Part I - Networks

1 The Regulated End of Internet Law, and the Return to Computer and Information Law?

Christopher T. Marsden *

This chapter is both a retrospective, and also even a requiem, for the ‘unregulation’ argument in Internet law in the past twenty-five years, and a prospective on the next twenty-five years of computer (or cyber) law,¹ in which many of the expert treatises of the 1990s need to be dusted down and reabsorbed.²

The global communications network connected by the Internet Protocol has transformed the consumer/prosumer and small business experience of electronic communication.³ The Internet is not a lawless, special unregulated zone; it never was.⁴ Now that broadband Internet is ubiquitous, mobile, and relatively reliable in urban and suburban areas, it is being regulated as all mass media before it. The major gatekeepers are regulated for the public good and public interest, whether that be access providers through infrastructure sharing, electronic privacy, cybersecurity and network neutrality regulation, or the social media, e-commerce and search giants through various duties of care including those for notice and rapid action – in many cases, requiring takedown of allegedly illegal material in a day or even an hour,⁵ and notification of breach of security and privacy to the customer.⁶ An Internet law expert arriving in a time machine from the mid-1990s would find all this quite shocking.

We have now come full circle from computer law prior to the Internet’s explaining the importance of robotics, cybernetics, and Electronic Data Interchange (EDI) in the 1980s; to an explanation of the Internet’s impact on the law in the 1990s that ranged across the entire syllabus including constitutional law and jurisprudence;⁷ to more specialist examinations of law in such areas as intellectual property and telecommunications in the 2000s; to a realization that the future was delayed not denied and that cyberlaw is vital to understanding regulation of platforms, of artificial intelligence and robotics, of blockchains, of automated vehicles, and of disinformation in our democracies.

The 2020s will finally be the decade of cyberlaw, not as ‘law of the horse’, but as digital natives finally help bring the law syllabus, legal practice, and even legislatures into the Information Society.

In the first part of the chapter, I explain how the cyberlawyers of the 1990s dealt with regulation of the then novel features of the public Internet. Internet law was a subject of much interest in the 1990s in the US, and some specialist interest in UK and Europe.

In Part 2, I explain the foundational rules for the adaptation of liability online initially focused on absolving intermediaries of legal responsibility for end user-posted content. This exceptionalist approach gradually gave way. While some US authors are hamstrung by a faith in the myth of the superuser and somewhat benign intentions of corporations as opposed to federal and state government, there has been a gradual convergence on the role of regulated self-regulation (or co-regulation)⁸ on both sides of the Atlantic.⁹

In Part 3, I argue that the use of co-regulation has been fundamentally embedded since European nations began to enforce these rules, with limited enforcement in which judges and regulators stated that business models largely focused on encouraging illegal posting would not be protected. Settled policy on liability, privacy, trust, encryption, open Internet policies against filtering, were arrived at as a result of expert testimony and exhaustive hearings.

Finally, in Part 4, I argue that hanging those policies on a whim results in potentially catastrophic results in terms of untying the Gordian knots of intermediary safe harbour, privacy, copyright enforcement, and open Internet European regulations.

It is often forgotten that the Werbach’s ‘Digital Tornado’ paper¹⁰ heralded a model of limited state regulation, but very substantial responsible collective self-regulation (‘consensus and running code’) within transnational law.¹¹ When that pact was broken by 4Chan script kiddies and two billion Facebook users, it moved regulation away from the responsible collectivism of the pioneers’ Internet.

There were three views of regulation in 1997: the type of self-regulation I have described; a belief in state regulation by those existing vested interests in broadcast, telecommunications and newspapers; and a third view that state regulation was inevitable as the Internet became ubiquitous but needed to be as reflexive and responsive as could be maintained with human rights responsibilities.

The perspective of today allows us to rethink the apparent triumph of the first view. If 2018 can in retrospect be seen as the year that the ‘Tech Bros’ view of regulation faltered and was replaced (to some extent) by state and supranational intervention, then the third option, of what I describe as co-regulation, appears to be supplanting that self-regulation option.¹² The state intervention was most notable in both scale and scope in European Union law, for data protection, consumer/prosumer protection, and also for competition enforcement.

Part 1: 1990s’ History of Internet Law

The Internet was developed in the 1960s at a group of research institutes in the United States and the United Kingdom.¹³ The Internet is a network of approximately 50,000 autonomous systems, which are interconnected by the Internet Protocol. The Internet became an information network of critical mass in the 1990s with the rise of Bulletin Board Services (BBS),¹⁴ still more so with the growth of commercial Internet service providers (ISPs) in the late 1980s, and eventually a mass market artefact with the development of the World Wide Web (‘WWW’) and release of commercial web browsers in 1993–1994. The Internet developed as a self-regulated academic network,¹⁵ and its emergence as a commercial platform that would rapidly permeate through society was largely unpredicted.¹⁶ Kahin and Nesson explained that the development of the Internet was bottom up and self-regulatory, and explored the emerging tensions as other nation-states began to assert a regulatory role.¹⁷

Internet growth, together with its increasing commercial exploitation, was accompanied by an explosive growth in United States’ scholarship. In 1993, Reidenberg explained that information had become an international commodity, ill served by existing legal frameworks poorly adapted due to their focus on the tangible aspects of information-intensive products and insufficient attention to the intangible aspects of information content.¹⁸ Reidenberg extended the argument that technology can create an environment in the absence of legal rules in his ground-breaking conception of lex informatica. In the absence of ex ante sovereign power and legal rules, technology can symbiotically create de facto commercial regulation in much the same way as the mediaeval lex mercatoria.¹⁹ He extensively spelled out the use of technology as a parallel form of regulation.

Building on Reidenberg’s insights, Johnson and Post made the classic argument for the Internet as a borderless self-regulatory medium that should be permitted to develop with less of the state-imposed restrictions that impeded the growth and development of earlier media.²⁰ The growth of the application of law to its emergence was also unpredictable, although Johnson and Post argued for an ‘exceptionalism’ to permit this globalized unregulated medium to grow unfettered by state censorship, which they saw as both normatively and substantively unjustified. They drew on United States’ constitutional law and history in the argument. They suggest a structured, principled, and internationally acceptable manner for national legislators to respond to the Internet. Lessig, while rejecting excessive state intervention, warned that self-regulation could lead to an Internet controlled by corporate interests.²¹ Lessig argued that state forbearance was rapidly resulting in private regulation by new monopolies, to supplement the existing regulation by technical protocols.

Although cyber-exceptionalism became the dominant viewpoint among scholars, it was not without its opponents. Goldsmith made a legal positivist stand against the Post-Johnson Internet exceptionalism, seeing as both normatively and substantively flawed any ‘claim that cyberspace is so different from other communication media that it will, or should, resist all governmental regulation’.²² He asserted that it can be regulated, including via conflict of laws rules, although this is not a normative position on whether law should utilize its tools to regulate the Internet. In an early trans-Atlanticist article arguing against Internet exceptionalism and reactive national Internet regulation, Mayer-Schönberger and Foster argued that the global information infrastructure limits both absolutists and regulators.²³ The emerging internationalization of the Internet would lead to both jurisdictional conflicts as well as a clash of rights principles, as foreseen by Mayer-Schönberger and Foster. Samuelson argued persuasively that legislators must ensure that the impending rule making for the Internet is proportional in both economic and human rights terms to the needs and demands of users, as well as coordinated internationally.²⁴ Samuelson accepted the rise of the state, the need for sovereign intervention, and the efficiency self-regulation had provided, in arguing for principles for legislating on the Internet.

