During the spring of 2007, David Ward, an administrator at the Sudbury YMCA, was home one Sunday evening when a police officer rang his doorbell.
The constable said that he was investigating a complaint about harassing e-mails.
It was a lie.
( How are Canada’s privacy laws about to change? Read The Globe’s easy explanation)
As part of a massive international probe codenamed Operation Penalty, the police suspected Mr. Ward was one of thousands of people who had downloaded child pornography from a German website. Without a search warrant, Mr. Ward’s Internet provider, Bell Sympatico, had agreed to confirm his name and address to investigators.
Now, the constable at his doorstep chatted him up to ascertain whether Mr. Ward was the sole user of the computers at that address.
A month later, Sudbury police returned, this time with a search warrant, seized Mr. Ward’s computer and arrested him on child pornography charges.
He was one of more than 40 Canadians detained in connection with the German website, Carookee.com.
Mr. Ward’s challenged his conviction to the Ontario Court of Appeal but lost in 2012. He didn’t pursue his appeal further, but the Supreme Court of Canada will rule on a similar case Friday.
The issue is very much being debated in Parliament and among civil-rights advocates: Can a telecommunications company hand to police the names and addresses of their subscribers without judicial oversight?
In the past decade, law-enforcement and Internet providers have quietly developed a protocol where companies co-operate with police in child-abuse investigations, disclosing to police who is behind suspicious Internet protocol addresses without requiring search warrants.
Privacy advocates and defence lawyers are concerned about such arrangements. They argue that connecting a suspect’s identity with their IP addresses will reveal a person’s Web use.
“That relationship reveals your private thoughts … the state shouldn’t get into your private thoughts,” Anil Kapoor, counsel for the Canadian Civil Liberties Association, argued when the Supreme Court heard the case last December.
However, prosecutors and police note some less publicized aspects of the controversy: The investigations are always eventually backstopped by a search warrant before the arrest, meaning that a judge’s authorization has to be sought at some point.
Furthermore, IP addresses are not static, undercutting the concern that a full Internet browsing history can be intuited from a single identifier.
“We’ve never gotten e-mail information, their surf history, or any of their other personal lifestyle info,” Sergeant Timothy Burtt, the Sudbury detective who coordinated the investigation into Mr. Ward, said in an interview.
THE TECHNICAL ISSUE
The IP address is a key bit of information detectives use to track the production and possession of child pornography, like a fingerprint or a DNA strand.
Most investigations usually involve detectives tracking IP address by placing themselves downstream from where child-abuse pictures are transmitted, for example on chat rooms or file-sharing networks run by programs such Gnutella, eDonkey or GigaTribe.
In the case now before the Supreme Court, a Saskatoon man named Matthew David Spencer was charged with possessing child pornography and making it available on the file-sharing software LimeWire.
Police can determine from an IP address the country of origin and even the Internet provider of a user.
However, detectives need to find from Internet companies who was using a particular IP address at a specific time.
Investigators say that, unless you seize a person’s computer and analyze its contents, it would be very hard to find out what they have done online solely from IP addresses.
“Just because someone’s IP address is associated with a child pornographic image doesn’t necessarily mean they were in knowing possession of it,” a prosecutor said. “Whose rear end is in the chair, using the computer, is not apparent from an IP address.”
Most suspects readily plead guilty once police search their computers and find child pornography pictures.
PIPEDA: USING PRIVACY LAW FOR WARRANTLESS ACCESS
Investigators used to obtain subscriber information by applying for a search warrant.
This changed in 2004, when police began invoking a four-year-old privacy law, the Personal Information Protection and Electronic Documents Act.