Review of:
Lessig, Lawrence. Code and Other Laws of Cyberspace. Basic Books, 1999*
By Karen Coyle

We have all encountered passages such as those above, declarations by the digerati of cyberspace on the non-governability of cyberspace. Some of them seem just silly, some of them have a ring of truth, but they all have a catchy appeal about them in the way that they declare a kind of unbounded enthusiasm for the new world order. I guess we could think of them as the "tune in, turn on, drop out" of the Internet generation. The arguments that counter these declarations of freedom tend to be stodgy and pedantic statements about government and responsibility. They are much less appealing.

Fortunately, we now have Lawrence Lessig, professor of constitutional law at Harvard and Fellow at the Berkman Center for Internet and Society. Here is a man who understands the term "government" at an extremely deep level and who expresses it in language that is modern, eloquent and even amusing. He is at heart a constitutional law expert, and when Lessig writes about governance and cyberspace it becomes a lesson in constitutional law. Not just law as it applies to cyberspace, but law as it applies to everything we do. This is the book for those of us who never thought very hard about government until we found ourselves in a place without it.

Listening to Lessig explain the role of government and constitution makes you ever grateful that the thinkers of the late 18th century were folks like Jefferson and Adams, and not Negroponte and Barlow. Imagine if, at the end of the Revolutionary War, the movers and shakers of the New World colonies had stood back and said, "Well, great, that's over. And, hey, who needs a government anyway?" But we tend to take all of the hard intellectual work of the founding fathers for granted. After all, we live in a country that hasn't faced a real constitutional crisis for over two hundred years. Other than hashing out rules of conduct with our college roommates most of us have never even tried to formulate a basic set of rules for living. At least, until e-mail came along.

Although the book is named Code and Other Laws of Cyberspace, Lessig uses this theme sparingly. It is a fairly simple concept: since cyberspace is entirely human-made, there are no natural laws to determine its architecture. While we tend to assume that what is in cyberspace is a given, in fact everything there is a construction based on decisions made by people. What we can and can't do there is governed by the underlying code of all of the programs that make up the Internet, which both permit and restrict. So while the libertarians among us rail against the idea of government, our freedoms in cyberspace are being determined by an invisible structure that is every bit as restricting as any laws that can come out of a legislature, legitimate or not. Even more important, this invisible code has been written by people we did not elect and who have no formal obligations to us, such as the members of the Internet Engineering Task Force (IETF) or the more recently-developed Internet Corporation for Assigned Names and Numbers (ICANN). It follows that what we will be able to do in the future will be determined by code that will be written tomorrow, and we should be thinking about who will determine what this code will be.

If that was all that Lessig had to say on the topic he would have done best by having himself interviewed by Wired instead of writing a book. But Lessig does not have such easy answers for us. As a matter of fact, the book doesn't contain answers; it weaves a complex cloth of legal and social thought, designed in part to let us know that no clever one-liner is going to solve our problems. Using techniques from the legal world, he presents many of his ideas by recounting actual events that have tested real world law in confronting virtual world problems. He gives us case studies with problems that haven't been clearly resolved. As someone unaccustomed to legal thinking (for I suspect that his style is common in the legal world) I was impressed by his decision not to take the easy way out, not to seek out a satisfying conclusion, by his insistence on seeing all of the complexity of a problem and leaving the reader with difficult things to think about.

Through the book he also introduces us to some legal concepts that many of us may not have encountered before, specifically indirection and translation. He then shows us how these concepts can be applied to some of the most basic and pressing issues we face on the Net: privacy, free speech and intellectual property.


One of Lessig's basic lessons is that there are direct and indirect forms of control over our behavior. Through his examples he shows that most regulation is not direct, but that social and technical aspects of the world around us affect our behavior. Local mores are a form of indirect control over our behavior, as is peer pressure. The code of cyberspace, from TCP/IP to HTTP, is a form of indirection, albeit technical. It has had both intended and unintended consequences, with anonymity being within the former and spam among the latter. Or perhaps a better example is the development of cookies to maintain state across HTTP accesses, which then became an instrument for user tracking and the gathering of marketing information. Because technologies are complex many people today are unaware of the controls that are operating on their lives through technological architecture.

