Milling around in the World of Internet Privacy

View fullsize

Sean Mills was chatting online. He thought he was chatting to a young girl. He was, in fact, chatting with a police officer. The officer had created an online profile portraying himself as a 14 year old girl. Mills contacted him and then began to chat. Eventually a meeting was set up. Mills was arrested at the meeting. The police had captured the chats between Mills and the officer. The trial judge explained this process.

[6]        …  In order to ensure that he had captured all the information on the screen, Constable Hobbs employed a program called “Snagit” which allows the computer user to capture and copy the information on the screen.  Snagit is a screen shot program that captures video display and audio output.  Constable Hobbs employed the Snagit program on each of his communications with Mr. Mills. 

[7]        The “Snagit” program is a program that is available to the public and commonly used.

Mills was convicted after trial and appealed: 2017 NLCA 12. On appeal to the Newfoundland Court of Appeal the court considered (i) whether Mills had a reasonable expectation of privacy [REP] and (ii) whether there was an "interception" within the meaning of Part VI of the Criminal Code.

With respect to the REP issue, the court rejected the notion that Mills had an objectively reasonable expectation of privacy:

In this case, the analysis focuses on the third and fourth headings identified in Spencer; that is, Mr. Mills’ subjective expectation of privacy in his communications with “Leann” and whether that subjective expectation was objectively reasonable in the circumstances.  Mr. Mills was using electronic social media to communicate and share information with a person he did not know and whose identity he could not confirm.  On an objective analysis, as the sender of such communications, Mr. Mills must have known that he lost control over any expectation of confidentiality that he appears to have hoped would be exercised by the recipient of the messages.  He took a risk when he voluntarily communicated with someone he did not know, a person he was not in a position to trust.  Any subjective expectation of privacy Mr. Mills may have had was not objectively reasonable.  In the absence of a reasonable expectation of privacy, section 8 of the Charter was not engaged. [@23].

With respect to whether there was an intercept, the court held that an "intercept" requires the participation of a third party - the after-the-fact capture of the communication between two parties did not amount to an "intercept".

That language does not alter the ordinary meaning of an interception which requires the involvement of a third party.  Where there is direct communication between two people, the intended recipient cannot be characterized as having “intercepted” a communication meant for that person. 

Further, the fact, unknown to the sender, that the recipient is a police officer cannot change the nature of the communication or transform a receipt by the intended recipient into an interception.  Viewed from another perspective, if “Leann” had, in fact, been a fourteen year old girl, it could not be said that her receipt of the communications from Mr. Mills constituted an interception. [@13-14].

Mills is one in a series of recent decisions on these issues. The REP ruling is particularly helpful and an important one that helps the continuing body of law considering REP in an internet world post-Spencer. The "intercept" ruling is interesting. It is arguably a narrower interpretation of "intercept" than that advanced in Telus as it requires the direct involvement of a "third party" to constitute an intercept. 

DM

Common Privacy?

Matthew Wawrykiewicz was in a hotel room. There was a complaint. The police were called. They entered the hotel room. Found drugs. Wawrykiewicz was arrested. Later the police were able to identify another address connected to the accused – 105 The Queensway. The police began surveillance at that address. They later obtained and executed a warrant. They located more drugs.

At trial Wawrykiewicz sought to exclude the evidence found at 105 The Queensway – in part he argued that the initial entry into the hotel room was unlawful and thus the subsequent search at 105 was unlawful. The trial judge agreed, but admitted the evidence under s24(2): 2017 ONSC 569.

As part of the defence Charter motion, Wawrykiewicz argued that the police surveillance at 105 The Queensawy – which included surveilling him and Poulter (who was also found in the hotel) in common areas of that building – violated s8: see R v White, 2015 ONCA 508. The trial judge disagreed.    

Prior to White was authority for the proposition that there is little or no expectation of privacy in the common areas of an apartment building: R. v. Piasentini, [2000] O.J. No. 3319 (Sup.Ct.); R. v. Thomsen, [2005] O.J. No. 6303 (Sup.Ct.).  As Wein J. pointed out in Piasentini, a contextual analysis is required that requires applying the factors set out in R. v. Edwards, 1996 CanLII 255 (SCC), [1996] 1 S.C.R. 128.

