Police  searches  for  info  from  private  computers

Originally when police investigators were searching for information about suspects they were investigating, they would either infiltrate their gangs or group of friends or alternatively, sneak up to windows at night and listen to conversations. The latter technique was called “eaves dropping” (implying lowering oneself down from the eaves of a house).  The investigators stood under the eaves of houses next to the windows to listen to conversations inside the houses. There was a time when police officers would go to libraries and search the history of borrowers who borrowed books from the library to see if the borrower was searching for information how to make bombs etc. Then as time moved on, they would tap the phones of their suspects. But to do that, they needed a court order to do it. Then the era of private computers arrived. The police realized that there was a great amount of conversations taking place in the Internet so the police began tapping the computers of their suspects for evidence that could be used against them.

         

In the United States, the National Security Agency (NSA) had placed software on nearly 100,000 of its computers around the world that allowed it to conduct covert surveillance on private computers. The technology gave the agency access to private computer networks by creating a virtual highway into the computers of its citizens. It wasn’t long before the police in Canada caught on that there was a trove of information in the computers of the people of Canada who had them so they began searching through their computers to elicit information they were seeking.  And like the NSA, they too did this without first obtaining a court order to do so.

This article is about what happened when the police in Canada decided to search into a suspect’s personal computer by tapping into it from the police computer. The police identified the Internet Protocol (IP) address of a computer of someone who had been accessing and storing child pornography through an Internet file sharing program.  They then obtained from the Internet Service Provider (ISP) without first getting judicial authorization, the subscriber information (name and street address) associated with that IP address.

Mr. Matthew David Spencer, who lived with his sister was connected to the Internet through an account registered in his sister’s name. He used the file-sharing program LimeWire on his desktop computer to download child pornography from the Internet. LimeWire is a free peer-to-peer file-sharing program that, at the time, anyone could download onto their computer. Peer-to-peer systems such as LimeWire allow users to download files directly from the computers of other users. LimeWire does not have one central database of files, but instead relies on its users to share their files directly with others. It is commonly used to download music and movies and can also be used to download both adult and child pornography. It was Mr. Spencer’s use of the file-sharing software that brought him to the attention of the police and which ultimately led to the search that is at issue in this case. He was charged and convicted being in in possession of child pornography but acquitted of distributing it to others.

At trial, Mr. Spencer sought to exclude the evidence found on his computer on the basis that the police actions in obtaining his IP address from Shaw without prior judicial authorization amounted to an unreasonable search contrary to section 8 of the Canadian Charter Rights and Freedoms. The trial judge rejected this contention and convicted Mr. Spencer of the possession count. It acquitted him of distributing child pornography. On appeal, the Saskatchewan Court of Appeal upheld the judge’s decision with respect to the search issue that result in his conviction of being in possession of child pornography.

The prosecution appealed the acquittal and Spencer appealed his conviction and subsequently, the matter finally ended up in the Supreme Court of Canada.  The appeal to this Court raised four main issues that are as follows;

1.      Did the police obtaining the subscriber information matching the IP address from the ISP constitute a search?

2.      If so, was the search authorized by law?

3.      If not, should the evidence obtained as a result be excluded?

4.     Did the trial judge err with respect to the fault element of the

“making available” offence?

The main issue in this case was whether or not the police could search private computers without first obtaining a court warrant to do so. A warrantless search, such as the one that occurred in this case, is presumptively unreasonable according to Canada’s Constitution.

We all know how easy it is to find something on the Internet by going to one of the Internet’s search engines. It can also be just as easy for the police to do a mass search of everyone’s computer to find out if anyone is plotting acts of terrorism or is searching for child pornography.  All they would have to do if they were searching for the latter is to type in key words such as “child pornography” or “sex with children” etc. Sooner or later, they would discover private computers where the users had been searching for those particular sites. Then they would search that user’s computer from their own computers and download what they saw and then use that information obtained covertly against the user in a court trial.

The real danger of this kind of covert computer snooping is that eventually, the police could do a mass search for anyone who doesn’t agree with various laws or the government or who don’t like the police.  That kind of snooping would far surpass what George Orwell envisioned when he wrote his novel 1984.

