|
Internet - General. R. v. Bykovets
In R. v. Bykovets (SCC, 2024) the Supreme Court of Canada usefully explains an IP number's role in identifying a computer user, and - more generally - the sometimes pernicious role of the internet in today's society:[18] Before trial, the appellant alleged that the police’s request to Moneris violated his right against unreasonable search and seizure under s. 8 of the Charter. The key issue on the voir dire was whether the appellant had a reasonable expectation of privacy in his IP address.
[19] Defence counsel submitted a forensic investigator’s expert report providing a technical summary of IP addresses and their functions. The report showed that there are internal and external IP addresses. External IP addresses are used to transfer information across the Internet from one source to another through a modem rented from the ISP. An external IP address is much like the street address of an individual’s house. Without one, a user can neither send nor receive data. A modem or router also assigns an internal IP address to each device on a local network, roughly equivalent to the individual rooms in a house.
[20] IP addresses can also be static or dynamic. Most are dynamic, meaning that the ISP can change a user’s external IP address without notice and for any number of reasons. ISPs keep a record of which subscriber each external IP address was assigned to and for what time period.
[21] A user’s ISP can be determined by entering their IP address into an IP lookup website. The police can then request subscriber information for the assigned IP address from the ISP, as contemplated by Spencer. That said, the expert explained that one may still take steps to determine a user’s identity, without resorting to an ISP, through the information logged on the website of a third-party company. Third-party companies, such as Google or Facebook, can track the external IP addresses of each user who visits their site and log this information to varying degrees. These companies can determine the identity of those individual users based on their Internet activity on their sites (expert report, reproduced in A.R., at p. 311). The effect is compounded when information from multiple sites is collected (p. 312).
[22] Thus, in the expert’s view, if those seeking to identify a particular Internet user have access to information logged by third-party companies, “it is not necessary to obtain ISP-held subscriber information in order to accurately identify a particular internet user” (p. 312).
....
[61] First, the activity associated with the IP address can itself be deeply revealing, even before any attempt to determine identity. Here, the activity was a series of financial transactions through an online intermediary, Moneris. Linked to financial intermediaries like Moneris or PayPal, an IP address can reveal all of a user’s transactions on that intermediary over the period the IP address was assigned to them. For example, Moneris associated five different online transactions with these IP addresses (voir dire reasons, at paras. 7-8).
[62] These purchases may “broadcas[t] a wealth of personal information capable of revealing personal and core biographical information about the [purchaser]” (Marakah, at para. 33), from the restaurants they frequent, the destinations they visit, the hobbies they enjoy, to the health supplements they use. Internet users may even have “an acute privacy interest in the fact of their electronic [purchases]”, especially as our marketplaces rapidly migrate online (para. 33 (emphasis in original)).
[63] Other online activities can reveal information that goes directly to a user’s biographical core. Websites offering dating services or adult pornography can give the state a depiction of the user’s sexual preferences. An Internet user’s history on medical, political, or other similar online chatrooms can reveal their health concerns or political views. If an IP address is not protected, this information is freely available to the state without the protection of the Charter whether or not it relates to the investigation of a particular crime.
[64] Second, the specific activity associated to the IP address by the search can be correlated with other online activity associated to that IP address.
[65] Without the protection of s. 8, nothing prevents the state from pre‑emptively collecting IP addresses and comparing that user’s IP address against their database. Further, and significantly, the scope of information that an IP address can reveal is enormous if correlated against information held by a third party. Cases suggest that third parties provide this information without being asked. For example, in State v. Simmons, 190 Vt. 141 (2011), the police, after identifying a suspect, contacted MySpace, a social media site, and requested that they share the IP addresses that had accessed his MySpace profile (para. 3). MySpace provided records showing not just the IP addresses themselves, but also every time each IP address had logged into Simmons’ MySpace account — including that one IP address had logged into the account “more than 100 times over the course of a week” (para. 3).
[66] As the expert explained, third-party websites can track the external IP address of each user who visits their site. Some websites, like Google, also collect massive amounts of other information such as YouTube history, Google searches, and location history. This information can be of an extremely personal nature.
[67] A great deal of online activity is performed anonymously (Spencer, at para. 48; Ward, at para. 75). People behave differently online than they do in person (Ramelson, at para. 5). “Some online locations, like search engines, allow people to explore notions that they would be loath to air in public; others, like some forms of social media, allow users to dissimulate behind veneers of their choosing” (para. 46). We would not want the social media profiles we linger on to become the knowledge of the state. Nor would we want the intimately private version of ourselves revealed by the collection of key terms we have recently entered into a search engine to spill over into the offline world. Those who use the Internet should be entitled to expect that the state does not access this information without a proper constitutional basis.
