I am an advocate for digital rights with the Centre for Law and Democracy (www.law-democracy.org), an international NGO that works to promote foundational rights for democracy, and I've just authored a book: Travel Guide to the Digital World: Surveillance and International Standards, which is available free at: www.law-democracy.org/live/wp-content/uploads/2012/08/Travel-Guide-to-the-Digital-World-Surveillanvce-and-International-Standards.pdf. The book was produced as part of the "Travel Guide to the Digital World" series produced by Global Partners Digital: www.gp-digital.org.

Julian Assange is considering leaving the Ecuadorian Embassy, Edward Snowden is definitely not leaving Russia, and the global intelligence apparatus is still monitoring everything we say and do online. I am at your disposal - let's talk about digital rights.

Proof: https://twitter.com/Law_Democracy/status/501727486427009024

Edit: Some of these questions seem to be straying into personal legal issues, so I should add a caveat up here that says that nothing I say constitutes legal advice, nor should it be relied on in any legal proceeding. Just a guy on the Internet answering some questions...

Edit 2: Thanks for all the great questions - it's been fun as always, but I should sign off. I'll probably be back with some colleagues for another AMA on Right to Know Day (Sept 28). Please do check out the (free!) book on surveillance, which you can find on our website at www.law-democracy.org. Also you can follow me on Twitter at @RTI_Law, and my NGO at @Law_Democracy. Cheers!

Comments: 100 • Responses: 36  • Date: 

hpcisco79659 karma

More and more tech products and services are gathering loads of consumer data. Judging from the growth of Big Data and the popularity of such products, it looks like consumers (in general) don't mind. And yet, we have all of the news about government electronic surveillance.

As a society, how do we balance the desires of consumers for interconnected goods and services against the problem of untrackable, unaccountable government surveillance?

Michael_Karanicolas8 karma

Great question! Corporate surveillance is also troubling, but it doesn't pose the same threat as government surveillance since companies lack the coercive power of the State. Imagine a gay Russian or Ugandan, or a Saudi atheist - the fact that Google and Facebook are tracking their online usage is creepy, but if the State is doing it these people would face a real threat to their lives and freedom. So, the first important point is to make a distinction between these issues.

In terms of the appropriate balance for consumer tracking - apathy and the desire for convenience are real challenges to enforcing proper standards. I think John Oliver pointed out that Apple could probably insert the entire text of Mein Kampf into their TOS agreement and 99% of people would still click right through. At some point though, there has to be a tipping point, and these companies will either face tougher regulation (as we're starting to see in the EU) or will have to conform to a sort of corporate social responsibility on gathering and using private information.

hpcisco79653 karma

How enforceable are TOS agreements against consumers, considering that nobody reads them?

To clarify my earlier question a bit: can we have a world where corporate surveillance matches consumer preferences BUT there are sufficient safeguards that the government cannot take advantage of that surveillance? Can we let Google into our bedrooms while keeping the NSA out?

Michael_Karanicolas6 karma

Another great point on the nexus between corporate surveillance and State surveillance - since of course the Snowden docs reveal the NSA piggybacking off of Google, Facebook and the like.

TOS agreements have been found to be legally enforceable, but they're also highly problematic in that nobody reads them, so I expect any judge looking at it would apply a high standard of whether the clauses were reasonable.

edited This is not legal advice!

SpikeMF6 karma

If you're on a call with a company that has a This call may be recorded for quality assurance purposes recording, does that mean they are consenting to being recorded?

Michael_Karanicolas4 karma

This is totally not legal advice

No - it means that YOU are consenting to being recorded.

ShittyAssAccount1 karma

How is that legal, they record it as soon as you call, is calling somebody classed as consent to be recorded?

Michael_Karanicolas1 karma

I believe the idea is they're telling you you're being recorded, so if you stay on the line, it serves as consent...

aintnufincleverhere4 karma

What is your view on internet piracy?

Michael_Karanicolas9 karma

I feel like the explosion in digital piracy can be traced back to an unnecessarily stringent copyright system which places far too little importance on expanding the public domain. People see the inherent absurdity in a system which protects work for decades after an author's death, and which fails to facilitate greater access to cultural content, and don't respect it as a result. I think copyright should be drawn down to defensible borders, and then it can be properly enforced. You can find a neat little paper I wrote on the subject at: http://www.law-democracy.org/live/wp-content/uploads/2013/06/Summary-in-English.pdf.

thejpn4 karma

I just had my law school convocation yesterday and what you do seems interesting. Any advice to someone just starting law school?

