I am Michael Karanicolas, a digital rights lawyer who's just authored a book on surveillance and online privacy. AMA about surveillance, digital rights or free speech.

More and more tech products and services are gathering loads of consumer data. Judging from the growth of Big Data and the popularity of such products, it looks like consumers (in general) don't mind. And yet, we have all of the news about government electronic surveillance.

As a society, how do we balance the desires of consumers for interconnected goods and services against the problem of untrackable, unaccountable government surveillance?

Great question! Corporate surveillance is also troubling, but it doesn't pose the same threat as government surveillance since companies lack the coercive power of the State. Imagine a gay Russian or Ugandan, or a Saudi atheist - the fact that Google and Facebook are tracking their online usage is creepy, but if the State is doing it these people would face a real threat to their lives and freedom. So, the first important point is to make a distinction between these issues.

In terms of the appropriate balance for consumer tracking - apathy and the desire for convenience are real challenges to enforcing proper standards. I think John Oliver pointed out that Apple could probably insert the entire text of Mein Kampf into their TOS agreement and 99% of people would still click right through. At some point though, there has to be a tipping point, and these companies will either face tougher regulation (as we're starting to see in the EU) or will have to conform to a sort of corporate social responsibility on gathering and using private information.

How enforceable are TOS agreements against consumers, considering that nobody reads them?

To clarify my earlier question a bit: can we have a world where corporate surveillance matches consumer preferences BUT there are sufficient safeguards that the government cannot take advantage of that surveillance? Can we let Google into our bedrooms while keeping the NSA out?

Another great point on the nexus between corporate surveillance and State surveillance - since of course the Snowden docs reveal the NSA piggybacking off of Google, Facebook and the like.

TOS agreements have been found to be legally enforceable, but they're also highly problematic in that nobody reads them, so I expect any judge looking at it would apply a high standard of whether the clauses were reasonable.

edited This is not legal advice!

If you're on a call with a company that has a This call may be recorded for quality assurance purposes recording, does that mean they are consenting to being recorded?

This is totally not legal advice

No - it means that YOU are consenting to being recorded.

How is that legal, they record it as soon as you call, is calling somebody classed as consent to be recorded?

I believe the idea is they're telling you you're being recorded, so if you stay on the line, it serves as consent...

I just had my law school convocation yesterday and what you do seems interesting. Any advice to someone just starting law school?

Don't go! Just kidding. I guess that would depend on whether and to what degree you'll be in debt when you graduate. If you can - try and set yourself up for a job you'll enjoy. I'm not saying everyone has to push into public interest work -but I know too many people that I graduated who just hate what they do, and it's no way to live.

No, but seriously: don't go

Haha... well - don't go expecting to find a job in public interest work, because they're thin on the ground, and don't go if it'll put you seriously in debt - because that situation can force you into taking a job you're going to hate just to get a decent income stream.

What is your view on internet piracy?

I feel like the explosion in digital piracy can be traced back to an unnecessarily stringent copyright system which places far too little importance on expanding the public domain. People see the inherent absurdity in a system which protects work for decades after an author's death, and which fails to facilitate greater access to cultural content, and don't respect it as a result. I think copyright should be drawn down to defensible borders, and then it can be properly enforced. You can find a neat little paper I wrote on the subject at: http://www.law-democracy.org/live/wp-content/uploads/2013/06/Summary-in-English.pdf.

What are your thoughts on Tor and the privacy/protection it offers to users?

Especially after some reports, most recently in Germany, that the NSA is specifically logging the IP of people who are just searching for the client/browser bundle or reading How-to articles.

So, I'm a lawyer, not a tech guy, but the Snowden docs revealed a lot of frustration within the NSA at their inability to unmask Tor users, which suggests that the service remains fairly effective, though there are some indications that, by controlling enough nodes, the NSA may sometimes be able to zero in and unmask a particular user. Personally, I find the whole arms-race between Tor programmers and the NSA kind of funny, because both sides are funded by the US government.

It doesn't surprise me at all that intelligence agencies would be focusing in on Tor users but, while this means more scrutiny for anything you do outside of Tor, it doesn't put them any closer to cracking the program itself.

TL/DR - Tor remains fairly effective, though it doesn't offer absolute security.

Why do people need privacy? Is privacy a right? Is it a fundamental or basic right? Or is it a privilege?

Privacy is absolutely a human right - recognized in the Universal Declaration of Human Rights: the grand-daddy of human rights documents, which is legally binding on all States: http://www.un.org/en/documents/udhr/

Last I checked, the US doesn't generally recognize most of the UN human rights committees and courts.