[68] Finally, link by link, an IP address can set the state on a trail of anonymous Internet activity that leads directly to a user’s identity. The expert uses the example of an IP address that logs onto a particular social media profile or email account containing information from which the user’s identity can be inferred, such as their name. From there, the user’s identity is but a short inference away. It is not an answer to say — as Crown counsel does — that a Spencer warrant is required if the IP address is sought in relation to information that can unveil the identity of the Internet user. It cannot be left to police or private companies to determine whether the information provided on the website will (perhaps in combination with other information) assist in identifying the source of the activity, the identity of the user or otherwise compromise privacy interests.
....
[73] The Internet has exponentially increased both the quality and quantity of information stored about Internet users, spanning the most public and the most private human behaviour (Ramelson, at para. 45). It is highly centralized, easily accessible, and “not filtered through human memory and motivation but can be produced as a copy of its original form” (L. M. Austin, “Technological Tattletales and Constitutional Black Holes: Communications Intermediaries and Constitutional Constraints” (2016), 17 Theoretical Inquiries L. 451, at p. 457). Information once revealed to the state in pieces can now be “compiled, dissected and analyzed to lend new insights into who we are as individuals or populations” (Ramelson, at para. 48). An IP address attaches to each of these pieces. It is the key that links them to one another.
[74] Even “information that may at first blush appear mundane and outside of the biographical core may be profoundly revealing when situated in context with other data points” (N. Hasan et al., Search and Seizure (2021), at p. 59). Aggregation “creates synergies. When analyzed, aggregated information can reveal new facts about a person that she did not expect would be known about her when the original, isolated data was collected” (O. Tene, “What Google Knows: Privacy and Internet Search Engines”, [2008] Utah L. Rev. 1433, at p. 1458, quoting Solove, at p. 507). The ubiquity of the Internet means we must increasingly consider “the ways in which different data sets in combination with other data sets affect privacy rights” (Hasan, at p. 60 (emphasis in original)).
[75] Not only does the Internet keep an accurate permanent record, it has concentrated this mass of data in the hands of third parties, investing these third parties with immense informational power. It has given large private corporations the ability to collect vast stores of user information and to aggregate that data into sharp images of their users’ online activity to determine what their users want and when they want it. In exchange, these corporations are “building possibly the most lasting, ponderous, and significant cultural artifact in the history of humankind” (Tene, at p. 1435, quoting J. Battelle, The Search: How Google and Its Rivals Rewrote the Rules of Business and Transformed Our Culture (2005), at p. 6).
[76] The Internet has not only allowed private corporations to track their users, but also to build profiles of their users filled with information the users never knew they were revealing. “Browsing logs, for example, may provide detailed information about users’ interests. Search engines may gather records of users’ search terms. Advertisers may track their users across networks of websites, gathering an overview of their interests and concerns” (Spencer, at para. 46). Commentators have even suggested that companies can use the data they collect to infer “what you are going to purchase, the kind of person you are going to get into a relationship with, whether you will be good at a new job, how long you will stay at that job, and whether you’ll get sick” (H. Matsumi, “Predictions and Privacy: Should There Be Rules About Using Personal Data to Forecast the Future?” (2017), 48 Cumb. L. Rev. 149, at p. 149).
[77] This is far from speculation. Indeed, it is common knowledge that the largest social media companies in the world use IP addresses to, for example, personalize the advertisements their users see, identify their users’ preferences, and infer even more information about their users, such as their age, their gender, and their interests. When it comes to tracking users on the Internet, to paraphrase science fiction novelist William Gibson, “[t]he future is already here” (P. Kennedy, “William Gibson’s Future Is Now”, The New York Times, January 13, 2012 (online)).
