The Court of Appeal for Ontario issued a significant judgment yesterday in which it held that the police did not breach section 8 of the Charter by obtaining the identity of an anonymous internet user without judicial authorization. The decision touches deep questions about anonymity and the rights of citizens (corporate or otherwise) to help law enforcement.
The case is about a child pornography investigation that started with a concern about the trading of contraband on a German website. The trading was done openly, but under the cover of pseudonyms. The RCMP obtained information that child pornography had been downloaded to computers at various IP addresses in Canada. It requested and obtained information from a Canadian internet service provider (ISP) that linked three downloads to the accused.
The key issue for the Court was whether the accused had a reasonable expectation of privacy in the circumstances. The same issue was before the Court of Appeal for Saskatchewan in two cases last year, and it reached a different reasonable expectation of privacy finding in each case, arguably because the commercial terms imposed by the ISP in each case differed.
One key to the Court of Appeal for Ontario’s rejection of a privacy claim is its characterization of the information at issue. The Crown argued that the ISP merely disclosed a name and address. The defence argued that the ISP disclosed information that would reveal “browsing history” and “the details of an individual’s Internet activities.” The Court accepts neither position. It characterizes the information as follows:
The police did not want the subscriber information so as to be able to identify the appellant as a customer of Bell Sympatico. That fact alone was of no value to the police. Nor does the appellant contend that he has a reasonable expectation of privacy with respect to the fact that he is a client of Bell Sympatico. The police wanted the information because they believed it could potentially identify the appellant as the person who had anonymously accessed child pornography on three separate occasions over the Internet. Translated into the content neutral language required for the purposes of s. 8, the police wanted the information because of what it could potentially tell them about the appellant’s Internet activity on three occasions. They sought to connect an identity to certain activity: see Slane & Austin, at pp. 500-503.
The Court’s reference to “content neutral” pays heed to case law that establishes that the protection afforded by section 8 of the Charter should not be debased by framing the activity that the proponent seeks to protect as criminal and therefore unworthy of protection. R v Wong, for example, was a case about the surveillance of unlawful gaming in a hotel room. The Supreme Court of Canada said that the privacy interest at stake was about the right to use a hotel room in private, not the right to use a hotel room for unlawful activity in private.
But does yesterday’s decision really treat the privacy interest at stake as neutral?
In the above quote the Court links the interest at stake to the anonymous downloading of pornography. It explains that broader, more neutral framing is not possible based on the record:
I cannot, however, go so far as Mr. Dawe, and counsel for the intervener, who relying on the comments of Cameron J.A. in Trapp, at paras. 32-37, argue that the information sought by the police would provide “an electronic roadmap of the appellant’s travels on the Internet”. That description, while consistent with the language used in Trapp, at para. 36, goes beyond the evidentiary record in this case. Adapting the intervener’s metaphor to the evidence adduced here, I would say that the police sought information capable of putting the appellant at a specific place, at a specific time in the course of his travels on the Internet.
The only activity occurring at the specific place and specific time at issue is criminal activity. The Court’s framing is proper based on evidence that established the dynamic nature of IP addresses, but it points to criminal activity and is therefore not neutral.
Then, in another very significant part of its analysis, the Court assigns significant weight to the ISP’s interest in “preventing the criminal misuse of its services.” It says that it is legitimate for an ISP to choose, for reasons relating to civic engagement or out of pure self-interest, to make a limited, voluntary disclosure to police – especially so given the repugnance of child pornography.
This analysis rests on far more fundamental concerns than an analysis that focuses on the commercial terms between an ISP and its subscribers. As the Saskatchewan cases might illustrate, an analysis that rests on commercial terms is flimsy and leaves to much to depend on a private arrangement that may vary by circumstance. An analysis that rests on a system owner’s interest in preventing the use of its property as an instrument of crime is strong. It is the kind of analysis that employers (also system owners) have said is missing from the Court of Appeal for Ontario’s last third-party disclosure decision, R v Cole.
Recognizing that system owners have a legitimate interest in preventing misuse of their systems may be strong and proper, but it is not neutral. The Court addresses this by saying that the nature of the offence under investigation is relevant to the reasonableness of an ISP’s response to a police request, but not the reasonable expectation of privacy analysis itself. Is this really a meaningful distinction?
All of this is to stress the complexity of this decision, with which I agree. People who trade child pornography engage in criminal activity in public and in a manner that creates an obvious digital trail. They hold the thinnest veil of anonymity, the maintenance of which rests on the outlook of an ISP. Whether an ISP should be able to take a value-laden, non-neutral stance against crime seems like it will be the fighting ground on any appeal.
All About Information 