What Larry doesn't get: code, law, and liberty in cyberspace.

• Author: Post, David G.
• Position: Review

CODE AND OTHER LAWS OF CYBERSPACE. By Lawrence Lessig. Basic Books. 1999. 297 pp. $30.00.

The emergence of the vast informational ecosystem we call cyberspace is an event of incalculable importance in the history of human liberty. The diversity and vibrancy of this "never-ending worldwide conversation"(1) continues to astonish and amaze those who spend time there. But life, as Kierkegaard reminds us, has to be lived forward, even if it can only be understood backward. Having brought this thing into being, how do we keep it alive and growing so that it can realize its profound freedom-enhancing promise? What's the plan?

Some suggest that this is all too important to be "left to the market," that the choices cyberspace forces upon us involve fundamental, even "constitutional," values that commerce will ignore or even destroy. Lawrence Lessig's Code and Other Laws of Cyberspace is surely the most elegant articulation of this view: Politics and collective decisionmaking, not the invisible hand, will give us a cyberspace where these values are protected.(2) I want to try here to articulate a different vision of the space. Fundamental values are indeed at stake in the construction of cyberspace, but those values can best be protected by allowing the widest possible scope for uncoordinated and uncoerced individual choice among different values and among different embodiments of those values. We don't need "a plan" but a multitude of plans from among which individuals can choose, and "the market," and not action by the global collective, is most likely to bring that plenitude to us.

As I was preparing this essay, I was asked to speak at a panel discussion about the problem of unwanted and unsolicited email ("spare") at Prof. Lessig's home institution, Harvard Law School's Berkman Center for Internet and Society.(3) The discussion focused on one particular anti-spam institution, the Mail Abuse Prevention System ("MAPS"); Paul Vixie, the developer and leader of MAPS, was also a participant at the event. MAPS attacks the problem of spare by coordinating a kind of group boycott by Internet service providers ("ISPs"). It operates, roughly, as follows.(4) The managers of MAPS create a list--the Realtime Blackhole List ("RBL")--of ISPs who are, in their view, fostering the distribution of spam. MAPS defines "fostering the distribution of spam" as, inter alia, providing "spam support services" (e.g., hosting web pages that are listed as destination addresses in bulk emails, providing email forwarders or auto-responders that can be used by bulk emailers), or allowing "open-mail relay" (i.e., allowing mail handling servers to be used by nonsubscribers, which allows bulk emailers to "launder" email by launching it from a site to which they cannot be traced).s MAPS makes the RBL list available to other ISPs on a subscription basis.(6) ISPs who subscribe to the RBL can, if they choose, set their mail handlers to delete all email originating from, or going to, an address appearing on the list; blackholed addresses disappear, in a sense, from the Internet as far as the subscribing ISP (and its customers) are concerned.(7)

The timing was propitious. Lessig, it happens, has made it very clear that he doesn't like the RBL at all. In one of the columns that he writes periodically for the Industry Standard, he castigates members of what he called the "self-righteous spam police," and he offered his opinion that "fundamental policy questions about how the Net will work" should not be in the hands of these "vigilantes."(8) Should network policy be subject to this kind of "policy-making by the 'invisible hand'"?(9)

The answer is obvious, even if the solution is not. This is not how policy should be made. We know this, but we don't know what could replace it. We imagine policy decisions made in a context where dissent can be expressed without punishment, where collective decisions can be made. But no such context exists in cyberspace, nor in our imagination about what cyberspace might become.(10) Now, my take on the RBL is quite different than Lessig's.(11) The MAPS "vigilantes" (bad) can just as easily be characterized as "activists" (good), and the kind of "bottom-up," uncoordinated, decentralized process of which the RBL is a part(12) strikes me as a perfectly reasonable way to make "network policy" and to "answer fundamental policy questions about how the Net will work."

