Police get warrantless access to Sympatico customer's data

Another case from Ontario about police getting warrantless access to personal information from an internet service provider, in this case Bell Sympatico. For previous cases, see this link.

The justification is based on a particular reading of Section 7 of PIPEDA, and Bell Canada deciding it should hand over the information. I don't agree with this interpretation of s. 7 and I also don't think the Bell should have handed customer information over without a warrant, even if it legally could do so.

Police may have access to your online history

TORONTO - An Ontario Superior Court ruling could open the door to police routinely using Internet Protocol addresses to find out the names of people online, without any need for a search warrant.

Justice Lynne Leitch found there is "no reasonable expectation of privacy" in subscriber information kept by Internet Service Providers, in a decision issued earlier this week.

The decision is binding on lower courts in Ontario and it is the first time a Superior Court level judge in Canada has ruled on whether there are privacy rights in this information that are protected by the charter. The ruling is a significant victory for police investigating crimes such as possession of child pornography, while privacy advocates warn there are broad implications even for law-abiding users of the Internet.

"There is no confidentiality left on the Internet if this ruling stands," said James Stribopoulos, a professor at Osgoode Hall Law School in Toronto.

Canada's privacy commissioner also warned Thursday the Conservative government's plans to revive legislation that would force Internet Service Providers to allow police to intercept Internet-based conversations "is a serious step forward toward mass surveillance" that violates the privacy rights of Canadians.

"My concerns are a huge increase in surveillance powers," Jennifer Stoddart told a news conference Thursday. "I understand there are technological challenges for the forces of law and order . . . but is this the only way this can be done?"

Police and the Canadian Security Intelligence Service already have the power to wiretap private communications, but the laws were written before the era of the Internet and wireless technologies such as mobile phones.

A "modernization" bill was first introduced by the former Liberal government and the Conservatives have promised for years to revive the legislation, which privacy advocates oppose because they say it could broaden the power of authorities because they could reach back for months of communications.

Public Safety Minister Peter Van Loan, who assumed the portfolio in November, told a House of Commons committee this week that he will move forward with a bill, which his predecessor, Stockwell Day, relegated to a back burner.

The court ruling by Leitch was made in a possession of child pornography case in southwestern Ontario.

A police officer in St. Thomas, Ont. faxed a letter to Bell Canada in 2007 seeking subscriber information for an IP address of an Internet user allegedly accessing child pornography. The court heard it was a "standard letter" that had been previously drafted by Bell and the officer "filled in the blanks" with a request that stated it was part of a child sexual exploitation investigation.

Bell provided the information without asking for a search warrant. The name of the subscriber was the wife of the man who was eventually charged with "possession of child pornography" and "making available child pornography."

Most ISPs in the country require search warrants to turn over subscriber information unless it is a child pornography investigation.

Ron Ellis, the lawyer for the defendant, stressed to the judge there was no allegation of attempted luring or of a child in immediate danger. The "making available" charge stems from peer-to-peer websites that permit the downloading of images from other users.

Ellis argued police should have been required to seek a search warrant to obtain the subscriber information.

Leitch accepted the arguments of Crown attorney Elizabeth Maguire the information is similar to what is in a phone book.

"One's name and address or the name and address of your spouse are not biographical information one expects would be kept private from the state," said Leitch.

The reasoning of the judge misses the context of what police are seeking, suggested Stribopoulos.

"It is not just your name. It is your whole Internet surfing history. Up until now, there was privacy. An IP address is not your name it is a 10-digit number. A lot more people would be apprehensive if they knew their name was being left everywhere they went," he said.

This information should require a search warrant by police if there is suspected criminal activity, said Stribopoulos. Judges are accepting the argument that this is "just your name" because "everyone wants to get at the child abusers," he said.

The federal Personal Information Protection Electronics Documents Act permits ISPs to provide this information to someone with "lawful authority," which Leitch interpreted as meaning a police officer and not requiring a court ordered warrant.

There is an irony that exemptions in federal privacy legislation have been used to increase police powers and potentially reduce privacy rights, said Stribopoulos.

The trial of the defendant in St. Thomas will resume this spring.

With a file from Janice Tibbetts, Canwest News Service