READING THE CONSTITUTION IN CYBERSPACE tion held in public space. 31 Contract notwithstanding, the data about me collected by others, or the data of mine that I put in public space is open to government theft without fear of constitutional penalty 32 This means that as the technologies of data collection and use have advanced, the extent of my privacy has declined, just because the extent of information held about me in public space has changed Whereas before I might have lived ninety percent of my life in places essentially protected from government surveillance, now ninety percent of my life in a place completely open to government surveillance Encryption may just be the technological accommoda- tion needed to balance this technological loss of control But what about a lesser regulation? Imagine that the government banned any encryption technology that was not registered, in the sense that it preserved in its design a"back door, 33 so that gov- ernment officials could decrypt a conversation if they had proper authorization. 34 Of course, for good David Post-like reasons, 35 this could not be a successful regulation if simply imposed as a rule( the Net spits out mandates); and of course, there is no simple way to describe what any such system would be, since there are many ways stem could implement this type of back-door access. But as suming that we could get the system implemented and assuming 6I See, e.g., Jill M. Ryan, Note, Freedom to Speak Unintelligibly: The First Amendment Implications of Government-Controlled Encryption, 4 WM. MARY BILL RTS. J 1165 (1996) See United States v Miller, 425 U.S. 435(1976). For a depressing) account of the constitutional protections for interpersonal privacy see Albert w. Alschuler, Interpersonal Privacy and the Fourth Amendment, 4 N ILL. U.L. REV. 1(1983) 33 A"back door" provides access to a system through a route other than one designed for primary users 4 The possibilities here are many. See A. Michael Froomkin, The Constitu- tionality of Mandatory Key Escrow, in BUILDING IN BIG BROTHER: THE CRYPTOGRAPHIC POLICY DEBATE, supra note 29, at 413 35 David G Post, Anarchy, State, and the Internet: An Essay on Law-Making in Cyberspace, 1995 J ONLINE L art. 3(1995). Post argues that because the Net facilitates easy exit, "rule-sets"imposed by governments will be easily evaded. Thus the techniques of regulation cannot be the direct techniques of pro- hibition, but must use market regulation as the means. This is an extremely important argument, and article, and I agree with the general point it is making But the extent of the flexibility depends upon the technology. At this stage, the more radical point that Post makes has not yet been reached
READING THE CONSTITUTION IN CYBERSPACE — 11 — tion held in public space.31 Contract notwithstanding, the data about me collected by others, or the data of mine that I put in public space, is open to government theft without fear of constitutional penalty.32 This means that as the technologies of data collection and use have advanced, the extent of my privacy has declined, just because the extent of information held about me in public space has changed: Whereas before I might have lived ninety percent of my life in places essentially protected from government surveillance, now I live ninety percent of my life in a place completely open to government surveillance. Encryption may just be the technological accommodation needed to balance this technological loss of control. But what about a lesser regulation? Imagine that the government banned any encryption technology that was not registered, in the sense that it preserved in its design a “back door,”33 so that government officials could decrypt a conversation if they had proper authorization.34 Of course, for good David Post-like reasons,35 this could not be a successful regulation if simply imposed as a rule (the Net spits out mandates); and of course, there is no simple way to describe what any such system would be, since there are many ways a system could implement this type of back-door access. But assuming that we could get the system implemented, and assuming 31 See, e.g., Jill M. Ryan, Note, Freedom to Speak Unintelligibly: The First Amendment Implications of Government-Controlled Encryption, 4 WM. & MARY BILL RTS. J. 1165 (1996). 32 See United States v. Miller, 425 U.S. 435 (1976). For a compelling (and depressing) account of the constitutional protections for “interpersonal privacy” see Albert W. Alschuler, Interpersonal Privacy and the Fourth Amendment, 4 N. ILL. U. L. REV. 1 (1983). 33 A “back door” provides access to a system through a route other than one designed for primary users. 34 The possibilities here are many. See A. Michael Froomkin, The Constitutionality of Mandatory Key Escrow, in BUILDING IN BIG BROTHER: THE CRYPTOGRAPHIC POLICY DEBATE, supra note 29, at 413. 35 David G. Post, Anarchy, State, and the Internet: An Essay on Law-Making in Cyberspace, 1995 J. ONLINE L. art. 3 (1995). Post argues that because the Net facilitates easy exit, “rule-sets” imposed by governments will be easily evaded. Thus the techniques of regulation cannot be the direct techniques of prohibition, but must use market regulation as the means. This is an extremely important argument, and article, and I agree with the general point it is making. But the extent of the flexibility depends upon the technology. At this stage, the more radical point that Post makes has not yet been reached
