The Internet Protocol Journal, Volume 11, No. 3

Book Reviews

Two Books on Cyber Law

Code and Other Laws of Cyberspace, by Lawrence Lessig, Basic Books, 1999, ISBN 0-465-03913-8.

Code 2.0, by Lawrence Lessig, Basic Books, 2006, ISBN-10: 0-465-03914-6, ISBN 13: 978-0-465-03914-2.

First published in 1999, then Harvard Law School Professor Lawrence Lessig's cautionary tale about the inescapable influence of certain material features of the built Internet has since become a foundational "Internet studies" text in universities and laws schools around the world. Lessig, who now occupies an endowed chair at Stanford Law School, makes a series of troubling observations about the Internet, his chosen sector of focus since setting aside his mid-1990s work on legal and institutional development in post-Soviet societies.

Lessig's key findings from that previous work are that rules matter—especially the sort of rules embodied in "constitutions" and other foundational institutions; that rules are artifacts of contingent human intent and design; and that rules can be changed. Being a "classical liberal" on the model of John Stuart Mill, Lessig advocates the sort of rules that afford maximum liberty for individuals against a triumvirate of coercive influences, including not only governments but also market power and oppressive social mores.

Now however, a fourth challenge to personal liberty has been exposed by the advent of the Internet—or rather, of cyberspace, which Lessig describes as the lived experience of participants in the rich application space that has been built atop the Internet. This new constraining factor is "architecture," which Lessig defines as "the built environment," or "the way the world is," that is, the cumulative result of all of the contingent historical events and decisions that have shaped the material circumstances confronting Internet users (or cyberspace denizens) today. Code is Lessig's term for the instruction sets (that is, programs, applications, etc.) that are the building blocks of the architecture of cyberspace; it is the stuff that emerges from the decision making of a relatively few (the code writers), which accretes over time into the less-malleable architecture that shapes the everyday choices and possibilities of everyone else whom the Internet or cyberspace touches.

New Code Means New Power(s)

According to Lessig, the code that defines cyberspace—which he calls "West Coast Code"—demands particular attention, both because of its omnipresence and because of how it differs from the other, more familiar factors that can impinge on individual liberty.

Like the canons of law (also known as "East Coast Code"), code is basically a collection of rules written with human goals and objectives in mind. However, in its effects code more closely resembles the laws of nature, because it requires neither the awareness nor the consent of its subjects in order to be effective. Although this claim sounds suspiciously like a variant, or perhaps an illustration of Arthur C. Clarke's Third Law of Prediction (which states that any sufficiently advanced technology will be indistinguishable from the supernatural), there is purpose behind Lessig's observation. The self-enforcing character of code is doubly problematic in the case of cyberspace, he suggests, because unlike the law, code affords no appeal, no recourse, and no formal, institutional review and interpretation of the kind that lawyers and judges exercise in legal matters. Without such expert oversight, code might come to be used as a tool to subvert individual liberties or public values, for either commercial or political gain, without anyone's being the wiser. In fact, he implies, the lack of transparency of code almost invites such abuses.

At this point some might be tempted to dismiss Lessig's program as just "sour grapes" from a high-profile industry spokesman sensing this erosion of the traditional prominence and centrality of his profession in a new code-centric world. Lessig believes passionately in the exercise of law and judicial review as master tools for keeping other important forces—government power, market power, and social norms—broadly aligned with "important public values." He extols the relationships among the rule of law, democracy, and politics, the latter of which invests law with legitimacy to raise or lower the cost of particular individual actions (for example, by taxing, criminalizing, valorizing, or subsidizing them) to encourage conformity with publicly chosen goals and values. He observes that "architecture is a kind of law" and that "code codifies values, and yet, oddly, most people speak as if code were just a question of engineering." It takes no great leap of imagination to conclude that code too should be subject to the same kind of legal and judicial oversight that keeps the rest of society running smoothly. Eliminating any doubt, Lessig asserts that:

"Technology is plastic. It can be remade to do things differently. We should expect—and demand—that it can be made to reflect any set of values that we think important. The burden should be on the technologists to show us why that demand can't be met."

However, such a dismissal would indeed be too easy, for Lessig also expresses misgivings about the professionalization and segregation of "constitutional thinking" within the legal sector. "Constitutional thought has been the domain of lawyers and judges for too long," Lessig writes, and as a result everyone else has grown less comfortable—and also less competent—in engaging in fruitful conversation about fundamental, "constitutional" values.

And yet Lessig suggests that this skill has also atrophied within the legal community, as more and more jurists have embraced an "originalist" interpretive philosophy that holds that the U.S. Constitution provides no guidance for how to resolve conflicts between old values—what Lessig calls latent ambiguities—or how to address wholly novel concerns raised by technologies such as the Internet. Originalists (Lessig mentions U.S. Supreme Court Justice Antonin Scalia) assert that in such cases the only recourse is the political and legislative processes—where, one assumes, limited experience with both technology and constitutional debate make the prospects for success even dimmer. Lessig writes that "We (legal scholars) have been trapped by a mode of reasoning that pretends that all the important questions have already been answered," but that "the constitutional discourse of our present Congress is far below the level at which it must be to address the questions about constitutional values that will be raised by cyberspace."

