Code, and Other Laws of Cyberspace
by Lawrence Lessig
Basic Books 1999

§ Note. I wrote the first part of this review in the summer of 2001, and in the spring of 2002 returned to complete it.

Lawrence Lessig is a Professor of Law (he was at Harvard when the book was published) and his concern is that the freedom of cyberspace is being compromised. The Net can potentially become the most regulated space of our lives. The needs of commerce sites to identify who we are, and the need we will then have to authenticate our identity, will create (are creating) pervasive threats to privacy, anonymity and access, and ultimately threats to freedoms of choice, action and speech. Regulation occurs through code and the architecture which that code generates and sustains. To paraphrase Lessig: how the Net is coded defines what the Net is. (see p. 60) Therefore, it is the code writers who have the power to diminish or expand this threat of total regulation.

The Internet is not what it used to be. When it consisted of only telnet, FTP, e-mail, USENET, and IRC it was text-based in its method of interaction. This enabled users who in the physical world may have been socially disadvantaged (the deaf or unattractive, for example) to interact with others, unburdened by those disadvantages. Lessig says that in the text-based Net, even the blind, using text-readers, were enabled. The Net enables others too. Communities develop around shared interests, concerns, needs, enthusiasms, viewpoints, and lifestyles. This is the basis of USENET.

These original layers, nodes, places or spaces (however it is you think of them) of the Net still exist, but with the advent of sound and video, following the ongoing advances in computer power and online connection speeds, and the resulting predominance of the graphic-based Web, the deaf or unattractive (and certainly the blind) are once again disadvantaged. Think of webcams and voice chat: as chat rooms or chat programs shift toward using voice and cam-based video instead of simple text, what we look like and sound like, and whether we can see or hear, will again be important. The code defining the Net defines the architecture of the Net, and, consequently, that code determines the freedoms, obligations and limits of our interactions within the Net, and the circumstances under which we move about the Net. Code regulates our behavior. Text-based interaction allows for a modified or fictionally assumed persona, but if all Internet live chat becomes voice and cam-based video, there is little chance of fooling anyone about your age, appearance, race or gender.

Regulation occurs through four modalities: norms, law, market, architecture. Norms occur through group-based injunctions, the imposition of values, and penalties or ostracism (for example, the "kill file" in USENET) for breaking the normative rules. Law is imposed by government: for example, copyright laws, defamation laws, obscenity laws, and child abuse laws. Law can reflect norms as well as alter them. Markets impose regulation through their need for productivity and sales, and through our dependence on those markets. An ISP such as AOL is a market that regulates its customers through, for example, constraints on how they may speak in public forums. Presumably this is imposed in order to maximize the number of subscribers; and subscribers must then abide by the rules or risk losing the ISP service. Architecture, arising from the design choices in code, regulates the user through, for example, requiring passwords, tracking downloads, restricting access, or banning encryption schemes. "The code embeds certain values or makes certain values impossible." (p. 89) Lessig mentions that AOL limits the number of participants in public forums. This is a regulation imposed and enforced by code.

Government can use law to indirectly regulate behavior through the direct regulation of the other three modalities. It can regulate norms through social indoctrination. It can regulate the market through taxation. It can regulate architecture through the control of code (i.e. laws concerning design). This indirect regulation "undermines political accountability." (p. 96) Government imposes such indirect regulation yet disavows it as government sponsored. This "confuses responsibility and hence confuses politics." (p. 96) Cyberspace is regulated in such a fashion. "The code of cyberspace is becoming just another tool of state regulation. Indirectly, by regulating code writing, the government can achieve regulatory ends, often without suffering the political consequences that the same ends, pursued directly, would yield." (p. 99)

There might be a way out. The Open Source movement is pushing for all code to be public and freely distributable. The GNU/Linux operating system in its various distributions, such as Debian, Slackware, SuSE, Red Hat, and Mandrake, and the applications and utilities developed for these distributions, are examples of programs with open source code. Other examples are the open source BSD Unix distributions: FreeBSD, NetBSD, and OpenBSD. With open source code, the architecture can be changed by anyone with the aptitude, and then offered back to the public for use. Thus, imposed regulation is more difficult. A programmer or group of programmers working together (as in the Linux or BSD communities) can always rewrite the code without the unwanted design elements. However, if the code is burned into hardware, rather than existing as software, then even if the source is public the architecture resulting from that code cannot be easily circumvented. (see p. 108)

The power of code to regulate through architecture is greater than the heretofore power of law. This power extends into the areas of intellectual property, privacy, free speech, and sovereignty.

For example, the laws of trespass protect against intrusion upon an established physical space over which we have some degree of sovereignty. Trespass law grants us privacy. Law officers cannot search our homes without a warrant. Early in the 20th century it became an issue of trespass law whether a wiretap on a telephone required a search warrant, since it was not necessary to physically trespass in order to tap the phone. At first, it was decided that this was not trespassing, and that it was legal to tap a phone without a warrant. This law was later changed. How does this compare with the Internet and the possibilities for monitoring our movements through websites, our chat interactions, our email, our USENET postings, or entering directly into our hard drives through the use of some intrusive program and searching through our files? What happens to privacy then? Is this trespassing? This could all be done without physically entering our homes, which the original version of trespass law was concerned about.

