HomeIntroducing CybercultureBook ReviewsCourses in CybercultureEvents and ConferencesFeatured LinksAbout RCCS

View All Books

Code and Other Laws of Cyberspace

Author: Lawrence Lessig
Publisher: New York: Basic Books, 1999
Review Published: August 2000

 REVIEW 1: Dan Orr
 REVIEW 2: Andrew Hess

In 1994, when passage of the Communications Decency Act threatened government censorship of the Internet, Electronic Frontier Foundation Co-founder John Gilmore was a cooler head that prevailed: "The net treats censorship as damage," wrote Gilmore, "and routes around it." Gilmore's quip has since become part of a larger belief that nearly any regulation aimed at the hydra of cyberspace is doomed to failure. The Internet can innovate faster than governments can legislate. New technology can circumvent an old law much faster than new laws can be enacted to keep pace, and even those laws which escape obsolescence may be impossible to enforce. Government intrusion online simply prompts the subjects of regulation to move outside the reach of the law. To Internet users, the location of a webserver is almost irrelevant, but from the point of view of many national governments, technology continues to move a large portion of commerce, culture, and conduct beyond their reach. This has lead many to conclude that the Internet cannot be regulated. They're wrong -- at least according to Harvard Law Professor, Lawrence Lessig.

In his book Code and Other Laws of Cyberspace, Lessig contends regulation of the Internet is not only possible but increasingly a reality. According to Lessig, the new threat to liberty online is not the government but the influence of corporate interests. The new mechanism for regulation is not public policy, but the underlying computer code of cyberspace, the computer programs and technical standards which define the architecture of the Internet itself. "Code is law," (6) writes Lessig, but far more as well. The level of control computer code permits over cyberspace far exceeds the influence of law over real world conduct. Code constrains the range of available behavior, just as the list of options available on the menus of a computer program are limits to our behavior within that program. Laws are disobeyed first and punished after, but the control of code over virtual space is like that of architecture or physics. Disobedience is not punished, disobedience is impossible -- just as walking through a wall or defying gravity is impossible. Creating new menu options in Microsoft Word requires technical expertise few of us have, and that's assuming we could ever get access to the program's source code. The control which code grants the owners of virtual spaces over their real estate is a power to define undesirable activities within those spaces out of existence, to add or to omit options to the menu. Code determines the gravity, the inertia, and the architecture which govern life in cyberspace. It defines the laws of physics for that reality but nonetheless remains a product of the human programmers who create it and embodies the values they choose.

"Code is regulable," writes Lessig, "only because the code writers can be controlled" (106). Code is unlike physics in that it is purely artificial. The values which exist in virtual spaces exist only because someone chose to write them there. Some virtual spaces exert high degrees of control on their participants, others less so. America Online, for example, watches its visitors closely, gathering information to create more personalized content and to evict those who violate the company's acceptable use policy with offensive speech or inappropriate action. Other virtual spaces such as most newsgroups on Usenet or most channels on Internet Relay Chat may rely exclusively upon social sanction for enforcement. That is assuming they even have any rules. Utter profanity in a chatroom on America Online and you will be forcibly disconnected from the service. Utter profanity on Internet Relay Chat and it's likely few will be surprised. Those who are offended will have little recourse. The difference is a product of the values coded into the two virtual spaces and the degree of control exerted to enforce those values.

Lessig contends the influence of code over conduct online and the values embedded within it by corporate code writers poses an increasing threat to freedom online. The increasing development of code designed to protect private interests, he contends, is steering the Internet towards "a future of control in large part exercised by technologies of commerce, backed by the rule of law" (Preface, x). Lessig continues: "Cyberspace . . . has different architectures, whose regulatory power is not so limited. An extraordinary amount of power can be built into the environment people know there. What data can be collected, what anonymity is possible, what access is granted, what speech will be heard -- all these are choices, not 'facts.' All these are designed not found" (217). Lessig's tone falls somewhere between a wakeup call and an alarm bell. He expresses concern at the increasing number of corporations which seek to regulate online conduct that may be bad for business by creating code which makes that conduct impossible. These corporations then frequently seek legal protection for their code making circumvention a criminal act or trademark, patent, or copyright infringement. Mergermania among technology and media corporations intensifies this problem. As code becomes the product of a smaller number of large companies the influence of those companies on public policy increases, and the more easy it becomes for such companies to collude with government and with each other to restrict conduct which threatens their business. The result is a virtual space where reality reflects the values of the corporation which created it, where disobedience to those values is impossible because of the code that defines the space, and circumvention of that code may be punished by real world legal sanctions or even criminal prosecution. Sounds far fetched? Perhaps a little, but not as much as one might hope.

