents.

Before his trial began, Mr. Bykovets challenged the police’s request to obtain the IP addresses from Moneris, alleging it violated his right against unreasonable search and seizure under section 8 of the Canadian Charter of Rights and Freedoms. The object of section 8 is to protect privacy, including informational privacy. To establish a violation of his section 8 right, Mr. Bykovets first needed to show that there had been a “search”. A search occurs where the state invades a reasonable expectation of privacy. Mr. Bykovets argued he had such an expectation with respect to his IP address.

The trial judge found that the police’s request to Moneris did not amount to a search because there was no reasonable expectation of privacy in an Internet user’s IP address. She reasoned that on their own, IP addresses do not provide a link to, or any other information about, an Internet user. As such, Mr. Bykovets did not have a reasonable expectation of privacy in his IP address and there was no violation of his section 8 right. He was ultimately convicted of 14 offences.    

A majority of the Alberta Court of Appeal agreed with the trial judge and dismissed Mr. Bykovet’s appeal. In dissent, one judge would have allowed his appeal, on the basis that a reasonable expectation of privacy did attach to the IP addresses. Mr. Bykovets appealed to the Supreme Court of Canada.  

The Supreme Court of Canada has allowed the appeal.

An IP address attracts a reasonable expectation of privacy.

Writing for the majority, Justice Karakatsanis explained that if section 8 of the Charter was to meaningfully protect the online privacy of Canadians in today’s overwhelmingly digital world, it must protect their IP addresses. An IP address is the crucial link between an Internet user and their online activity. She said “it is the key to unlocking a user’s Internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy”. Accordingly, a request by the state – in this case, the police – for an IP address is a search under section 8 of the Charter.

On this basis, Justice Karakatsanis allowed Mr. Bykovet’s appeal, set aside his convictions and ordered a new trial.