Michael_Karanicolas5 karma

Don't go! Just kidding. I guess that would depend on whether and to what degree you'll be in debt when you graduate. If you can - try and set yourself up for a job you'll enjoy. I'm not saying everyone has to push into public interest work -but I know too many people that I graduated who just hate what they do, and it's no way to live.

bstampl11 karma

No, but seriously: don't go

Michael_Karanicolas3 karma

Haha... well - don't go expecting to find a job in public interest work, because they're thin on the ground, and don't go if it'll put you seriously in debt - because that situation can force you into taking a job you're going to hate just to get a decent income stream.

Nottherealcelery3 karma

What are your views on Julian Assange, WikiLeaks, etc? It's more freedom of information than speech, but your insight would still be appreciated.

Michael_Karanicolas8 karma

Wikileaks plays a vital service in facilitating whistleblowing, but I think the whole episode with Assange and the embassy is a bit absurd. It's worth noting that Glenn Greenwald has been back to the US since the Snowden leaks, and has never been charged with anything. The fear of Assange being shipped to the US is, in my opinion, not credible.

KafkaTamura903 karma

What are your thoughts on Tor and the privacy/protection it offers to users?

Especially after some reports, most recently in Germany, that the NSA is specifically logging the IP of people who are just searching for the client/browser bundle or reading How-to articles.

Michael_Karanicolas10 karma

So, I'm a lawyer, not a tech guy, but the Snowden docs revealed a lot of frustration within the NSA at their inability to unmask Tor users, which suggests that the service remains fairly effective, though there are some indications that, by controlling enough nodes, the NSA may sometimes be able to zero in and unmask a particular user. Personally, I find the whole arms-race between Tor programmers and the NSA kind of funny, because both sides are funded by the US government.

It doesn't surprise me at all that intelligence agencies would be focusing in on Tor users but, while this means more scrutiny for anything you do outside of Tor, it doesn't put them any closer to cracking the program itself.

TL/DR - Tor remains fairly effective, though it doesn't offer absolute security.

Shirley_Surely3 karma

Why do people need privacy? Is privacy a right? Is it a fundamental or basic right? Or is it a privilege?

Michael_Karanicolas9 karma

Privacy is absolutely a human right - recognized in the Universal Declaration of Human Rights: the grand-daddy of human rights documents, which is legally binding on all States: http://www.un.org/en/documents/udhr/

throwworht62 karma

Last I checked, the US doesn't generally recognize most of the UN human rights committees and courts.

Michael_Karanicolas9 karma

You're probably thinking of the ICC. However, the USA has signed and ratified the International Covenant on Civil and Political Rights, which includes the right to privacy, as well as review by the UN Human Rights Committee. So - it is binding on the US.

throwworht65 karma

Is it enforceable, or can it even be investigated, without international court?

edit: and as a side note, the US is not party to many human rights treaties including: Convention on the Rights of the Child (alone with Somalia); Convention on the Elimination of All Forms of Discrimination Against Women; Mine Ban Treaty;Convention against Torture; Convention for the Protection of All Persons from Enforced Disappearance; Convention on Cluster Munitions.

Michael_Karanicolas3 karma

Enforceable is kind of a fuzzy concept in this area. Certainly you can lodge a complaint, and have it investigated. But, you can't get Michael Hayden hauled off to jail for violating your right to privacy.

PS - I absolutely love this photo of Michael Hayden and Edward Snowden posing in tuxedos: http://mashable.com/2014/08/13/snowden-hayden-tuxedo-photo/

satanismybacon3 karma

If a complaint were lodged and the US found to have violated its citizens privacy, is there a class action type lawsuit that could be filed?

Michael_Karanicolas2 karma

Not a class action suit - but there are lawsuits proceeding against the US government which target the constitutionality of the NSA programs (see Jewel v. NSA).

AeroJonesy2 karma

What are your thoughts on the "right to be forgotten"? Does it stray too far into censorship? Is there a better way to balance personal rights with free speech?