You're probably thinking of the ICC. However, the USA has signed and ratified the International Covenant on Civil and Political Rights, which includes the right to privacy, as well as review by the UN Human Rights Committee. So - it is binding on the US.

Is it enforceable, or can it even be investigated, without international court?

edit: and as a side note, the US is not party to many human rights treaties including: Convention on the Rights of the Child (alone with Somalia); Convention on the Elimination of All Forms of Discrimination Against Women; Mine Ban Treaty;Convention against Torture; Convention for the Protection of All Persons from Enforced Disappearance; Convention on Cluster Munitions.

Enforceable is kind of a fuzzy concept in this area. Certainly you can lodge a complaint, and have it investigated. But, you can't get Michael Hayden hauled off to jail for violating your right to privacy.

PS - I absolutely love this photo of Michael Hayden and Edward Snowden posing in tuxedos: http://mashable.com/2014/08/13/snowden-hayden-tuxedo-photo/

If a complaint were lodged and the US found to have violated its citizens privacy, is there a class action type lawsuit that could be filed?

Not a class action suit - but there are lawsuits proceeding against the US government which target the constitutionality of the NSA programs (see Jewel v. NSA).

What are your views on Julian Assange, WikiLeaks, etc? It's more freedom of information than speech, but your insight would still be appreciated.

Wikileaks plays a vital service in facilitating whistleblowing, but I think the whole episode with Assange and the embassy is a bit absurd. It's worth noting that Glenn Greenwald has been back to the US since the Snowden leaks, and has never been charged with anything. The fear of Assange being shipped to the US is, in my opinion, not credible.

What are your thoughts on the "right to be forgotten"? Does it stray too far into censorship? Is there a better way to balance personal rights with free speech?

Great question! It's a tricky issue. I have a real problem with any action that allows people to try and control what the Internet says about them, which strikes at the heart of the Internet's core character. On the other hand, I have some sympathy for people who don't want to be dogged by something stupid they did a decade ago, and for the harmful impact that can have on employment and personal relationships.

But, because this is such a delicate issue to balance, I think it's a problem the EU ruling happened the way it did, which offered very little guidance on what the proper balance should be. Now that the door has been opened, there needs to be serious legislative attention paid to providing a proper solution.

As a followup, do you think the sites that index sites that have been removed from Google will able to stick around? For those unfamiliar, there are a few sites that track articles that have been de-indexed from Google, presumably due to a right to be forgotten request. The embarrassing data is gone from Google, but is now highlighted elsewhere. The process could be repeated ad infinitum. Could we ever end up with a national registry of information that is no longer allowed to be made public (sort of like a right to be forgotten do-not-call list)?

It's important to remember that de-listing a site from Google doesn't remove it from the Internet, of course, it just makes it more difficult to access. And that, I think, is what the Court was intending - not to remove the information entirely, but to prevent it from dominating your online footprint.

That said - there can totally be a Streisand Effect to these kinds of efforts. The original plaintiff in the Google case, Mario Costeja, is now famous for the very financial problems he was trying to bury.

Some big thinkers in future studies predict that privacy is going to be going away. With drones being ubiquitous, and the internet of things knowing everything about everything.

Is this a possibility and could it be a good thing?

That's basically the debate that's going on right now over the so-called "right to be forgotten" - and whether the Internet's capacity to track and record everything is a good or a bad thing.

While there's no doubt that conceptions of privacy are changing, I don't think it will ever disappear.

Why would anyone ever think they have privacy on the internet?

Because you're alone, in your home, and it feels private, even though the fact is that everything you do is being watched, noted and recorded.

But it's important to note that this feeling of privacy is what gives rise to a lot of what we value about the Internet - freewheeling discourse, uninhibited exploration - and that is worthy of protection. People need to feel secure in their communications, or they won't feel comfortable to express themselves freely.

Also - it's important to note that there's an important difference between Facebook and Google spying on me, with my (nominal) consent, and the government doing it.

Thanks for answering. What is the difference between Google and Facebook spying and the Gov? Do you think they would ever use something against you? It seems to me that the internet is a very public place, even more public than being outside in 'public'. For instance, if I got to a shopping mall and yell profanity a few hundred at most people will hear me. My actions are limited to those around that witness this act during. If I post the same thing to my FB or Google+ account it is archived on the internet, open for the entire world to see. This leads me to believe we should not do anything on the internet we wouldnt mind the entire world seeing.

