Thank the child pornographers for your internet rights to privacy. Then lock them up.

The advancement of internet legal principles is the only good thing to result from child pornography #RvSpencer
– Me, on Twitter, last Friday as I read the case

Sure, quoting yourself from Twitter is pretty dumb. And tragically, my #RvSpencer hashtag never took off. But the point still stands. Illegal activities like child pornography tend to be lightning rods for internet privacy, and the only way we can get landmark internet law cases like last Friday’s R v. Spencer case from the Supreme Court of Canada. And the Court even found a way to keep the child pornography evidence intact while guaranteeing some internet privacy rights. Win-win!

So let’s take a look at the pretty simple facts. Police in Saskatoon were investigating child pornography, and found that someone using a certain IP address was downloading and storing child pornography using the peer-to-peer program LimeWire. Tells you how long cases take to work through the courts considering LimeWire ceased existing in 2010. ANYWAY, the police had the IP address, and traced it back to the ISP, Shaw. Without a warrant (or technically, a “production order”), they asked Shaw (nicely I’m sure) to turn over the name, address, and phone number associated with the IP address. The request from Shaw had some alleged basis in law, as the police relied on s. 7(3) (c.1) (ii) of PIPEDA, which states:

…an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is…
(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that…
(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law (my bold as usual)

So basically what they are saying is that because the files he downloaded contained child pornography which is illegal the user broke the law allowing law enforcement to request the user’s details and the file sharing app were required to comply which seems legit to me. It also means that if the files you downloaded had of contained adult pornography which is legal although not a common practice now with all the free adult porn websites about like https://www.porn-hd.xxx/, legal law enforcement could request the users info but the file sharing app would be under no obligation to provide them with it because the user had not broken any laws, at least I think that’s what it means but I’m not the Supreme Court! We’ll get back to this. Anyway, Shaw turned over the info, which in fact belonged to Spencer’s sister, where Spencer was living. The police then got a warrant and found hundreds of child pornography pictures and videos on Spencer’s computer. Busted. This is just one of the negative things that porn has become. Other sad things to come from peoples thirst for porn is an addiction. Thankfully, pornaddiction.com offers support to people trying to overcome this troubling issue, if you suffer with a porn addiction then maybe some additional reading on that website might help you.

At his trial, Spencer claimed that the his Charter rights had been violated when police got his info from Shaw without any court order or warrant. Section 8 of the Charter states that “Everyone has the right to be secure against unreasonable search or seizure”. The trial judge said sorry buddy, nothing wrong with that, getting ISP subscriber info is not even a “search” so GUILTY GUILTY GUILTY. The Court of Appeal agreed with that assessment. Supreme Court here we come.

Well the Supreme Court kind of disagreed on a few points, but the result is still appeal DENIED. First, the Court disagreed with the lower courts and said in fact it is a search. To get to this, there is some legal mumbo jumbo about past cases and the fact that the Court must look at two things: 1. the subject matter of the search, and 2. the nature of the privacy interest potentially compromised by the state action. I know that’s more law than you wanted to hear, but there is a very important quote in the number 2 of this part of the analysis that bears repeating, because it goes to the nature of internet privacy rights and illegal activities:

The nature of the privacy interest does not depend on whether, in the particular case, privacy shelters legal or illegal activity. The analysis turns on the privacy of the area or the thing being searched and the impact of the search on its target, not the legal or illegal nature of the items sought. To paraphrase Binnie J. in Patrick, the issue is not whether Mr. Spencer had a legitimate privacy interest in concealing his use of the Internet for the purpose of accessing child pornography, but whether people generally have a privacy interest in subscriber information with respect to computers which they use in their home for private purposes

So that’s good to know. Even if your dealing with illegal stuff, you have privacy! Pirate Bay here I come. This analysis goes on for a bit, talking about “informational privacy” (like, on the internet). Here’s a good quote about that for your future speeches:

Recognizing that anonymity is one conception of informational privacy seems to me to be particularly important in the context of Internet usage

And hey, look, the Court understands the internet:

the Internet has exponentially increased both the quality and quantity of information that is stored about Internet users. Browsing logs, for example, may provide detailed information about users’ interests. Search engines may gather records of users’ search terms. Advertisers may track their users across networks of websites, gathering an overview of their interests and concerns. “Cookies” may be used to track consumer habits and may provide information about the options selected within a website, which web pages were visited before and after the visit to the host website and any other personal information provided