Michael_Karanicolas2 karma

Great question! It's a tricky issue. I have a real problem with any action that allows people to try and control what the Internet says about them, which strikes at the heart of the Internet's core character. On the other hand, I have some sympathy for people who don't want to be dogged by something stupid they did a decade ago, and for the harmful impact that can have on employment and personal relationships.

But, because this is such a delicate issue to balance, I think it's a problem the EU ruling happened the way it did, which offered very little guidance on what the proper balance should be. Now that the door has been opened, there needs to be serious legislative attention paid to providing a proper solution.

AeroJonesy1 karma

As a followup, do you think the sites that index sites that have been removed from Google will able to stick around? For those unfamiliar, there are a few sites that track articles that have been de-indexed from Google, presumably due to a right to be forgotten request. The embarrassing data is gone from Google, but is now highlighted elsewhere. The process could be repeated ad infinitum. Could we ever end up with a national registry of information that is no longer allowed to be made public (sort of like a right to be forgotten do-not-call list)?

Michael_Karanicolas2 karma

It's important to remember that de-listing a site from Google doesn't remove it from the Internet, of course, it just makes it more difficult to access. And that, I think, is what the Court was intending - not to remove the information entirely, but to prevent it from dominating your online footprint.

That said - there can totally be a Streisand Effect to these kinds of efforts. The original plaintiff in the Google case, Mario Costeja, is now famous for the very financial problems he was trying to bury.

devilbones2 karma

Why would anyone ever think they have privacy on the internet?

Michael_Karanicolas2 karma

Because you're alone, in your home, and it feels private, even though the fact is that everything you do is being watched, noted and recorded.

But it's important to note that this feeling of privacy is what gives rise to a lot of what we value about the Internet - freewheeling discourse, uninhibited exploration - and that is worthy of protection. People need to feel secure in their communications, or they won't feel comfortable to express themselves freely.

Also - it's important to note that there's an important difference between Facebook and Google spying on me, with my (nominal) consent, and the government doing it.

devilbones2 karma

Thanks for answering. What is the difference between Google and Facebook spying and the Gov? Do you think they would ever use something against you? It seems to me that the internet is a very public place, even more public than being outside in 'public'. For instance, if I got to a shopping mall and yell profanity a few hundred at most people will hear me. My actions are limited to those around that witness this act during. If I post the same thing to my FB or Google+ account it is archived on the internet, open for the entire world to see. This leads me to believe we should not do anything on the internet we wouldnt mind the entire world seeing.

Michael_Karanicolas1 karma

The main difference is that the government is much more powerful (even than Google, believe it or not!). The government can lock you up, they can end your life in some countries, and they have a duty of accountability and responsibility that we don't attach to companies in the same way.

As to whether companies would spy on you for their own ends - there was a recent case where Microsoft went into a journalist's hotmail account to find the source of his leaks about the company... But I think that's kind of a rarity, due to the potential for reputational damage.

ShowerQuestions2 karma

How long does your average shower last?

Michael_Karanicolas3 karma

Never timed it - I'd guess 8 minutes or so...?

Speaking of creepy data collection - I really hope you're stockpiling a repository of shower-based information on all the people who do AMAs.

TriumphantGeorge2 karma

One of the great problems of technology is that our information is distant from our direct experience and is not instance restricted - but we still tend to think of a message as a "thing" like a physical letter, even as we share it. All that "hidden back end" stuff that is out of our control (or perception) can change dramatically in terms of its structure and who has access, without us knowing. Corporations and governments and 'interested parties' inevitably collude for economic and political power.

Can regulation really make much difference when it is easy to present a 'good face' while continuing to collude? Aren't we essentially reliant on whistleblowers now?

Michael_Karanicolas2 karma

We are very much reliant on whistleblowers, which is why whistleblower protection is essential for those countries that don't have good laws in place.

However - the technical sophistication you mention doesn't place this stuff beyond our control so long as there are experts working to decode the policies, and explain them in layman's terms to the public. EFF for example, are great at taking these technical concepts and putting them out in a user-friendly way (that's also what I tried to do with my book, above).

TriumphantGeorge1 karma

Thanks, good point about EFF, and the book looks good.

There is also the hope that we are currently in a time where public knowledge is lagging - but the new wave of kids will be much more savvy about these things. Just think of how the image of computers has changed over the last 10 years (nerd/geek mocking -> an unthinking essential to how life works). Plus, Raspberry Pi.

