Fluent Essays

Please read and summarize the article, “The Law of the Horse,” which can be found at the following link finalhls.pdf Unformatted Attachment Preview FINALHLS.DOC 12/03/99 – 10:19 AM COMMENTARIES THE LAW OF THE HORSE: WHAT CYBERLAW MIGHT TEACH Lawrence Lessig ∗ INTRODUCTION A few years ago, at a conference on the “Law of Cyberspace” held at the University of Chicago, Judge Frank Easterbrook told the assembled listeners, a room packed with “cyberlaw” devotees (and worse), that there was no more a “law of cyberspace” than there was a “Law of the Horse”;1 that the effort to speak as if there were such a law would just muddle rather than clarify; and that legal academics (“dilettantes”) should just stand aside as judges and lawyers and technologists worked through the quotidian problems that this souped-up telephone would present. “Go home,” in effect, was Judge Easterbrook’s welcome. As is often the case when my then-colleague speaks, the intervention, though brilliant, produced an awkward silence, some polite applause, and then quick passage to the next speaker. It was an interesting thought — that this conference was as significant as a conference on the law of the horse. (An anxious student sitting behind me whispered that he had never heard of the “law of the horse.”) But it did not seem a very helpful thought, two hours into this day-long conference. So marked as unhelpful, it was quickly put away. Talk shifted in the balance of the day, and in the balance of the contributions, to the idea that either the law of the horse was significant after all, or the law of cyberspace was something more. ––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––– ∗ Jack N. and Lillian R. Berkman Professor for Entrepreneurial Legal Studies, Harvard Law School. An earlier draft of this article was posted at the Stanford Technology Law Review, . This draft is a substantial revision of that earlier version. Thanks to Edward Felten, Deepak Gupta, David Johnson, Larry Kramer, Tracey Meares, Andrew Shapiro, Steve Shapiro, Polk Wagner, and Jonathan Zittrain for helpful discussions on an earlier draft of this essay. Thanks also to the Stanford and Chicago Legal Theory Workshops. Research assistance, much of it extraordinary, was provided by Karen King and James Staihar, and on an earlier draft by Timothy Wu. I expand many of the arguments developed here in a book published this month, CODE AND OTHER LAWS OF CYBERSPACE (1999). 1 See Frank H. Easterbrook, Cyberspace and the Law of the Horse, 1996 U. CHI . LEGAL F. 207. The reference is to an argument by Gerhard Casper, who, when he was dean of the University of Chicago Law School, boasted that the law school did not offer a course in “The Law of the Horse.” Id. at 207 (internal quotation marks omitted). The phrase originally comes from Karl Llewellyn, who contrasted the U.C.C. with the “rules for idiosyncratic transactions between amateurs.” Id. at 214. 501 FINALHLS.DOC 502 12/03/99 – 10:19 AM HARVARD LAW REVIEW [Vol. 113:501 Some of us, however, could not leave the question behind. I am one of that some. I confess that I’ve spent too much time thinking about just what it is that a law of cyberspace could teach. This essay is an introduction to an answer.2 Easterbrook’s concern is a fair one. Courses in law school, Easterbrook argued, “should be limited to subjects that could illuminate the entire law.”3 “[T]he best way to learn the law applicable to specialized endeavors,” he argued, “is to study general rules.”4 This “the law of cyberspace,” conceived of as torts in cyberspace, contracts in cyberspace, property in cyberspace, etc., was not. My claim is to the contrary. I agree that our aim should be courses that “illuminate the entire law,” but unlike Easterbrook, I believe that there is an important general point that comes from thinking in particular about how law and cyberspace connect. This general point is about the limits on law as a regulator and about the techniques for escaping those limits. This escape, both in real space and in cyberspace,5 comes from recognizing the collection of tools that a society has at hand for affecting constraints upon behavior. Law in its traditional sense — an order backed by a threat directed at primary behavior6 — is just one of these tools. The general point is that law can affect these other tools — that they constrain behavior themselves, and can function as tools of the law. The choice among tools obviously depends upon their efficacy. But importantly, the choice will also raise a question about values. By working through these examples of law interacting with cyberspace, we will throw into relief a set of general questions about law’s regulation outside of cyberspace. I do not argue that any specialized area of law would