There have been extensive discussions as to the provenance of a field termed ‘Internet’ or ‘cyber’ law since the mid-1990s. As the law was colonizing the metaphorical “cyberspace” – communications between computer users over the Internet – most of the most authoritative and pioneering legal scholarship with regard to the new medium dates to the 1990s. Several offline subjects have themselves incorporated large literatures from their digital form, including intellectual property, non-networked computer law, telecommunications, privacy, cybercrime, and media content regulation. As the Internet was ‘born global’ but first became widely deployed in the United States, much of the literature has a bias in that direction.

Many argue that the effects of digital information retrieval on the law applies across all areas with some relevance, especially for intellectual property, and that Internet law should be considered part of the law of contracts, competition, the Constitution, and so on, with narrow exceptions for such issues as legal informatics, and telecommunications law, which are being transformed by technology, and therefore cannot remain distinct²⁵. Easterbrook famously argued along these lines that there is no field of ‘Internet law’, any more than there is the ‘law of the horse’.²⁶ Lessig responded that the transformative effects of the Internet on law, in areas including free expression, privacy, and intellectual property, are such that it offers lawyers a radically new route to thinking about private regulation and globalization, the limits of state action, as well as a powerful metaphor for explaining these wider changes to law students.²⁷ Sommer dismissed Lessig’s claims regarding the exceptionalism of cyberlaw, arguing that ‘a lust to define the law of the future’ is dangerous, and can create bad taxonomy and bad legal analysis.²⁸

Academics have constantly argued that the lack of general academic expertise and the emergence of the field mean that Internet law is a necessary short-term distinct study area, which may eventually be reintegrated into its constituent parts, as an inevitable eventual assimilation. Kerr explained two divergent views of Internet law. The first is an internalized expert view of the law, the second a technophobic view. Kerr concluded that two perspectives will converge and evolve, as more people understand the underlying technologies involved, and the useful middle ground.²⁹ In a survey essay into the origins of the Internet law debate, Guadamuz argued that several new fields are emerging from the study of computers and law, including legal informatics, artificial intelligence (AI) and law, and that Internet law can provide new insights into established fields that provide contemporary context for the theoretical study of several subjects, and the profession’s development as a whole.³⁰ Guadamuz argued that the ‘Attack of the Killer Acronym’ was preventing accessibility to Internet law for the wider legal profession, clients (and faculty).

Larouche later argued that the object of information law has mutated, scope for public intervention has been rolled back, implementation of any form of public intervention has been made more difficult, and that information law has seen its main topics expropriated by more traditional topics. The law syllabus is being digitized, literally (e-books, e-syllabi, e-libraries). He predicted the end of Internet law as a subject and the abstraction of information law to move away from a specific technology (except telecoms, media law). As a result, he argued that a ‘future information law’ will be radically amended.³¹ Goldman argued for an Internet law that can be taught using new pedagogical elements employed on a survey-type course, and argued against Easterbrook that the volume of Internet-specific legislation and case law means that common law cannot provide a sufficient grounding for students to understand the transformations wrought by Internet law.³²

Specialization happened to some extent, with e-commerce part of standard contract law, platform dominance in competition law, digital copyright (and patent) law, cybercrime in criminal law, and so on, as Murray described.³³ Some of the more interesting specialist Internet law academic literature from the 1990s (and early 2000s) has also stood the test of time,³⁴ for instance, on network effects,³⁵ cyberlaw, and control by code or lex informatica,³⁶ free and open source software and control of the online environment,³⁷ network neutrality and the regulation of intermediaries by their networked environment,³⁸ and the creation of monopoly gatekeepers resisting yet also predicting the dominance of Google, Amazon, Facebook, Apple, and Microsoft (GAFAM).³⁹ Internet law has been approached as a private and public law, with policy perspectives from law and economics as well as sociolegal studies. The overviews that best introduce the topic to general readers contain contributions that provide both a commercial and a public law perspective. Some important contributions have focused on US law and policy,⁴⁰ and relatively few works provide a trans-Atlantic context.⁴¹

The world has changed less than we think it has in the last generation, and the battle between tyranny and freedom is eternal and geographical.⁴² Both the twenty-first-century Internet and the nineteenth-century telegraph are controlled by the Five Eyes (the Anglo-American powers and their former colonies in Singapore and Oceania). While the reach of international human rights law was severely limited in the nineteenth century, largely a matter of humanitarian aspects of the law of war and the extraterritorial application of domestic anti-slavery laws by the hyper-power Great Britain, we now live in what are claimed to be more enlightened times. The cabling of the planet for the Internet uses much the same undersea telegraph lanes and developments from those technologies. The first Internet link outside North America was to Norway (as part of the North Atlantic Treaty Alliance) in 1973. We have wired Africa and have an interplanetary Internet. Geography matters, and so does territorial sovereignty. Information flows through those cables, and whoever controls the cables controls the information. The tapping of telegraph lines and blocking of encrypted messages was de rigueur in the Victorian era but this policy has been challenged under international human rights law in the twenty-first century.

The likelihood that multistakeholder civil society is able to exercise useful scrutiny and control over hyper-power politicians and their obedient corporate clients or partners may appear remote, and the call for international norms for human rights law quixotic. It could mark what some might call a tectonic shift in governance of communications. Cables may girdle the Earth in only 66.8 light milliseconds, but we continue to observe covert Internet surveillance in the shadowy half-light of governance of the corporations and surveillance agencies that have for so long controlled our information.⁴³

Part 2: A Very Short Internet Liability Legislative History

These foundational rules for the adaptation of liability online focused on absolving faultless (and low fault, the line is shifting) intermediaries of liability for end user-posted content. More than two decades after ACLU v. Reno and the ‘Information Superhighway’ metaphor of Al Gore and Bill Clinton’s first term is as useful a time as any to look back to the future. Settled policies were arrived at as a result of expert testimony and exhaustive hearings, on liability, privacy, trust, encryption, open Internet policies against filtering. Changing those policies now may result in potentially catastrophic untying of the Gordian knots of intermediary safe harbour, privacy, copyright enforcement, and open Internet European regulations.