Governments and other power institutions also engage in indirection even though they have direct regulation capabilities as well. An example of government indirect regulation is that of adding heavy taxes to the sale of cigarettes. The government might actually wish to tell you that you cannot smoke, but it chooses not to do that directly for a variety of reasons, so it approximates its goal (and perhaps masks its intentions) by making cigarettes artificially expensive through taxation and thus relying on economic forces to convince you to quit.

However, indirect regulation has its problems. As Lessig puts it: "Indirection misdirects responsibility." It masks the true source of power. When used by government, it makes government action less clear and it makes government less accountable for the results. It can even upset the balance of powers in our democracy, such as when the Reagan administration "regulated" doctors in family planning clinics to not advise patients of the option of abortion. This particular act was in defiance of the U.S. courts, which had determined that abortion was indeed within the law.

An example of indirection from cyberspace is encryption. The U.S. government has regulated encryption of communications in cyberspace by outlawing the export but not the use of encryption technology. Because the Internet is a global communications system, and there is currently no way to apply a technology to only one geographical region, this has essentially blocked use of high levels of encryption on the Net.

Lessig's message about indirection is a warning. While many Net movers and shakers are busy fighting against any overt acts of government regulation of the Internet, the Net is evolving and the direction of its evolution is not random. Although very little of cyberspace is directly regulated, many powerful entities, whether governments or corporations, are clearly getting what they want. How they get it may not be obvious to us.

To illustrate this, Lessig uses the technological and legal question of authentication of Internet users. Many of the problems of regulation in cyberspace have to do with the fact that we really don't know who is on the other end of our virtual communication. This has been most obvious with respect to the issue of pornography on the Internet. In real space, it's easy to deny a 9-year-old access to materials with explicit sexual content; if a child of that age walks into a store and picks up Hustler magazine, everyone can see that he is too young to read or purchase the magazine. Not so in cyberspace, where anyone can click the button that says, "Yes, I am over 18 years of age."

This lack of authenticated identification not only makes it hard to protect children, it can be detrimental to legitimate business, the kind that government wants to encourage. An example of this is the sale of wines over the Internet. Many vintners would like to sell their wares over the Internet much as other businesses are doing, but the restrictions on who can and can't purchase alcohol, which vary greatly from jurisdiction to jurisdiction, make these sales very problematic.

To solve problems of this nature it would make sense for each of us to have an online ID that included information about where we live and how old we are. However, the Internet community would certainly resist the idea of a government-sponsored online identifier. But it doesn't have to be a government ID; any persistent form of ID would do. This ID could come into existence in the normal course of the development of e-commerce and could facilitate all kinds of transactions. Once the IDs begin to catch on they would be required for access to many online services, and so more and more people would find that access in cyberspace depends on having such an ID. And once the IDs exist and are in general usage there is a whole range of regulation that becomes possible, for example states with laws forbidding gambling can require Internet gambling sites to reject users from their state.

So the mechanism for applying governmental regulations and restrictions in cyberspace does not have to come directly from government. There are many other ways that the authentication of users may come about. A clever government would encourage -- or at least fail to discourage -- the development of e-commerce applications that make such IDs necessary. This isn't a conspiracy theory, it's a description of how things happen in today's world.


Another important legal concept that he introduces us to is translation. Translation is what allows courts to apply older legal concepts to new situations and it is what allows the law to attempt to keep up with new technologies. An example of translation occurred when the courts confronted wiretapping. The Fourth Amendment protects "persons, houses, papers, and effects, against unreasonable searches and seizures." There is, of course, nothing in the constitution about protecting communication going across wires. When it first came up the courts did not interpret the Fourth Amendment to cover wiretapping because it didn't take place within the private home of the individual. But in 1967 the Supreme Court took another look at wiretapping and this time translated the Fourth Amendment to mean that area where, in the context of the times, private activities take place. Since private conversations now commonly take place between parties who are not in the same physical space, the virtual space of the phone conversation was included by the court in the list of private areas that should be protected by the Fourth Amendment.

