For a whole lot of reasons, I don’t have a
whole lot of time to spend on David
Ellis’ lengthy and largely inaccurate posting about the Voltage case and
Teksavvy’s role – or lack thereof - in the current case. Let me simply say:
- There isn’t much difference between not opposing and supporting a motion. Whatever the difference is, it really doesn’t normally matter for practical purposes. A motion that is not opposed will usually be granted;
- Asking for an adjournment is hardly equivalent to “challenging” a motion; and,
- The reference to an “anonymous” opinion that there is a risk to an ISP’s “safe harbor” and “”neutrality” status by standing up for its customers’ privacy under PIPEDA is not helpful. It would be very interesting if any knowledgeable lawyer were to make such a point in their own name.
In the BMG case, the Court
was very concerned that inaccurate and unreliable evidence
could lead to innocent persons
being sued. In paragraph 21, the Court
dealt with the problem of hearsay evidence:
Much of the crucial evidence submitted by the plaintiffs was hearsay
and no grounds are provided for accepting that hearsay evidence. In particular,
the evidence purporting to connect the pseudonyms with the IP addresses was
hearsay thus creating the risk that
innocent persons might have their privacy invaded and also be named as
defendants where it is not warranted. Without this evidence there is no
basis upon which the motion can be granted and for this reason alone the appeal
should be dismissed. (Emphasis added)
In paragraph 43 of its decision, the Court
stated in the context of dated information that:
If there is a lengthy delay between the time the
request for the identities is made by the plaintiffs and the time the
plaintiffs collect their information, there
is a risk that the information as to identity may be inaccurate.
Apparently this is because an IP address may not be associated with the same
individual for long periods of time. Therefore
it is possible that the privacy rights of innocent persons would be infringed
and legal proceedings against such persons would be without justification.
Thus the greatest care should be taken to avoid delay between the investigation
and the request for information. Failure
to take such care might well justify a court in refusing to make a disclosure
order. (Emphasis added)
If, as Mr. Ellis states, there was in the
current instance such a “problem of cleaning up the many false positives and other errors in the
primary evidence, Voltage’s numeric IP file”, then
one might well ask why this alone would not be enough to easily and
successfully oppose the disclosure motion.
See also Jason Koblosvky's response to Mr. Ellis.
HPK
Posts
"Apparently this is because an IP address may not be associated with the same individual for long periods of time."
ReplyDeleteWow. As anyone with even a passing technical acquaintance with home routers will know, an IP address may sometimes only be associated with a particular account for only ten minutes, or even less! If someone connects their high-speed DSL modem to their computer, every time they shut down and restart their computer, there is a reasonable chance they will have a new IP address. If you are having problems with the settings on your home router, you might be connecting and disconnecting every few minutes - and getting a different address each time. Your former address will be promptly given to a different customer account.
As a result, the ISP must keep records of each IP address grant to a customer, so that they can know, for any given moment, who had what address. This is an essential part of the billing cycle, since ISPs track the volume of data sent and received for each account. Without these records, there is NO chance of determining which ISP account was associated with which IP address.
Conversely - as long as the records are kept, there is no limit to far into the past you can reach to determine the IP/account relationship.
Now, some ISPs may, as an ongoing business operation, destroy these records when they are older than a certain date. That may be a valid reason to ensure a *request* for information is made quickly, so that needed business records are not automatically deleted.
However, as part of making the request, it should be reasonable to expect the ISP to lock the records for a particular period, so that they are not lost.
My take on this particular issue is that the court should do the utmost to determine if the available evidence is solid *before* piercing the privacy veil. As long as they make clear to the ISP that the IP address records should not be destroyed, then there will be no problem with the ability to determine which ISP account had an IP address at any time in the future.