The main difference is that the government is much more powerful (even than Google, believe it or not!). The government can lock you up, they can end your life in some countries, and they have a duty of accountability and responsibility that we don't attach to companies in the same way.

As to whether companies would spy on you for their own ends - there was a recent case where Microsoft went into a journalist's hotmail account to find the source of his leaks about the company... But I think that's kind of a rarity, due to the potential for reputational damage.

Do you believe data collection and surveillance can or has ever helped, or aided ,or protected anyone?

Certainly! There's criminals that engage in online fraud, distribute child pornography and the like, and the police face a legitimate need to combat this. But, what I have a problem with is the untargeted way that it's being done, which degrades the safety, security and sense of privacy of the Internet for everyone.

How do you think regulations like Safe Harbor will change the American consumer landscape in regards to access to and the protection of personal information?

Uh... the two aren't really connected... Safe harbour is usually about protecting services like Google and Facebook from responsibility for the actions of their users, like if they're violating copyright. This is a vital principle of the Internet, but not one that's really directly tied to online privacy.

Thanks for responding! Don't you see the access principle of Safe Harbor as being tied to consumer protection? In my mind, the "right to be forgotten" and Safe Harbor are coming from similar places.

I guess it depends on what you're referring to. What I'm talking about with safe harbour is intermediary liability - which is not about protecting consumers, it's about protecting Internet companies from liability for the actions of their consumers - otherwise they'd be sued into oblivion (imagine if YouTube was responsible for every copyright infringement by their users).

One of the great problems of technology is that our information is distant from our direct experience and is not instance restricted - but we still tend to think of a message as a "thing" like a physical letter, even as we share it. All that "hidden back end" stuff that is out of our control (or perception) can change dramatically in terms of its structure and who has access, without us knowing. Corporations and governments and 'interested parties' inevitably collude for economic and political power.

Can regulation really make much difference when it is easy to present a 'good face' while continuing to collude? Aren't we essentially reliant on whistleblowers now?

We are very much reliant on whistleblowers, which is why whistleblower protection is essential for those countries that don't have good laws in place.

However - the technical sophistication you mention doesn't place this stuff beyond our control so long as there are experts working to decode the policies, and explain them in layman's terms to the public. EFF for example, are great at taking these technical concepts and putting them out in a user-friendly way (that's also what I tried to do with my book, above).

Thanks, good point about EFF, and the book looks good.

There is also the hope that we are currently in a time where public knowledge is lagging - but the new wave of kids will be much more savvy about these things. Just think of how the image of computers has changed over the last 10 years (nerd/geek mocking -> an unthinking essential to how life works). Plus, Raspberry Pi.

Young folk may be apparently casual about privacy, but they are also smart and have no time for corporate/government/manipulative nonsense!

I am eternally optimistic going forward - partly by my nature, partly because I do see progress and evolving understandings of digital rights. Of course, you also can't just lean back and leave it to the next generation to fix. Everyone needs to be active, and work safeguard the rights that are important to them.

What protections do we have from being ID'd on reddit? Assuming we want to remain anonymous, and don't do stupid things like post our personal information there. What techniques are used to do such a thing (in general terms).

Well, assuming you're not posting personal information, presumably the only thing that could link the account to you would by the IP address that you're logging in through, which can be masked through Tor.

How long does your average shower last?

Never timed it - I'd guess 8 minutes or so...?

Speaking of creepy data collection - I really hope you're stockpiling a repository of shower-based information on all the people who do AMAs.

I believe we have entered a time when technology has not only advanced faster than the law, it's advanced faster than our social mores. I don't think there is a consensus on what our rights are or should be. The same people who get violently upset when a camera is pointed at them on a public street don't mind if Google or Facebook tracks their activity, or if the NSA reads their email. I think we all need to agree on what should be private, what should be public, and what should be bought and sold.

What are your thoughts on this?

One last response before I go! Privacy is very much a relative concept, which varies tremendously around the world. So, for example, Germans take a much more vigilant attitude towards personal privacy, possibly as a result of cultural experiences with repressive State overreach from first the Nazis and then the Stasi.

But, as you note, the Internet is a universal medium, which requires universal rules - so I agree that conceptual work needs to be done to agree on common standards of privacy, in order to facilitate the universality of the online world.

What is the statute of limitations for downloading copyrighted material (lets say a music album for instance)?