[78] By concentrating this mass of information with private third parties and granting them the tools to aggregate and dissect that data, the Internet has essentially altered the topography of privacy under the Charter. It has added a third party to the constitutional ecosystem, making the horizontal relationship between the individual and the state tripartite. Though third parties are not themselves subject to s. 8, they “mediat[e] a relationship which is directly governed by the Charter — that between the defendant and police” (A. Slane, “Privacy and Civic Duty in R v Ward: The Right to Online Anonymity and the Charter-Compliant Scope of Voluntary Cooperation with Police Requests” (2013), 39 Queen’s L.J. 301, at p. 311). . Ramlal Hemchand v. Toronto Community Housing Corporation
In Ramlal Hemchand v. Toronto Community Housing Corporation (Div Court, 2023) the Divisional Court notes a novel LTB facility for parties "who do not have access to technology":[16] There is then the issue of whether it was unfair to proceed on the new date, without the tenant. The LTB has put forward a document indicating that the notice of hearing (for the new date) was mailed to the tenant along with information permitting the tenant to use the Public Access Terminals (“PATs”) that the LTB makes available to parties who do not have access to technology. . Caplan v. Atas [see the main link for numbered case cites]
In Caplan v. Atas (Sup Ct, 2021) the Superior Court finds a new tort, that of 'internet harassment'. This new development in the law was in response to a remarkable case fact pattern (see paras 77-91). In these present quotes the court canvasses the larger social phenomenon of internet harassment:[99] Online harassment, bullying, hate speech, and cyber stalking straddle criminal and civil law. Harmful internet communication has prompted many jurisdictions to amend or pass legislation to deal with the issue. The courts too have been challenged to recognize new torts or expand old ones to face the challenges of the internet age of communication.[26] The academic commentators are almost universal in their noting that, while online harassment and hateful speech is a significant problem, there are few practical remedies available for the victims.
[100] In England, after it appeared that there was some movement toward the recognition of a common law tort of harassment, Parliament passed the Protection from Harassment Act 1997, which created statutory protections and civil remedies for harassment. In 2014, the Australian Law Reform Commission recommended the passage of legislation for a statutory civil remedy for harassment. In 2015, New Zealand passed the Harmful Digital Communications Act, which created an agency to administer a complaints process and applicable remedies.
[101] In November 2017, the Law Reform Commission of Ontario published a consultation paper entitled ‘Defamation Law in the Internet Age’. One of its working papers, entitled ‘The Relationship between Defamation, Breach of Privacy, and Other Legal Claims Involving Offensive Internet Content’ was published by David Mangan in July 2017. Both the consultation paper and the working paper include extensive reviews of the law. Since final argument of these motions, the Law reform Commission of Ontario has published a Final Report.[27] To date, legislation has not been enacted in Ontario to address these issues.
[102] In 2018, Nova Scotia re-introduced the Intimate Images and Cyber-Protection Act.[28] ‘Cyber-bullying’ is defined, at section 3(c) of the Act, as follows:“cyber-bullying” means an electronic communication, direct or indirect, that causes or is likely to cause harm to another individual’s health or well-being where the person responsible for the communication maliciously intended to cause harm to another individual’s health or well-being or was reckless with regard to the risk of harm to another individual’s health or well-being, and may include (i) creating a web page, blog or profile in which the creator assumes the identity of another person, (ii) impersonating another person as the author of content or a message, (iii) disclosure of sensitive personal facts or breach of confidence, (iv) threats, intimidation or menacing conduct, (v) communications that are grossly offensive, indecent, or obscene, (vi) communications that are harassment, (vii) making a false allegation, (viii) communications that incite or encourage another person to commit suicide, (ix) communications that denigrate another person because of any prohibited ground of discrimination listed in Section 5 of the Human Rights Act, or (x) communications that incite or encourage another person to do any of the foregoing. [103] Section 6(1) of the Act gives the Court the following powers:Where the Court is satisfied that a person has engaged in cyber-bullying or has distributed an intimate image without consent, the Court may make one or more of the following orders:(a) an order prohibiting the person from distributing the intimate image;
(b) an order prohibiting the person from making communications that would be cyber-bullying;
(c) an order prohibiting the person from future contact with the applicant or another person;
(d) an order requiring the person to take down or disable access to an intimate image or communication;
(e) an order declaring that an image is an intimate image;
(f) an order declaring that a communication is cyber-bullying;
(g) an order referring the matter to dispute-resolution services provided by the agency or otherwise;
(h) an order provided for by the regulations;
(i) any other order which is just and reasonable. [104] As should be clear from this brief review, this is a developing area of the law. The law of defamation provides some recourse for the targets of this kind of conduct, but that recourse is not sufficient to bring the conduct to an end or to control the behaviour of the wrongdoer. The reasons that follow explain this conclusion, which provides a foundation for this court’s conclusion that the common law tort of harassment should be recognized in Ontario. “Harassment” describes what Atas has been doing, and ordering Atas to stop harassment provides remedial breadth not available in the law of defamation. . Teksavvy Solutions Inc. v. Bell Media Inc.
