Lawrence Lessig
Code doesn’t prohibit. Code makes impossible. This distinction, which Lessig named in 1999, explains why digital systems regulate behavior more effectively than any formal law.
The real law is not in the Official Gazette.
Article 17 of 21—Governance as Versioning Series
This is Article 17. The Governance as Versioning series maps 335 years of political, philosophical, and systemic thought to the logic of code versioning. Article 17 covers Lawrence Lessig, the transversal concept of architecture as real constitution—the idea that every design choice in a governance system is itself a political decision—and the question that connects Benkler to Castells: if code is law, then who writes the code holds the power, and power is tied to the structure of the network, not just to the content of any specific repository.
What you’ll find here:
This article shows that the most powerful rules in any group are not written in bylaws or standing orders: they are in the architecture of the system the group uses to communicate and decide. Whoever designs that architecture decides what is possible, what is difficult, and what simply never happens—without anyone needing to sign anything. This illuminates something central to the versioning protocol: every design choice in the governance system is itself a political decision.
1. Where it all begins
Washington, D.C., October 1998. President Bill Clinton signs the law that would become informally known as the “Mickey Mouse Act.” Its official name was the Sonny Bono Copyright Term Extension Act: a law that stretched the protection period for artistic works by another twenty years, preventing the planet’s most famous mouse from entering the public domain.
Lawrence Lessig, a 37-year-old constitutional law professor, read the law and got angry. Not because of Mickey specifically. But because he saw there something few legal scholars were willing to see: that the most powerful rules of a society were no longer in the Official Gazette. They were in the code.
Code, in the technical sense: the instructions that tell a computer what to do, what to permit, and what to block.
For a legal scholar, this was an uncomfortable revelation. For centuries, humanity had debated laws in parliaments, created courts, invented appeals, and guaranteed rights of defense. And suddenly, a programmer in an office in Cupertino or Mountain View was deciding what millions of people could or could not do—without debate, without a vote, without appeal.
Lessig published Code and Other Laws of Cyberspace in 1999. He revised and expanded it in 2006 as Code 2.0. But the summary phrase had already shifted the debate: “Code is law.”
He was not saying that code has the same legal nature as a statute. He was saying something more disturbing: digital architecture regulates human behavior more effectively than any formal law. Because of law, you can disobey, accepting the risk of punishment. Code you simply cannot disobey. It is not prohibition; it is impossibility.
2. Historical context
Lessig identified four forces that regulate human behavior in any society: formal law (punishment by the state), social norms (punishment by the community), market (punishment by price), and architecture. The last is where everything changes.
A speed bump on the road does not prohibit acceleration. It makes acceleration physically impossible. There is no punishment: there is prevention. In the digital world, code plays that role.
DRM (Digital Rights Management—the system that prevents you from copying a film or lending an e-book to a friend) inside a file does not say “you cannot copy.” It says something more definitive: you cannot copy. It is not a law to disobey. It is a wall.
3. The central idea
Lessig showed that this fourth modality is the most powerful because it operates silently. The law is published in the Official Gazette. Social norms are visible in people’s reactions. Price appears on the label. Code is invisible: you do not notice you are being regulated—you simply discover that certain things do not work.
Before Lessig, most legal scholars treated technology as a subject for engineers. After him, it became difficult to maintain that separation: if code regulates behavior, then whoever writes code does politics. And politics requires accountability—which is exactly what most code systems lack.
4. Developments
Whoever writes the code writes the Constitution.
The logical consequence of Lessig’s argument is uncomfortable for anyone who values democracy.
Constitutions are negotiated in assemblies. Laws pass through parliaments. Even executive orders have some form of publicity and appeal. But who decides that a news feed algorithm will prioritize content that generates outrage? A product engineer in a Thursday afternoon meeting.
Who decides that a criminal risk assessment system will classify certain profiles as dangerous? A statistician hired by a private company, whose code is a trade secret. The defendant cannot challenge it because they cannot see how the system works.
Lessig was not saying that all these agents are malicious. He was saying that the power to legislate had migrated to a space without the checks and balances that democracy spent centuries building. And that is structurally dangerous, regardless of the intentions of whoever occupies that space.
The invisible constitution of the apartment building
Think of a residential building. The internal regulations are the formal law: no noise after 10 p.m., no animals above a certain size.
But the building has another “constitution” that nobody calls by that name: the physical architecture. The narrow hallways that make large moves difficult. The cameras that record who comes and goes. The intercom that runs through a switchboard the building manager controls.
None of this is in the regulations. But all of it regulates behavior more effectively than any written article.
Whoever designed the building made political decisions, even while believing they were just making technical choices. The size of the meeting room defines how many people can organize. The position of the cameras defines what is monitored. Access to the intercom defines who controls communication.
Lessig called this “architecture is politics.” Technical design embeds values. Those values regulate who can do what, even when no one is paying attention.
The neutrality fallacy
The most common argument is that technology is neutral—it depends on how it is used.
Lessig replied, “No.” With a simple example.