The court then reviewed rulings in R v Barton, 2016 ONSC 8003 and R v Brewster, 2016 ONSC 4133 noting and adopting, inter alia, the following factors set out in that latter ruling:

• The police must be engaged in activity that constitutes a search: R. v. Evans, 1996 CanLII 248 (SCC), [1996] 1 S.C.R. 8; Hunter v. Southam, 1984 CanLII 33 (SCC), [1984] 2 S.C.R. 145;
• There must be a reasonable expectation of privacy in the place to be searched, which is determined from a contextual analysis: R. v. Edwards, supra; R. v. Tessling, 2004 SCC 67 (CanLII), [2004] 3 S.C.R. 432; R. v. Plant, [1993] 3 S.C.R. d281;
• There is no reasonable expectation of privacy in observations of a underground parking garages in order to determine an association between an accused person and a building: R. v. Drakes and Brewster, 2009 ONCA 560 (CanLII);
• There is no reasonable expectation of privacy from non-obtrusive observations made in the elevators and hallways of multi-unit buildings.  That includes observations of odours emanating into the common areas or the number of a unit where the suspect enters and exits: R. v. Laurin (1997), 1997 CanLII 775 (ON CA), 113 C.C.C. (3d) 519 (Ont.C.A.); R. v. Thomsen, supra;
• Section 8 of the Charter is only engaged where the police “go beyond making observations that are externally visible or externally emanating into the common areas”: R. v. Laurin, supra; R. v. White, supra.

Turning to the facts the court noted:

1. The police conducted surveillance in the elevator, the lobby and on one of the floors
2. Wawrykiewicz was observed exiting 1905 and using a key to lock the door
3. Wawrykiewicz was observed using a key fob to gain entry into the building
4. There was no evidence regarding the actual connection he had to this residence
5. Wawrykiewicz had bail conditions that required him to reside at a different address

Based on these facts the judge concluded:

I accept that a person may have more than one residence, but in the absence of any further evidence I cannot conclude that Mr. Wawrykiewicz’s expectation of privacy at 105 The Queensway was high.  I therefore find that he had even less of an expectation of privacy in the common areas.

I also cannot conclude that the police engaged in the type of intrusive behaviour that they did White.  They did not cock an ear to a door in order to eavesdrop on a private conversation.  They did not try to determine what Mr. Wawrykiewicz and Ms. Poulter were up to in Unit 1905.  Their sole purpose was to determine whether there was a connection between Mr. Wawrykiewicz and that unit.  As noted by Code J., there is no expectation of privacy in the unit number in a multi-unit building.  I therefore find that there was no stand-alone violation of s. 8 of the Charter in respect of Unit 1905 of The Queensway. @55-56

The Ontario Court of Appeal’s ruling in White has been the subject of much discussion since its release. Putting aside the conduct of the police in that case, the concept of creating an expectation of privacy in common areas is somewhat controversial, or at least subject to much discussion regarding its scope. Wawrykiewicz is a helpful ruling clarify this issue.

DM

Not so Black and White

View fullsize

Merith White lived in a condominium unit. The police searched it. Evidence obtained during that search led to him being charged with drug trafficking and possession of stolen property. He was acquitted - as a result of evidence being excluded under section 24(2) after the trial judge found that the search violated section 8. The Crown appealed. That appeal was dismissed: 2015 ONCA 508.

White lived in a condominium unit. It was one of 10 in a four story building. That unit was visited by Yianni Papadolias. Unfortunately for White, the police had Papadolias under surveillance via GPS tracking. The police suspected Papadolias was involved in drug trafficking.

As a result of that information, an officer entered the condominium unit on three occasions. On the first occasion he followed a postal worker in through the front door which was otherwise locked. On the second and third occasions he entered an doorway that would normally be locked, but for reasons not fully explained, the door was not locked and the officer entered. As a result of observations made during those entries the police obtained a warrant to enter White's residence.

At trial White successfully excluded the results of the search on the basis that it violated section 8. The Crown appealed.

