Code Does Not Trump Law

According to this article from C|NET, an Australian judge has propounded an original and counter intuitive theory - that technology, represented by computer code, is more powerful than the law. As he put it in his own words, "We are moving to a point in the world where more and more law will be expressed in its effective way, not in terms of statutes solidly enacted by the parliament...but in the technology itself--code."

Of course, I use the words "original" and "counter intuitive" in their ironic sense, to mean "not original" and "not counter intuitive." The basic thesis is at least as old as Lawrence Lessig's 1999 book Code and other Laws of Cyberspace. However, the point of this post is not to point out that the judge's ideas are unoriginal, it's to set forth why I think they're wrong. Basically, I think there are three problems with the judge's argument that code trumps privacy legislation.

First, the judge fails to recognize that there are many types of privacy concerns. The article asserts that search engines like Yahoo! and Google had rendered the concept of limited usage for personal information obsolete. Frankly, I'm not sure how anyone could support such a silly notion. Yahoo! and Google make it easier to find information about a person, but do nothing to release information which isn't already publicly available. Thus, you can use Google to find out that I was (at one point) a competitive chess player, but you can't use Google to find out how much I paid the last time I went to the hospital. The fact that the judge does not realize that would be more serious concerns raised by my hospital records being publicly accessible by Google than are raised by my blog being accessible by Google indicates that his ultimate conclusion that code trumps law shouldn't be taken seriously.

Second, the judge overlooks the fact that, historically, the force of the law has a relatively good record in trumping the capabilities of code. For example, at one point there was a file-sharing service called Napster which was (supposedly) going to tear down the antiquated structure of intellectual property laws (for an example of the heady predictions related to Napster, see here). Of course, that didn't happen. What did happen is that Napster was sued out of existence based on violations of the intellectual property laws. For an even better example, consider the digital millennium copyright act, which has eliminated entire categories of consumer products (see this article for examples), which, if "code" actually trumped law, would be freely available. Now, by using these examples, I am not trying to make a normative argument that law should trump code, or that the world is better off because Napster (in its original incarnation) is gone and the DMCA is the law of the land. However, I think this examples make very clear that "code trumps law" is a conclusion which is simply not supported by the history of conflicts between the two.

Finally, the judge seems oblivious to the fact that "code" (or technology more generally) doesn't have the power to enforce social norms without the support of the law. For example, a search engine which is written in a manner that collects no personal information could only enhance privacy if: 1) people could trust its claims of gathering no personal information, which requires truth in advertising laws; and, 2) people could be sure it wouldn't unilaterally change its policies after they had relied on its guarantees of privacy, which requires the law to enforce its agreements. To me, the failure to understand that it is law which allows code to act as an alternate enforcer of social norms further undermines the judge's credibility, and his ultimate point that code trumps law.

Actually, the last of the three points is what bothers me most about the "code trumps law" argument. If you really think that "code" (or technology) trumps law, and that "code" can, ultimately be used to enforce social norms, there's no real need to fight for appropriate legal change. The result, of course, is that there won't be any legal change, and "code" will eventually trump law simply because the "law" side of the equation is ignored. As someone who cares about privacy protections, that seems to me to be an outcome which should be avoided, but that can only happen if people realize that the law is vital to protecting individual rights.