Problems With Code-Based Regulation

Dave Kumar

I. Introduction

A few years ago, the phrase "technology is not neutral" would have been contested by many. Engineers and other "techies" would refuse to believe that the technology they created was fraught with policy implications. Admittedly, the policy implications of designing an integrated circuit a certain way, or writing a sorting algorithm in a particular way, are less obvious (if they exist at all). With the advent and growth of the internet, however, the policy implications of communications technologies have become much clearer. 1 Few people today contest the proposition that technology is not neutral—that technological choices have policy implications (few people who have actually thought about this, at any rate). 2

Prof. Lessig has gone a step further and explained how technology (he uses the more precise terms "architecture" and "code") can act as a regulator. 3 He discusses this idea with respect to real space, but his ideas are focused on regulation in cyberspace. In cyberspace, it is clear that certain features of the architecture of the internet have important and far-reaching policy implications. For example, it is the open protocol used by the internet that allows one to use it anonymously, which is an aspect of the internet that has significant and obvious policy implications. Similarly, it is the decentralized architecture of the internet that leads to the common theme that the internet has no boundaries, which is another aspect of the internet that has important policy implications. If the technology affects policy, it follows that the technology can be used to shape policy. In a sense, then, the internet can be regulated by choosing an architecture that enables the goal of the regulation.

This Paper begins to examine some of the ways in which regulation through code introduces problems that are different from the problems of regulation by other means. An initial argument that one might make is that this topic is premature, since no one is actually thinking about regulating through code. 4 However, Prof. Lessig has taught us that the regulation need not be the narrow definition of regulation that we are used to thinking about, i.e. laws passed by Congress, or rules promulgated by some administrative agency. 5 One can think about the internet domain name dispute, 6 or the efforts to guarantee privacy in cyberspace, 7 or the efforts to allow private parties to censor content on both the internet 8 and in television. 9 These are all examples where regulation, in some sense, is being achieved through code (or, more generally, technology). Thus, we seek technical solutions to perceived problems with the internet—solutions that, in effect, regulate through code. 10

The following section will discuss the problems associated with regulation through code, including the problems of changing technology, network effects, and lock-in of technologies and parties. Section III will attempt to suggest ways in which we can avoid some of the problems discussed in this Paper as we design ways in which to regulate the internet.

II. Problems With Code Acting as a Regulator

A. The Problem of Changing Technology

Simply put, the problem with technology acting as a regulator is that technology develops and changes. This is not a significant problem if technology regulates alone, since the regulation will change as the technology changes. In real space, the fact that geographic distance acts to regulate our ability to get away from where we are has become less significant as technologies have developed that allow us to travel more quickly and easily. 11 The problem arises when technology (or code or architecture) acts in conjunction with other constraints (law, norms, or market) to regulate. Here, the other constraint(s) typically develops around a particular stage of technology, and the scheme of regulation develops serious problems when the technology inevitably changes. For example, the fact that we are at least somewhat tied to our physical location has a lot to do with the laws of personal jurisdiction that have developed. These laws faced significant tensions as people became more mobile, leading to a complicated and not altogether satisfactory "minimum contacts" test. 12 Now, the technology has developed even further, and the internet allows people to be almost completely free from geographical classification. The laws of jurisdiction are struggling to keep abreast.

An example of a regulatory scheme that has been challenged because of a change in technology is that of spectrum management. 13 The current laws relating to spectrum management were designed in the 1920s and 1930s when, in order to prevent broadcast signals from interfering with each other, it was necessary to allocate bands of spectrum to specific users. This regulatory scheme was perfectly reasonable given the state of the technology at that time, since it provided no alternative for avoiding signal interference. 14 In the sixty or so years since then, however, the technology has changed in a manner that renders the rationale for the current spectrum allocation scheme obsolete. 15 Spread spectrum and other digital radio technologies have developed (and have become feasible thanks to increased processing power) and allow receivers to distinguish between multiple signals received at the same frequency. Suddenly, the government’s regulatory scheme, which allows certain people to "speak" at a particular frequency and excludes others, appears both unwise and unconstitutional. 16 The regulatory scheme, which combined the constraints of laws and technology (or code), became problematic once the technology changed.