On appeal the court cited Edwards and noted the factors set out therein. The court also recognized that there were "lower courts" that had found no expectation of privacy in "common areas of multi-unit buildings" - but the court rejected the applicability of those cases: 

It is clear that lower courts have rendered decisions rejecting reasonable expectation of privacy claims in several cases involving the common areas of multi-unit buildings: see e.g. R. v. Piasentini, [2000] O.J. No. 3319 (S.C.J.); R. v. Simpson, [2005] O.J. No. 5056 (S.C.J.), rev’d on other grounds 2007 ONCA 793 (CanLII), 231 O.A.C. 19; R. v. Nguyen, 2008 ABQB 721 (CanLII),462 A.R. 240, aff’d 2010 ABCA 146 (CanLII), 477 A.R. 395; and R. v. Verrett, 2013 ABQB 658 (CanLII), 574 A.R. 212. But the lesson from Edwards is that the reasonable expectation of privacy is a context-specific concept that is not amenable to categorical answers. A number of considerations may be relevant in determining whether an expectation of privacy is reasonable in the context of particular multi-unit buildings, albeit that none of them is dispositive. The Edwards factors must be considered as a whole, having regard to the particular circumstances of each case. [@44].

Having rejected the applicability of those cases, the court offered the following (in part) as the basis for concluding that White had a reasonable expectation of privacy in the common areas and thus the entry thereto constituted a violation of section 8:

Although the respondent did not have absolute control over access to the building, it was reasonable for him to expect that the building’s security system would operate to exclude strangers, including the police, from entering the common areas of his building several times without permission or invitation and investigating at their leisure. It was reasonable for him to assume that although access to the building’s storage area was not regulated, it was not open to the general public. And it was reasonable for him to assume that people would not be hiding in stairwells to observe the comings and goings and overhear the conversations and actions within his unit.

In any event, the fact that a relatively large number of people may have access to a building’s common areas need not operate to eliminate a reasonable expectation of privacy. It is one thing to contemplate that neighbours and their guests, all of whom may be strangers to another resident, might be present in the common areas of a building, but another to say that a resident has no reasonable expectation of privacy as a result. An expectation of privacy may be attenuated in particular circumstances without being eliminated. [@47-48].

The court further upheld the trial judge's conclusion that the exclusion of the evidence under 24(2) was no in error.

With respect, it is not easy to accept these conclusions.

First, to the extent there was any expectation of privacy, it was significantly diminished and not breached by the police. The court does not discuss explicitly the nature of the privacy interest at play, but it seems clear that it must be territorial. Here, however, the territorial privacy is one that the court acknowledged was accessible by others - including strangers to the accused. Moreover, while the police did not have permission to access the area, they did not do anything illegal to access the area. Indeed, on two occasions, they entered through an unlocked door. In short, while territorial privacy interests can be significant, here, where they are impacted by strangers and accessed so easily, the nature (if any) of such an expectation is significantly diminished.

Second, applying the Edwards factors does not reveal an objective basis for the expectation: (i) the accused was not present at the time; (ii) the accused could permit access, but had no real control over access; (iii) the accused had no "ownership" over the common areas; (iv) while he did have historical use over this area, many others did as well; (v) the accused has no real ability to regulate access (other than to permit). What remains are subjective and objective assessments of the accused's expectation of privacy. In light of these it is hard to accept that there is an objective expectation of privacy from plain view observations in such common areas.

Third, even if there was a breach, it is not obvious that the evidence should be excluded. If the above analysis is, at least, reasonable, the seriousness of the breach must be minimal. The evidence obtained is reliable. The offence is serious. In these circumstances, exclusion should not follow.

DM

Expecting privacy, you might have to say so

View fullsize

Richard Steele had a loaded, prohibited, semi-automatic handgun. He decided to take it with him when he went for a drive with his friend, White, in his mother’s car; Steele sat in the passenger seat. It was about 2 am when officer Stephens spotted the vehicle and pulled it over; the officer did so with the intention to check for proper documentation and to check on the sobriety of the driver.