The legislation that underpins intermediary liability was introduced in an extraordinary ‘dot-com’ boom in the period 1996–1999, frequently dated to start on 12 April 1996, when Yahoo! underwent an initial public offering, shares making 270 per cent profit for investors on a single day. The growth of Yahoo! reflects the heady valuations of Internet stocks in the period with its peak at $118.75 a share on 3 January 2000 crashing to $8.11 on 26 September 2001 – lower than the price of its IPO.⁴⁴ The rise and fall of broader telecoms stocks (the Internet’s infrastructure plumbing) of about forty-two months was documented by Malik as amounting to an excessive valuation of about $750 billion.⁴⁵ A regulatory outcome of the large-scale fraud, accounting irregularity, and generalized lack of regulation in that period is the lack of proper investigation to learn the lessons of that boom and bust beyond the Sarbanes-Oxley Act 2002.⁴⁶ This may have contributed in small part to the failure of regulation, and far greater losses, of the ‘Great Recession’ of 2008–2009 and the ‘Age of Austerity’ that followed.⁴⁷

Two myths need rebutting to understand the ‘self-regulatory settlement’ of Internet law. The first is that the United States settled on self-regulation and a hands-off approach. While this was the spirit of the Digital Tornado paper, it was very much unreflective of the 104th Congress that voted through the Communications Decency Act as part of the Telecommunications Act 1996.⁴⁸ In the US, liability regimes have differed according to speech-based and copyright-based liabilities. Communications Decency Act 1996 s.230 provides that ‘No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.’⁴⁹ This language might shield ISPs from liability for subscriber copyright infringement as well. However, Section 230(e)(2) specifically states: ‘Nothing in this section shall be construed to limit or expand any law pertaining to intellectual property.’ Section 230 established the concept of limited liability.⁵⁰ The Digital Millennium Copyright Act 1998 s.512 laid out detailed rules for copyright infringement and the action required of intermediaries when notice of infringement, as paid out in DMCA, was sent. The introduction on 30 June 1995 of the Internet Freedom and Family Empowerment Act to amend the omnibus Telecommunications Act of 1934, was designed in part to mandate filters against adult pornography in all United States’ households, and the eventual law as amended was voted through 420–4 on 4 August 1995,⁵¹ remaining the federal law until part struck down in the famous ACLU v. Reno Supreme Court case on 26 June 1997.⁵²

This non-filtered Internet regime, which arrived by accident as a result of constitutional convention, has been developed over time, and maintains a significant degree of difference from the gradually less permissive intermediary regime now permitted in the European Union.⁵³ Note that the 105th and 106th Congress were largely obsessed with attempting to impeach President Clinton for perjury, related to a sexual misconduct that was first publicized via that unrestricted Internet that Congress had attempted to control in 1995–7.⁵⁴ Attempts to reform the law in the period 2000 onwards were partially successful in restricting government-funded Internet services in for instance libraries, e.g. Children’s Internet Protection Act 2001,⁵⁵ although statutes such as Child Online Protection Act 1998 were struck down by the Supreme Court.⁵⁶

There is thus a patchy history of US federal legislators attempting to restrict Internet harms and place restrictions on Internet access, struck down by the Supreme Court defending individual liberty against censorship.⁵⁷ In the absence of an active Supreme Court, Europe’s lawmakers have faced fewer restrictions on controlling the Internet, although the liability regime is only modestly different. As Holznagel indicates, US courts have applied ‘safe harbour’ provisions to widely protect Internet service providers (ISPs), even where [a] it was aware of unlawful hosted content; [b] if it had been notified of this by a third party; [c] if it had paid for the data.⁵⁸ According to Yen: ‘[T]he general philosophy motivating these decisions – namely, that the liability against ISPs for subscriber libel would result in undesirable censorship on the Internet – remains vitally important in assessing the desirability of ISP liability.’⁵⁹ Despite multiple recent proposals to amend the limited liability safe harbour of s.230 Communications Decency Act to counter ‘revenge porn’, disinformation and terrorist content, the broad exemption from liability for ISPs has continued into 2020.⁶⁰ Frydman and Rorive see courts as ‘in line with the legislative intent … applied the immunity provision in an extensive manner’.⁶¹

The second myth that needs exposing is that Europe was entirely reactive to the US Internet liability regime. While it is true that European telecoms were only formally liberalized in 1998, moves to regulate liability for online services predate the public Internet. European consumer Internet use roughly dates to 1998, with the opening of the Telecoms Single Market, and broadband to 2000, with the Local Loop Unbundling Regulation. However, a high-level group of experts led by Professor Luc Soete was set up in May 1995 to advise the European Commission on ‘social and societal changes associated with the Information Society’, which set out over one hundred initial policy suggestions in January 1996, including the infamous ‘bit tax’ to prevent e-commerce eroding the local tax base.⁶² Among these suggestions was a recommendation to investigate further ‘appropriate ways in which the benefits of the Information Society can be more equally distributed between those who benefit and those who lose’. Given the upheavals of the ‘zero hours’ precariat economy of the 2010s, and the scandals of Apple, Amazon, Alphabet, Facebook and other multinationals’ failure to pay tax on in-country activities, the bit tax may be returning in 2020.⁶³

In the German Teleservices Act of 1997⁶⁴ and Bavaria v. Felix Somm (Compuserve) case,⁶⁵ Germany showed that it wished to see a similar limited liability regime to that in the US. This led with British support to adoption of the Electronic Commerce Directive of 2000, creating the Digital Single Market in e-commerce. 1999 seems very late in the dot-com boom – but the legislative history of the ECD is directly traceable to 16 April 1997, months before the Teleservices Act was finally ratified. The coordination of US and European lawmaking came in the International Ministerial Conference ‘Global Information Networks: Realizing the Potential’ in Bonn (then the German capital city) on 6–8 July 1997, which addressed ‘international policy-making amongst others for electronic commerce with a view to adopting a Ministerial Declaration’.⁶⁶ As with the US Telecommunications Act 1996, it was an eighteenth-month legislative process.

‘Safe harbour’ protection of ISPs from liability was only implemented on 17 January 2002, when the ECD came into force. Article 12 protects the ISP where it provides ‘mere conduit’ with no knowledge of, or editorial control over, content or receiver (‘does not initiate [or] select the receiver’). Benoit and Frydman establish that it was based on the 1997 German Teleservices Act, albeit with ‘slightly more burden on the ISPs in comparison with the former German statute’.⁶⁷ Where ISPs provide hosting services, under Article 14, they are protected from liability, in two ways:

1. 1. the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity is apparent; or

2. 2. the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disrupt access of the information.

Like the proverbial three blind monkeys, ISPs and web hosting services should ‘hear no evil, see no evil, speak no evil’.⁶⁸ As mere ciphers for content, they are protected; should they engage in any filtering of content, they become liable. Thus masterly inactivity except when prompted by law enforcement is the economically most advantageous policy open to them. Frydman and Rorive state ‘undoubtedly the Directive seeks to stimulate coregulation’. It does this by formally permitting national courts to override the safe harbour in the case of actual or suspected breach, of national law, including copyright law.

Whereas in the US, the absolute speech protection of the First Amendment and procedural concerns mean that Notice and Take Down is counter-balanced by ‘put back’ procedures, in Europe, where no such protection of free speech exists, speech freedom is qualified by state rights. In both jurisdictions, Notice and Take Down regimes cause Frydman and Rorive to state that: ‘[T]his may lead to politically correct or even economically correct unofficial standards that may constitute an informal but quite efficient mechanism for content-based private censorship.’⁶⁹ It is clear that the economic incentive for ISPs is simply to remove any content notified, otherwise do nothing to monitor content, and let end users, the police and courts, and ultimately the ethics of the content providers decide what is stored and sent over their access networks. Frydman and Rorive state that: ‘Business operators should never be entrusted with … guidelines defining the limits of the right to free speech and offering procedural guarantees against censorship … which belong to the very core of the human rights of a democratic people.’⁷⁰ That is nevertheless the situation that ISP Codes of Conduct seek to self-regulate.