I want to be sure not to overemphasize the significance of changing technology. After all, it is common for more than one constraint to regulate together, for one of the constraints to change, and for a tension in the scheme of regulation to result. This is often seen in the interaction between laws and social norms when they combine to regulate behavior. For example, social norms regarding drug use (particularly marijuana) have changed somewhat over the last few decades, but the laws have stayed the same, with a resulting tension in the regulatory scheme. Similar tensions were observed between laws and social norms when the law changed with respect to segregation and abortion. The purpose of this paper, however, is to explore the differences between regulation through code and regulation using other constraints. In other words, what makes the combination of code and other constraints as a regulator (to use Prof. Lessig’s framework) different from the combination of any of the other constraints when any of the constraints may change, resulting in a tension in the regulatory framework?

The first difference stems from the speed at which technology often changes. In recent years, technology has been changing at a break-neck speed. It is hard to imagine that the World Wide Web, which has become such a large part of our commercial and non-commercial existence, did not exist at the start of this decade. The speed at which technology changes often allows the regulatory scheme even less of a chance of keeping up with changes. Nowhere is this clearer than with the internet, where the legal system and society in general has struggled to keep pace with the seismic changes that the developments in networking technologies have produced. In addition, even as the regulatory scheme attempts to change, the technology is changing so fast that when the scheme adapts, it is time to adapt again. 17 It is exceedingly rare for the market, social norms, and laws to change as rapidly. 18

The second difference between a change in technology or code and a change in another constraint is that changes in technology and the processes that generate these changes are often far less public than changes (and the associated processes) in other constraints. A change in social norms, almost by definition of "social norms", takes effect only when a significant portion of the public is aware of and affected by these changed norms. Similarly, the laws of the land are public and people are aware of any changes in them. The process by which these laws change is also open via the democratic process. 19 Changes in technology, however, are often far more discreet. Trade secret and other forms of intellectual property law often keep awareness of developing technologies out of the public eye until the technologies are actually available on the market and have begun affecting the prevalent regulatory scheme. More importantly, the decisions regarding technological change 20 are made by a privileged few with almost no public awareness or accountability whatsoever. The interests of a corporation making decisions regarding the development of technologies are rarely in line with those of society at large. 21 A corporation’s main interest is in making profits, and this interest often makes the corporation indifferent to the values and policy implications of its choices relating to developing technologies. This lack of awareness (or concern) of the societal impact of changing technology has a negative effect on the existing regulatory framework in that the framework would not be able to anticipate needed adaptations. 22

Finally, changes in technology are different from changes in other types of constraints in terms of their complexity. Modern technologies have become so complex that only a very small percentage of the population can understand even the final market product, let alone the developments in technology that result in those products. Very few people are able to predict how changes in communications technologies such as compression algorithms, packeting schemes, etc. will effect the future of the internet and human expression. To be sure, many laws (such as tax codes) are also complex. In most instances, however, a layperson is able to develop an understanding and an opinion about a legislative issue upon reading about it, while it may take formal technical education to understand changing technology. It is far easier to educate oneself on the merits of school vouchers than it is to educate oneself on the implications of Code Division Multiple Access ("CDMA") vs. Time Division Multiple Access ("TDMA").

B. Network Effects and Path Dependency

There has been a significant amount of economic and legal literature on the topic of network effects (some authors prefer the term network externalities) and path dependency. 23 Network effects refer to the phenomenon that when a user is faced with a choice between products, that user’s choice may be based on how other consumers are expected to behave. 24 A common example is the choice of an operating system, where the value of the operating system depends upon the number of other consumers that use or plan to use that operating system. 25 Path dependency refers to situations in which the final outcome in a particular sequence of events is largely influenced by other events that are temporally remote. 26 Common examples of path dependant results are the ultimate market dominance of "QWERTY" keyboards, VHS tapes, and the IBM Operating System (DOS). 27

Much of this literature has focused on whether network effects and path dependency have negative effects on the economy. My interest, however, is to point out that in instances where technology is chosen to act in conjunction with other constraints to regulate behavior, there is an inherent bias in favor of that particular technology—a network effect. In addition, the event of choosing a particular technology as part of a regulatory scheme affects the development of technology in the future—making this sequence path dependant. Of course, in some situations, this biasing in favor of particular technologies may be the desired result. In many situations, however, the biasing in favor of a particular technology is usually not optimal, especially in light of the possible development of the technology discussed in the previous Section.

