During the spring of 2007, David Ward, an administrator at the Sudbury YMCA, was home one Sunday evening when a police officer rang his doorbell.
The constable said that he was investigating a complaint about harassing e-mails.
It was a lie.
( How are Canada’s privacy laws about to change? Read The Globe’s easy explanation)
As part of a massive international probe codenamed Operation Penalty, the police suspected Mr. Ward was one of thousands of people who had downloaded child pornography from a German website. Without a search warrant, Mr. Ward’s Internet provider, Bell Sympatico, had agreed to confirm his name and address to investigators.
Now, the constable at his doorstep chatted him up to ascertain whether Mr. Ward was the sole user of the computers at that address.
A month later, Sudbury police returned, this time with a search warrant, seized Mr. Ward’s computer and arrested him on child pornography charges.
He was one of more than 40 Canadians detained in connection with the German website, Carookee.com.
Mr. Ward’s challenged his conviction to the Ontario Court of Appeal but lost in 2012. He didn’t pursue his appeal further, but the Supreme Court of Canada will rule on a similar case Friday.
The issue is very much being debated in Parliament and among civil-rights advocates: Can a telecommunications company hand to police the names and addresses of their subscribers without judicial oversight?
In the past decade, law-enforcement and Internet providers have quietly developed a protocol where companies co-operate with police in child-abuse investigations, disclosing to police who is behind suspicious Internet protocol addresses without requiring search warrants.
Privacy advocates and defence lawyers are concerned about such arrangements. They argue that connecting a suspect’s identity with their IP addresses will reveal a person’s Web use.
“That relationship reveals your private thoughts … the state shouldn’t get into your private thoughts,” Anil Kapoor, counsel for the Canadian Civil Liberties Association, argued when the Supreme Court heard the case last December.
However, prosecutors and police note some less publicized aspects of the controversy: The investigations are always eventually backstopped by a search warrant before the arrest, meaning that a judge’s authorization has to be sought at some point.
Furthermore, IP addresses are not static, undercutting the concern that a full Internet browsing history can be intuited from a single identifier.
“We’ve never gotten e-mail information, their surf history, or any of their other personal lifestyle info,” Sergeant Timothy Burtt, the Sudbury detective who coordinated the investigation into Mr. Ward, said in an interview.
THE TECHNICAL ISSUE
The IP address is a key bit of information detectives use to track the production and possession of child pornography, like a fingerprint or a DNA strand.
Most investigations usually involve detectives tracking IP address by placing themselves downstream from where child-abuse pictures are transmitted, for example on chat rooms or file-sharing networks run by programs such Gnutella, eDonkey or GigaTribe.
In the case now before the Supreme Court, a Saskatoon man named Matthew David Spencer was charged with possessing child pornography and making it available on the file-sharing software LimeWire.
Police can determine from an IP address the country of origin and even the Internet provider of a user.
However, detectives need to find from Internet companies who was using a particular IP address at a specific time.
Investigators say that, unless you seize a person’s computer and analyze its contents, it would be very hard to find out what they have done online solely from IP addresses.
“Just because someone’s IP address is associated with a child pornographic image doesn’t necessarily mean they were in knowing possession of it,” a prosecutor said. “Whose rear end is in the chair, using the computer, is not apparent from an IP address.”
Most suspects readily plead guilty once police search their computers and find child pornography pictures.
PIPEDA: USING PRIVACY LAW FOR WARRANTLESS ACCESS
Investigators used to obtain subscriber information by applying for a search warrant.
This changed in 2004, when police began invoking a four-year-old privacy law, the Personal Information Protection and Electronic Documents Act.
Section 7 of the PIPEDA says that an organization may reveal personal information without a person’s consent, to someone who has “legal authority,” if it is for the purpose of enforcing a Canadian law.
In court testimony, Paul Krawczyk, an officer with the Toronto Police Service, recalled that the RCMP sent an e-mail advising other police forces about using PIPEDA.
Eventually, major Internet providers such as Bell, Telus, Shaw and Sasktel joined police and other stakeholders and formalized the process. It would only be used when investigating child abuse cases. And there was even a form that officers could fill to expedite their requests.
“For files that are related to abuse against children, we co-operate with the police without a warrant from a court of justice but the request must be made by virtue of PIPEDA. For other requests, we need a warrant to provide the information unless a person’s life is in danger,” said Élodie Girardin-Lajoie, a spokeswoman for Videotron.