produce the same insight. I am not defending the law of the horse. My claim is specific to cyberspace. We see something when we think about the regulation of cyberspace that other areas would not show us. My essay moves in three parts. I begin with two examples that are paradigms of the problem of regulation in cyberspace. They will then suggest a particular approach to the question of regulation generally. In the balance of Part I, I sketch a model of this general approach. In Part II, I apply this general approach to a wider range of examples. It is in the details of these examples that general lessons will be found. ––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––– 2 I have developed elsewhere a complete account of this answer, or as complete as my account can be. See LAWRENCE LESSIG, CODE AND OTHER LAWS OF CYBERSPACE (1999). 3 Easterbrook, supra note 1, at 207. 4 Id. 5 I have discussed in considerable detail the idea that one is always in real space while in cyberspace or, alternatively, that cyberspace is not a separate place. See Lawrence Lessig, The Zones of Cyberspace, 48 STAN. L. REV. 1403, 1403 (1996). 6 See, e.g., H.L.A. HART, THE CONCEPT OF LAW 6–7, 18–25 (2d ed. 1994). FINALHLS.DOC 1999] 12/03/99 – 10:19 AM WHAT CYBERLAW MIGHT TEACH 503 These lessons reach beyond the domain of cyberspace. They are lessons for law generally, though the non-plasticity of real-space regulation tends to obscure them. The final Part describes three of these lessons — the first about the limits on law’s power over cyberspace, the second about transparency, and the third about narrow tailoring. The first lesson is about constitutional constraints — not constitution in the sense of a legal text, but a constitution understood more generally. Just as the division of powers sets constraints on how far the federal government might reach, so, too, do the features of cyberspace that I will describe set limits on how far government may reach. The lesson about transparency is more familiar, though I suspect its relationship to cyberspace is not. By making “non-transparency” easy and seemingly natural, cyberspace provides a special opportunity to appreciate both the value and costs of transparency. The final lesson, about narrow tailoring, is less familiar still, though it is potentially the most significant feature of the interaction between cyberspace, and real-space law. In the examples of regulation in cyberspace, we will see the threat that a failure to “tailor” presents. The lessons about transparency and narrow tailoring both carry significance beyond the world of engineers. Or better, the regulations by engineers will have important implications for us. I conclude with an answer to Easterbrook’s challenge. If my argument sticks, then these three lessons raise regulatory questions as troubling in real-space law as they are in cyberspace. They are, that is, general concerns, not particular. They suggest a reason to study cyberspace law for reasons beyond the particulars of cyberspace. I. REGULATORY SPACES, REAL AND “CYBER” Consider two cyber-spaces, and the problems that each creates for two different social goals. Both spaces have different problems of “information” — in the first, there is not enough; in the second, too much. Both problems come from a fact about code — about the software and hardware that make each cyber-space the way it is. As I argue more fully in the sections below, the central regulatory challenge in the context of cyberspace is how to make sense of this effect of code. A. Two Problems in Zoned Speech 1. Zoning Speech. — Porn in real space is zoned from kids. Whether because of laws (banning the sale of porn to minors), or norms (telling us to shun those who do sell porn to minors), or the market (porn costs money), it is hard in real space for kids to buy porn. In the main, not everywhere; hard, not impossible. But on balance the regulations of real space have an effect. That effect keeps kids from porn. FINALHLS.DOC 504 12/03/99 – 10:19 AM HARVARD LAW REVIEW [Vol. 113:501 These real-space regulations depend upon certain features in the “design” of real space. It is hard in real space to hide that you are a kid. Age in real space is a self-authenticating fact. Sure — a kid may try to disguise that he is a kid; he may don a mustache or walk on stilts. But costumes are expensive, and not terribly effective. And it is hard to walk on stilts. Ordinarily a kid transmits that he is a kid; ordinarily, the seller of porn knows a kid is a kid,7 and so the seller of porn, either because of laws or norms, can at least identify underage customers. Self-authentication makes zoning in real space easy. In cyberspace, age is not similarly self-authenticating. Even if the same laws and norms did apply in