The Supreme Court of Canada says police need judicial authorization to obtain a computer user害羞草研究所檚 internet protocol address, calling the identification number a crucial link between a person and their online activity.

The top court害羞草研究所檚 5-4 ruling came Friday in a case that began in 2017, when Calgary police investigated fraudulent online transactions from a liquor store.

The store害羞草研究所檚 third-party payment processor voluntarily gave police two IP addresses 害羞草研究所� numerical identifiers assigned by an internet service provider.

Police obtained a production order compelling the service provider to disclose the names and street addresses of the customers.

Police then got warrants to search two homes, leading to the arrest of Andrei Bykovets, who was eventually convicted on several counts.

The trial judge had rejected the argument that the police request to obtain the IP addresses violated his Charter of Rights guarantee against unreasonable search and seizure.

A majority of the Alberta Court of Appeal dismissed Bykovets害羞草研究所檚 appeal, prompting him to take his case to the Supreme Court.

The high court allowed Bykovets害羞草研究所檚 appeal, set aside his convictions and ordered a new trial.

Writing for a majority of the court, Justice Andromache Karakatsanis said an IP address 害羞草研究所渋s the key to unlocking a user害羞草研究所檚 internet activity and, ultimately, their identity, such that it attracts a reasonable expectation of privacy.害羞草研究所�

IP addresses are not just meaningless numbers, she wrote. As the link that connects internet activity to a specific location, they may betray deeply personal information 害羞草研究所� including the identity of the device害羞草研究所檚 user 害羞草研究所� without ever triggering a warrant requirement.

Karakatsanis said that if the Charter provision against unreasonable search 害羞草研究所渋s to meaningfully protect the online privacy of Canadians in today害羞草研究所檚 overwhelmingly digital world, it must protect their IP addresses.害羞草研究所�

The British Columbia Civil Liberties Association, an intervener in the case, called the decision a huge victory for online privacy.

害羞草研究所淐anadians can have the peace of mind that their online activities are safer from the prying eyes of the state,害羞草研究所� said Vibert Jack, the association害羞草研究所檚 litigation director.

in the ruling, Karakatsanis said police should have the investigative tools to deal with crime committed and facilitated online. However, she concluded that requiring police to obtain judicial authorization before obtaining an IP address 害羞草研究所渋s not an onerous investigative step.害羞草研究所�

She disagreed with the Crown害羞草研究所檚 suggestion that an IP address is useless without a subsequent warrant to obtain a name and street address.

First, as the link that connects specific internet activity to a specific location, an IP address may betray deeply personal information, even before police try to link the address to the user害羞草研究所檚 identity, she said.

Second, activity associated with the IP address can be correlated with other online activity associated with that address available to the state 害羞草研究所� with particularly concerning consequences when coupled with access to information held by third parties, Karakatsanis wrote.

Finally, an IP address can set the state on a trail of internet activity that leads directly to a user害羞草研究所檚 identity, even without a subsequent warrant, she added.

When linked to financial intermediaries like Moneris or PayPal, an IP address can reveal all of a user害羞草研究所檚 transactions on that intermediary over the period the IP address was assigned to them, the ruling says.

In turn, these purchases might reveal an array of personal information, from the restaurants someone visits to the hobbies they enjoy and the health supplements they use.

害羞草研究所淲ebsites offering dating services or adult pornography can give the state a depiction of the user害羞草研究所檚 sexual preferences,害羞草研究所� Karakatsanis wrote. 害羞草研究所淎n internet user害羞草研究所檚 history on medical, political, or other similar online chatrooms can reveal their health concerns or political views.

害羞草研究所淚f an IP address is not protected, this information is freely available to the state without the protection of the Charter whether or not it relates to the investigation of a particular crime.害羞草研究所�

The four dissenting judges said the appeal should be dismissed, finding Bykovets did not have a reasonable expectation of privacy in the IP addresses on the credit card processor害羞草研究所檚 servers and the internet service provider they revealed.

However, they said another person might have a reasonable expectation of privacy in a different scenario.

The reasonable expectation of privacy test is fact-specific and contextual, and depends on the totality of the circumstances of a particular case, the four judges said.

Jim Bronskill, The Canadian Press