The arguments against applying real world law to the Internet often come down to a declaration that the Internet is different. Many people have declared copyright dead because, among other things, networked computers really do nothing but copy. Unfortunately this argument was sufficiently convincing that the industries that rely on copy protection, such as publishers and film and music companies, felt the need to insist on new laws and new protections. Instead of eliminating copyright, we have seen a strengthening of copy protection. The end result is that the public protections that were included in the constitutional statement on copyright have essentially been eliminated. Rather than rely on translation of the law, we created new laws, and we may have lost some rights in the process.

Lessig warns us against the tendency to create new laws for seemingly new situations because "... in our day constitutional discourse at the level of the legislature is a very thin sort of discourse." In other words, if you want deep thinking about the law, the judiciary is the body most able to do this, not Congress. No amount of new legislation will give us a basis for an interpretation of constitution as it relates to cyberspace. Ill-designed legislation, such as the Communications Decency Act or the Digital Millenium Copyright Act, can result in denying us certain of our constitutional rights.

Copyright, Free Speech, and Privacy

Copyright, free speech, and privacy are three areas where we have encountered what seem like great conflicts between real world law and cyberspace architecture. On the Internet, copying is easy, cheap and perfect, and there have been a fair number Netizens who have declared copyright dead in that environment. [3] Free speech presents some of the more interesting problems because we tend to forget that the First Amendment is a uniquely American concept and it simply isn't possible to apply this concept to a global communications network. We also generally fail to recognize that free speech is only free within a very specific regulatory context relating to government suppression of the speech of citizens: it doesn't apply to private entities and it excludes some types of speech such as libelous speech or speech that can be deemed "harmful to minors." . In terms of privacy, the Internet has gotten a reputation as Big Brother, watching your every move. Scott McNealy of Sun Microsystems made headlines when he said "You have zero privacy anyway. Get over it."


For those of you who followed the development of the Digital Millenium Copyright Act (DMCA) from the 1994 Department of Commerce Green Paper on copyright through the World Intellectual Property Organization meeting in 1996 to its passage in Congress in 1998 , Lessig's chapter on intellectual property will not be startlingly new. He takes much of his analysis from Pamela Samuelson and other advocates of public access and argues that the intent of copyright law in the past was not to give total control of their works to authors or publishers. To Lessig the fallibility of copyright law, that is the fact that people could and did make some copies without the permission of the copyright holders, was an inherent element of our copyright protection, not a mistake that must be corrected with new technologies. Although one can argue that the ability to make a few copies for oneself and friends and not get caught was not explicitly written into copyright law, you can also argue that the law could have been made more restrictive if the need had been there. The option of "fair use" shows the intention to allow personal use of copyrighted materials entirely apart from the desires of the copyright holder. Throughout the book, Lessig's message is that we must read the entire context of the law, not just the letter.

The copyright issue allows him to put forth another of his important theses, privatized law. His example uses the work of Mark Stefik of Xerox Parc. Stefik is a well-known proponent and developer of technology for copy protection systems and watermarking of digital intellectual property. To a constitutionalist like Lessig, the creation of such systems is essentially a matter of taking the law into ones own hands. Technology trumps the law in this case because the technological protection is immutable and absolute. The law, on the other hand, contains both checks and balances (as in fair use) and some ambiguities. These ambiguities are what allow the courts to re-interpret the intent of the law over time and in different situations. The copy protection program will be mechanical, not thoughtful. And the worst of all is that it has no constitutional basis for its existence and therefore is entirely a private mechanism of control. There are no code courts that can determine if a system of this type violates the rights of the public.

Free Speech

His free speech illustration is also an illustration about the question of jurisdiction. He uses the case of Michigan university student Jake Baker to talk about this issue. Baker participated in one of the more extreme newsgroups and submitted highly sadistic stories to the group. Within the news group his stories were considered on topic and not deviant. Unfortunately, Jake fell victim to what I refer to as the "butt factor" -- while his mind was transported to a new social realm called cyberspace, his butt was still firmly planted in Michigan. The latter had laws against the very behavior that the newsgroup encouraged and appreciated.