 Whether there is a reasonable expectation of privacy in the totality of the circumstances of a case like this one is assessed by considering and weighing a large number of interrelated factors.  The main dispute in this case turns on the subject matter of the search and whether the accused’s subjective expectation of privacy was reasonable.  The two circumstances relevant to determining the reasonableness of his expectation of privacy in this case are the nature of the privacy interest at stake and the statutory and contractual framework governing the ISP’s disclosure of subscriber information.         

When defining the subject matter of a search, courts have looked not only at the nature of the precise information sought, but also at the nature of the information that it reveals.  In this case, the subject matter of the search was not simply a name and address of someone in a contractual relationship with the ISP.  Rather, it was the identity of an Internet subscriber which corresponded to particular Internet usage. 

                                     

The nature of the privacy interest engaged by the state conduct turns on the specific privacy of the area or the thing being searched and the impact of the search on its target. It does not turn on the legal or illegal nature of the items sought. 

In this particular case that was before the court, was the primary concern dealing with informational privacy.  Informational privacy is often equated with secrecy or confidentiality, and also includes the related but wider notion of control over, access to and use of these kinds of sources of information.  However, particularly important in the context of Internet usage is the understanding of privacy such a as anonymity of the user. The identity of persons linked to their use of the Internet must be recognized as giving rise to a privacy interest beyond that inherent in the person’s name, address and telephone number that can be found in the subscriber information. 

Subscriber information, by tending to link particular kinds of information to identifiable individuals may implicate privacy interests relating to an individual’s identity as the source, possessor or user of that information.  Some degree of anonymity is a feature of much Internet activity and depending on the totality of the circumstances, anonymity may be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure.  In this case, the police request to link a given IP address to subscriber information was in effect a request to link a specific person to specific online activities. This sort of request engages the anonymity aspect of the informational privacy interest by attempting to link the suspect with anonymously undertaken online activities, activities which have been recognized by the police as being illegal.       

There can be no doubt that the contractual and statutory framework may be relevant to, but not necessarily determinant of whether there is a reasonable expectation of privacy.  In this case, the contractual and regulatory frameworks overlap and the relevant provisions provide little assistance in evaluating the reasonableness of the accused’s expectation of privacy. 

It would be reasonable for an Internet user to expect that a simple request by police would not trigger an obligation to disclose personal information or defeat a general prohibition on the disclosure of personal information without consent. 

The contractual provisions the subscriber had with his Internet provider in this case supports the existence of a reasonable expectation of privacy.  The request by the police for assistance from the Internet Service provider had no lawful authority in the sense that while the police could ask, they had no authority to compel compliance with that request without first obtaining a court order. Therefore, the mere request by the police that the ISP voluntarily disclose such information amounted to a request for an illegal search.

Since in the circumstances of this case the police did not have the power to conduct a search for subscriber information in the absence of exigent circumstances (such as extreme emergency) or a reasonable law, the police could not gain a new search power through the combination of a declaratory provision and a provision enacted to promote the protection of personal information. 

The conduct of the search in this case must have surely therefore violated the edicts of the Canadian Charter. Without the subscriber information that had been improperly obtained by the police, the warrant could not have been obtained. It must also follow that if that information was excluded from consideration as it must be because it was unconstitutionally obtained, then there were not adequate grounds to sustain the issuance of the warrant and the search of the residence was therefore unlawful since the police action violated the edicts of the Charter that protected Spencer from an improper search of his IP address. Actually in this case, the information sought by the police simply established the identity of the contractual user of the IP address. 

In previous cases like this one, the courts looked at not only the nature of the precise information sought, but also at the nature of the information that it revealed. It is clear that the tendency of the information sought to support inferences in relation to other personal information in the suspect’s computer must be taken into account in characterizing the subject matter of the search. 

The subject matter of the search was not simply a name and address of someone in a contractual relationship with his Internet Service Provider,  rather, it was specifically Spencer’s search for a particular Internet usage, to wit; child pornography on the Internet. 

To label the search for information of this kind as mere “subscriber information” or “customer information”, or nothing but “name, address, and telephone number information”, tends to obscure its true nature of the police search especially when the police computer is capable of revealing information about that individual, including the individual’s online activity in his home.

That latter aspect of the search is easy to do if the aspect’s computer is on at the time the police computer is searching for information in the suspect’s computer. Years ago when I was having a problem with my computer, a friend of mine who is a computer programmer was at my request, able to make the adjustments on my computer from his own home computer.  It follows that the police can open sites stored in someone’s computer.