Could a stronger case be made to make ISPs responsible for a class of their content, where it serves their commercial benefit? This is an idea that was suggested in the 1990s, before the CDA and ECD supplanted the idea. It has returned in the US with Balkin and Zittrain’s concept of information fiduciaries,⁷¹ adapted to Europe in Perrin and Woods’ recent work on duty of care.⁷²

Vicarious liability tests the ability to benefit and control [i] the right and ability to supervise and [ii] a financial direct interest. This tends to make ISPs choose not to monitor even for law enforcement. The financial direct benefit is interesting in view of the ‘killer application’ for broadband deployment in the 2000s: Did this include peer-to-peer if the access charges received by the ISP is based on traffic i.e. adverts on portal or bandwidth usage? ISPs arguably benefitted from the existence of copyright infringement on the Internet. Thousands of users desired Internet service precisely because it offers free access to copyrighted materials. As Yen argued, an ISP (like the Polygram trade show operator⁷³) could make copyright compliance part of its system rules and then monitor for violations.⁷⁴ The Viacom v. YouTube case in 2010 failed to fully establish the burden in such cases.⁷⁵

Similar controversies have arisen beyond content and intellectual property. The landmark 2000 French criminal case of Yahoo v. LICRA, confirmed that US multinationals must conform to national criminal law on hate speech.⁷⁶ With regard to privacy, in 2000, the Europeans and US published the ‘safe harbour’ agreement. Negotiated from 1998, it was always legal nonsense if sound policy, and was struck down by the European Court of Justice in Schrems in 2015.⁷⁷ Its replacement, the ‘privacy shield’, is equally a sticking plaster over trans-Atlantic differences, and may also be struck down. While this chapter will not describe any of the data protection law developments over the last 25 years, it is noteworthy that the Data Protection Directive⁷⁸ was continually attacked as unsuitable for the Internet that it was not expressly designed to regulate,⁷⁹ so the new General Data Protection Regulation is already subject to much attack for its failure to regulate artificial intelligence and robotics, yet again technologies for which it was not expressly designed … but may be adapted.⁸⁰

Part 3: The Development of Co-Regulation

The early period of frenetic legislative activity in 1997–2001 matched the growth of the Internet sector in Europe, which was very small and not officially measured until 1998, when it grew from 9 per cent to over 42 per cent in 2002 in the United Kingdom, for example.⁸¹ This unprecedented growth of a single electronic medium was driven by broadband, mobile and Wifi-enabled Internet access as well as the growth of social media: seven in ten Europeans were using the Internet by 2010.⁸² By the end of 2017, 86 per cent of European Union citizens used the Internet, with 433 million users, and 252 million users of Facebook within that number and approximately 400 million Google users.⁸³

The European Commission has conducted continuous monitoring of Internet self-regulation throughout the twenty-first century. A 2004 report for the European Commission concluded:

An imperfect self-regulatory solution may be better than no solution at all, and we must not raise our standards so high that self-regulation is never attempted. But there are limits to how much imperfection can be tolerated, and for how long. If self-regulatory codes and institutions are insufficiently transparent and accountable, and if they do not observe accepted standards of due diligence, they will lose the trust of the public and fail. There is a danger that some aspects of internet self-regulation fail to conform to accepted standards. We recommend co-regulatory audit as the best balance of fundamental rights and responsive regulation.⁸⁴

The development of Internet regulation has been scrutinized in real time as it developed. Self-regulation continues, and even in the absence of any new laws we would expect the development of the Internet not to be static.⁸⁵ Legislative impact assessments of Internet law that ask, ‘What happens if we do nothing?’, do not involve stasis. The zero option is that the Internet continues to develop.⁸⁶ Self-regulation is viewed as making standards and practices across industry that the European Commission, or a Member State, views agnostically in legislative terms (or pre-legislative, given the focus on areas that are emerging and which are not yet regulated), but which intends to monitor to analyse the extent to which the self-regulation approaches the standards of ‘representativeness’ that co-regulation is meant to demonstrate as a best practice. The Commission’s insistence that this is not an inevitable journey is backed by its actions in such areas as technical standard setting.

The largest European Internet companies are United States based. Half of the world’s ten largest public companies by capitalization are computer technology, Internet-based advertising, media and e-commerce conglomerates: Google (trading as Alphabet Inc.), Apple, Facebook, Amazon, and Microsoft (GAFAM). Apple is in the global top twenty corporations by revenues, with two Internet access providers in the top thirty (AT&T and Verizon). Large Internet companies have very high profit margins driven in part by their avoidance of high sales taxes, corporate taxes and transfer pricing, as well as merger activity. The European Commission explained that: ‘Google’s search engine has held very high market shares in all EEA countries, exceeding 90% in most. It has done so consistently since at least 2008.’⁸⁷ Regulation by states of the failings of those private actors is in general much slower, with the Google competition breach investigated from November 2010 until a record fine was finally issued in June 2017. The actors that enforce regulation on the Internet are thus young but globally successful multinationals, an unprecedented group of private actors regulating speech and commerce on a communications medium. In 2017, the European Commission found all these companies guilty of anticompetitive conduct:

• Apple in Ireland, and Amazon in Luxembourg, had received illegal state aid of respectively €13 billion and €1.5 billion.

• Google abused its dominance through its search business, EC imposing a €2.4 billion fine.

• Facebook had flagrantly breached the terms of its merger with WhatsApp in 2014, with an EC fine of €110 million imposed in May 2017.

• Previously dominant software and Internet company Microsoft had been found guilty of abusing its dominance three times since 2007; fined a total of €2.2 billion.

This total of fines is a record for any sector, as are the individual instances of fines. To give a sense of the scale of mergers by the companies in that period, they made 436 acquisitions worth a total $131 billion in the decade to June 2017.⁸⁸ These private actors operate with enormous scale and scope, yet they are legally regulated exactly as small commercial websites. The size and scale of their operations make their regulation more difficult than the equivalents in other industries – for instance, the infamous ‘Seven Sisters’ energy companies whose regulation inspired both energy and, to some extent, environmental law.⁸⁹ Such regulation between states and firms has been termed ‘para-diplomacy’,⁹⁰ and it is constantly engaged in by the GAFAM group.

Major platforms (now including Google, Yahoo!, Facebook, Microsoft) and access providers formed a self-regulatory group, the Global Network Initiative (GNI), in 2008 to respond to government demands for better enforcement. GNI members publish transparency reports which can be audited by the board of GNI, an example of self-regulation by a group.⁹¹ Google first published a report in 2010, and reported in 2018 almost 4 billion annual copyright removal requests as compared to 495,000 annual “right to be forgotten” delisting requests and only 16,000 annual government content requests (affecting 221,000 websites), demonstrating that its most substantial enforcement actions are carried out on behalf of copyright owners.⁹² Facebook, Twitter (since 2012), Amazon (since 2015) and others also produce annual transparency reports.⁹³

Co-regulation was noted by United States Congress in 2002 to describe certain aspects of European regulation: ‘government enforcement of private regulations’.⁹⁴ It actually came from Australia.⁹⁵ The European adventure in co-regulation in wider consumer protection legislation, as well as standards setting, was made detailed in 2002,⁹⁶ and became official policy in December 2003, with the Inter-Institutional Agreement on Better Law-Making (IIA), which defines co-regulation.⁹⁷ Although a non-legislative act, the IIA is virtually a constitutional document in European law, and its importance cannot be over-estimated, as it agrees the rules of engagement of the European Parliament, Council of Ministers and Commission.⁹⁸ The Commission confirms that forms of regulation short of state regulation ‘will not be applicable where fundamental rights or important political options are at stake or in situations where the rules must be applied in a uniform fashion in all Member States’.