Courts have been dealing with multiple jurisdictions for a very long time and there are ways to determine whose laws apply under different circumstances. Cyberspace is somewhat different from real world jurisdiction problems because in the real world you can't be in two places at once. Not so cyberspace. And here we have one of the ironies of this virtual world with no government: there is no legal body there to argue for the jurisdiction of cyberspace. When it comes to a battle between cyberspace and the real world, the real world holds all of the legal cards. Jake Baker spent a month in jail before groups like the ACLU were able to obtain his release.


Lessig fares surprisingly poorly in the chapter on privacy. He introduces the concept of privacy as a property interest in information about yourself, and presents an interesting distinction between the part of your life that can be monitored, and the part that can be searched. New technologies have increased both, but most of us are more concerned about the part that can be searched; the monitoring of our lives through the eyes of others that we pass on the street or the surveillance cameras whose storage media are recycled after a short period has an ephemeral nature that limits its ability to be used by others. The recorded data is a lifelong threat that makes concepts like rehabilitation and redemption nearly obsolete. When the legislature in the state of Washington wanted to set up a file that would begin with a child's entry into first grade and be updated throughout the years with all significant school activities many of us had visions of that trip to the principal's office in third grade being available to every potential employer for the rest of our lives. Unfortunately, by the end of the chapter Lessig embraces the vision of privacy as property, and therefore suitable as a commodity to be traded, sold or bartered. Although he doesn't exactly endorse the World Wide Web Consortium's Platform for Privacy Preferences (P3P) he fails to disclose the elements of P3P that fit so well into his basic thesis: that P3P sets in code behaviors that would be much better served by a constitutional view of the rights of the individual within society. It is private law that has been developed by a consortium of private institutions with their own interests.

The fact that Lessig misses the message of P3P perhaps shouldn't be such a surprise. Lessig is a legal scholar, not a system developer. The articles written about P3P by its developers are plain language statements that give their interpretation of its intentions. The real impact of P3P is only visible on a reading of the protocols themselves[4] , and most people, even very smart people like Lessig, are not able to read and understand such protocol documents. While you and I may be able to look around ourselves and read the code of many aspects of our daily lives, there are always those areas that only specialists can interpret. The fact is that much of the code that has great impact on what we can and can't do is invisible because it is deeply embedded in complex structures like Federal tax law or computer protocols. Although I agree in many ways with Lessig's exhortation to look at and understand, or at least question, the codes we live with I cannot get over the feeling that the code has grown so complex that we can no longer unravel it.


At the April 2000 conference on Computers, Freedom and Privacy I was pressed into service at the last minute to moderate the panel on Internet governance and the role of standards bodies. Fortunately I had with me the quotes that opened this review, and the following quote from Lessig's Code which serves as a neat rebuttal:

The first speaker on the panel, Timothy Schoechle, Associate Director of the International Center for Standards Research, had Lessig's book out on the table before him and referred to it in his talk. As he held it up another speaker, Jean-Francois Abramatic, President of the World Wide Web Consortium (W3C), reached into his bag and showed that he, too, had a copy of the book. At this point the remaining speaker, Fred Baker, Chair of the Internet Engineering Task Force (IETF) said something to the effect of "Well, I guess I have to get this book and read it." He does. So do you.

For the foreseeable future, Lessig's book will be the starting point for all discussions of Internet governance. It has created an entirely new platform for such discussions, a kind of ground zero for thinking about the hard issues of rights and sovereignty, of jurisdiction and constitution. And it has a great advantage over the ideas of the previous thinkers such as Barlow and Negroponte because it actually gives us somewhere to go.
* This review was published Information Technology and Libraries, September, 2000.

1. Negroponte, Nicholas. Being Digital. New York, Vintage Books, 1995. pp. 237-238
2. Barlow, John Perry. Declaration of the Independence of Cyberspace.
3. Dyson, Ester. Intellectual Value. in: Wired, 3.07, July, 1995.
4. The official P3P page is Some critical interpretations of the protocol are:;;

©Copyright Karen Coyle, 2000
Back to Karen Coyle's Home Page