Officer Stephens approached the car and asked White (who was driving) for a licence and the ownership. The car was registered to a Valarie Steele – the mother of Richard Steele. White told the officer the car belonged to a friend’s mother; there was no indication that the friend was the passenger, Richard Steele [para 7]. Steele remained silent throughout this exchange. White seemed nervous, but appeared to be cooperative. Officer Stephens offered to help him find his documentation, White accepted that offer. The other occupants were asked to step out of the vehicle and officer Stephens went to the passenger side of the vehicle and attempted to locate the documents in the glove box. Instead, officer Stephens spotted, under the seat, Steele’s loaded handgun.

Steele was arrested and charged. At trial he sought to exclude the evidence of the gun arguing that the search violated section 8. The trial judge dismissed the motion and convicted Steele. Steele appealed: 2015 ONCA 169.

Pardu J wrote the judgement for the court. Pardu J began by considering whether or not Steele had a reasonable expectation of privacy in the car. Citing R v Edwards, [1996] 1 SCR 128 and R v Belnavis, [1997] 3 SCR 341 and outlined relevant factors in this consideration; Pardu J also noted the Supreme Court’s recent consideration of this issue in R v Cole, 2012 SCC 53 and identified the “four lines of inquiry” to guide this test: "(1) an examination of the subject matter of the alleged search; (2) a determination as to whether the claimant had a direct interest in the subject matter; (3) an inquiry into whether the claimant had a subjective expectation of privacy in the subject matter; and (4) an assessment as to whether this subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances".

With those factors in mind, Pardu J concluded that Steele had no expectation of privacy:

In the circumstances of the present case, the appellant did not have a reasonable expectation of privacy in the car. The appellant was a passenger in the vehicle at the time of the search, and he was authorized by his mother, at the very least, to be a passenger in the vehicle. However, the appellant’s degree of possession or control, historical use, or ability to regulate access to the vehicle is unknown.

In general, it would be objectively reasonable for an individual using a family member’s car to have a reasonable expectation of privacy in that vehicle. Here though, the appellant did not identify himself as a person to whom the car had been loaned, and he did not indicate his connection to the vehicle’s owner. He was only a passenger in a vehicle driven by another person who claimed to have borrowed the car. Further, the police had no reason to believe that the appellant had any connection to the vehicle other than as a passenger. Moreover, the driver was attempting to produce required documentation to police, and had apparent control of the vehicle. Under these circumstances, there is no basis for a person in the appellant’s position to have subjectively expected privacy in the vehicle. [Emphasis added]; [@19-20].

Steele is a helpful case that illustrates the importance of a principled and substantive, as opposed to formulaic, consideration of the issue: see paras 16-17. In particular, despite the fact that the car belonged to Steele’s mother and she knew he had it, the absence of evidence from Steele himself (see similar comments in R v Lattif, 2015 ONSC 1580) and absence of evidence provided to the officer, in part, undermined any claim that he had a reasonable expectation of privacy at the time.

DM

New & Notable: Privacy of Anonymity Protected

View fullsize

In a blog posting on February 11, 2013 Brian Holowka discussed the case of Matthew Spencer – a case decided by the Saskatchewan Court of Appeal: 2011 SKCA 144 – which dealt with the issue of whether persons have a reasonable expectation of privacy in their personal identifiers held by their ISP company.

Today the Supreme Court released its ruling on appeal from that decision: 2014 SCC 43. In short, it held that Spencer did have a reasonable expectation of privacy in his name and other personal identifiers as held by his ISP, Shaw Communications, that related to the IP address linked to his computer.

The facts – as set out in the previous post – may be succinctly summarized as follows:

Matthew Spencer used a popular file-sharing program called “LimeWire” to obtain a large number of files containing child pornography. He kept these files in a shared folder on his computer. Others similar users of the file-sharing program could view and download these files.

An officer with the Saskatoon Police Service used the “LimeWire” program and discovered the child pornography files in this shared folder. The IP address associated with the computer hosting the shared folder was publicly available and easily ascertainable by the police. The police wrote to Shaw Communications, the ISP, requesting the customer information associated with the IP address at the date and time relevant to the discovery. This kind of information is often referred to as customer name and address or CNA. The request was made pursuant to the Personal Information Protection and Electronic Documents Act (PIPEDA).