De jure co-regulation involves legislation that tells the industry ‘regulate or else’. The UK Digital Economy Act 2010 included two specific elements of co-regulation, for the domain name authority (Nominet) and audiovisual media services online (the Authority for Television on Demand). De facto co-regulation exists where the regulators have used their powers of extreme persuasion. It is an area in which the industry players are very aware that the regulator has power. There can be de facto co-regulation taking place alongside de jure co-regulation.

The Commission in 2005 analysed co-regulation in terms of ‘better regulation’.⁹⁹ This was immediately made part of internal EC practice in the Impact Assessment Guidelines,¹⁰⁰ which the Commission must follow before bringing forward a new legislative or policy proposal.¹⁰¹ Price and Verhulst (2005) contained significant focus on AOL and internal self-organization.¹⁰² They identified even then increasing realism in recognizing competition problems, emerging monopolies, and dominance. Verhulst and Latzer provided excellent analysis of the types of co-regulation beginning to develop and their institutional path dependency.¹⁰³ They identify five types of regulation, short of statutory agency-led regulation:

• Co-regulation,

• State-supported self-regulation,

• Collective industry self-regulation,

• Single company self-organization,

• Self-help/restriction by users including rankings to impose restrictions on access to content.

Note the direction of travel: both bottom-up transformations from self- into co-regulatory bodies, and top-down delegation from regulation into co- but not self-regulation. Also note examples of ‘zombie’ self-regulation – where no one will declare the patient dead or switch off the life support machine. I described these as ‘Potemkin’ self-regulators, where there was a website and the appearance of a regulator but few resources, no physical address containing offices and little or no apparent adjudication and enforcement.¹⁰⁴ We should note the gains and losses in the lifecycle of regulation – will self-regulation ossify if it stays true to its principles of self-regulation? If ossification were to result, would it matter other than to self-regulatory purists if a mature self-regulator were then to be made into a co-regulator? UK converged communications regulator Ofcom’s own managerial and regulatory analysis of co- and self-regulation arrives at similar conclusions.¹⁰⁵

The EC has made it pragmatic to fund standards and ex ante support self-regulation in cases where the US would simply ex post regulate via competition law. This leads to substantial US–European differences of approach, which may create ‘transatlantic competition of standardization philosophies … [in] consumer protection systems’.¹⁰⁶ Examples of co-regulation have become frequent in this field in the 2000s, notably in data privacy, domain name governance, content filtering, Internet security, and network neutrality, as well as standard setting and social network privacy regulation.¹⁰⁷ Both soft law and soft enforcement play a vital regulatory role which legal positivists would be in danger of overlooking by a failure to consider the law in its co-regulatory context.

A Beaufort scale of co-regulation was developed for the European Commission based on the Beaufort scale of wind speed (from calm to hurricane).¹⁰⁸ The wind in this case is the degree to which the government was breathing on the forms of self-regulation that were taking place. Zero was a state of calm, which would be an entirely technical standards body whose standards were formed totally within the technical community, such as the Internet Engineering Task Force, up to a state of storm, which could be the forms of co-regulation that were formalized in the Digital Economy Act. Between zero and eleven, there is a lot of room for us to see different elements of influence that have been exerted. That wind is blowing a lot more strongly from European governments and from parliaments towards trying to achieve something much closer to co-regulation than to self-regulation. There are three alternatives:

1. 1. not to regulate, but the world develops without regulation

2. 2. to regulate all the platforms that legislators are concerned about

3. 3. to regulate only the dominant platforms.

It is this regulatory dilemma that I consider in the final part of the chapter.

Part 4: Back to The Future of Cyberlaw in the Ubiquitous Networked Computing Era

Internet lawyers are widening their horizons and returning to the broader notion of being information lawyers whose interests extend beyond a public IP network. The end of the special place for Internet law, and its absorption into media law, has been prematurely announced. It is not only the European institutions that are becoming excited about more Internet regulation, driven in part by self-preservation and the rise of disinformation (‘fake news’ – sic). Reed and others question how we regulate AI¹⁰⁹ and dominance of the ‘surveillance-industrial’ state in these post-Snowden/Schrems/GDPR times, pushing digital law into even constitutional studies.¹¹⁰ These are exciting times to be an information lawyer.

To put a damp squib on too much recurrent techno-optimism or cynicism, I argue that most arguments for regulating the Internet and cyber-technologies today remain old wine in new bottles.¹¹¹ The United Kingdom regulator Ofcom has called for more regulation, and potentially a new regulator, of the Internet.¹¹² Most developed legal systems have lots of legal regulators of information, even if none of those is entirely shiny, new, and ‘cyber’. There is the UK Information Commissioner, Electoral Commission, Ofcom itself, the Advertising Standards Authority, and others. There are technical support institutions such as National Cyber Security Centre,¹¹³ and a variety of non-governmental organizations such as the Nuffield Foundation-supported Ada Lovelace Foundation, the Turing Institute, and venerable Foundation for Information Policy Research.¹¹⁴ In constructing what I call ‘OffData’, a regulator of electronic communications and content,¹¹⁵ we need to learn the lessons of previous regulatory mergers both inside (OfCom) and outside (OfGem) communications. We need to recall what is known about sectoral regulation. UK Ofcom was set up almost twenty years ago as a result of technological convergence between broadcasting and telephony,¹¹⁶ but deliberately constructed not to regulate Internet content. It is now required to so do. This is not a moment for unique solution peddling or an ahistorical view of the need to extend competences beyond a privacy, a security, a sectoral competition, and a communications regulator.

While information law is maturing, and the old Internet law/cyberlaw nomenclature may be fading, what we do as lawyers dealing with computers and their impact on society is growing more important. Some of the new ideas about regulating the Internet and artificial intelligence (AI) betray a naive faith in technology companies’ intentions towards law enforcement. It is now the job of grizzled, veteran information lawyers to help policy makers understand how to make better laws for cyberspace.¹¹⁷ Hildebrandt explains the scale and scope that can create disinformation problems in social media platforms:

Due to their distributed, networked, and data-driven architecture, platforms enable the construction of invasive, over-complete, statistically inferred, profiles of individuals (exposure), the spreading of fake content and fake accounts, the intervention of botfarms and malware as well as persistent AB testing, targeted advertising, and automated, targeted recycling of fake content (manipulation).¹¹⁸

Some of the claims that AI can ‘solve’ the problem of disinformation (‘fake news’) do just that. Limiting the automated execution of decisions (e.g. account suspension) on AI-discovered problems is essential in ensuring human agency and natural justice: the right to appeal. That does not prevent Internet platform operators’ suspension of ‘bot’ accounts at scale, but ensures the correct auditing of the system processes deployed.¹¹⁹

Technological solutions to detect and remove illegal/undesirable content have become more effective, but they also raise questions about who is ‘judge’ in determining what is legal/illegal, desirable/undesirable in society. Underlying AI use is a difficult choice between different elements of law and technology, public and private solutions, with trade-offs between judicial decision making, scalability, and impact on users’ freedom of expression. Public and private actors have suggested that AI could play a larger role in future identification of problematic content – but these systems have their own prejudices and biases. It is worth restating that neither law nor technology is neutral: they both embody the values and priorities of those who have designed them (‘garbage in, garbage out’).

