If you expect privacy when you’re online, if you think you can anonymously use the Internet without the government finding out who you are and what you’ve accessed, then you’re being unreasonable. That’s what the Ontario Court of Appeals has said, making them the highest court in Canada to rule that privacy laws don’t protect Canadians’ names and addresses from warrantless requests by police.
The case in question, of course, involves child pornography. David Ward of Sudbury was convicted of possessing pornographic images and videos of children. Police found him after German authorities handed them an I.P. address linked to a Canadian Internet account, provided by Bell Sympatico. The cops took the I.P. number to Bell and told them it was a child porn case, and Bell handed over Ward’s name and address. With that, police were able to get a search warrant, which they used to seize Ward’s incriminating hard drive. The service agreement Ward had signed with Bell gave them the right to surrender his identity in the event of a criminal investigation, and, as we now know, no Canadian privacy law trumps that contract.
Why should we care? Locking up child porn users sounds like a good idea to most Canadians, and Ward’s case is unlikely to cause much of a stir. But that’s exactly why child porn cases are often used to set privacy-eroding precedents. Nobody wants to look like they don’t care about the suffering and exploitation of children, so it’s easy to ignore the larger implications of precedents set in the handling of pornography cases.
Which this: police are now able to invade a person’s home and seize their property based on the fact that an I.P. address they rent is linked to a crime. An I.P. address is not a person. Often, a number of people under one roof use the same I.P. address. An I.P. address isn’t a fingerprint either. If a wi-fi connection is unprotected, anyone nearby can use it. I.P. spoofing allows users to hide their real I.P. addresses and use a fake one. If these fake addresses ever match a real one assigned to a third party, police investigations may incriminate innocent people.
It’s like getting a full body-cavity search because your cousin was spotted shoplifting. Or it’s like a SWAT team barging into your house and upturning your belonging because somebody robbed a bank with a “you” mask on. Actually, it’s worse than either of those things, because scrutinizing a hard drive can be far more invasive than scrutinizing a person’s body or belongings. It’s closer to forced mind-reading.
Am I overstating this? I hope so. Right now, we can hope that this erosion of privacy law will only be applied to cases in which the crime is atrocious and the suspect turns out to be guilty. But today’s legal precedents will be used to investigate tomorrow’s crimes, which will be committed using tomorrow’s technologies.
Criminals who know they are doing wrong online will grow ever-more capable of dancing around I.P.-based identification. The rest of us will grow ever more likely of turning up as “false-positives.”
Follow Jesse on Twitter @JesseBrown