Digital Law Online: Code as Speech

Restrictions on the dissemination of encryption research results raise the question of whether a computer program is protected speech, and what protection it deserves. The question is complicated because the same code conveys valuable information to those familiar with computer programming and controls the function of a machine.

In the first appellate decision interpreting provisions of the DMCA, Universal City Studios v. Corley, {FN191: 273 F.3d 429, 60 USPQ2d 1953 (2nd Cir. 2001)} the Second Circuit addressed the “code as speech” question:

Communication does not lose constitutional protection as “speech” simply because it is expressed in the language of computer code. Mathematical formulae and musical scores are written in “code,” i.e.,symbolic notations not comprehensible to the uninitiated, and yet both are covered by the First Amendment. If someone chose to write a novel entirely in computer object code by using strings of 1’s and 0’s for each letter of each word, the resulting work would be no different for constitutional purposes than if it had been written in English. The “object code” version would be incomprehensible to readers outside the programming community (and tedious to read even for most within the community), but it would be no more incomprehensible than a work written in Sanskrit for those unversed in that language. The undisputed evidence reveals that even pure object code can be, and often is, read and understood by experienced programmers. And source code (in any of its various levels of complexity) can be read by many more. Ultimately, however, the ease with which a work is comprehended is irrelevant to the constitutional inquiry. If computer code is distinguishable from conventional speech for First Amendment purposes, it is not because it is written in an obscure language.

Of course, computer code is not likely to be the language in which a work of literature is written. Instead, it is primarily the language for programs executable by a computer. These programs are essentially instructions to a computer. In general, programs may give instructions either to perform a task or series of tasks when initiated by a single (or double) click of a mouse or, once a program is operational (“launched”), to manipulate data that the user enters into the computer. Whether computer code that gives a computer instructions is “speech” within the meaning of the First Amendment requires consideration of the scope of the Constitution’s protection of speech. {FN192: 273 F.3d at 445-446, 60 USPQ2d at 1963-1964 (citations omitted)}

The court, after discussing the scope of the First Amendment’s protection for speech, particularly for scientific writings, goes on:

Computer programs are not exempted from the category of First Amendment speech simply because their instructions require use of a computer. A recipe is no less “speech” because it calls for the use of an oven, and a musical score is no less “speech” because it specifies performance on an electric guitar. Arguably distinguishing computer programs from conventional language instructions is the fact that programs are executable on a computer. But the fact that a program has the capacity to direct the functioning of a computer does not mean that it lacks the additional capacity to convey information, and it is the conveying of information that renders instructions “speech” for purposes of the First Amendment. The information conveyed by most “instructions” is how to perform a task.

Instructions such as computer code, which are intended to be executable by a computer, will often convey information capable of comprehension and assessment by a human being. A programmer reading a program learns information about instructing a computer, and might use this information to improve personal programming skills and perhaps the craft of programming. Moreover, programmers communicating ideas to one another almost inevitably communicate in code, much as musicians use notes. Limiting First Amendment protection of programmers to descriptions of computer code (but not the code itself) would impede discourse among computer scholars, just as limiting protection for musicians to descriptions of musical scores (but not sequences of notes) would impede their exchange of ideas and expression. Instructions that communicate information comprehensible to a human qualify as speech whether the instructions are designed for execution by a computer or a human (or both). {FN193: 273 F.3d at 447-448, 60 USPQ2d at 1964-1965}

But having determined that code is speech does not answer the question of what protection it enjoys. Even though the First Amendment to the Constitution says that “Congress shall make no law . . . abridging the freedom of speech,” the reality is not so absolute. Congress has passed many laws that restrict speech, such as forbidding a company from providing fraudulent financial information to prospective investors.