Does the use of AI that employs algorithmic processes to identify ‘undesirable’ content and nudge it out of consumers’ view, provide a means for effective self-regulation by platforms? The UK Parliament Artificial Intelligence Committee reported on some of these issues in 2017.¹²⁰ There are an enormous number of false positives in taking material down. It is very difficult for AI to tell the difference between a picture of fried chicken and a Labradoodle, simply because of the nature of the attempts by algorithms to match these things.¹²¹ It will need human intervention to analyse these false positives. AI can be deployed, but Google and Facebook are employing 50,000 more people because they recognize that there will have to be a mixture in order to achieve any kind of aim.¹²² Artificial intelligence and algorithms cannot be the only way to regulate content in future.¹²³

‘Mechanical Turks’ are people employed – subcontracted, typically – to carry out these activities,¹²⁴ in parts of the world where their own cultural understanding of the content they are dealing with may not be ideal.¹²⁵ One of the problems is that they are responding to a perceived need to remove more content, rather than addressing fair process and due process. Subcontracting to people on very low wages in locations other than Europe is a great deal cheaper than employing a lawyer to work out whether there should be an appeal to put content back online. The incentive structure will be for platforms to demonstrate how much content they have removed.

Transparency and explanation are necessary, but remain a small first step towards greater co-regulation.¹²⁶ Veale et al. have explained how to move beyond transparency and explicability to replicability: to be able to run the result and produce the answer that matches the answer they have.¹²⁷ The greater the transparency, the greater the amount of information you give to those users who do not read the terms of service online: the degree to which that helps is limited. Prosumers are told: ‘If you do not agree to the effectively unilateral terms of service you may no longer use Facebook.’ A better approach would be the ability to replicate the result achieved by the company producing the algorithm. Algorithms change all the time, and the algorithm for Google search, for instance, is changed constantly. There are good reasons to keep that as a trade secret. Replicability would be the ability to look at the algorithm in use at the time and, as an audit function, run it back through the data to produce the same result. It is used in medical trials as a basic principle of scientific inquiry. It would help to have more faith in what is otherwise a black box that prosumers and regulators have to trust. The European Commission has used the overarching phrase ‘a fair deal for consumers’.¹²⁸

Platform regulation is a new version of an existing regulated problem, with potentially dramatic negative effects on democracy and media pluralism.¹²⁹ In tackling disinformation (and other undesirable uses of online communication, as the history of electoral and defamation reform shows), not only the effectiveness of the technological measures needs to be considered, but also raising awareness of the individual and social responsibility for the provision and appreciation of verifiable truthful content, by independent platforms rather than a single central authority. Media pluralism and literacy go hand in hand with any technological intervention.

I predict that 2020 will see the implementation of hard law requiring ‘notice and action’ within one hour of complaints about illegal content online.¹³⁰ The vigorous action on social network regulation has not happened, in spite of urging from national and European politicians in view of terrorist content, sexual abuse, fake news, and the other vile elements of human society manifested on the Internet. European regulators continue to rely more on corporate social (ir)responsibility than hard law. The European Commission record fine for Google is being appealed, but it will have to accept some kind of co-regulation of its vertically integrated advertising in time.

I explained in the Introduction to this chapter that Werbach’s Digital Tornado, along with Reidenberg’s conception of lex informatica, heralded a model of limited state but very substantial responsible collective self-regulation. Hard law, in the shape of the proposed European Digital Services Act to be introduced in 2020, will continue in the 2020s to be accompanied by Codes of Conduct and other self- or co-regulatory measures. At the time of writing, the world was plunging into a deep economic and social depression due to the pandemic, with broadband connectivity and Internet platforms ever more vital. Even as legislatures introduce hard law to combat their particular favourite online harm, continued emphasis will focus on giant platforms’ self-regulatory practices. Cyberlaw has become mainstream in the most dramatic manner imaginable.

2 Networks, Standards, and Network-and-Standard-Based Governance

Julie E. Cohen ^*

The Net interprets censorship as damage and routes around it.

—John Gilmore, Interview, Time Magazine

Introduction

This chapter, adapted from a forthcoming book on the evolution of legal institutions in the networked information society, situates the disruptive effects of networked digital technologies within a longer process of institutional change catalyzed by the gradual emergence of an informationalized global political economy. Over the last half century, institutions for transnational economic governance have multiplied. The landscape of world trade agreements and enforcement processes has grown increasingly complex. New structures for transnational regulation of economic activity have emerged that seem to operate according to their own rules in ways influenced by states but not controlled by them. Other new institutions, created to govern the Internet and its constituent protocols and processes, do not operate based on state representation at all. This chapter juxtaposes the various governance processes and treats them explicitly as iterations of a new – or, more precisely, emergent – networked legal-institutional form.¹ It also considers the relationship(s) between that institutional form and new platform entities that wield enormous de facto power – though not (yet) formally acknowledged sovereign authority – based on their control of infrastructures and protocols for networked, social communication.

Although networked governance institutions differ from one another in many ways, they share a common structure: They are organized as networks constituted around standards. Each of the scholarly literatures that has grown up around the various institutions described in this chapter has grasped some essential aspects of the network-and-standard dynamic but not that of others. Legal scholars who study transnational business regulation have interrogated the political legitimacy of networked governance processes, and they also have explored the political issues surrounding the development of international technical standards. Even so, they have paid less attention to the ways that standards bind networks together, and so the two conversations do not fully join up.²

Legal scholars who study “code as law” have explored how technical standards structure the markets organized around them, and they also have raised persistent, serious concerns about the relationships between and among automated enforcement, lock-step conformity, and authoritarian modes of governance. They have tended, however, to situate standards processes within market-based governance frameworks and to understand code’s mandatory nature as illustrating how code differs from law. Consequently, they have not taken network-and-standard-based governance seriously as a new legal-institutional type.³ And, for the most part, the different scholarly communities have not engaged in much dialogue with one another.