45 EMORY L J. NO. 3(1996) that we could select a sufficiently secure system( the two really diffi cult questions simply assumed away ), then would such a regime be constitutional? The place to start in answering this question is a recent Supreme Court case touching on the right of anonymity, McIntyre v. Ohio Elections Commission. 36 Ohio had a statute that made it illegal to distribute unsigned brochures relating to an election or ballot issue The state defended the statute on the ground that it would reduce fraud or misleading statements at the time of an election. The Su preme Court, in an opinion by Justice Stevens, struck down the statute. A clear practice, both at the founding, and in the two centu- ries since, made it plain that speech did not lose its First Amendment protection simply by being anonymous, this speech in particular (political speech) did not lose its First Amendment protection by being anonymous, thus, because the statute burdened political speech, the Court applied "exacting scrutiny, upholding the restric tion"only if it is narrowly tailored to serve an overriding state inter- est. 37 Because this regulation reached anonymous speech gener- ally, the Court held, it reached too broadly McIntyre establishes a constitutional principle of anonymity, though no doubt a limited one 38 It is a rule that is consistent with the original practice: While the framing world was not an anony mous one. it was clear that one had the right to build walls. One could take steps to make one s stuff private, by putting it behind walls. As a balance to constant publicity, one could take steps to keep one's identity secret, and these efforts at concealment were Mclntyre, however, leaves open the question whether this right to build walls is absolute. Or, more generally, whether the govern- ment can regulate the kinds of walls one builds. One might look to the Framers practice to resolve this question, hoping for a clear an swer there. But the short and inescapable conclusion of such a search is this: that there is no original practice there to find. Gov ernment didnt regulate the kind of anonymity one was allowed,in part because there was no way to regulate the kind of anonymity one was allowed Technology didnt allow it, and any way, the kind of anonymity one could achieve was easily enough broken without l15s.Ct.1511(1995) ld at 1519 38 The Court was explicit that the opinion reached"only written communica- tions and, particularly, leaflets of the kind Mrs. Mclntyre distributed. ld.at 1515n.3
45 EMORY L. J. NO. 3 (1996) — 12 — that we could select a sufficiently secure system (the two really difficult questions simply assumed away), then would such a regime be constitutional? The place to start in answering this question is a recent Supreme Court case touching on the right of anonymity, McIntyre v. Ohio Elections Commission. 36 Ohio had a statute that made it illegal to distribute unsigned brochures relating to an election or ballot issue. The state defended the statute on the ground that it would reduce fraud or misleading statements at the time of an election. The Supreme Court, in an opinion by Justice Stevens, struck down the statute. A clear practice, both at the founding, and in the two centuries since, made it plain that speech did not lose its First Amendment protection simply by being anonymous; this speech in particular (political speech) did not lose its First Amendment protection by being anonymous; thus, because the statute burdened political speech, the Court applied “exacting scrutiny,” upholding the restriction “only if it is narrowly tailored to serve an overriding state interest.”37 Because this regulation reached anonymous speech generally, the Court held, it reached too broadly. McIntyre establishes a constitutional principle of anonymity, though no doubt a limited one.38 It is a rule that is consistent with the original practice: While the framing world was not an anonymous one, it was clear that one had the right to build walls. One could take steps to make one’s stuff private, by putting it behind walls. As a balance to constant publicity, one could take steps to keep one’s identity secret, and these efforts at concealment were respected. McIntyre, however, leaves open the question whether this right to build walls is absolute. Or, more generally, whether the government can regulate the kinds of walls one builds. One might look to the Framers’ practice to resolve this question, hoping for a clear answer there. But the short and inescapable conclusion of such a search is this: that there is no original practice there to find. Government didn’t regulate the kind of anonymity one was allowed, in part because there was no way to regulate the kind of anonymity one was allowed. Technology didn’t allow it, and anyway, the kind of anonymity one could achieve was easily enough broken without 36 115 S. Ct. 1511 (1995). 37 Id. at 1519. 38 The Court was explicit that the opinion reached “only written communications and, particularly, leaflets of the kind Mrs. McIntyre distributed.” Id. at 1515 n.3
