We have a reasonable expectation of privacy in online anonymity, rules Supreme Court (of Canada)

Thanks to Danielle and CoOp for inviting me back!  Canadian search and seizure cases can be a fascinating read for Fourth Amendment nerds, since Canada’s courts apply a version of the Katz test to their search and seizure determinations — and have diverged significantly from our Supreme Court in applying that test to a variety of contexts.

Case in point: on Friday the Supreme Court of Canada added a new wrinkle to the debate surrounding the privacy of subscriber information, holding unanimously that the police need a court order to obtain an internet customer’s identification information from an internet service provider.

One of the most interesting aspects of the case is the Court’s reliance on the importance of anonymity to online privacy:

Some degree of anonymity is a feature of much Internet activity and depending on the totality of the circumstances, anonymity may be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure. In this case, the police request to link a given IP address to subscriber information was in effect a request to link a specific person to specific online activities. This sort of request engages the anonymity aspect of the informational privacy interest by attempting to link the suspect with anonymously undertaken online activities, activities which have been recognized in other circumstances as engaging significant privacy interests.

The Court concluded that in the totality of the circumstances in the case, “there is a reasonable expectation of privacy in the subscriber information,” disclosure of which “amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous.” The request by the police that the ISP voluntarily disclose such information therefore amounted to a search triggering constitutional protection.

While anonymity hasn’t played a significant role under US Fourth Amendment law, the Canadian Supreme Court has now made it an integral part of that country’s search and seizure jurisprudence (which has non-trivial parallels with US law). I’ll get a bit deeper into the opinion after the jump, and would be curious to hear whether readers think this development could have an influence — even a small one — on US courts’s jurisprudence regarding privacy expectations surrounding subscriber information and metadata.

Facts

The facts of the case are fairly straightforward (and follow those of the typical child pornography sting).  The police identified the IP address of a computer that someone had been using to access and store child pornography through an Internet file sharing program.They then obtained from the Internet Service Provider, without prior judicial authorization, the subscriber information associated with that IP address.  This led them to the accused, who had downloaded child pornography into a folder that was accessible to other Internet users using the same file sharing program. He was charged and convicted at trial of possession of child pornography, and appealed his conviction on the grounds that the evidence was collected unlawfully.

The Court’s analysis 

The opinion is worth a read. Without getting too deeply into the details, here are some highlights:

Justice Cromwell, writing for the Court, engaged in a subtle — and sometimes academic — analysis of the privacy interests at stake.  The opinion divided informational privacy into “three conceptually distinct although overlapping understandings of what privacy is,” identifying them as “privacy as secrecy, privacy as control and privacy as anonymity.”

In arguing for anonymity as a privacy right, the Court relied (among other things) on scholarship and precedent supporting a right to privacy in public.  It cited Westin’s Privacy and Freedom for the proposition that “[a]nonymity permits individuals to act in public places but to preserve freedom from identification and surveillance”–and referred to a Jones-like Canadian vehicle tracking case holding that “ubiquitous monitoring of a vehicle’s whereabouts on public highways” amounted to a violation of the suspect’s reasonable expectation of privacy.

I would have liked to see this ‘privacy in public’ analogy flushed out a bit more.  As I understand it, the Court’s argument is: your actions may be visible on public streets, as they are online, but they don’t necessarily reveal who you are–and that’s a type of privacy worth protecting both online and off.  It’s a compelling but imperfect analogy.  (To the extent the argument has force, it raises an interesting question: at least five justices on the US Supreme Court agree with the proposition that a reasonable expectation of privacy can exist in public activities (see US v. Jones).  Would those justices also find the jump to a right to online anonymity persuasive?)

As part of its reasonableness analysis, the Court also gave weight to the ISP’s privacy policy, which limited disclosure of subscriber information (without notice/consent) to “exceptional circumstances, as permitted by law.”  The Court seemed to suggest that this factor was not by itself determinative, though it will be interesting to see in future cases whether particular contractual language can swing a case one way or another.