Some examples will help illustrate this point. In the area of spectrum management, the government chose to establish a regulatory framework that involved a governmental role in allocation and a choice of radio technologies that did not share the broadcast spectrum. 28 This not only led to the tension in the regulatory scheme described above, but also likely hindered the growth of spread spectrum and other technologies that share the radio spectrum since they did not fit into the existing regulatory framework. With this biasing of the development of technology, it is hard to imagine what new transmitter and receiver technology would have been developed in its absence. However, the growth of the internet—which occurred in as highly a deregulated environment as one can imagine—suggests that allowing technology to develop with as few constraints as possible improves society’s lot both economically and otherwise. 29

A second example is the current effort to regulate privacy on the internet using P3P. 30 While this may be an excellent solution using code, there is simply no way to predict what technologies will be available to us in the future to solve this problem. As with the spectrum allocation case, we run the risk not only of foreclosing other, potentially more elegant and effective technological solutions in the future, but also of severely hindering the development of alternative technologies to solve the same problem. 31

C. Lock-In and Problems of Entitlement

A final problem associated with using code as a regulator is one that is closely tied to the previous two. In a world where a regulatory scheme favors certain older technologies over more efficient newer ones, the market cannot be relied upon to produce the optimal solution in terms of the choice of technologies. This problem of locking in on an inefficient solution is essentially another way of restating the problem of network effects, which in such a case would clearly be network externalities.

The related and more significant problem is that the locked-in technologies also produce entitlements in certain parties, which then further resist change. Thus, as one might imagine, companies that own licenses to use parts of the spectrum strongly resist any changes to the present spectrum management scheme, especially one that will allow anyone to transmit without permission. Similarly, local phone companies are currently resisting opening up their networks for interconnection as they cling to their monopoly entitlement. 32 Both these groups are also good examples of companies that have significant political clout and can use their existing power to influence legislatures to resist changes to the regulatory framework. This, in turn, stagnates society at an undesirable regulatory scheme and an older, less efficient technology. Thus, the fact that certain favored technologies are associated with certain companies worsens the problems of using regulatory frameworks that are at least in part code-based.

There is still the question of how the problem of regulation using code is different from regulation using other constraints. After all, almost any law-based regulation results in some parties being entitled relative to others. Where the regulation is achieved using technology, however, the result in a spiral in which the technological solution to a problem influences the development of other technologies that might act as alternative solutions. This problem does not seem to arise in legal solutions—in choosing between legal solutions, the selection of one rarely presents a huge obstacle to the advocacy of another in the future. Further, apart from issues of retroactivity and faithfulness to a stare decisis-type principle, there is little institutional resistance to a change in the law. On the other hand, as discussed above, choosing one technical solution over another can make it very hard for the alternative to become preferred in the future. Also, one runs the risk of never being exposed to a potential technical solution in a way in which one does not worry with respect to legal solutions.

III. Recommendations

Unfortunately, many of the problems related to regulating through code do not present easy solutions. The problem of changing technologies is one that seems will always be present. Of course, one recommendation is that we should not be hesitant to reexamine existing regulatory frameworks when the technologies that are part of the framework have changed. Thus, the government should revisit the issue of spectrum allocation in light of the changes in technology and decide how to proceed. 33 On a similar note, we should be creative when we reexamine existing regulatory frameworks by trying to think about how our prior decisions influenced the development of technology and possible technological solutions.

There is one problem associated with regulating using code that deserves further discussion—the fact that decisions related to technology are often made outside the public eye. This is one area in which we should think seriously about the dangers posed by regulating through code, and how we may be sacrificing some of our democratic values by allowing private parties to make decisions that have an enormous impact on all members of society. With the growth of the internet and other communications technologies, the avenues for individual expression are becoming increasingly privatized. Decisions regarding issues such as privacy, censorship, domain names, how to use the spectrum, etc.—issues that are important to us all—are increasingly being made by private organizations that are not answerable to any democratic process. While proposing a solution to this problem is extremely complex and beyond the scope of this Paper, I merely suggest that the government (or some other body that is answerable to the public for its actions) maintain some role in either making or overseeing technical decisions that shape regulation that affects us all.

