No Privacy Interest In IP Addresses For Individuals?

• Published date: 18 March 2020
• Subject Matter: Media, Telecoms, IT, Entertainment, Privacy, IT and Internet, Privacy Protection
• Law Firm: MLT Aikins LLP
• Author: Ms Kristal Allen and Jeremy Barber

A recent decision out of the Alberta Court of Queen's Bench in R v Bykovets, 2020 ABQB 70 ("Bykovets") raises questions regarding the privacy attributed to an Internet protocol address ("IP address").

While it seems intuitive that an IP address, due to its ability to connect individuals with specific online activity, could conceivably reveal a great deal of information about an individual's behavior on the Internet and would therefore be considered private and enjoy the protection of the law, the Court's ruling in Bykovets suggests otherwise.

Facts

The Calgary Police Service's Cybercrimes Investigation Team ("CPS") was investigating online purchases of several gift cards, as it was alleged that these purchases had been made with stolen credit card information. CPS contacted Federated Co-operatives Limited ("Co-op"), one of the businesses at which gift cards had been purchased. The goal was to obtain records relating to the purchases from Co-op, so that the individual responsible could be identified. Co-op in turn directed CPS to its payment processor, which disclosed the IP addresses associated with the fraudulent gift card purchases. CPS had not obtained any warrant or court order in support of its request for the IP addresses from the payment processor.

While CPS had the IP addresses associated with the fraudulent purchases, CPS could not, without more, connect the purchases to physical addresses or particular individuals. Using a free publicly available online tool, CPS was able to determine the IP addresses obtained from Co-op's payment processor were assigned by Telus. Since Telus was responsible for assigning the IP addresses, CPS concluded the fraudster or fraudsters had accounts with Telus, and that Telus could thus connect the IP addresses with specific physical addresses and individuals. CPS obtained a production order for the subscriber information associated with the IP addresses, and presented it to Telus. Telus then disclosed that the IP addresses in question were associated with accounts held by a Mr. Andrei Bykovets and his father.

With this new information in hand, CPS obtained search warrants for the residences of Mr. Bykovets and his father. The searches were executed, and Mr. Bykovets was ultimately charged with 33 counts of various offences, generally related to the possession and use of third party credit cards and personal information, as well as firearms.

Argument

Mr. Bykovets took the position that when CPS took steps to obtain his and his father's IP...