Regulation by Software

Regulation by Software

James Grimmelmann

Harvard/Yale ISP/Berkman Cyberscholars

November 20, 2003

This presentation is available under a Creative Commons license

At this session, I presented an early working version of what became Note: Regulation by Software, 114 Yale Law Journal 1719 (2005), available at




code regulates

That is, Larry Lessig's Code: And Other Laws of Cyberspace explains how software can do the regulatory work we associate with law.

two detours

Lessig's claim was so smart and so important that people immediately started arguing over things that were important in their own right but distractions from Lessig's deeper points. The immediate debate was over whether Lessig was right to argue that as a practical matter, real-life authorities could effectively control the the technical architecture of the Internet. The jury is still out.

A deeper problem is the ambiguity of Lessig's catchphrase, "code is law." Lessig didn't mean that software and law were identical; in fact, he meant that software was a kind of architecture. It was like law in many ways, but not the same thing. People have spilled ink debunking a confliation of code and law that wasn't really present in Lessig in the first place. Some very interesting recent scholarship has also focused on the use of software to escape from legal regulation (so that code and law are in competition). Smart, but a very different point, and not one that directly engages Lessig.

New Chicago

See Lawrence Lessig, The New Chicago School 27 Journal of Legal Studies 661 (1998).

the claim


the claim

software is its own modality of regulation

Specifically, software is not a form of physical architecture. It is like law and it is like architecture, but it is not a species of either of them.

three features

Automatic: software runs without the need for human intervention. Immediate: software works directly, preventing forbidden conduct entirely, rather than punishing the conduct after it takes place. Plastic: sofwtare is enormously flexible, capable of carrying out any instructions that can be formulated precisely.

software is automatic

software is immediate

I no longer think that the temporal aspect is as important as I did then. Interestingly, Lessig's "present" has the same sense of being at once spatial and temporal as "immediate" does. I prefer "immediate" because it gets at the lack of mediation, as well.

software is plastic

"The programmer, like the poet, works only slightly removed from pure thought-stuff. . . .Few media of creation are so flexible, so easy to polish and rework, so readily capable of realizing grand conceptual structures."

- Frederick P. Brooks, Jr., The Mythical Man-Month


jurisprudence of rules

software cannot be ignored

The first two bullets are right; the third took me in over my head. The point here is that laws can be ignored by people where no one else is affected. Between you and me, if we don't care whose legal duty it is to repair the fence between our farms, we need never get a court involved if we come to agreement amicably. Where software is involved, we can't just ignore it. We need explicitly to reverse its decisions if they're wrong.

In the presentation, I went on to say that where software creates inefficient outcomes like that, there's great pressure for us to find a way around it. We're trying to "circumvent" inappropriate software results. That's true enough, but I was really trying to equate that circumvention with DMCA-style "circumvention." That's conflating two senses of the word, and the analogy isn't exact enough for the point to be worth making in this way.

catastrophic failure modes

bugs are expected

the $64 question


the $64 question

when is regulation by software legitimate?

Feedback at the workshop was that this section wasn't quite coherent. Some very good questions enabled me to see that I was moving too quickly from the descriptive to the normative. The published version of the article is much better at situating the normative claims within a more precise framework. "Legitimate" is a proper question, but it's not quite in line with what I'm asking here. I get at that question more in Virtual Power Politics, albeit in one particular context..

the naive view

problems of legitimacy

uh oh

the rhetoric of bugs

there is no escape

I still think that this point holds up. See Virtual Power Politics for the extended remix of this argument.




here's a story that brings it all together

Great story. Great example. Wrong presentation. I have much better case studies in the finished article.

the ballad of Shadowbane

I wrote this in the fall of 2003. Shadowbane had another forced migration this spring. The same fights over its terms and its fairness broke out.

morals of the story

back in the real world


back in the real world

we call this stuff "politics"

the emperor's new software

digital rights mismanagement

This slide pretty much made it into the final version intact. I unpack the details more carefully there.

offenses against speech

software is a bad regulatory fit

This slide didn't make it into the article, for space reasons. But the point is easily stated. Whatever you think about laws against offensive speech, software is in many ways a less effective and more contentious way of restricting offensive speech than laws would be. Rules just don't work well with the subtleties of communication, and bugginess is a huge problem.

closing thought


closing thought

"You can't hack the law."

- Cindy Cohn