The internet of the 1990s was designed with the “end-to-end” principle: the network was simple, and intelligence sat at the edges. Any connected computer could do anything. No central company controlled the traffic. That design favored innovation without asking anyone’s permission.
The internet of the 2020s is different. Centralized platforms control traffic, visibility, and access. To reach the user, you pass through gatekeepers: Google in search, Apple and Google in app stores, and Meta in social networks.
The design changed. The possibilities changed. Not because anyone published a new law: the architecture was redesigned. Technical decisions have political consequences. Whoever makes them accumulates power that no constitution regulates effectively.
5. Historical legacy
Lessig did not stay in theory. He founded Creative Commons in 2001: licenses that allow creators to say “you may use this, but give credit” or “you may use this, but keep it open.” If copyright law closes everything by default, create legal tools that open whatever the author wants to open.
Today, more than two billion works use Creative Commons licenses. All of Wikipedia is under CC BY-SA: anyone can copy, modify, and redistribute articles as long as they keep the same open license. This is legal code written to create commons instead of closing them.
In Republic, Lost (2011), Lessig applied the same reasoning to American politics: the problem is not explicit corruption but structural dependence on private funding. The code of the electoral system was designed so that politicians need money from donors to exist. It is not bribery: it is architecture.
He lost at the U.S. Supreme Court in 2003 (Eldred v. Ashcroft). He won in culture: the awareness that copyright was privatizing collective knowledge entered public debate in a way it had not before.
6. Contradictions and limitations
Lessig is an American lawyer writing about the American internet in the 2000s. His vision has a contextual bias.
The most serious critique: he underestimated the capacity of existing power structures to adapt. Lessig bet that open architecture would be hard to close. The internet proved the opposite: it centralized rapidly, with or without laws specifically designed for that. The market did what the government did not need to do.
Get Gustavo J. Alessandri’s stories in your inbox
Join Medium for free to get updates from this writer.
Another contradiction: Lessig used the American legal system to fight against the American legal system. Creative Commons is a brilliant tool within the copyright logic he criticizes. This is intelligent pragmatism, but it does not resolve the structural problem he himself identified.
7. The translation into versioning
A legitimate objection before continuing: “If code is law and whoever writes the code decides what is possible, then the versioning protocol is also a law imposed by whoever created it. Why trust it?” The answer lies in the difference between closed and open code: in an open versioning system, the protocol itself is auditable, modifiable, and can be replaced by the group at any time. The code that governs the governance system is visible to everyone. This does not eliminate the problem Lessig identified, but it makes it manageable: you can see, contest, and change the rules of the game.
Lessig never saw a Git repository. But had he, he would have recognized in it the architecture he defended his whole career.
The transversal concept Lessig illuminates in this series architecture as real constitution: the idea that every design choice in the governance system (which platform to use, who can propose changes, how approvals work, what gets recorded, and what disappears) is itself a political decision. No single step of the protocol captures this because Lessig’s thesis applies to every step: from the first commit to the last merge, every technical rule of the system is also a rule of power.
Transparency forced by design. In an open repository, anyone can see the full history: who proposed, when, what changed, who approved, and who rejected. This is not transparency by goodwill. It is transparency because the architecture does not allow hiding. A group that governs via open repository cannot claim “that was decided this way” without showing the commit that records when, by whom, and with what justification.
Fork as a codified right of dissent. Lessig fought in courts trying to guarantee that people could express themselves freely against corporate power. The open repository resolves this in the architecture: if you disagree with the direction the group has taken, you have the technical right to copy the entire history and go your own way. Dissent is not tolerated: it is enabled by design. No one needs permission to fork.
Mandatory review as checks and balances. The problem Lessig identified in closed code systems is that a person with access can alter the system without review. In a well-configured repository, nobody merges without approval from other people. The governance system’s code can require two or more different perspectives to approve any change before it enters the official version.
Vigilance: if the repository exists but review is perfunctory (automatic approvals, commits without descriptions, branches approved without discussion), the system has become bureaucracy with an open-source interface. The form is there. The substance is not. The repository’s license is the group’s real constitution. Not what they say they do in meetings, but what the system actually allows. Code is law. The governance system’s code is the group’s real law.
Han went further on a point. Lessig left implicit: code does not need to prohibit in order to control. It is enough to make certain actions invisible, undesirable, or exhausting. A feed that never shows long proposals does not censor them: it simply ensures no one reads them. A voting system that requires ten steps to participate does not prevent participation: it merely ensures few participate. Han called this psychopolitics—power that acts through exhaustion and manufactured preference, not through repression. The warning for versioning is direct: a repository whose interface is confusing enough to discourage occasional participants is not open by design. It is a cathedral with a glass door.
A limitation versioning does not resolve on its own: the protocol assumes that whoever configures the system does so in good faith—leaving permissions open, licenses visible, and history accessible. Nothing prevents someone from configuring a repository with an open appearance but effectively closed permissions: password-protected branches, restricted history, and a fork disabled by configuration. The system does not guarantee openness: it requires the group to audit the architecture of the system itself, not just the content circulating within it. Lessig would say, “It is not enough to have a repository.” You need to understand what the repository permits and what it silently prevents.
