File C-1-24

Coat of Arms

Ottawa, February 23, 2026 – A public version of the confidential decision in file 2025 FC 1978 was issued today by the Honourable Justice Catherine Kane of the Federal Court:

IN THE MATTER OF AN APPLICATION BY […] FOR WARRANTS PURSUANT TO SECTIONS 12 AND 21 OF THE CANADIAN SECURITY INTELLIGENCE SERVICE ACT, RSC 1985, c C-23
AND IN THE MATTER OF CYBER ESPIONAGE, CYBER SABOTAGE, AND CYBER FOREIGN-INFLUENCED ACTIVITIES

Summary:

On February 29, 2024, the Canadian Security Intelligence Service [CSIS] filed a supplemental application pursuant to a condition in the above noted warrant, known as the “cyber warrant,” to execute powers with respect to newly identified infrastructure, in particular, infrastructure associated with certain Internet Protocol [IP] addresses [the Supplemental Application].

In the context of determining the Supplemental Application pursuant to the “cyber warrant,” the Court considered whether additional infrastructure associated with certain IP addresses was lawfully obtained/collected.

Prior to the Court’s determination of the Supplemental Application, the Supreme Court of Canada issued its decision in R v Bykovets, 2024 SCC 6 [Bykovets], which found that individuals have a reasonable expectation of privacy in their IP address, that IP addresses enjoy the protection of section 8 of the Canadian Charter of Rights and Freedoms [Charter], and that the request by the police to a third party for the IP address at issue in that case, without a warrant, violated the reasonable expectation of privacy.

On the Supplemental Application, the Court considered the submissions of the Attorney General of Canada and the amicus curiae appointed by the Court regarding the implications of Bykovets on CSIS’s authority to obtain the IP addresses at issue and to obtain IP addresses more generally.

The Court concluded that the IP addresses at issue in the Supplemental Application were lawfully collected pursuant to section 12 of the Canadian Security Intelligence Service Act [CSIS Act] as non-intrusive collection; in the particular circumstances, the IP addresses at issue did not attract a reasonable expectation of privacy and did not engage section 8 of the Charter.

The Court also concluded that IP addresses collected pursuant to the cyber warrant, in analogous circumstances (for example, where passively received and/or where there is no reasonable expectation of privacy in the particular circumstances), may be lawfully collected as non-intrusive or minimally intrusive pursuant to section 12 of the CSIS Act. In other contexts, where the IP addresses are passively received by CSIS and where there is no “state action,” the IP addresses may be lawfully collected pursuant to section 12 of the CSIS Act.

The Court noted that in Bykovets, the majority characterized the reasonable grounds to suspect standard imposed on law enforcement to obtain a production order for transmission data by telewarrant pursuant to section 487.015 of the Criminal Code (which would collect an IP address) as not onerous. Relying on jurisprudence regarding section 12 of the CSIS Act, the Court found that if the police can obtain a warrant pursuant to the Criminal Code to identify a device on the reasonable grounds to suspect standard and obtain an IP address, then CSIS should be able to collect this same type information pursuant to section 12 of the CSIS Act on the same standard in the national security context; no higher standard should be imposed in the national security context (Mahjoub v Canada (Citizenship and Immigration), 2017 FCA 157 at paras 265-267; X (Re), 2017 FC 1047).

The Court clarified that any collection of IP addresses that is more than a minimal intrusion, including where it has potential to reveal biographical core type information, requires judicial pre-authorization.

The decision is posted on the News Bulletins page of the Federal Court website.

This is a Modal Popup Form