Diagnosis from a Distance

Lessig is without question eminently qualified to make such observations about his home-turf legal and political spheres. However, it is less clear that his blanket charge of deliberative incompetence is equally valid across the full range of Internet and cyberspace stakeholders. Neither is it clear that the architecture of cyberspace is as uniquely problematic as he suggests, compared to the architecture of other, more familiar domains. Finally, Lessig's own admittedly limited technical expertise may lead him to misapprehend the boundary between cyberspace and the Internet, and to underestimate the radicalness of his proposed cyberspace fix.

Taking these ideas in reverse order, Lessig's conception of the structural and functional distinction between the Internet and cyberspace merits closer scrutiny. As explained later, Lessig advocates profound technical changes to bring the functions of code under the rule of law (or laws, because Lessig wishes to accommodate subsidiary jurisdictions as well as sovereign differences in law). However, he envisions this intervention affecting only the "code" domain, not the "Internet's core protocols":

"When I speak about regulating the code, I'm not talking about changing these core TCP/IP protocols...In my view these components of the network are fixed. If you required them to be different, you'd break the Internet. Thus rather than imagining the government changing the core, the question I want to consider is how the government might either (1) complement the core with technology that adds regulability, or (2) regulate applications that connect to the core.

Lessig's specific ideas for achieving this function while preserving the core are not fully detailed in this context until Code 2.0 (2006), which Lessig describes as an update rather than a full rewrite, albeit one with new relevance to match a "radically different time." The central idea involves the introduction of an "identity layer" that permits authoritative in-band querying and signaling of the jurisdiction(s) to which every would-be Internet user is subject. The deployment of this system would be accompanied by the development of a comprehensive distributed database of Internet usage restrictions mandated by every legally recognized jurisdiction around the world. Together, these components would operate as a kind of "domain interdiction system" that would automatically black-hole all Internet resource queries that are legally impermissible to individuals based on their jurisdiction(s) of origin, regardless of their actual location.

This proposal is clearly vulnerable to criticism of many kinds—technical, ethical, practical, etc.—and to be fair Lessig anticipates and preemptively responds to several of the most obvious ones. Space limitations preclude any review of those arguments here, but it is impossible to resist a few short observations. First, it is not clear why Lessig imagines that his proposed system would be anything less than a fundamental intervention in the core function and protocols of the Internet. Today several different high-profile technical developments that could plausibly be described as changing TCP/IP are under way, but they (hopefully) will not break the Internet. At the same time, TCP/IP is not the only technology that is essential to the Internet "core." The system that Lessig advocates is clearly inspired by the Domain Name System (DNS), it would of necessity be similarly global and ubiquitous in scope and scale, and it would likely function by selectively blocking some DNS responses based on the initiator's identity. Although some once regarded the DNS as a mere application (for example, shortly after it was invented), few today would categorize it as anything other than a core protocol. Also, given the degree to which any implementation of the proposed identity system would preempt many "normative" features that are associated with the Internet core (for example, the principles behind the end-to-end arguments), it is unclear what would remain "unbroken" therein that might still warrant any special consideration or separate treatment. We can only hope that Lessig's optimism on this question is justified, because looming developments in certain wireless standards as well as in the management of IP addressing may provide for more concrete—and less revisable—answers in the very near future.

Objects in View May Be Closer Than They Appear

Then there is the question of how much code really makes the architecture of cyberspace different from the architecture of other domains. Many of Lessig's claims on this point date back to the first version of the book, when Internet exceptionalism was still new enough for deflationary counterarguments to seem provocative.

Although the revolutionary potential of the Internet continues to inspire many (this reviewer included), the past decade of booms, busts, compromises, and indictments have done much to temper that faith. It is not that Lessig's concerns about the opaque nature of cyberspace architecture, about the substantial influence that code writers and network owners command, and about the vulnerability of the whole system to a crisis-induced authoritarian turn aren't reasonably well-founded. But they are equally apropos to most other important spheres of life. The phrase "possession is nine-tenths of the law" has multiple meanings, and was coined many decades before the Internet was invented. The inexplicability of many current "real-world" legislative and judicial outcomes without recourse to some cynical theory of unacknowledged interests and unobservable influence certainly raises many questions about the architecture of the space beyond cyberspace. And Lessig's warnings about national security fears precipitating a sudden loss of freedoms (taken from Jonathan Zittrain's Z-Theory) now seem prophetic—albeit less for the Internet than for the earliest and largest host society of the Internet. One might observe that Lessig is guilty of his own kind of exceptionalism—one that, ironically, may obscure the degree to which constitutional challenges in the real and virtual worlds are more or less the same. In fact, Lessig's subsequent shift of priorities from code to intellectual property law recently ended with a return to his original home turf of law and politics—perhaps in belated recognition that sometimes, even when you have a good story, East Coast Code is still the only durable recourse.