Finally, the Court argued that the interest in anonymity is of heightened importance in the Internet age, where users have little control over what information about them is tracked and stored by third parties:

“[T]he Internet has exponentially increased both the quality and quantity of information that is stored about Internet users. Browsing logs, for example, may provide detailed information about users’ interests. Search engines may gather records of users’ search terms. Advertisers may track their users across networks of websites, gathering an overview of their interests and concerns. “Cookies” may be used to track consumer habits and may provide information about the options selected within a website, which web pages were visited before and after the visit to the host website and any other personal information provided.

Quick thoughts:

1. The Court didn’t give much attention to the very tough question of voluntary disclosures.  As the Court describes it, the police in the case didn’t do any more than ask for the subscriber information–“while the police could ask, they had no authority to compel compliance with that request.”  Presumably, the ISP could have told the police to ‘come back with a warrant,’ as many US internet companies now do with requests for content.  To what extent does the Court’s ruling affect the police’s ability to ask for voluntary disclosures in other contexts?  To what extent would it restrict voluntary disclosures ISPs who haven’t been asked to disclose information by the police?

2. Does the Court’s argument rely on the proposition that we have anonymity online? The Court’s argument seemed (by my reading) to hinge in part on the truth of a factual claim, that there is anonymity online.  That’s a claim that may become increasingly difficult to support as de-identification and other methods are used to trace online conduct back to the biographical information of unique users.  Does the refutation of the claim that we can be truly anonymous online change the Court’s analysis–and the search and seizure calculus?

3. Why did the Court decide to protect online anonymity, rather than the privacy of online conduct itself? Why protect the link between information and a suspect, rather than protect the information itself (in this case, the trail of information associated to the IP address)?  The Court’s answer seems to be that we have an interest in keeping information anonymous, even when it’s not private (which seems to beg the question; why isn’t the information itself private?). A more pragmatic (cynical?) answer might be that focusing on anonymity is simply more administrable than focusing on privacy.  It allows the government to do a whole bunch of stuff  —  track IP addresses and so on — without a court order, and draws a reasonably bright line where they have to get a court order: when they’ve uncovered evidence of a crime, and want to establish a link to an individual.

4. Is there space for a reasonable expectation of anonymity in US search and seizure jurisprudence?  Anonymity has played a role in US First Amendment law, in the US Supreme Court’s cases on associational and expressive freedom such as NAACP v. Alabama and McIntyre v. Ohio Elections Commission. Anonymity has not, however, played as important a role in US Fourth Amendment or privacy jurisprudence. In Whalen v. Roe, the Court expressly rejected the notion of anonymity as an independently enforceable privacy right, limiting its application to where it is required to secure “freedom of association for the purpose of advancing ideas and airing grievances.”

And while First Amendment associational interests are becoming an increasing source of concern in searches and seizure cases — from cell phone searches incident to arrest to the bulk collection of telephone records — the type of anonymity at issue in cases about subscriber data (or requests for search engine data, browsing history, etc.) seems to be broader than merely an interest in private associations.  Anonymity in these cases is, instead, more closely related to what Justice Brandeis characterized as the “right to be let alone,” a right whose source is in the Fourth Amendment.

If the Canadian Supreme Court is correct, anonymity is one of the most important aspects of the right to be let alone in the context of our online lives.  For that argument work in the United States, however — at least in the context of police access to subscriber information — it will have to contend with a couple of US Supreme Court cases from a different time (Smith and US v. Miller), which are, for better or for worse, still the law of this land.  Cue discussion of the 11th Circuit’s recent decision on cell site data.

[As always, the views expressed here are my own and not necessarily those of my employer, or anyone else, for that matter].

You may also like...

1 Response

  1. Fascination case. Interesting reading the opinion of the court. I think it is good they protect the online privacy.