To posit networked governance institutions as an emergent category of legal institutions is, of course, to beg some basic questions about what makes an institution distinctively legal. One traditional set of answers has to do with the ways that the outcomes produced by such institutions are linked to rulemaking and enforcement authority. Another traditional set of answers is more explicitly normative: what makes an institution distinctively legal is its adherence to regular procedural rules and associated rule-of-law values. Communities are accountable only to themselves and markets may mete out consequences that seem arbitrary. According to a thick conception of what makes a legal institution, law’s authoritarian bite is (or should be) mitigated by procedural fairness and conformance with principles of public reason.⁴

As we are about to see, network-and-standard-based governance institutions satisfy each of these definitions in some respects while challenging them in others. For some, that means they are not law at all, but I think that answer is too pat. The shift to a networked and standard-based governance structure poses important challenges both to the realizability of rule-of-law values and to traditional conceptions of the institutional forms that those values require, but the rule-of-law constructs that legal theorists traditionally have articulated are themselves artefactual – outgrowths of the era of text-based communication and of accompanying assumptions about the feasible mechanisms for formulation, justification, and transmission of claims of authority that are now rapidly being outpaced by sociotechnical change.⁵ If the new governance institutions are to serve the overarching values that traditionally have informed thicker versions of rule-of-law thinking, both institutions and constructs will need to adapt. Here, I lay some groundwork for that project.

The first part of the chapter provides an overview of the rich and varied assortment of transnational, networked governance arrangements. The next part identifies five important features of the network-and-standard-based legal-institutional form that challenge traditional understandings of how legal institutions – institutions constrained by the rule of law – ought to operate. The final part of the chapter provides a brief introduction to information platforms and the functions they perform and considers whether platforms are best understood as stakeholders or as emergent information-era sovereigns.

Networks and Standards in Transnational Governance

The processes of world trade regulation, transnational business regulation, and Internet governance span many different subject areas and involve many different participants and interests. The institutions through which those forms of regulation are conducted also vary considerably from one another in terms of their rules for membership and participation. Some assign membership and participation rights to nation states while others operate differently, and some are more highly formalized than others. Even so, juxtaposing the various institutions and processes also reveals equally important ways in which they resemble one another: They are organized as networks, the networks are constituted around standards designed to facilitate and structure flows of economic and communicative activity, and the formulation and administration of those standards reflect the increasing influence of private economic power.

The global logics of production and extraction that have become characteristic of informational capitalism rely heavily on governance arrangements for facilitating crossborder flows of trade. Norms of liberalization do not simply relate to manufactured goods or even to crossborder flows of raw materials and intermediate inputs to more complex products. Following the important Uruguay Round of negotiations, which produced the World Trade Organization (WTO), the General Agreement on Trade in Services (GATS) and the protocol on Trade-Related Aspects of Intellectual Property Rights (TRIPS), liberalization imperatives relating to services, information, and intellectual goods have emerged as separate, powerful logics driving the articulation and expansion of trade obligations.⁶ The Uruguay Round also produced two important agreements on international technical standardization that have generated increasing momentum toward scientific (and quasi-scientific) rationalization of liberalization rules.⁷

For many decades, the multilateral regime organized around the framework established under the General Agreement on Tariffs and Trade was the principal source of trade liberalization standards, but a series of rapid and pronounced shifts in the institutional structure of world trade governance began to occur in the mid-1990s. As noted earlier, the Uruguay Round produced several new multilateral instruments and a powerful new enforcement body, the WTO, which began operations in 1995. Following the Uruguay Round, however, the process of reaching new agreements under the established multilateral framework has ground to a halt, and trade negotiators have shifted their efforts toward framing and securing new bilateral free trade agreements. The thickening network of bilateral agreements has in turn shaped proposals for new multilateral and regional instruments.⁸ Although the initial impetus for the turn toward bilateral and multilateral agreements negotiated outside the WTO framework came from the United States and other developed economies, the so-called Washington Consensus on trade liberalization has begun to fragment and other significant initiatives have emerged. For example, the Regional Coalition for Economic Participation (RCEP) has launched an effort to negotiate a new, pan-Asian trade protocol.

In parallel with the changes in institutional structure, the landscape of world trade governance and world trade activism also has broadened to include a more heterogeneous assortment of actors and interests. In particular, transnational corporations and business associations wield increasing de facto power in setting trade policy priorities. In part, that power flows through traditional channels of influence; powerful economic actors have long enjoyed privileged access to national policymakers and have learned to exploit that access to demand stronger and more effective protection for their global supply chains.⁹ But global logics of production and extraction also translate into new networked models of influence that flow outside state-sanctioned channels, and assertions of corporate interest also have prompted experimentation with new forms of dispute resolution that allow corporations to assert claims directly against states.¹⁰ Meanwhile, exploiting the same networked connectivity that has facilitated global concentrations of economic power, civil society groups have worked to challenge asserted failures of transparency and accountability, building alliances with one another and coordinating their efforts for maximum effect.¹¹

The landscape of transnational economic governance also includes a large and varied group of regulatory arrangements, some well-established and others more emergent, that extend through and around the boundaries of nation states. Some arrangements originate with the United Nations (UN) or its member agencies. Others are cooperative ventures among national regulators or among other entities that play well-established quasi-regulatory roles. For example, financial regulators and central bankers engage in extensive, cooperative crossborder governance of financial market activities, and data protection regulators work collaboratively on various policy issues.¹² Other regulatory arrangements involve UN officials or national regulators in collaboration with private industry oversight bodies and trade associations.

As in the case of world trade, pervasive and crosscutting themes in both the theory and the practice of transnational regulation are the increasing importance of standard-setting activities and the growing power of private “stakeholders.”¹³ The universe of standard-making activities is large and diverse and comprises a thickening network of “soft law” that structures and coordinates economic conduct. Many of the UN’s standard-making initiatives are structured as public–private collaborations.¹⁴ Additionally, in 1996, the UN adopted a consultative process intended to give civil society organizations and other nongovernmental organizations (NGOs) a formal avenue for providing input into its policymaking processes. Business NGOs have been especially active users of that process.¹⁵ Transnational corporations engage in standard making to facilitate their own operations and those of their global supply chains, and industry associations may work to coordinate those activities.¹⁶ In the domain of financial governance, private transnational associations spanning fields from securities to insurance to accounting perform a wide variety of governance functions.¹⁷

Also notably, the outputs of both private and public–private standard-making processes have begun to migrate into the domain of world trade. In particular, new bilateral and multilateral trade agreements covering labor, environmental regulation, and corporate social responsibility often refer to such standards.¹⁸ As a result, standard-making activities constitute a new and fruitful avenue for private economic actors wanting to shape the formulation of trade provisions intended to delineate the appropriate reach of domestic protective mandates.