Finally, there is the question of constitutional acumen. This question is the critical one for Lessig (he uses some form of the term constitution more than 250 times in the main text), because for him the term evokes nothing less than "an architecture... a way of life that structures and constrains social and legal power, to the end of protecting fundamental values." In this sense, he adds, constitutions are built rather than found. Moreover, they have been built in different (albeit sometimes overlapping) places by different institutions and societies, many with quite different conceptions of which fundamental values to uphold. From whence will the architecture of values of cyberspace emerge? Who will be its authors? Lessig never quite gives a final answer, even for his own home jurisdiction, but he does help to winnow out several likely suspects. As noted previously, he invests little faith in the current U.S. legislative branch. He also has reservations about many members of his own legal profession, although the need to preserve backward compatibility with the primary U.S. Constitution and to reconcile newly revealed "latent ambiguities" therein obviously recommends some legal training at the very least. Government and industry represent the most likely perpetrators of liberty-undermining code, Lessig claims, so he looks for no help from those quarters.

In the end Lessig provides some oblique advice for judges (abandon formalism), hackers (open source), and voters (educate yourself, and don't give up hope), but ultimately concludes with a call for more lawyerly deliberation: if only our leaders could act more like lawyers, telling stories that persuade "not by hiding the truth or exciting the emotion, but by using reason," and our fellow citizens could act like juries, resisting the fleeting passions of the mob and making decisions based on the facts alone, then perhaps we could overcome the architectural challenges of both cyberspace and physical space.

Story Boards and Internet Constitutions

Notwithstanding its solipsistic aspects, advice like that discussed in the last section is hard to find fault with. Professor Lessig is unquestionably a person of good conscience, and has a long, distinguished, and very well-documented record of putting this advice into practice in a wide range of good causes, including many that are wholly unrelated to code or cyberspace. However, one could argue (perhaps with equal solipsism) that many of the behaviors and virtues that he commends are now regularly on display in the mailing lists, message boards, and other deliberative records of the Regional Internet Registries, the IETF, and the IAB—in particular in discussions on the form that IPv4 and IPv6 address-allocation policies should take, in the design of future routing systems that balance scalability with the freedom to choose between competing providers, and in the reconciliation of traditional policies and their beneficiaries with the changing realities of Internet resource stewardship. Closer scrutiny of these records reveals that successful consensus policies are almost invariably borne of good, well-reasoned stories, the vast majority of which are offered by individuals who are affiliated neither with government agencies nor with any of the largest and most powerful ISPs. Many of the storytellers are old hands, but new voices regularly emerge and command attention based on nothing more than the strength of their reasoning. Participating in these discussions, one can occasionally experience the same feeling that inspires Lessig in the courtroom, where "some, for the first time in their lives, see power constrained by reason. Not by votes, not by wealth, not by who someone knows—but by an argument that persuades."

That this "architectural" work has gone largely unrecognized to date in law schools, university humanities and social science departments, and even in some civil society-oriented Internet governance fora is not entirely unexpected, because the context and terminology of those discussions is invariably technical, even if many participants recognize that the underlying principles are essentially "constitutional" in nature. No doubt a more complete conversation between code writers and constitutionalists is inevitable over time, and with luck more cross-fertilization will lead to better protocols, better policies, and better architecture.

However, this rapprochement is unlikely to be initiated by technologists seeking to take up the study and application of legal principles. Lessig, whose own intellectual project builds substantially on the antiformalist, "legal realist" school of thought, should understand this reality better than most. In the crudest of forms, legal realism holds that "the Law is whatever lawyers happen to say it is." Stated as neither a boast nor a claim of entitlement but rather as a practical observation of the challenges that lawyers face in applying ambiguous old laws to incommensurable new circumstances, this maxim nevertheless clearly conveys a sense of both the great responsibility and the great power that lawyers command. Perhaps it is time that Mr. Lessig and his counterparts consider the possibility that a similar school of thought may inform (consciously or unconsciously) the perspectives of network builders and code writers. Being of no less good conscience, perhaps code writers and other "cyberspace realists" are merely waiting for the moment when the Law and lawyers come calling with a good story, under the banner of reason rather than power. So long as the story now unfolding continues to make sense and satisfy the ever-expanding audience, we needn't fear either.

Code may not be that particular story, but it's an excellent read, and an important contribution to a dialogue that must be engaged.

—Tom Vest

Read Any Good Books Lately?

Then why not share your thoughts with the readers of IPJ? We accept reviews of new titles, as well as some of the "networking classics." In some cases, we may be able to get a publisher to send you a book for review if you don't have access to it. Contact us at for more information.