cyberspace, and even if the constraints of the market were the same (as they are not), any effort to zone porn in cyberspace would face a very difficult problem. Age is extremely hard to certify. To a website accepting traffic, all requests are equal. There is no simple way for a website to distinguish adults from kids, and, likewise, no easy way for an adult to establish that he is an adult. This feature of the space makes zoning speech there costly — so costly, the Supreme Court concluded in Reno v. ACLU,8 that the Constitution may prohibit it.9 2. Protected Privacy. — If you walked into a store, and the guard at the store recorded your name; if cameras tracked your every step, noting what items you looked at and what items you ignored; if an employee followed you around, calculating the time you spent in any given aisle; if before you could purchase an item you selected, the cashier demanded that you reveal who you were — if any or all of these things happened in real space, you would notice. You would notice and could then make a choice about whether you wanted to shop in such a store. Perhaps the vain enjoy the attention; perhaps the thrifty are attracted by the resulting lower prices. They might have no problem with this data collection regime. But at least you would know. Whatever the reason, whatever the consequent choice, you would know enough in real space to know to make a choice. In cyberspace, you would not. You would not notice such monitoring because such tracking in cyberspace is not similarly visible. As Jerry Kang aptly describes,10 when you enter a store in cyberspace, the store can record who you are; click monitors (watching what you choose with your mouse) will track where you browse, how long you view a particular page; an “em––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––– 7 Cf. Crawford v. Lungren, 96 F.3d 380, 382 (9th Cir. 1996) (upholding as constitutional a California statute banning the sale of “harmful matter” in unsupervised sidewalk vending machines, because of a compelling state interest in shielding minors from adult-oriented literature). 8 521 U.S. 844 (1997). 9 See id. at 885; Lawrence Lessig, What Things Regulate Speech: CDA 2.0 vs. Filtering, 38 JURIMETRICS J. 630, 631 (1998). 10 See Jerry Kang, Information Privacy in Cyberspace Transactions, 50 STAN. L. REV. 1193, 1198–99 (1998); cf. Developments in the Law — The Law of Cyberspace, 112 HARV. L. REV. 1574, 1643 (1999) [hereinafter Developments] (suggesting that upstream filtering’s invisibility is one potential problem of a proposed solution to children’s access to pornography). FINALHLS.DOC 1999] 12/03/99 – 10:19 AM WHAT CYBERLAW MIGHT TEACH 505 ployee” (if only a bot11) can follow you around, and when you make a purchase, it can record who you are and from where you came. All this happens in cyberspace — invisibly. Data is collected, but without your knowledge. Thus you cannot (at least not as easily) choose whether you will participate in or consent to this surveillance. In cyberspace, surveillance is not self-authenticating. Nothing reveals whether you are being watched,12 so there is no real basis upon which to consent. These examples mirror each other, and present a common pattern. In each, some bit of data is missing, which means that in each, some end cannot be pursued. In the first case, that end is collective (zoning porn); in the second, it is individual (choosing privacy). But in both, it is a feature of cyberspace that interferes with the particular end. And hence in both, law faces a choice — whether to regulate to change this architectural feature, or to leave cyberspace alone and disable this collective or individual goal. Should the law change in response to these differences? Or should the law try to change the features of cyberspace, to make them conform to the law? And if the latter, then what constraints should there be on the law’s effort to change cyberspace’s “nature”? What principles should govern the law’s mucking about with this space? Or, again, how should law regulate? * * * To many this question will seem very odd. Many believe that cyberspace simply cannot be regulated. Behavior in cyberspace, this meme insists, is beyond government’s reach. The anonymity and multijurisdictionality of cyberspace makes control by government in cyberspace impossible. The nature of the space makes behavior there unregulable.13 This belief about cyberspace is wrong, but wrong in an interesting way. It assumes either that the nature of cyberspace is fixed — that its architecture, and the control it enables, cannot be changed — or that government cannot take steps to change this architecture. Neither assumption is correct. Cyberspace has no nature; it has no particular architecture that cannot be changed.14 Its architecture is a function of its design — or, as I will describe it in the section that follows, its ––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––– 11 A “bot” is a computer program that acts as an agent for a user and performs a task, usually remotely, in response to a request. 