Young folk may be apparently casual about privacy, but they are also smart and have no time for corporate/government/manipulative nonsense!

Michael_Karanicolas2 karma

I am eternally optimistic going forward - partly by my nature, partly because I do see progress and evolving understandings of digital rights. Of course, you also can't just lean back and leave it to the next generation to fix. Everyone needs to be active, and work safeguard the rights that are important to them.

Thefishlord2 karma

Do you believe data collection and surveillance can or has ever helped, or aided ,or protected anyone?

Michael_Karanicolas4 karma

Certainly! There's criminals that engage in online fraud, distribute child pornography and the like, and the police face a legitimate need to combat this. But, what I have a problem with is the untargeted way that it's being done, which degrades the safety, security and sense of privacy of the Internet for everyone.

RedErin2 karma

Some big thinkers in future studies predict that privacy is going to be going away. With drones being ubiquitous, and the internet of things knowing everything about everything.

Is this a possibility and could it be a good thing?

Michael_Karanicolas1 karma

That's basically the debate that's going on right now over the so-called "right to be forgotten" - and whether the Internet's capacity to track and record everything is a good or a bad thing.

While there's no doubt that conceptions of privacy are changing, I don't think it will ever disappear.

dolphinupchuck2 karma

What protections do we have from being ID'd on reddit? Assuming we want to remain anonymous, and don't do stupid things like post our personal information there. What techniques are used to do such a thing (in general terms).

Michael_Karanicolas1 karma

Well, assuming you're not posting personal information, presumably the only thing that could link the account to you would by the IP address that you're logging in through, which can be masked through Tor.

novasoma2 karma

How do you think regulations like Safe Harbor will change the American consumer landscape in regards to access to and the protection of personal information?

Michael_Karanicolas3 karma

Uh... the two aren't really connected... Safe harbour is usually about protecting services like Google and Facebook from responsibility for the actions of their users, like if they're violating copyright. This is a vital principle of the Internet, but not one that's really directly tied to online privacy.

novasoma1 karma

Thanks for responding! Don't you see the access principle of Safe Harbor as being tied to consumer protection? In my mind, the "right to be forgotten" and Safe Harbor are coming from similar places.

Michael_Karanicolas2 karma

I guess it depends on what you're referring to. What I'm talking about with safe harbour is intermediary liability - which is not about protecting consumers, it's about protecting Internet companies from liability for the actions of their consumers - otherwise they'd be sued into oblivion (imagine if YouTube was responsible for every copyright infringement by their users).

MarchingHome1 karma

Thank you for doing this AMA!
I am very interested in the topic of traditional copyright legislation in this age of digital 'revolution'. The fact that you do this AMA may give some people the incentive to familiarize themselves with the topic and form an opinion on it, which in turn hopefully trickles down to politics on a large enough scale for some reform to happen.
Speaking about copyright reform and politics: are there some views on the matter from the International Pirate Party that you absolutely do not agree with? Or are you not familiar enough with them to have an answer for me (which would be fine, of course)?

Michael_Karanicolas1 karma

Last I checked the Pirate Party's platform was to lower copyright terms to five years, which I'd say is probably too short. Although markets are shifting, leading for example to a greater emphasis on live music rather than recorded stuff, there needs to be a reasonable opportunity for artists to profit from their work. I've heard other suggestions at limiting copyright durations to 20 years, or to the life of the artist and no longer, which seem like a more reasonable compromise to me.

MarchingHome2 karma

I feel that it is very hard to draw a hard line (in terms of number protected-by-copyright-years) and make things so black and white, while there is clearly a grey area and a lot of individual cases that seem to require specific ruling, but this is the case with almost all legislation. So: frustrating, but understandable.

Thank you for your view on the matter and your work.

Michael_Karanicolas1 karma

Well - you have to draw a line at some point - but I agree it should be done based on specific markets for specific forms of media. Look at the profitability and how sales of a particular type of work chart over time, as well as the expense and difficulty of producing it, and set a limit based on the need to balance appropriate compensation with the common good of having the work freely available.

AsABoxer1 karma

I believe we have entered a time when technology has not only advanced faster than the law, it's advanced faster than our social mores. I don't think there is a consensus on what our rights are or should be. The same people who get violently upset when a camera is pointed at them on a public street don't mind if Google or Facebook tracks their activity, or if the NSA reads their email. I think we all need to agree on what should be private, what should be public, and what should be bought and sold.