In Teksavvy Solutions Inc. v. Bell Media Inc. (Fed CA, 2021) the Federal Court of Appeal upheld a 'site-blocking' injunction against third party ISPs, barring their customers from accessing copyright-infringing content [paras 18-32]. The case also consider the Telecommunications Act role in this, finding that the Act's net-neutrality is not infringed by the common carrier where the court makes such an order [paras 33-44].
. R. v. Ramelson
In R. v. Ramelson (SCC, 2022) the Supreme Court of Canada engages in an interesting analysis of the internet in the course of an entrapment criminal case:(2) Online Spaces
[42] Like any evolving technology, even an expansive definition of the Internet risks a quick obsolescence. And over time, the Internet has proven to be many things: social and anti-social, informative and mis-informative, and marked by clusters of hyperactivity and landscapes of inactivity. Still, some general features can be identified.
[43] While sustained by a vast physical infrastructure, the Internet, at least as most users experience it, is first and foremost a network of information and a means of connecting with others. That information is stored on servers but is accessible from an increasing array of devices in many physical locations. To say that individuals gather in online “spaces” means only that people have accessed shared information, wherever they happen to be geographically — which, today, may be from nearly anywhere.
[44] Freed of geographical constraints, online spaces permit unique experiences. They are permeable, allowing users to seamlessly traverse from one space to another. They are often interactive, facilitating that movement and encouraging users to express themselves and engage with content. They can also be coded to enable varying levels of supervision, regulation or control. The Internet can be manipulated in ways that physical spaces cannot.
[45] And its information comes in all types. Functionally, the Internet encompasses the most public and the most private human behaviour. It is the largest megaphone or billboard ever conceived, allowing publishers to connect with audiences far vaster than could ever physically congregate. Yet many millions also conduct private activities online, confident that their information — whether touching their work, social or personal lives — will remain as secure from general circulation as if they had transacted in person.
[46] With that range of behaviour comes a range of candour. Some online locations, like search engines, allow people to explore notions that they would be loath to air in public; others, like some forms of social media, allow users to dissimulate behind veneers of their choosing. Still others, like those dedicated to sexual activity, may encompass both poles. Online behaviour, in other words, may be radically transparent, radically disingenuous, or both. People do not always act online as they do in person.
[47] This, combined with its ubiquity, helps explain why the Internet raises “a host of new and challenging questions about privacy” (R. v. Spencer, 2014 SCC 43, [2014] 2 S.C.R. 212, at para. 1). Virtual police investigations may produce vast amounts of highly personal information, in contexts where people may be unusually uninhibited, engaged in forms of self-discovery, or seeking anonymity. The mere threat of state intrusion into those spaces may promote self-censorship, or the abstention from those spaces altogether, with costs to free expression and the exchange of ideas so essential in a vibrant democracy.
[48] Nor do privacy concerns end with online interactions. The Internet collects traces — information about a user’s physical location, online activity, and more — in ways that in-person interactions typically do not (Spencer, at para. 46). This data collection often occurs without a user’s awareness or consent, and those traces may persist indefinitely. They can spread with prodigious speed and reach, making it still more likely those traces will persist. And they can be compiled, dissected and analyzed to lend new insights into who we are as individuals or populations. As the rights and autonomy implications of those insights have become clearer, the divisions over how data is collected, protected and mobilized have in turn sharpened.
[49] Online spaces, in short, differ from physical spaces in at least three ways: the Internet, being informational rather than geographical, sheds many of the physical world’s limitations in terms of scale and functions; people behave differently when online; and virtual spaces raise unique rights concerns. As Ahmad stated, online spaces are qualitatively different.
[50] In my view, the greatest consequence of these differences for bona fide inquiries is that the boundaries of an online “space” only tell part of the story. While intuitive, geographical analogies are imperfect. There is no simple way to compare a six-block area of a city to its online equivalent, except perhaps via those spaces’ functions. And even then, similar functions may conceal deeper differences in experience. In an era when a single Tweet may attract more traffic than an entire mall, the parameters of a virtual space may be a poor proxy for the scope of a police investigation.
[51] To respect the entrapment doctrine’s underlying balance of first principles, then, courts assessing whether an online police investigation was bona fide must pay close attention to the space’s functions and interactivity — that is, to the permeability, interconnectedness, dynamism and other features that make the Internet a distinctive milieu for law enforcement. Even tailored online investigations may represent a broad and profound invasion into peoples’ lives. Given the potential of online investigations to impact many more individuals than an equivalent investigation in a physical space, the nature of those impacts deserve scrutiny. How the police act on the Internet may matter as much or more as where they act.
|