Despite the foregoing paragraphs in this article,  Spenser’s Internet Service Provider has a joint privacy policy that states the following;

“You (customer) hereby authorize Shaw( Spencer’s IPS) to cooperate with (i) law enforcement authorities in the investigation of suspected criminal violations, and/or (ii) system administrators at other Internet Service Providers  or other network or computing facilities in order to enforce this Agreement. Such cooperation may include Shaw providing the username, IP address or other identifying information about a subscriber, in accordance with the guidelines set out in Shaw’s Privacy Policy.”

Now you will notice that this doesn’t mean that Shaw can authorize the police to look at anything that Spenser has downloaded into his computer.  Shaw is however committed to protecting personal information, which is defined as information about an identifiable individual such as his name and address providing of course if he gives permission or if it is demanded of them by law.

Shaw and other Internet Service Providers have a legitimate interest in preventing crimes committed through its services so entirely different considerations may apply where an ISP itself detects illegal activity and of its own authority wishes to report this activity to the police.

An Internet search will be reasonable if: (a) it was authorized by law; (b) the law itself was reasonable; and (c) the search was carried out in a reasonable manner.

Justice LaForest of the Supreme Court said in part;

“Mr. Spencer has not challenged the constitutionality of the laws that purportedly authorized the search. He did raise concerns about the reasonableness of the manner [of the search], but in my view, these are groundless. Accordingly, we need only consider whether the search was authorized by law.”

Lawful authority for a search may include several things. It may refer to the common law authority of the police to ask questions relating to matters that are not subject to a reasonable expectation of privacy. It may refer to the authority of police to conduct warrantless searches under exigent circumstances or where authorized by a reasonable law that grants such exceptions.

Justice LaForest also said in his decision;

“The subscriber information obtained by police was used in support of the Information to Obtain (document) which led to the issuance of a warrant to search Ms. Spencer’s residence. Without that information, the warrant could not have been obtained. It follows that if that information is excluded from consideration as it must be because it was unconstitutionally obtained, there were not adequate grounds to sustain the issuance of the warrant, and the search of the residence was therefore unlawful. I conclude, therefore, that the conduct of the search of Ms. Spencer’s residence violated the Charter. Nothing in these reasons addresses or diminishes any existing powers of the police to obtain subscriber information in exigent circumstances such as, for example, where the information is required to prevent imminent bodily harm. There were no such circumstances here.”

Now the real tricky question had to be decided. Should the Evidence Have Been Excluded?  

The Justice said;

“The court must assess and balance the effect of admitting the evidence on society’s confidence in the justice system having regard to: (1) the seriousness of the Charter-infringing state conduct (2) the impact of the breach on the Charter-protected interests of the accused and (3) society’s interest in the adjudication of the case on its merits.”

Let me give you an example. Suppose a police officer capriciously pulls a car over to search for drugs when he has no reason to believe that the car has drugs inside it. He opens the trunk and sees a dead body and upon further search, he discovers the gun that was used and the fingerprints of the driver are on the gun. Can the driver who is obviously the murderer of the deceased person in the truck be convicted of the murder considering that his rights to privacy were violated? In Canada, he could. That is because the community expects justice to override the rights of a murderer. A similar incident occurred in Florida and the man was acquitted because his rights to privacy were consider more important to society in general than letting a murderer get off scott free. However, if a suspect is beaten into confessing to a crime that he committed, his confession would be thrown out because such actions against a citizen is an insult to the well being of its citizens in their relationships with the police who are there to protect them.

The other members of the Supreme Court agreed with Justice LaForest and for this reason, Spencer’s conviction of being in possession of child pornography remained.

The Court of Appeal ordered a new trial on the ‘making available’ count on the basis that the trial judge had erred in his analysis of the fault requirement for the offence. It found that the trial judge had erred by finding that the ‘making available’ offence required that Mr. Spencer knew that some positive act on his part facilitated access by others to the pornography. This error, in the Court of Appeal’s view, led the judge to fail to consider whether Mr. Spencer had been willfully blind to the fact that the pornography was being made available to others through the shared folder.

The Supreme Court agreed with the decision of the Court of Appeal and confirmed that a new trial on that issue should be convened.