What are your thoughts on this?

Michael_Karanicolas2 karma

One last response before I go! Privacy is very much a relative concept, which varies tremendously around the world. So, for example, Germans take a much more vigilant attitude towards personal privacy, possibly as a result of cultural experiences with repressive State overreach from first the Nazis and then the Stasi.

But, as you note, the Internet is a universal medium, which requires universal rules - so I agree that conceptual work needs to be done to agree on common standards of privacy, in order to facilitate the universality of the online world.

CH3-CH2-OH1 karma


Michael_Karanicolas2 karma

Greetings to a fellow Canadian! Certainly corporations are collecting your information in bulk, and there's a pretty good chance you'll be caught up in US filters as well, because they just catch so much. As for the Canadian government - the police make millions of requests for personal information every year, but a recent Supreme Court decision has basically made that impossible to keep up going forward.

Second question would depend on the app. Because most people click through these terms without thinking, there may be some tendency for the lawyer that writes them to just lump everything in there to be on the safe side. But by and large - I'd say that's a fair assumption as well.

mrhhug1 karma

Me and a few other seniors at my university wrote an application.

We showed the application to interested parties. Those parties loved the application and want us to set them up to have our application working in their enterprise (for a price yet to be negotiated).

I don't think the algorithms or code was all that difficult to write. The complete idea is what no one thought of before, so after showing anyone with even mediocre programming skills, they could easily re-write the application in their own language of choice.

Do we need a patent? and if so on what?

Michael_Karanicolas1 karma

Sorry - I can't really get into those kinds of issues - it's well beyond my area of expertise and I'd hate to get it wrong and for you to end up losing money as a result.

bstampl11 karma

What was your career path that led you to this area of law? How hard is it to break into this area of law?

Michael_Karanicolas1 karma

Very difficult, unfortunately - there's not a lot of jobs in this field and it can be intensely competitive to crack into.

Personally - it was a combination of having the right skill set and qualifications (background in journalism, international experience, top student in media and international law), and luck, since my NGO happened to be getting off the ground just as I graduated, so I was able to get in on the ground floor, before we really had much of a name.

mehandsuch1 karma

Thanks for taking the time to answer questions. Does putting a copyright logo on the bottom of a webpage protect everything contained on the page without additional action? For example if I put up photos that I have taken on a page with a copyright in the footer, can someone take them without any legal recourse?

Michael_Karanicolas1 karma

The thing about copyright is that it works by default - so everything you write/create is automatically copyrighted. The logo itself is unnecessary - you have copyright in every photo you take, unless you take steps to specifically waive it (such as by attaching a creative commons licence, or uploading to a website that has some sort of waiver within its terms of service).

IncognitoIsBetter1 karma

How could one make a legal relation between illegal online surveillance and copyright?

To further explain myself in copyright you protect your creation of any type from illegal reproduction or use from a third party, even if your expectation is to share your copyright material.

In daily online life you will do things that could be construed as protected by copyright, it could be in a blog post, an email, even in a reddit post... But since the courts feel I have no expectation of privacy it's fair use by the NSA. Is copyright a valid defense against NSA spying?

Sorry if I make no sense... English is not my main language, and I'm in a bit of a hurry.

Thanks for the AMA!

Michael_Karanicolas1 karma

No - I wouldn't necessarily link those issues (your English is fine though!).

ShortBusAllStar1 karma

What is the statute of limitations for downloading copyrighted material (lets say a music album for instance)?

Michael_Karanicolas2 karma

Absolutely not legal advice in any way shape or form

That depends from jurisdiction to jurisdiction and whether you're talking about facing a civil charge (lawsuit) or a criminal charge - I think most places will have some timeframe beyond which civil actions cannot be brought. But enforcement rates are so low, it's probably not something that comes up very often.

AbsolutelyNotMatt1 karma

Does using browsers like Tor actually accomplish anything?

Michael_Karanicolas1 karma

Yes - from what I understand Tor remains fairly effective at masking your online identity.

satanismybacon1 karma

How effective is encryption in slowing/thwarting survailence?

Michael_Karanicolas1 karma

I'm speaking slightly out of my depth, since my background is in law rather than anything technical, but those who know say that encryption is the best way to thwart broad scale surveillance - particularly if it's practiced by everyone, as a default.