What I found most puzzling is not that Lessig and I disagreed; we have engaged in a public and private conversation about law and governance in cyberspace over the past several years,(13) and we have disagreed before. It is that Lessig considered my view not merely incorrect, but obviously and self-evidently incorrect. Lessig had placed a "Do Not Enter" sign at the entrance to one path through the jungle of cyberspace policy--a path that I think looks pretty interesting--without any real explanation of why he had done so.(14)

Code, and Other Laws of Cyberspace is that explanation. The theme of Code--or at least one major theme of a book filled with complex, interlocking argument--is precisely the one that Lessig articulated in his column: that "[p]olicy-making by the invisible hand"(15) will create a cyberspace in which we will not want to live. There is "no reason," he states at the very beginning of the book,

... to believe that the grounding for liberty in cyberspace will simply emerge. In fact, as I will argue, quite the opposite is the case.... [W]e have every reason to believe that cyberspace, left to itself, will not fulfill the promise of freedom. Left to itself, cyberspace will become a perfect tool of control.... [T]he argument of this book is that the invisible hand of cyberspace is building an architecture for cyberspace that is quite the opposite of what it was at cyberspace's birth. The invisible hand, through commerce, is constructing an architecture that perfects control....(16) Code is, in short, a dense and multi-layered indictment of the invisible hand. Good lawyer that he is, Lessig's argument has the feel of inevitability that the best arguments always have, marching logically and even inexorably from its premises to its conclusion: The accused is guilty as charged. Why then, he asks with frustration and even despair, don't the Net libertarians--those "for whom this point should be most important"--"get it"?(17) How can they "believe liberty will take care of itself"?(18) Why do they seem almost "proud" to "leave things to the invisible hand"?(19) Why don't they see that if we just "do nothing" the invisible hand is poised to bring us a cyberspace that is "less free" than it is today?(20) How can they be so obtuse?

Although I have not been appointed the designated spokesman for the libertarian position--something of an oxymoron, that--I am someone who has, let us say, more sympathy than Lessig for the libertarian position, and I'm happy to take Lessig up on his challenge. I want to suggest here that some of us do get it--we even admire it and learn much from it. But we don't buy it. We do not fail to understand or appreciate the logic of Lessig's argument; we simply do not accept its premises--premises that are, I suggest below, not as self-evidently true as Lessig might have us believe. One can, in other words, start from a very different set of premises and march just as inexorably to a conclusion that at least casts reasonable doubt on the defendant's guilt.

1. THE IS OF IT

   Let us, then, take a careful look at Lessig's argument. He first sets the context: What do we need to know about this new place in order to think clearly about law and governance there? Lessig does not subscribe to the "cyberspace is just like real-space" school of thought; he recognizes that one cannot understand law and governance in cyberspace unless one acknowledges that "something fundamental has changed,"(21) that "[c]yberspace presents something new for those who think about regulation and freedom. It demands a new understanding of how regulation works and of what regulates life there."(22)

   That something new is the "code" of the book's title. The regulation of human behavior takes place through a complex interaction among four forces, four different "regulators." Three are familiar: law, markets, and social norms.(23) The fourth regulator is what Lessig calls "architecture," the combined constraints of physics, nature, and technology that in the aggregate define the contours of the place(s) where human behavior occurs and the thing(s) through which it is expressed. With regard to the smoking example Lessig uses to illustrate the way these regulators work,(24) he writes:

   [T]here are the constraints created, we might say, by the technology of cigarettes, or by the technologies affecting their supply. Unfiltered cigarettes present a greater constraint on smoking than filtered cigarettes if you are worried about your health. Nicotine-treated cigarettes are addictive and therefore create a greater constraint on smoking than untreated cigarettes. Smokeless cigarettes present less of a constraint because they can be smoked in more places. Cigarettes with a strong odor present more of a constraint because they can be smoked in fewer places. In all of these ways, how the cigarette is affects the constraints faced by a smoker. How it is, how it is designed, how it is built--in a word, its architecture.(25) Each of these constraints is a "distinct modality of regulation."(26) The constraints are distinct, yet highly interdependent. Regulation of an individual's behavior is the "sum of these four constraints,"(27) and a complete picture of regulatory action must consider all four.

   What makes cyberspace a new place is that its architecture is, uniquely, defined by its code--the design of the hardware and software elements that populate this new place, and of the communication protocols that allow these elements to interact with one another.

   [A]n analog for...