Police Now Need Warrant For IP Addresses, Canada's Top Court Rules

The Supreme Court of Canada ruled today that police must now have a warrant or court order to obtain a person or organization's IP address. CBC News reports: The top court was asked to consider whether an IP address alone, without any of the personal information attached to it, was protected by an expectation of privacy under the Charter. In a five-four split decision, the court said a reasonable expectation of privacy is attached to the numbers making up a person's IP address, and just getting those numbers alone constitutes a search. Writing for the majority, Justice Andromache Karakatsanis wrote that an IP address is 'the crucial link between an internet user and their online activity.' 'Thus, the subject matter of this search was the information these IP addresses could reveal about specific internet users including, ultimately, their identity.' Writing for the four dissenting judges, Justice Suzanne Cote disagreed with that central point, saying there should be no expectation of privacy around an IP address alone.

In the Supreme Court majority decision, Karakatsanis said that only considering the information associated with an IP address to be protected by the Charter and not the IP address itself 'reflects piecemeal reasoning' that ignores the broad purpose of the Charter. The ruling said the privacy interests cannot be limited to what the IP address can reveal on its own 'without consideration of what it can reveal in combination with other available information, particularly from third-party websites.' It went on to say that because an IP address unlocks a user's identity, it comes with a reasonable expectation of privacy and is therefore protected by the Charter. 'If [the Charter] is to meaningfully protect the online privacy of Canadians in today's overwhelmingly digital world, it must protect their IP addresses,' the ruling said.

Justice Cote, writing on behalf of justices Richard Wagner, Malcolm Rowe and Michelle O'Bonsawin, acknowledged that IP addresses 'are not sought for their own sake' but are 'sought for the information they reveal.' 'However, the evidentiary record in this case establishes that an IP address, on its own, reveals only limited information,' she wrote. Cote said the biographical personal information the law was designed to protect are not revealed through having access to an IP address. Police must use that IP address to access personal information that is held by an ISP or a website that tracks customers' IP addresses to determine their habits. 'On its own, an IP address does not even reveal browsing habits,' Cote wrote. 'What it reveals is a user's ISP -- hardly a more private piece of information than electricity usage or heat emissions.' Cote said placing a reasonable expectation of privacy on an IP address alone upsets the careful balance the Supreme Court has struck between Canadians' privacy interests and the needs of law enforcement. 'It would be inconsistent with a functional approach to defining the subject matter of the search to effectively hold that any step taken in an investigation engages a reasonable expectation of privacy,' the dissenting opinion said.

Read more of this story at Slashdot.