The Code Is the Law

By Lawrence Lessig
The Industry Standard

April 09, 1999

Three years ago, Congress passed the Communications Decency Act, trying to prevent "indecent" material from reaching kids. The Net went wild in opposition. About a year ago, Congress passed a second attempt to regulate indecency on the Net. No one seemed to notice.

In 1995, Netscape's Navigator version 1.1 introduced the technology for placing "cookies" on client machines, making it easier to gather and track data about Web surfers. No one seemed to notice. Three months ago, Intel announced the Pentium III, with a digital ID built into the chip. The Net went wild.

This is progress. The single most significant change in the politics of cyberspace is the coming of age of this simple idea: The code is law. The architectures of cyberspace are as important as the law in defining and defeating the liberties of the Net. Activists concerned with defending liberty, privacy or access must watch the code coming from the Valley – call it West Coast Code – as much as the code coming from Congress – call it East Coast Code.

Civil-rights groups are beginning to get this. The ACLU fought hard against the CDA, East Coast Code regulating the Net. Bruce Ennis, arguing the case before the Supreme Court, asserted that blocking software – West Coast Code – would do the job better than Congress.

But when the court agreed, the ACLU turned against West Coast Code and published "Fahrenheit 451.2: Is Cyberspace Burning?" which warned of the threats to free speech these solutions present. The Center for Democracy and Technology has been consistently code-centric (though too friendly to code in the context of indecency) as has the Electronic Frontier Foundation, cofounded by Mitch Kapor, father of Lotus and of the meme "Architecture is politics."

The future of Net regulation will be more West Coast Code. More and more, those with interests to protect (copyright holders, for example) or interests to exploit (feeders on personal data) will use code writers of Silicon Valley rather than Congress to secure their interests.

Thus, rather than depend on Congress to bottle up MP3, copyright holders are increasingly likely to turn instead to more efficient code to do the same thing. Regardless of congressional legislation, the personal-data bottom feeders are likely to get what they want through sophisticated systems of identification buried deep inside their code. West Coast Code works better than East Coast Code. It's faster, cheaper and more reliable than the laws made by Congress.

It makes no sense to uniformly condemn, or praise, West Coast Code solutions. Technology is always Janus-faced – what looks freedom-enhancing from one perspective looks freedom-reducing from another. The recent flap over Microsoft's identification data, stored in its Office 98 files, is a perfect example: When Richard Smith, president of Phar Lap Software, alerted the world to the potential threat posed by the data, Microsoft was quick to promise that it would be removed. But a few weeks later, Smith used that very same data to track down the source of one of the most significant Net viruses of recent history, Melissa.

Rather than condemn, the trick is to critique. We must develop the same critical sensibilities for code that we have for law. We must ask about West Coast Code what we ask about East Coast Code: Whose interests does it serve and at what price? Is it consistent with values we believe fundamental? Does it protect certain interests (copyright in particular) more than our tradition, and our Constitution, would?

Consider the value of transparency and the difference between open code (such as Linux or Apache) and closed code (the Mac OS or Word 98). If there is one thing clear about the value we demand of East Coast Code, it is transparency. Secret laws are not law. And if there is one thing clear about the recent panic about privacy, it is that much of the anxiety was about the secrets hidden within closed code. Closed code hides its systems of control; open code can't. Any encryption or identification system built into open code is transparent to those who can read the code, just as laws are transparent to those who can read Congress' code – lawyers.

The question for the future will not be whether West Coast Code regulates; it already does, and nothing can stop it. The question for the future will be how West Coast Code regulates. Does it do so in the open? Is it transparent about its means? Does it advance values that we believe are fundamental?

Open code can answer these questions more easily than closed code can. But there is no reason to believe closed code can't become responsible. Let them publish their regulations, so the regulated can choose. n

Lawrence Lessig [ http://www.thestandard.com/thenetwork/person_display/0,1407,1739,00.html ] (http://cyber.law.harvard.edu/lessig.html) is the Berkman Professor of Law at Harvard Law School.