As the court noted:

the scope of protection for speech generally depends on whether the restriction is imposed because of the content of the speech. Content-based restrictions are permissible only if they serve compelling state interests and do so by the least restrictive means available. A content-neutral restriction is permissible if it serves a substantial governmental interest, the interest is unrelated to the suppression of free expression, and the regulation is narrowly tailored, which in this context requires that the means chosen do not burden substantially more speech than is necessary to further the government’s legitimate interests.” {FN194: 273 F.3d at 450, 60 USPQ2d at 1966 (citations omitted)}

In the case before the Second Circuit, the operator of a Web site had posted a copy of a program called DeCSS that circumvented the Content Scrambling System (CSS) used to protect movies on a DVD:

The initial issue is whether the posting prohibition is content-neutral, since, as we have explained, this classification determines the applicable constitutional standard. The Appellants contend that the anti-trafficking provisions of the DMCA and their application by means of the posting prohibition of the injunction are content-based. They argue that the provisions “specifically target . . . scientific expression based on the particular topic addressed by that expression – namely, techniques for circumventing CSS.” We disagree. The Appellants’ argument fails to recognize that the target of the posting provisions of the injunction –DeCSS – has both a nonspeech and a speech component, and that the DMCA, as applied to the Appellants, and the posting prohibition of the injunction target only the nonspeech component. Neither the DMCA nor the posting prohibition is concerned with whatever capacity DeCSS might have for conveying information to a human being, and that capacity, as previously explained, is what arguably creates a speech component of the decryption code. The DMCA and the posting prohibition are applied to DeCSS solely because of its capacity to instruct a computer to decrypt CSS. That functional capability is not speech within the meaning of the First Amendment. The Government seeks to justify both the application of the DMCA and the posting prohibition to the Appellants solely on the basis of the functional capability of DeCSS to instruct a computer to decrypt CSS, i.e.,“without reference to the content of the regulated speech.” This type of regulation is therefore content-neutral, just as would be a restriction on trafficking in skeleton keys identified because of their capacity to unlock jail cells, even though some of the keys happened to bear a slogan or other legend that qualified as a speech component.

As a content-neutral regulation with an incidental effect on a speech component, the regulation must serve a substantial governmental interest, the interest must be unrelated to the suppression of free expression, and the incidental restriction on speech must not burden substantially more speech than is necessary to further that interest. The Government’s interest in preventing unauthorized access to encrypted copyrighted material is unquestionably substantial, and the regulation of DeCSS by the posting prohibition plainly serves that interest. Moreover, that interest is unrelated to the suppression of free expression. The injunction regulates the posting of DeCSS, regardless of whether DeCSS code contains any information comprehensible by human beings that would qualify as speech. Whether the incidental regulation on speech burdens substantially more speech than is necessary to further the interest in preventing unauthorized access to copyrighted materials requires some elaboration.

Posting DeCSS on the Appellants’ web site makes it instantly available at the click of a mouse to any person in the world with access to the Internet, and such person can then instantly transmit DeCSS to anyone else with Internet access. Although the prohibition on posting prevents the Appellants from conveying to others the speech component of DeCSS, the Appellants have not suggested, much less shown, any technique for barring them from making this instantaneous worldwide distribution of a decryption code that makes a lesser restriction on the code’s speech component. It is true that the Government has alternative means of prohibiting unauthorized access to copyrighted materials. For example, it can create criminal and civil liability for those who gain unauthorized access, and thus it can be argued that the restriction on posting DeCSS is not absolutely necessary to preventing unauthorized access to copyrighted materials. But a content-neutral regulation need not employ the least restrictive means of accomplishing the governmental objective. It need only avoid burdening “substantially more speech than is necessary to further the government’s legitimate interests.” The prohibition on the Defendants’ posting of DeCSS satisfies that standard. {FN195: 273 F.3d at 453-455, 60 USPQ2d at 1969-1970 (citations omitted)}

A similar finding that the DMCA did not unconstitutionally restrict free speech was reached in a preliminary ruling in U.S. v. Elcom, {FN196: 203 F.Supp.2d 1111, 62 USPQ2d 1736 (N.D. Cal. 2002)} the criminal trial of a Russian software company that distributed a program capable of circumventing the protection for Adobe electronic books.

Next section: Security Testing