IV. Conclusion

As technology plays a larger role in our day-to-day life through developments such as the internet, regulating behavior using code-based solutions has become an increasing option. If technology has something to do with the behavior that we seek to regulate, why not design a regulatory framework around the technology? This Paper has attempted to point out some of the concerns and problems with code-based regulation. This is a growing area of study, and there is clearly more to say on this issue. In addition, while this Paper scratches the surface of the problems associated with code-based regulation, it does even less with proposing solutions to these problems. In the end, though, perhaps the most useful recommendation for solving the problems related to code-based regulation is to be aware of some of the potential problems at the outset. Too often, we view technology one-dimensionally in a way that fails to consider its inherently dynamic nature. If we can at least think about the volatile nature of a technology while coming up with regulatory frameworks that use that technology, we will probably end up a step ahead of where we would have been in the past.


1. This is due in part to the fact that the internet is so closely tied to human expression. Certainly, other technological advances have had a large impact on expression-the transistor led to the development of radio, which no doubt had a huge impact on society in the 1930s and 40s. With the internet, however, the relationship between the technology and the aspects of the technology that impact society are much clearer.

2. An interesting (if somewhat excessive) example of a technological choice having certain value associated with it is provided by the late Ithiel de Sola Pool:

In the 1920s . . . planners in the Soviet Union found it cheaper to install wired loudspeakers than to market radios. In the systems of independent radio receivers and wired loudspeakers, the common element is the loudspeaker. In the radio system one has to add a tuner, amplifier, and antenna. To the speaker in the wired system, one has to add some yards of wire. Which one is cheaper clearly depends on the number of yards of wire. In the Soviet planned economy the number of yards per speaker could be small. If the authorities decided to have an apartment house wired for speakers, or to put speakers down a certain street, they could ensure a high proportion of subscribers along that line. So for forty years the wired speaker was the dominant device for radio entertainment in the Soviet Union.

Ithiel de Sola Pool, Technologies of Freedom 32 (1983). While only the extremely nave would imagine that such a choice was made without regard to policy concerns, the example still illustrates that even when two technologies meet the same goal-providing the public with radio entertainment-the technological choice between them has clear policy implications.

3. For a discussion of how technology or “code,” together with laws, norms, and the market, regulates behavior, see Lawrence Lessig, The Law of the Horse: What Cyberlaw Might Teach, (Sep. 20, 1998) available at <>.

4. In fact, the Government has expressed an interest in staying out of technological choices related to the internet. See, e.g. U.S. Department of Commerce, Management of Internet Names and Addresses, available at <http://>.

5. See supra note 3. Prof. Lessig discusses that in addition to laws, the market, social norms, and code combine to regulate behavior. See Lessig, supra note 3. I will refer to these constraints (laws, market, norms, and code/architecture/technology) throughout this Paper.

6. The assigning of domain names has policy implications in both the process and the actual assignment, which explains why many parties hope to have a say in what how the domain names are assigned in the future. Domain names have both commercial value, such as “” or “,” and noncommercial value, see Planned Parenthood Federation of America, Inc. v. Bucci, 1997 WL 133313 (S.D.N.Y.).

7. See, e.g., Joseph M. Reagle Jr., P3P and Privacy on the Web FAQ, available at <>.

8. Several products have emerged that allow private control of what content may be accessed through the Web, such as NetNanny or Cyber Patrol. These products are typically used by parents and employers, as well as by libraries. See Reno v. ACLU, 117 S.Ct. 2329, 2354 (1997) (O’Connor, J., concurring in the judgment in part and dissenting in part) (mentioning screening software such as Cyber Patrol and SurfWatch); Mainstream Loudoun v. Board of Trustees of the Loudoun County Library, 2 F.Supp.2d 783 (E.D. Va.) (memorandum opinion and order), 24 F.Supp.2d 552 (E.D. Va. 1998) (memorandum opinion) (concerning use of filtering software by public libraries).

9. The obvious example is the V-Chip. See James Boyle, Foucault in Cyberspace: Surveillance, Sovereignty, and Hard-Wired Censors, V (1997), available at <>.

10. A recent joint MIT/Harvard Law School class focused much of its time on trying to find such legal/technical solutions. See <>; <>.

11. Note, however, that this is still a problem if not everyone has the same access to a particular technology. The growth of air travel means little to the millions who cannot afford it, a fact that plays out in bail hearings-some people can afford to leave the jurisdiction more easily than others. Similarly, the freedom that the internet seems to offer means little to the more than half of the world’s population who have yet to make a phone call, let alone get online.