Examples in support of Lessig's concerns abound in technology headlines. During the past year, the Motion Picture Association of America has waged a tireless legal campaign designed to shut down Web sites which circulate information on circumvention of the copyright protection on DVDs [1]. The MPAA has succeeded in obtaining injunctions not only against sites that distribute software that disable such protections, but even against sites that included academic discussion of how circumvention might be accomplished. The Uniform Computer Information Transaction Act, recently enacted in Virginia [2] and under discussion in a number of other state legislatures, provides a second example of corporate code backed by the rule of law. UCITA lends full force to software licensing agreements as soon as a customer tears open the shrink-wrap the software is packaged in or clicks the "I agree" button in a download, making such actions as binding as a legal contract. The measure gives software companies broad new powers to enforce unilaterally these agreements by disabling or even repossessing software whose use they feel violates such a licensing agreement. Big business claims the increased intellectual property protection will be a boost to e-commerce, but opponents ranging from librarians to consumer advocates claim the measure represents a substantial reversal to cherished principles of fair use. A lawsuit filed by toy manufacturer Mattel against two programmers presents a third example [3]. The suit alleges the programmers violated licensing agreements and federal law by reverse engineering the source code to its software CyberPatrol, a program designed to prevent children from accessing adult Web sites. The programmers had initially cracked the software to obtain the list of Web sites blocked by CyberPatrol, a large number of which they felt were non-pornographic and were being censored by mistake. However, following the suit were forced to sell the rights to their hack to Mattel for one-dollar to avoid further legal action.

But not only is big business creating an Internet which restricts freedom to protect its own interests, according to Lessig, but those restrictions are becoming more difficult to escape. A growing incentive structure towards identification and authentication will make changing jurisdictions to avoid regulation more difficult, if not impossible. Refusing to identify yourself on the Internet may soon become more of a hindrance than having to type your credit card number twice; it may mean an inability to purchase online at all. Already information stored in cookies identifies users, stores passwords and credit card numbers, and determines numerous aspects of life online, tailoring content, controlling access, and linking online experience, such as a product you wish to buy, with offline resources like your credit card number. Could social security numbers be next or a certificate that says what state you live in, and therefore what laws govern your actions online? As Lessig notes: "Life in an authenticating world will be simpler for those who authenticate" (42). There is no government requirement that all citizens carry a driver's license, but you may find it difficult to prove who you are without one even if you do not drive. The more people who accept an incentive the more it becomes a standard. You can theoretically refuse to provide proof of identity but it may mean the loss of a benefit or being forced to take your business elsewhere. Lessig observes: "The lesson is simple: make the incentive to carry ID so strong that no government requirement is necessary" (50). According to Lessig this trend will culminate in an Internet which knows who you are and regulates your conduct accordingly no matter where or how you choose to visit cyberspace.

The solutions offered by Code are no less controversial than the concerns it raises. Lessig suggests the government must become more involved in the regulation of the Internet, and legislative and judicial institutions must become public forums for debate over the values embedded in the medium's underlying code. He envisions an Internet where government institutions, guided by informed public debate, provide a check on the power of corporate interests to define the values latent in programming. His chief weapon in this fight is the U.S. Constitution, whose principle, he argues, should be extended to govern action by the private sector. But he worries about the translation process of Constitutional values and interpretation into the information age, and it is for precisely this reason that he advocates government, the most public of forums, as a means to resolve the dilemmas of civil liberties in a digital age. For example, if the FBI releases a worm which scans the files on every computer in America, with no inconvenience to the computer's owner, and only reports back if a specific, illegally obtained classified document is found on that computer -- does that constitute an illegal search under the fourth amendment? The answer, according to Lessig, is a matter of interpretation which remains to be decided. Is privacy protection only burdensome searches, one which a device as unobtrusive as the worm avoids? Or is privacy the enumeration of an inalienable human right whose dignity is offended by even by the most innocuous search? The translation of these latent ambiguities, problems subject to interpretation in which the document's framers might have drawn their conclusions either way, into the information age is the defining question of Lessig's book. Code argues for placing these questions on the public agenda and evaluating them in public forums instead of private boardrooms.

Code is a call to action or at least to attention. As Lessig notes: "To preserve the values we want, we must act against what cyberspace otherwise will become" (209). Lessig's ideas are thought provoking, and his conversational style weaves elements of technology, policy, and constitutional law into a clear and concise synthesis. His tone is one of concern but not of panic. He is neither a doomsayer nor impractical in his defense of civil liberties. He recognizes the importance of commerce on the Net, but is astute in his criticisms of the corporate threat to civil liberties. Code and Other Laws of Cyberspace is a warning against complacency in the emerging future of the Internet. It is a powerful argument for public discussion of what has traditionally been the private domain of geeks and lawyers. Code is a wake up call to those who believe that the civil liberties battles of the new millennium have already been won and there is nothing left but to enjoy the fruits of those labors: "If we do nothing, the code of cyberspace will change," writes Lessig, "The invisible hand will change it in a predictable way. To do nothing is to embrace at least that. It is to accept the changes that this change in code will bring about. It is to accept a cyberspace that is less free, or differently free, than the space it was before" (109). Code represents the first steps towards a crucial public debate over technical standards, corporate influence, and Constitutional rights in the 21st century.

1. For more information on the details of this case see the OpenLaw DVD/DeCSS Forum FAQ.

2. See Declain McCullagh, Furor Over Virginia E-Biz Law, Wired News, 3/15/00.

3. See Declain McCullagh, Mattel Sues Over Blocking Hack, Wired News, 3/16/00.

Dan Orr:
Dan Orr is a graduate student at the Annenberg School for Communication of the University of Pennsylvania. He served as Systems Administrator to U.S. Senator Byron Dorgan and worked previously for the Electronic Frontier Foundation.  <dorr@asc.upenn.edu>

©1996-2007 RCCS         ONLINE SINCE: 1996         SITE LAST UPDATED: 12.10.2009