A concern, first raised by the federal government’s now-defunct Bill C-30, is that Ottawa is keen to expand warrantless access beyond child-abuse investigations to include intelligence-gathering or non-criminal probes.
Even in child-abuse cases, it is not the job of businesses to help expedite the work of police, says privacy lawyer David Fraser. “If the issue is the paperwork and the delays, then remedial efforts need to focus on the paperwork and delays – not removing the safeguards that we have and that protect Canadians’ privacy.”
HOW IT WORKS: OPERATION PENALTY
In the spring of 2006, the operator of a Web portal in the sleepy southern German town of Radolfzell noticed 28 of his online forums had been used to trade images of child sexual abuse. He called the police.
The German investigation, codenamed Operation Penalty, found that nearly a million suspicious IP addresses had retrieved illegal files on the website.
The German state criminal office in Baden-Wuerttemberg eventually announced that there were 4,700 suspects around the world. Their IP addresses, which came from 107 different countries, were transmitted to Interpol, which began alerting local police forces.
By September, the RCMP’s National Child Exploitation Co-ordination Centre in Ottawa received from Interpol 229 Canadian IP addresses alleged to have accessed the German website, Carookee.com.
RCMP officers identified which Internet company used each of those IP numbers, then began sending them PIPEDA requests.
According to the Association of Police Chiefs, Internet providers only denied 47 of the 229 PIPEDA requests related to Operation Penalty.
One batch of requests for example was faxed on Nov. 22, 2006, by RCMP Constable Jason Tree.
The reply from Bell Sympatico: three of the IP addresses had been used on specific dates by the account of Mr. Ward in Sudbury.
The RCMP forwarded the information to Sudbury Regional Police.
In Sudbury, Sgt. Burtt first reviewed the photos to make sure they were illegal. (This was necessary because Germany and Canada have different cutoff ages in their definition of child pornography.)
Over the next months, Sudbury police did background checks on Mr. Wade, to make sure no one was piggybacking on his account. “You still got to verify if that address is there. Is that person associated with that address? We did a door knock,” Sgt. Burtt said.
Meanwhile, across Canada, the German information also trickled to local authorities. Ontario’s Peel Regional Police investigated a resident in suburban Brampton. In northern B.C., the RCMP detachment in Surrey, B.C., closed in on an elementary-school principal in Fort Nelson. The Sûreté du Québec had 27 suspects.
THE CONSTITUTIONAL ISSUE
The PIPEDA requests in Operation Penalty took place at a time when the process was being challenged in court.
Nine days before the information came from Germany, in September, 2006, justice of the peace Mark Conacher refused to recognized the PIPEDA process in a probe against a Toronto firefighter.
The Toronto police reapplied successfully before a judge. Afterward, Toronto police and the RCMP in Ottawa had discussions but decided to keep using the requests.
By January, 2008, a number of Operation Penalty suspects were already before the court while 27 were still to be arrested in Quebec, when a judge invalidated the PIPEDA requests system.
Ontario Court Justice William Gorewich ruled that Toronto police had violated the privacy rights of a Markham man, Arthur Kwok, when it used a warrantless PIPEDA request to identify him as the man who traded child pornography in a private chat room.
Some of the men caught in the Operation Penalty dragnet later invoked the Kwok decision in an attempt to get the courts to throw out the evidence against them.
Mr. Ward was one of the first to try, but in June, 2008, he failed and was found guilty. The Crown successfully argued that, to obtain an Internet connection, Mr. Ward had signed a term of service where Bell warned it could share personal information with police as required by law.
Other challenges failed on the same arguments.
The Supreme Court is now deciding the case of Mr. Spencer, which has similar issues.
When the Supreme Court heard the case last December, a recurring concern was the way the current system had developed, from arrangements between police and private sector to relying on the fine print of service contracts.
“The problem, I say, is that this deal between ISPs [Internet service providers] and the police is trying to serve the function of law, but it’s not law,” said Mr. Ward’s former lawyer, Jonathan Dawe, who was representing the Criminal Lawyers’ Association Of Ontario.
Two of the justices, Louis LeBel and Andromache Karakatsanis, wondered about the dynamic nature of IP addresses but the lawyers at the hearing were unable to provide technical details.
Justice Rosalie Abella, who asked the more probing questions about the police’s behaviour, wondered why detectives took a chance with PIPEDA requests, knowing it could be a grey legal area.
“Where is the sin in choosing the easier road if it’s legal?” Saskatchewan senior Crown prosecutor Anthony Gerein replied.
On Friday, the top court will rule if indeed the easier road is legal.