12. See International Shoe Co. v. State of Washington, Office of Unemployment Compensation and Placement, 326 U.S. 310 (1945). Consider also the meaninglessness of the service of process at one’s property, as in Pennoyer v. Neff, 95 U.S. 714 (1877).

13. See Yochai Benkler, Overcoming Agoraphobia: Building the Commons of the Digitally Networked Environment, 11 Harv. J.L. & Tech. 287 (1998); see also Dedric Carter et al., Spread Spectrum: Regulation in Light of Changing Technologies, available at <>.

14. See Benkler, supra note 13, at 298-99; but cf. id. at 299-301.

15. See id. at 290-95.

16. See Carter et al., supra note 13, at 64-71, VI.

17. Consider Justice Stevens’ majority opinion in Reno v. ACLU, where he states that “the receipt of information on the Internet requires a series of affirmative steps more deliberate and directed than merely turning a dial.” Reno v. ACLU, 117 S.Ct. 2329, 2336 (1997) (quoting the District Court’s opinion at 929 F. Supp. 830, 845 (1996)). Even at the time, “push” technologies existed which rendered this somewhat critical assumption false.

18. In a sense, laws change more rapidly than technology in that a change in the law takes effect instantaneously. However, a change in the law is almost never unexpected, and the process by which laws change is open to all through the democratic process. Thus, apathy aside, one can almost never be completely unprepared for a change in the law.

19. Once again, this ignores the reality that many people are unaware of changes in laws due to apathy. The lack of awareness relating to technology, on the other hand, is more sinister because one might not be able to find out about changes in technology (and especially the processes through which related decisions are made) even if one makes a serious effort.

20. As discussed earlier, these changes in technology can have significant policy implications. See supra note 2.

21. Consider the interests of a company developing filtering software for the internet. It is unlikely to focus on the possible chilling effect on individual expression and thought. See Lawrence Lessig, Tyranny in the Infrastructure: The CDA was Bad, but PICS May Be Worse, 5.07 Wired (1997), available at <>.

22. It should be noted that changes in the market as a constraint have many of the same non-public problems that changing technology has. In many instances, and certainly with respect to the internet, changes in the market are very closely associated with changes in the technology.

23. See, e.g., Mark A. Lemley & David McGowan, Legal Implications of Network Economic Effects, 86 Cal. L. Rev. 479 (1998); Stan Liebowitz & Stephen E. Margolis, Should Technology Choice Be a Concern of Antitrust Policy?, 9 Harv. J.L. & Tech. 283 (1996); Brian W. Arthur, Positive Feedbacks in the Economy, 262 Sci. Am. 92 (1990); Paul A. David, Clio and the Economics of QWERTY, 75 Am. Econ. Rev. 332 (1985).

24. See Liebowitz & Margolis, supra note 23, at 286.

25. See id.

26. See David, supra note 23, at 332.

27. See Liebowitz & Margolis, supra note 23, at 312-17; see also David, supra note 23, at 332-36.

28. See supra text accompanying notes 13-16.

29. See Benkler, supra note 13, at 365-91.

30. See supra note 7.

31. Note, of course, that I am not suggesting that, since the technology will always change, one should never seek a code-based solution. All I am suggesting is that whenever one chooses to use a code-based solution to a regulatory problem, one runs the risk of hindering the development of future technologies that would solve the same problem more efficiently. The problem, then, involves a trade-off between the importance of solving the problem using present-day technology and the next-to-impossible-to-determine risk of hindering the development of as-yet-undeveloped technologies.

32. Note that I am not necessarily suggesting that the incumbent companies are wrong to claim their entitlements. Spectrum licensees such as broadcasters have done much to enhance the value of the band of spectrum allocated to them, and may have a reliance interest in the spectrum band allocated to them. Similarly, local telephone companies developed networks in a model in which universal access, and not price efficiency, was often seen as the goal. Asking them to interconnect with “leaner and meaner” competitors who had the luxury of designing their networks without having to commit to serving rural and other underserved areas may be unfair. While it may be fair for spectrum licensees and local phone companies to keep their entitlements, this is not the most efficient solution for society at large.

33. As indicated in supra note 32, I am not necessarily suggesting that the government change its current allocational policy of spectrum management, but that it at least reexamine the regulatory framework in light of the changes in technology that have rendered its earlier rationale obsolete.