Rejecting government fears of a "crime-friendly Internet," the Supreme Court of Canada said anonymity is vital to personal privacy in the digital era. It told police they need a judge's permission before asking Internet providers for basic information that would identify their customers – such as a suspected child pornographer at the heart of a 2007 Saskatchewan investigation.
Legal observers called the unanimous ruling a privacy landmark, with implications for everything from child porn investigations to snooping by national security agencies to police powers under the Conservative government's cyberbullying bill.
David Fraser, a Halifax privacy lawyer, said that "the message to police is 'Come back with a warrant;' customers' names and addresses are not as innocuous as police might think, or want us to believe." The Conservative government would not say whether it would amend proposed laws that expand the sharing of that kind of private information.
Paul Gillespie, a former head of the Toronto Police Service's child exploitation unit, said the ruling creates major practical problems for police.
"The challenge is that there are tens of thousands of Canadian computers actively trading images of child abuse and Canadian police only arrest about 500 people a year. This additional court order will impose an increased investigative workload on the police who are already overwhelmed."
Internet providers "will now have to process many more court orders, which will likely lead to greater backlogs. This is a major problem when you are talking about crimes against children," Mr. Gillespie said.
Friday's ruling came after a 2007 child pornography investigation in which Saskatoon police, acting without a warrant, asked Shaw Communications for information on a user, and Shaw complied. That request led ultimately to the arrest and conviction of Matthew Spencer for possession of child pornography. The Supreme Court allowed that conviction to stand, saying police believed they were acting lawfully, and throwing the child-porn evidence out would harm the justice system's reputation.
But in future, Canadian police are on notice — whether they are chasing child pornographers, terrorists or any other criminals — that they need a search warrant, even if they are asking only to obtain the name and home address of a consumer who has signed up for Internet use.
The Saskatoon case forced the judges, most of whom were born before 1950, to determine what Canadians reasonably expect in privacy when they use the Internet. They found a high expectation of privacy, with anonymity a "foundation" of that right.
The federal Director of Public Prosecutions had warned that "recognizing a right to online anonymity would carve out a crime-friendly Internet landscape by impeding the effective investigation and prosecution of online crime." But Justice Thomas Cromwell, writing for the court, said the ruling "falls short of recognizing any 'right' to anonymity," though "there may be a privacy interest in anonymity depending on the circumstances." In any event, police could have obtained a court order to oblige Shaw to give over the subscriber information, he said.
Mr. Spencer had made child pornography available over a widely accessible file-sharing network known as LimeWire, and Saskatchewan prosecutors argued that this kind of outrageous public activity would justify a police question to an Internet provider.
"If someone set up a stand at a public market and left child pornography lying around, a reasonable person would expect someone to notice and the police to investigate," Saskatchewan said in a brief filed with the Supreme Court. "The police would no doubt arrest the individual at once. If the person who set up the stand was not around, though, the police would surely investigate, perhaps asking others at the market the identity and location of the stand's owner, or linking the stand to the vehicle that brought it to the market."
But the court said that to know the basic subscriber information is to potentially unlock detailed information about what they are using the Internet for. "The Internet has exponentially increased both the quality and quantity of information that is stored about Internet users. Browsing logs, for example, may provide detailed information about users' interests. Search engines may gather records of users' search terms."