Shaw complied with the PIPEDA request and armed with this information, the police obtained a search warrant to search the home. The computer was located, seized and searched. Child pornography was located on the hard drive of the computer.

On appeal the Court considered whether Spencer had a reasonable expectation of privacy. That consideration began by determining his subjective expectation which was driven by two considerations: (i) the subject matter of the search; and (ii) the nature of the privacy interest potentially compromised.

With respect to the subject matter, the court noted that in some cases this is easily discerned, in others it is more nuanced and complex. In this case, the determination of the subject matter fell into the latter category and in such cases the court should take “a broad and functional approach to the question, examining the connection between the police investigative technique and the privacy interest at stake” [para 26]. In doing so courts should looked “not only the nature of the precise information sought, but also at the nature of the information that it reveals” [emphasis added]; [para 26].

Put another way, the Court held that courts should not look “narrowly at physical acts involved but should consider the nature of the privacy interest impact: para 31.

In the present case the Court concluded on this point with the following:

The subject matter of the search was not simply a name and address of someone in a contractual relationship with Shaw. Rather, it was the identity of an Internet subscriber which corresponded to particular Internet usage. As Cameron J.A. put it, at para. 35 of Trapp:

To label information of this kind as mere “subscriber information” or “customer information”, or nothing but “name, address, and telephone number information”, tends to obscure its true nature. I say this because these characterizations gloss over the significance of an IP address and what such an address, once identified with a particular individual, is capable of revealing about that individual, including the individual’s online activity in the home.

Here, the subject matter of the search is the identity of a subscriber whose Internet connection is linked to particular, monitored Internet activity [emphasis added]; [paras 32-33].

With respect to the nature of the privacy interest, the Court first identified the privacy interest at stake as being “informational” and noted:

To return to informational privacy, it seems to me that privacy in relation to information includes at least three conceptually distinct although overlapping understandings of what privacy is. These are privacy as secrecy, privacy as control and privacy as anonymity [para 38].

After setting out the framework for the analysis of each of these privacy interests, the Court identified an intrusion into the “privacy as anonymity” and concluded:

In the circumstances of this case, the police request to link a given IP address to subscriber information was in effect a request to link a specific person (or a limited number of persons in the case of shared Internet services) to specific online activities. This sort of request engages the anonymity aspect of the informational privacy interest by attempting to link the suspect with anonymously undertaken online activities, activities which have been recognized by the Court in other circumstances as engaging significant privacy interests: R. v. Morelli, 2010 SCC 8, [2010] 1 S.C.R. 253, at para. 3; Cole, at para. 47; R. v. Vu, 2013 SCC 60, [2013] 3 S.C.R. 657, at paras. 40-45.

I conclude therefore that the police request to Shaw for subscriber information corresponding to specifically observed, anonymous Internet activity engages a high level of informational privacy [emphasis added]; [para 50-51].

In undertaking this analysis the Court drew the conclusion that Spencer had a subjective expectation of privacy.

Turning to determine whether such an expectation was reasonable, the Court discussed the implications of PIPEDA and the reliance thereon for the disclosure in question. In particular, Spencer argued that the contractual and statutory terms of his agreement with Shaw (the ISP) did not undermine his expectation of privacy. While recognizing that PIPEDA sets outs as a guiding principle that an organization may disclose personal information as they feel appropriate, this principle does not apply where the police seek such information – as opposed to the ISP discovering it and providing it on their own initiative. Where the police request the information they must have a “lawful authority”.

...s. 7(3)(c.1)(ii) of PIPEDA…permits disclosure only if a request is made by a government institution with “lawful authority” to request the disclosure. It is reasonable to expect that an organization bound by PIPEDA will respect its statutory obligations with respect to personal information [para 63].

The Court concluded that Spencer’s expectation of privacy was reasonable:

In my view, in the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information. The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous. A request by a police officer that an ISP voluntarily disclose such information amounts to a search [para 66].

DGM