READING THE CONSTITUTION IN CYBERSPACE such regulation. If we are to look to the Framers for guidance, what is required is not obedience to what they thought, but elaboration from what they did One elaboration might be this. While we know that intentionally created anonymity was not anathema to the framing generation, we also know that even the thickest walls had to yield to a court order to open. When sufficient cause existed to demand the right to search the power to search was upheld. The constitutional question about anonymity then comes to this: Whether the government has the right to regulate anonymity, so as to assure the ability to search when it has the right to search Consider a regime like this. 39 On every transaction in cyber space, automatically there would be attached an encrypted finger print. 40 This fingerprint would be meaningless to anyone save one who held a key; but to one who held the key, the identity of the sender, and perhaps its content, would be revealed. The requirement would be that this key must be preserved, such that the government, if armed with a warrant, would have the power to get access to it. 41 Such a regime(assuming it worked)would preserve the benefits of anonymity. To the public, my message or identity could be hid den. And so too to the government, except when the government had judicial permission to crack this identity or content. Only then would the anonymity be broken What are the constitutional arguments against this regime? Oth- rs have offered extensive doctrinal and analogical analysis of this 39 Again, I am ignoring the most difficult question here, namely, how one would implement this as a requirement. The technique would not be to require it by law, but to require it in the protocol of the Net 40 This is simply a way of tracing the transaction back to an originator, al though the ability to trace would exist only if one had the key to decrypt the fingerprint. This is different from the"digital fingerprint discussed by Data Se curity, Inc, a cryptography company. See RSA's Frequently Asked Questions About Today's Cryptography (last modified May 9, 1995) 41 Note the question whether fingerprinting itself is a search has not been clearly resolved. See 1 WAYNE R. LAFAVE, SEARCH AND SEIZURE 434
READING THE CONSTITUTION IN CYBERSPACE — 13 — such regulation. If we are to look to the Framers for guidance, what is required is not obedience to what they thought, but elaboration from what they did. One elaboration might be this. While we know that intentionally created anonymity was not anathema to the framing generation, we also know that even the thickest walls had to yield to a court order to open. When sufficient cause existed to demand the right to search, the power to search was upheld. The constitutional question about anonymity then comes to this: Whether the government has the right to regulate anonymity, so as to assure the ability to search when it has the right to search. Consider a regime like this.39 On every transaction in cyberspace, automatically there would be attached an encrypted fingerprint.40 This fingerprint would be meaningless to anyone save one who held a key; but to one who held the key, the identity of the sender, and perhaps its content, would be revealed. The requirement would be that this key must be preserved, such that the government, if armed with a warrant, would have the power to get access to it.41 Such a regime (assuming it worked) would preserve the benefits of anonymity. To the public, my message or identity could be hidden. And so too to the government, except when the government had judicial permission to crack this identity or content. Only then would the anonymity be broken. What are the constitutional arguments against this regime? Others have offered extensive doctrinal and analogical analysis of this 39 Again, I am ignoring the most difficult question here, namely, how one would implement this as a requirement. The technique would not be to require it by law, but to require it in the protocol of the Net. 40 This is simply a way of tracing the transaction back to an originator, although the ability to trace would exist only if one had the key to decrypt the fingerprint. This is different from the “digital fingerprint” discussed by Data Security, Inc., a cryptography company. See RSA’s Frequently Asked Questions About Today’s Cryptography (last modified May 9, 1995) <http://ww.rsa.com/rsalabs/faq/faq_misc.html>. 41 Note the question whether fingerprinting itself is a search has not been clearly resolved. See 1 WAYNE R. LAFAVE, SEARCH AND SEIZURE 434 & n.162 (1996)