8. Practical implication
Facebook, Cambridge Analytica, and the 2016 election: architecture as political decision at scale
In 2018 it came to light that Cambridge Analytica had collected data from approximately 87 million Facebook users without explicit consent, using a quiz application that exploited a gap in the platform’s API (an API is the technical gateway that allows other programs to access Facebook’s data). With this data, the company built psychological profiles and used them to direct personalized political advertising in the 2016 American elections and the Brexit referendum in the United Kingdom.
No law was clearly violated at the time: the gap existed because Facebook’s architecture permitted it. The platform’s code did not prohibit that type of access. There was no specific regulation. The “real law” was what the system allowed—not what the terms of service said in fine print that no one read.
The case forced Facebook to change its API architecture, forced the U.S. Congress to hold hearings that exposed the absence of regulation, and pushed the European Union to accelerate approval of the GDPR (General Data Protection Regulation, a law that treats personal data as something to be protected). Lessig’s lesson applied in real time: when the architecture changes, the possibilities change. Before the change, mass data collection was possible by design. After it, it became impossible by design.
What no law had managed to prohibit, a technical change to the API resolved in weeks.
Let us illustrate with a hypothetical situation. A residents’ cooperative in a neighborhood decides to create a governance system to manage shared space. They write a beautiful charter: open participation, decisions by consensus, and total transparency.
Then they put all decisions in a WhatsApp group.
WhatsApp has closed code. The group administrator can mute, remove, and control who speaks. The history disappears after a certain time. Forking is not possible. There is no auditable trace of decisions.
The charter says one thing. WhatsApp’s architecture says another. Which one actually governs?
Lessig already answered: the architecture. Code is law. If the cooperative wants genuinely open governance, it needs to choose a platform whose architecture is compatible with the values its charter declares.
9. Lessons learned
Code is not neutral: every technical choice favors certain uses and makes others harder. That choice is political, even when it appears technical.
The real constitution of any group is what the system allows it to do, not what the documents say should happen.
Easy fork is legitimate dissent by design. Systems that make a fork difficult concentrate power, even if they say nothing of the sort anywhere.
History transparency is not optional: it is the mechanism that makes accountability possible. Without an auditable trace, there is no review. Without review, the system collapses into informal authority.
License defines the kind of commons you are building. Choosing a closed license and claiming the system is open is an architectural contradiction.
10. Exploring paths and connections
Coming back one step: we came from Benkler (Article 16), who showed how peer production works economically. Benkler explained the “how” of collaboration at scale. Lessig showed the “why” of why architecture matters: because code is law, and law defines what is possible.
But a question emerges that Lessig identified but did not resolve alone: if code defines possibilities, and power lies with whoever writes the code, then power is tied to the structure of the network—not just to the content of a specific repository.
That is where Manuel Castells enters.
Barcelona, 1996. A Catalan sociologist of 44 publishes the first volume of a trilogy he will call The Information Age. The central argument: the basic unit of contemporary society is not the individual, not the family, not the nation. It is the network. And power does not lie with whoever gives orders: it lies with whoever connects.
Lessig showed that code is law within a system. Castells will show that the structure of the entire network defines who has influence, who is included, and who simply does not exist.
Previous articles, the preface, the introduction, and full documentation are available here:
https://codeberg.org/openarchy/gitgov
https://github.com/openarchy/gitgov
All content is fully open source and accessible to everyone. Licensed under CC BY-SA 4.0: read, share, translate, adapt, and improve — as long as you keep attribution and distribute derivatives under the same license.
If you find an error, have an idea, or want to propose an improvement, just open an issue or fork it on Codeberg or GitHub. Contributions are welcome. That’s exactly the point.
11. References
- BENKLER, Yochai. The Wealth of Networks: How Social Production Transforms Markets and Freedom. New Haven: Yale University Press, 2006.
- CADWALLADR, Carole; GRAHAM-HARRISON, Emma. Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach. The Guardian, London, 17 Mar. 2018. Available at: https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election. Accessed: Mar. 2025.
- HAN, Byung-Chul. Infocracy: Digitalization and the Crisis of Democracy. Cambridge: Polity Press, 2022.
- LESSIG, Lawrence. Code and Other Laws of Cyberspace. New York: Basic Books, 1999.
- LESSIG, Lawrence. Code: Version 2.0. New York: Basic Books, 2006.
- LESSIG, Lawrence. Free Culture: How Big Media Uses Technology and the Law to Lock Down Culture and Control Creativity. New York: Penguin Press, 2004.
- LESSIG, Lawrence. Republic, Lost: How Money Corrupts Congress and a Plan to Stop It. New York: Twelve, 2011.
- WU, Tim. The Master Switch: The Rise and Fall of Information Empires. New York: Knopf, 2010.