Copyright law is related to the rights concerning ownership of physical things, but it extends into the realm of ideas. This is similar to trespass law in that the sphere of enforcement extends into the non-physical. Law is trying to have something to say about the regulation of non-physical things. Copyright law gives the author rights of ownership as if the ideas of the author were unique physical things. Many physical books can contain the exact same text but the non-physical abstraction of the text belongs to the author under copyright. Under copyright law you cannot manufacture a book containing the text of an author without that author's permission. This law is enforceable. With the advent of the computer, and the ability to repeatedly duplicate a text with negligible manufacturing costs and to easily distribute its content, it became especially difficult to regulate against copyright crimes. Yet, at the same time, law has never regulated copyright as strictly as it is now possible to regulate it with code. You can read a physical book as many times as you like and give it away or sell it to someone without asking the author for permission or giving the author any part of the money you get. With code, and the needs of Net commerce, it may happen that you purchase an e-text online with fewer rights than you have with a physical book. The author may retain more rights through Internet copyright laws. It depends on the code and the ability of others to circumvent that code. The market, in conjunction with law, code, and norms, will work to enforce the new copyright restrictions. Only those able to break the code and make copies anyway, as long as they are also willing to suffer the social and legal consequences of doing that, will defeat the new copyright regulations.

Copyright law not only protects the author from losing the first-sale monetary reward for his work (just like patent law), it also protects against losing the reward of esteem. An author wants to be recognized for having interesting, original, or useful ideas. Without copyright protection not only might he lose payment, but someone else might take credit for something which cost him a great deal of effort. Copyright law also protects the integrity of the author's work. You can't insert some rogue text into a larger text protected under copyright, for example. (Notice, incidentally, that the agenda of the Open Source Initiative seems to entail a renunciation or denial of certain copyright protections.) There is a relation here to the concept of sovereignty, but let's consider privacy next.

Privacy is threatened by Net commerce. Lessig mentioned this earlier in the book, but when he wrote his chapter on privacy he said very little about that. There is in fact little of substance to recount from the chapter, or to extrapolate, which I've done often in this review. A quotation must do: "People gain knowledge about you in only two ways — through monitoring or searching (or by reports relying on the results of monitoring and searching)." (p. 143)

The chapter on free speech is as weak as that on privacy. Essentially, Lessig distinguishes between zoning and filtering. Filtering can be invisible and occur at various points, such as within our computer, at the ISP gateway through which we access the Net, or at the websites we visit (the site may filter content from us without our knowledge). Zoning would be relatively more visible in that it would create restricted areas of the Net, to which we would be denied access if the zoning ordinance of that area disqualified us. Lessig prefers zoning because its use and consequences are less hidden. He doesn't mention this explicitly, but filters and zones can not only restrict ingress but also egress: they can not only keep people from getting into an area to access guarded content but also keep any banned content from getting out.

In the final pages of the chapter on free speech, Lessig discusses the FCC and its regulation of the broadcast spectrum. He says that this regulation, while it is not fully compatible with our (that is, those of us who are U.S. citizens) Constitutionally guaranteed right to free speech, it came about because chaos would have resulted without overriding laws governing allocation of use. The argument for these laws focused on the impracticality of broadcast without them. This resulted in Federal licensing and the governmental control over (broadcast) speech. This was a regulation of architecture. With the advent of "spread spectrum" broadcast, the original argument for Federal involvement in broadcast control is now questionable. In comparison, Lessig says, the Internet has no practical difficulties like those which occurred in the early days of radio. Nothing needs to be allocated for practical reasons that would regulate who has access to the Net or who can send or receive information within it. Lessig, does not, however, mention in this context that our access to the Net is controlled by our ISP, which itself is to some degree under Federal control.

The next chapter is on sovereignty. Control is enabled through the "architecture" of a society. Without the necessary social configurations, laws cannot be enforced. Lessig describes sovereignty as "the sovereign's power to set rules that govern the behavior of people rightfully within its reach." (p. 192) He emphasizes that it is through rules applied to those rightfully within the sovereign's authority that the sovereign governs. United States citizens are subject to dual sovereignty: their State government and the Federal government. According to the "principle of supremacy", Federal law prevails over State law. Federal law can even control a U.S. citizen outside the United States. The Child Sexual Abuse Prevention Act, 18 USC §2423(b) (1994), forbids "Americans from engaging in child sex while outside the United States, even in jurisdictions where child sex is permitted." (p. 191) What about sovereignty and the Internet? While online you are also subject to the laws of your country. You are like a traveler to another country while remaining within your own. Where is the authority of the Net? How does sovereignty function there? There is at present no principle of supremacy operating to adjudicate control. Lessig writes: "Government should push the architecture of the Net to facilitate its regulation, or else it will suffer what can only be described as a loss of sovereignty." (p. 199) He believes this because, he says, "these structures and the values they embed should be architectures and values we have chosen." The question I would raise is this: does the Government control the people or do the people control the Government? Who, then, would be pushing "the architecture of the Net to facilitate its regulation"? Lessig doesn't raise the question. It's a vital point because there is a power evolving in technology beyond any that has ever existed before — it is creating an enabling architecture, profoundly useful for the enforcement of law — and the extent to which an autonomous Government has control over that technology is the extent to which the power of that Government is unassailable. It is through code that the architecture of the Net arises. It is, then, through the control of code that one pushes "the architecture of the Net to facilitate its regulation". Code, therefore, becomes equivalent to law. "If code is law, who are the lawmakers? What values are being embedded into the code?" (p. 207) Who and what, indeed?

Lawrence Lessig's website is here.