In response to Lawrence Lessig's "
Code is Law", I wanted to point out, from a technical perspective, that it is literally the transfer, authentication, and verification
protocols that define law on the Net. Yes, protocols consist of code, but so do web pages, but they don't dictate much of Net law.
TCP/IP protocols (redundant) were developed not by one person, but several, interested in a similar end goal, and common values. As Lessig points out, the most important value in today's age (at least in regards to technology, and the exchange of information) is the avoidance of control, and government by another, or even ourselves. This was most certainly at the core of the Internet's development.
With its positive contributions and drawbacks, I want to update Lessig's argument with a few modern examples for 2007. Lessig seems to think that any added protocol to TCP/IP will be dangerous to the inherit "1st Amendment Code" embedded into the Net. On the contrary, I believe this spirit of free exchange is still thriving, and even more abundant. This may be due to instances of forceful governance such as the one pointed out by a Sarah Wheeler, in her
example regarding the patched in DRM of a popular video game. Users and non-users alike undoubtedly felt betrayed by this sort of imposing force on their own free exchange and will naturally lean towards systems that do not invade a person's right to information.
Regardless of the reason, today, many developers are working together in a completely democratic, open environment (the cliché is "Open Source") to create protocols that will standardize and protect user information, such as the identification dilemma presented by Lisseg. One such project has been called
OpenID. While its technical aspects, conceptual approach, and history are beyond this post, it is truly a technology that resides in the hands of its users. Anyone with the know-how (perhaps a limitation that breaks the system) can contribute to the standardized web application login system. This standard attempts to allow users to have only one, centralized identity, that is username, password, and typical profile information such as age and geographical location. With this information, participating web applications can draw on this info to allow practically any Internet user to access their content and still retain the security associated with the typical user identification process. It's eliminating hassle, without the expense of lost security, just as Lessig described in 2000.
Of course, a system like this does have its disadvantages. While the data does not have to be stored in a central location (theoretically, any domain can), if a user's identity were to be stolen once, that user's information would be compromised across the Net. The OpenID protocol has security in place, but Lessig is right, it's only a matter of time before malicious code arrives on the scene.
Perhaps, even collaborative efforts like OpenID will become a product of self control, but the ungoverned system will account for itself, and new protocols will be developed to replace the abandoned.
As a developer, I'm not worried ... too much.
*If OpenID is interesting to you, also be sure to read up on
OAuth, a standard protocol to secure API's for various web applicaitons.*