45 EMORY L J. NO. 3(1996) question 42 But my sense is the matter will be resolved at a much simpler level. One might argue that the regime is too burdensome, would not get one far. Or one might present constitutional regime, but of course, that argument, in the ay that requiring production of the key itself is a search, 4 but if the key were never used or pro duced except when a warrant existed, then it would be odd to think of this as a search. Maybe it is a seizure 4 but then the question is whether such a seizure is reasonable and with this the essence of the problem is revealed. For my sense is that the whole Fourth Amend ment question will get resolved in just this way: Given the tiny bur den on any particular individual's life, and given sufficient assur ance that the key would not be misused, and given the increase in privacy that any such general regime would make, 4> is there any value from the framing legal regime that would justify the conclu- sion that this kind of regulation could not be permitted? I dont see such a value in our present constitutional regime There was no legal value that preserved to the framing regime the right to keep stuff hidden, even in the face of a judicial warrant. 46 There may have been the ability to keep stuff hidden, since the tech nology to find it, or identify it, might have been limited. But friction doesnt convert to a right. An argument for this conversion is re quired--some reason why it makes sense. My prediction is that no 42 The most extensive discussion is contained in Froomkin, supra note 19,at 810-43, Philip R Reitinger, Compelled Production of plaintext and Keys, 1996 U. CHI. LEGAL F(forthcoming, Fall 1996) 43 This is distinct from any Fifth Amendment question. On that, see Reitinger, supra note 42; Froomkin, supra note 19, at 833-38 44 If it involved the taking of a physical key, of course it would be a seizure Sodal v. Cook County, 506 U.S. 56(1992); United States v Jacobsen, 466 U.S. 109(1984). Action interfering with the possessory interests of an owner would constitute a seizure as well. Arizona v Hicks, 480 U.S. 321, 324 (1987) Taking a copy of an encryption key would be, if anything, of an intan- gible, which, the Court has held, over strong dissent, would be a seizure. Berger V. New york,388U.S.41(1967) 45 A encryption regime arguably would increase privacy because it would in- crease the marginal cost of privacy violations for both the government and the individual. See Lessig, supra note 30, at 1751 n 23 46 However, Professor Stuntz does make a strong argument that the thrust of the Amendments protections are substantive. See William Stuntz, The Substan- tive Origins of Criminal Procedure, 105 YALE L.J. 393(1995)
45 EMORY L. J. NO. 3 (1996) — 14 — question.42 But my sense is the matter will be resolved at a much simpler level. One might argue that the regime is too burdensome, but of course, that argument, in the present constitutional regime, would not get one far. Or one might say that requiring production of the key itself is a search,43 but if the key were never used or produced except when a warrant existed, then it would be odd to think of this as a search. Maybe it is a seizure,44 but then the question is whether such a seizure is reasonable and with this the essence of the problem is revealed. For my sense is that the whole Fourth Amendment question will get resolved in just this way: Given the tiny burden on any particular individual’s life, and given sufficient assurance that the key would not be misused, and given the increase in privacy that any such general regime would make,45 is there any value from the framing legal regime that would justify the conclusion that this kind of regulation could not be permitted? I don’t see such a value in our present constitutional regime. There was no legal value that preserved to the framing regime the right to keep stuff hidden, even in the face of a judicial warrant.46 There may have been the ability to keep stuff hidden, since the technology to find it, or identify it, might have been limited. But friction doesn’t convert to a right. An argument for this conversion is required—some reason why it makes sense. My prediction is that no 42 The most extensive discussion is contained in Froomkin, supra note 19, at 810-43; Philip R. Reitinger, Compelled Production of Plaintext and Keys, 1996 U. CHI. LEGAL F. (forthcoming, Fall 1996). 43 This is distinct from any Fifth Amendment question. On that, see Reitinger, supra note 42; Froomkin, supra note 19, at 833-38. 44 If it involved the taking of a physical key, of course it would be a seizure. Sodal v. Cook County, 506 U.S. 56 (1992); United States v. Jacobsen, 466 U.S. 109 (1984). Action interfering with the possessory interests of an owner would constitute a seizure as well. Arizona v. Hicks, 480 U.S. 321, 324 (1987). Taking a copy of an encryption key would be, if anything, a seizure of an intangible, which, the Court has held, over strong dissent, would be a seizure. Berger v. New York, 388 U.S. 41 (1967). 45 A encryption regime arguably would increase privacy because it would increase the marginal cost of privacy violations for both the government and the individual. See Lessig, supra note 30, at 1751 n.23. 46 However, Professor Stuntz does make a strong argument that the thrust of the Amendment’s protections are substantive. See William Stuntz, The Substantive Origins of Criminal Procedure, 105 YALE L.J. 393 (1995)