Sorry for all the big quotes but this is really important stuff you guys! OK we’re getting to the important bit now, first about anonymity:

The user cannot fully control or even necessarily be aware of who may observe a pattern of online activity, but by remaining anonymous – by guarding the link between the information and the identity of the person to whom it relates – the user can in large measure be assured that the activity remains private

And the clincher about how this relates to subscriber info:

subscriber information, by tending to link particular kinds of information to identifiable individuals, may implicate privacy interests relating not simply to the person’s name or address but to his or her identity as the source, possessor or user of that information(…)
In the circumstances of this case, the police request to link a given IP address to subscriber information was in effect a request to link a specific person…to specific online activities

That’s the key here – the IP address doesn’t give you just the name of the person and their address, it gives you their whole online history. This means that if someone was being perfectly legal and looking at porn you can see if you Visit This Link they would be exposed fully for that despite having done nothing wrong. That’s bad! OK we’re still just talking about whether asking for subscriber info was a “search”. It was, and here is the money quote that wraps it all up:

there is a reasonable expectation of privacy in the subscriber information. The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous. A request by a police officer that an ISP voluntarily disclose such information amounts to a search.

Again, this is important. A request for subscriber info leads to my your “intimate and sensitive activities”. That’s private dammit!

So we have a search. Was it lawful? Fuck and no. Besides the big PIPEDA clause I wrote out above (ok, ok, cut and pasted above), there is a Criminal Code provision (487.014(1) if you care to look it up) that allows for the police to ask someone (say, an ISP) to voluntarily turn over information if they are not legally prevented from turning over that information. Yeah, I know, sounds kind of circular to me too. But the PIPEDA provision and Criminal Code provision together do not provide a new special search power:

Since in the circumstances of this case the police do not have the power to conduct a search for subscriber information in the absence of exigent circumstances or a reasonable law, I do not see how they could gain a new search power through the combination of a declaratory provision [Ed. note: the Criminal Code provision] and a provision enacted to promote the protection of personal information [Ed. note: the PIPEDA provision]

So, unlawful search. BUT, should we exclude the evidence (the child porn pics and videos) we got due to the illegal search? Fuck and no! Lemme explain. The Charter says that if evidence was obtained in violation of Charter rights, it “shall be excluded if it is established that, having regard to all the circumstances, the admission of it in the proceedings would bring the administration of justice into disrepute”. The Court then does a standard analysis of some factors from another famous case from the Supreme Court and determines that yeah, your Charter rights were violated buddy, but if we exclude the evidence, that would bring the administration of justice into disrepute, because child porn is real bad. I’m paraphrasing. The evidence is in, and the Court upholds the conviction on possessing child pornography.

There is another bit in the judgment about the “making available” offense of child pornography, but that has nothing to do with internet law so let’s just ignore it. Point is, there is a real right to privacy in the subscriber information, because there is information about your internet habits associated with that, and the ISP shouldn’t just be turning it over willy-nilly when the police ask.

Super Happy Funtime Analysis Hour!

First, good job Supreme Court! You found some quality right to privacy and anonymity stuff in there, while at the same time keeping the evidence in and upholding the conviction. Can you imagine if the effect of the decision was to let Spencer go free? The Harper government would have had a field day, demanding all sorts of new laws for ISPs to disclose subscriber info and other nefariousness. Remember Bill C-30?

Well, Bill C-30 is dead, but now we have Bill S-4 working its way (and pretty quickly mind you) through the legislative process. Let’s go back to what I wrote in that post I just linked to on S-4. I described how PIPEDA will be amended to allow an organization to disclose personal information (like ISP subscriber info):

(only if the disclosure is) made to another organization and is reasonable for the purposes of investigating a breach of an agreement or a contravention of the laws of Canada or a province that has been, is being or is about to be committed and it is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the investigation;

So it looks like S-4 is granting the power under PIPEDA that the Supreme Court just said doesn’t exist? That there is no basis for it to exist? Hmmm. The government doesn’t seem to give a shit. But given this Spencer ruling, S-4 (not to mention Bill C-13) may have some constitutional issues.

The Privacy Commissioner of Canada says the Government should reconsider C-13 and S-4 in light of this ruling. The Government says bite me. Which side are you on?