Absolutely not legal advice in any way shape or form

That depends from jurisdiction to jurisdiction and whether you're talking about facing a civil charge (lawsuit) or a criminal charge - I think most places will have some timeframe beyond which civil actions cannot be brought. But enforcement rates are so low, it's probably not something that comes up very often.

Me and a few other seniors at my university wrote an application.

We showed the application to interested parties. Those parties loved the application and want us to set them up to have our application working in their enterprise (for a price yet to be negotiated).

I don't think the algorithms or code was all that difficult to write. The complete idea is what no one thought of before, so after showing anyone with even mediocre programming skills, they could easily re-write the application in their own language of choice.

Do we need a patent? and if so on what?

Sorry - I can't really get into those kinds of issues - it's well beyond my area of expertise and I'd hate to get it wrong and for you to end up losing money as a result.

Thanks for taking the time to answer questions. Does putting a copyright logo on the bottom of a webpage protect everything contained on the page without additional action? For example if I put up photos that I have taken on a page with a copyright in the footer, can someone take them without any legal recourse?

The thing about copyright is that it works by default - so everything you write/create is automatically copyrighted. The logo itself is unnecessary - you have copyright in every photo you take, unless you take steps to specifically waive it (such as by attaching a creative commons licence, or uploading to a website that has some sort of waiver within its terms of service).

What was your career path that led you to this area of law? How hard is it to break into this area of law?

Very difficult, unfortunately - there's not a lot of jobs in this field and it can be intensely competitive to crack into.

Personally - it was a combination of having the right skill set and qualifications (background in journalism, international experience, top student in media and international law), and luck, since my NGO happened to be getting off the ground just as I graduated, so I was able to get in on the ground floor, before we really had much of a name.

[deleted]

Greetings to a fellow Canadian! Certainly corporations are collecting your information in bulk, and there's a pretty good chance you'll be caught up in US filters as well, because they just catch so much. As for the Canadian government - the police make millions of requests for personal information every year, but a recent Supreme Court decision has basically made that impossible to keep up going forward.

Second question would depend on the app. Because most people click through these terms without thinking, there may be some tendency for the lawyer that writes them to just lump everything in there to be on the safe side. But by and large - I'd say that's a fair assumption as well.

How could one make a legal relation between illegal online surveillance and copyright?

To further explain myself in copyright you protect your creation of any type from illegal reproduction or use from a third party, even if your expectation is to share your copyright material.

In daily online life you will do things that could be construed as protected by copyright, it could be in a blog post, an email, even in a reddit post... But since the courts feel I have no expectation of privacy it's fair use by the NSA. Is copyright a valid defense against NSA spying?

Sorry if I make no sense... English is not my main language, and I'm in a bit of a hurry.

Thanks for the AMA!

No - I wouldn't necessarily link those issues (your English is fine though!).

How effective is encryption in slowing/thwarting survailence?

I'm speaking slightly out of my depth, since my background is in law rather than anything technical, but those who know say that encryption is the best way to thwart broad scale surveillance - particularly if it's practiced by everyone, as a default.

Does using browsers like Tor actually accomplish anything?

Yes - from what I understand Tor remains fairly effective at masking your online identity.

Thank you for doing this AMA!
I am very interested in the topic of traditional copyright legislation in this age of digital 'revolution'. The fact that you do this AMA may give some people the incentive to familiarize themselves with the topic and form an opinion on it, which in turn hopefully trickles down to politics on a large enough scale for some reform to happen.
Speaking about copyright reform and politics: are there some views on the matter from the International Pirate Party that you absolutely do not agree with? Or are you not familiar enough with them to have an answer for me (which would be fine, of course)?

Last I checked the Pirate Party's platform was to lower copyright terms to five years, which I'd say is probably too short. Although markets are shifting, leading for example to a greater emphasis on live music rather than recorded stuff, there needs to be a reasonable opportunity for artists to profit from their work. I've heard other suggestions at limiting copyright durations to 20 years, or to the life of the artist and no longer, which seem like a more reasonable compromise to me.

I feel that it is very hard to draw a hard line (in terms of number protected-by-copyright-years) and make things so black and white, while there is clearly a grey area and a lot of individual cases that seem to require specific ruling, but this is the case with almost all legislation. So: frustrating, but understandable.

Thank you for your view on the matter and your work.

Well - you have to draw a line at some point - but I agree it should be done based on specific markets for specific forms of media. Look at the profitability and how sales of a particular type of work chart over time, as well as the expense and difficulty of producing it, and set a limit based on the need to balance appropriate compensation with the common good of having the work freely available.