READING THE CONSTITUTION IN CYBERSPACE such argument will be gerprint requirement in cyber- pace will be held to be constitutional Warrant-less search Imagine a worm--a bit of computer code that crosses network wires and places itself on your computer--that snooped your hard disk looking for illegal copies of software. 47 The FBI, for example might spit this critter onto the Net, and let it work its way onto disks across the country. When the worm found an illegal copy of soft ware. it would send a message to that effect back to the FBi: if it found no such illegality, it would self-destruct. No difference in the operations of the computer would be noticed; the worm would snoop, as it were, deep underground This worm would be doing what the framers would have at tacked as a general search; it would be marching through hard disks across the country without any particularized suspicion. It would be searching without warrant, either judicial or factual. If all general searches were illegal, then this one certainly would be. But if it causes no disruption of the disk, at least if it discovers no illegality, and if erases itself without being discovered. then it shares few of the characteristics of a generalized search. 48 While it is a search that proceeds without warrant, it is also a search that produces no false positives. It would be like a dog-sniff at the airport, 49 though better: worms dont bite, and unless you see them, they don t terrify either Would it be constitutional? Odd as this might sound, my sense here again is that this inversion of the original purpose of the Fourth Amendment would be found to be constitutional. For the Fourth Amendment s test is reasonableness(one can get a warrant only with particularized suspicion, but one violates the Fourth Amend ment only if one conducts an unreasonable search); and the calcula tion of reasonableness must look to the benefit and the harm The enefits are clear the criminal activity being sought would be found with little effort and with no real disruption. The primary costs would be costs to those whose criminal activity had been discov- 47 The example comes from Michael Adler, Cyberspace, General Searches, and Digital Contraband: The Fourth Amendment and the Net-Wide Search, 105 YALE L.J.1093(1996) 48 The closest analog is the dog-sniff, which the Court held"less intrusive than a typical search? since it didn t require the opening of any packages by the individual, and it was precisely targeted at contraband. United States v. Place, 462US.696,707(1983) 15
READING THE CONSTITUTION IN CYBERSPACE — 15 — such argument will be found. A fingerprint requirement in cyberspace will be held to be constitutional. Warrant-less Search Imagine a worm—a bit of computer code that crosses network wires and places itself on your computer—that snooped your hard disk looking for illegal copies of software.47 The FBI, for example, might spit this critter onto the Net, and let it work its way onto disks across the country. When the worm found an illegal copy of software, it would send a message to that effect back to the FBI; if it found no such illegality, it would self-destruct. No difference in the operations of the computer would be noticed; the worm would snoop, as it were, deep underground. This worm would be doing what the Framers would have attacked as a general search; it would be marching through hard disks across the country without any particularized suspicion. It would be searching without warrant, either judicial or factual. If all general searches were illegal, then this one certainly would be. But if it causes no disruption of the disk, at least if it discovers no illegality, and if erases itself without being discovered, then it shares few of the characteristics of a generalized search.48 While it is a search that proceeds without warrant, it is also a search that produces no false positives. It would be like a dog-sniff at the airport,49 though better: worms don’t bite, and unless you see them, they don’t terrify either. Would it be constitutional? Odd as this might sound, my sense here again is that this inversion of the original purpose of the Fourth Amendment would be found to be constitutional. For the Fourth Amendment’s test is reasonableness (one can get a warrant only with particularized suspicion, but one violates the Fourth Amendment only if one conducts an unreasonable search); and the calculation of reasonableness must look to the benefit and the harm. The benefits are clear: the criminal activity being sought would be found with little effort and with no real disruption. The primary costs would be costs to those whose criminal activity had been discov- 47 The example comes from Michael Adler, Cyberspace, General Searches, and Digital Contraband: The Fourth Amendment and the Net-Wide Search, 105 YALE L.J. 1093 (1996). 48 The closest analog is the dog-sniff, which the Court held “less intrusive than a typical search” since it didn’t require the opening of any packages by the individual, and it was precisely targeted at contraband. United States v. Place, 462 U.S. 696, 707 (1983). 49 Id