12 See FEDERAL TRADE COMM’N, PRIVACY ONLINE: A REPORT TO CONGRESS 3 & n.9 (1998) [hereinafter PRIVACY ONLINE]. 13 See, e.g., David R. Johnson & David Post, Law and Borders — The Rise of Law in Cyberspace, 48 STAN. L. REV. 1367, 1375 (1996); David Kushner, The Communications Decency Act and the Indecent Indecency Spectacle, 19 HASTINGS COMM. & ENT. L.J. 87, 131 (1996); David G. Post, Anarchy, State, and the Internet: An Essay on Law-Making in Cyberspace, 1995 J. ONLINE L. art. 3, 12–17 (1995) ; Tom Steinert-Threlkeld, Of Governance and Technology, INTER@CTIVE WK. ONLINE (Oct. 2, 1998) . 14 See Developments, supra note 10, at 1635 (“The fundamental difference between [real space and cyberspace] is that the architecture of cyberspace is open and malleable. Anyone who understands how to read and write code is capable of rewriting the instructions that define the possible.”). FINALHLS.DOC 506 12/03/99 – 10:19 AM HARVARD LAW REVIEW [Vol. 113:501 code.15 This code can change, either because it evolves in a different way, or because government or business pushes it to evolve in a particular way. And while particular versions of cyberspace do resist effective regulation, it does not follow that every version of cyberspace does so as well. Or alternatively, there are versions of cyberspace where behavior can be regulated, and the government can take steps to increase this regulability. To see just how, we should think more broadly about the question of regulation. What does it mean to say that someone is “regulated”? How is that regulation achieved? What are its modalities? B. Modalities of Regulation 1. Four Modalities of Regulation in Real Space and Cyberspace. — Behavior, we might say, is regulated by four kinds of constraints.16 Law is just one of those constraints. Law (in at least one of its aspects) orders people to behave in certain ways; it threatens punishment if they do not ––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––– 15 As I define the term, code refers to the software and hardware that constitute cyberspace as it is — or, more accurately, the rules and instructions embedded in the software and hardware that together constitute cyberspace as it is. Obviously there is a lot of “code” that meets this description, and obviously the nature of this “code” varies dramatically depending upon the context. Some of this code is within the Internet Protocol (IP) layer, where protocols for exchanging data on the Internet (including TCP/IP) operate. Some of this code is above this IP layer, or in Jerome H. Saltzer’s terms, at its “end”: For the case of the data communication system, this range includes encryption, duplicate message detection, message sequencing, guaranteed message delivery, detecting host crashes, and delivery receipts. In a broader context, the argument seems to apply to many other functions of a computer operating system, including its file system. Jerome H. Saltzer, David P. Reed & David D. Clark, End-to-End Arguments in System Design, in INNOVATIONS IN INTERNETWORKING 195, 196 (Craig Partridge ed., 1988). More generally, this second layer would include any applications that might interact with the network (browsers, e-mail programs, file-transfer clients) as well as operating system platforms upon which these applications might run. In the analysis that follows, the most important “layer” for my purposes will be the layer above the IP layer. The most sophisticated regulations will occur at this level, given the Net’s adoption of Saltzer’s end-to-end design. See also infra note 24; cf. Timothy Wu, Application-Centered Internet Analysis, 85 VA. L. REV. 1163, 1164 (1999) (arguing that a legal analysis of the Internet that focuses on the user must necessarily focus on this layer) . Finally, when I say that cyberspace “has no nature,” I mean that any number of possible designs or architectures may affect the functionality we now associate with cyberspace. I do not mean that, given its present architecture, no features exist that together constitute its nature. 16 I have adapted this analysis from my earlier work on regulation. See generally Lawrence Lessig, The New Chicago School, 27 J. LEGAL STUD . 661, 662–66 (1998) (discussing the way in which laws, norms, markets, and architecture operate as modalities of constraint). It is related to the “tools approach to government action,” of John de Monchaux & J. Mark Schuster, but I count four tools while they coun ... Purchase answer to see full attachment