A final important site of transnational legal-institutional entrepreneurship is the Internet and its constituent protocols and processes. The most prominent governance arrangements for the Internet are formally non-state-based and multistakeholder-oriented. The Internet Engineering Task Force (IETF), a voluntary membership organization of computer technologists, oversees the continuing evolution of the Internet’s foundational standards for information transmission, and the Internet Corporation for Assigned Names and Numbers (ICANN), a not-for-profit transnational governance corporation chartered under California law, oversees governance of the domain name system. An assortment of other organizations – some formally multilateral and some private – also play important roles, however. For example, the International Telecommunications Union, a UN-affiliated body, superintends standards for wireless telephony, and the Institute of Electrical and Electronic Engineers, a technical professional organization, coordinates the evolution of standards for wireless interconnection. The databases that map human-readable domain names to network addresses are maintained by a small group of entities – including universities, research consortia, government entities, and a few private corporations – pursuant to contracts with the Internet Assigned Numbers Authority, an entity for many years overseen by the US Department of Commerce and now administered by an affiliate of ICANN.¹⁹

Technical standard making is front and center in Internet governance, but Internet governance arrangements also play more substantive and comprehensive roles in the governance of global networked communications, and do so via increasingly elaborate institutional structures.²⁰ Under pressure from a diverse mix of global stakeholders, ICANN has developed regularized pathways for participation, including formal consultative procedures for national governments and civil society organizations.²¹ At its inception, the IETF was a self-selected community of volunteers that rejected “kings, presidents, and voting” in favor of “rough consensus and running code.”²² Today, although membership remains voluntary and policy-making consensus-based, it comprises two principal divisions made up of over one hundred working groups, overseen by two steering groups and advised by two different boards. Working groups follow elaborate protocols for documenting their activities, communicating with other groups, and reporting to the steering groups and advisory boards. There is a process (so far, never used) for administrative appeals. At the same time, as in the cases of trade and transnational economic regulation, private economic power also plays a highly visible role in Internet governance. Private technology firms are well-represented in myriad working groups and steering committees, and as the Internet’s constitutive liberalization norms have been filtered through the lens of multistakeholder-based institutional design, they have produced institutional responses optimized to the needs of the most active and well-resourced stakeholders.²³

Networks, Standards, and the Rule of Law: Five Problematics

A network is a mode of organization in which hubs and nodes structure the flows of transactions and interactions. Some commentators have characterized structures for networked participation and governance as radically democratizing, while others have worried that the absence of definite chains of command undermines democratic accountability.²⁴ Important recent books about power and global political economy by David Singh Grewal and Manuel Castells explore the importance of networked organization for political economy generally, articulating new theoretical models of networked social, political, and communication power.²⁵ Network-and-standard-based governance arrangements, however, are not simply networks; they are also institutions.²⁶ This section seeks to identify with greater precision the various points of mismatch between the rule-of-law tradition in legal theory and the operation of the network-and-standard-based legal-institutional form. It begins by reconsidering two points of conventional wisdom about network organization and its relationship to legal power.

First, the assertion that network organization is inherently more democratic than other forms of organization because it facilitates the expression and circulation of dissenting views is open to serious question. It is true that, because network organization is nonhierarchical, even an enormously powerful hub cannot prevent information from flowing around it through other nodes.²⁷ Within networked governance arrangements, however, the ability to navigate interruptions works most reliably to the benefit of the powerful. The same networked affordances that enable the dissident to evade the censor also enable economically or politically dominant parties to circumvent inconvenient negotiating stalemates and avoid inconvenient but localized regulatory burdens. Within networked governance arrangements, power interprets regulatory resistance as damage and routes around it.

Second, the observation that network organization is nonhierarchical can be somewhat misleading. From an internal perspective, network organization around a standard imposes a form of hierarchical ordering that inheres in the standard itself. If other networks organized around other standards are available that may not matter much. But a standard invested with legal significance is not just a standard because participants lack the authority to depart from it. So too with a standard, such as the basic Internet protocol, that exacts universal adherence as a practical matter. Network organization under conditions of legally or practically mandated standardization may be quite exacting as to the forms of compliance, and it also may afford new opportunities for the exercise of economic and political power. From the perspective of traditional legal theory, this point is easy to miss because legal theory traditionally has drawn a distinction between rules and standards that drives in the opposite direction. Within that scholarly tradition, “rules” are granular and demand precise compliance, while “standards” are more flexible and are fleshed out via norms and interpretative conventions.²⁸ Network organization under conditions of legally or practically mandated standardization is a different creature entirely.

The powerful critiques of transnational governance arrangements that have emerged within legal scholarship still have not fully assimilated the hybridity of the network-and-standard-based legal-institutional form. Both the ability of power to route around inconvenient regulatory resistance and the relocation of authority into the standard strain traditional accounts of law, reliably eliciting institutional features that seem very different from those that a system of the rule of law would require. The same developments also strain conventional understandings of standards and standardization, reliably foreclosing the kinds of pathway that facilitate competition, correction, and stabilization in the contexts where standards are more usually studied. It has become vitally important to understand the ways that the intersecting vectors of governance, law, and standardization are transforming one another. This section identifies five important directions for inquiry, which relate to the nature of standard-making authority, the available pathways for contesting and changing the reigning standard, the available pathways for coopting governance mechanisms to advance authoritarian political and geopolitical interests, the mechanisms for political accountability, and the vernaculars in which mandatory standards are articulated, applied, and contested.

Dominance as Hegemony: The Problem of Unchecked Authority

One distinctive characteristic of emergent global networked legal-institutional arrangements is the way that network-and-standard-based organization reshapes the exercise of lawmaking authority. Within such arrangements, a dominant party’s ability to shape policy is both more absolute than it typically is within more traditional legal settings and more immediate than it typically is in technology standards markets. When instituted against a background of vastly unequal geopolitical power, network organization under conditions of mandated standardization has resulted in policy hegemony relatively unchecked by political or structural constraints.

In democratic societies with rule-of-law traditions, legal institutions are recognizable as such in part because of their adherence to regular, reasoned processes for making policy and for contesting policy choices. This is not to suggest that such processes always work perfectly or even well. But certain high-level constraints on institutional behavior – in particular, principles of separation of powers and procedural due process and commitments to giving reasons for official actions – also have been widely acknowledged in democratic societies.

Dominance in technology standards markets confronts different kinds of limit. Although networks do exhibit lock-in effects, various forms of competition remain possible (we will consider those forms more closely in the next section).²⁹ Additionally, in paradigmatic, discrete technology standards markets, the connection between market dominance and policy dominance tends to be indirect. The standards governing such matters as the layout of a typewriter keyboard or the arrangement of prongs on an appliance plug are thoroughly agnostic as to their users’ political beliefs and policy commitments. Many contemporary disagreements over technology policy arise precisely because the emergence of networked information and communications technologies has set protocol and policy on converging paths.

Network-and-standard-based legal-institutional arrangements connect protocol and policy directly to one another and eliminate separation between them. Within such arrangements, the point of mandated standardization is exactly to specify the kinds of flow that must, may, and may not travel via the network. The policy is the standard and vice versa, and that equivalence sets up the two interlocking dynamics that produce policy hegemony. On one hand, a dominant network enjoys network power – which David Grewal defines as the self-reinforcing power of a dominant network and Manuel Castells explains as a power that is “exercised not by exclusion from the networks, but by the imposition of the rules of inclusion” – simply by virtue of its dominance.³⁰ On the other, if a particular hub within a dominant network exercises disproportionate control over the content of the standard, then networked organization will amplify that hub’s authority to set policy and legally mandated standardization will amplify it still further.

Developments in the domains of world trade governance and transnational business regulation over the second half of the twentieth century mapped straightforwardly to this lock-in-based theoretical model (we will consider some more recent anomalies in the next section), enabling the consolidation of US policy hegemony across a wide and varied set of domains.³¹ The case of Internet governance is more complicated. US observers, in particular, tend to think that Internet governance processes have avoided the worst excesses of US policy hegemony precisely because of their sui generis, multistakeholder design. As noted earlier, however, private technology companies, including especially the dominant US technology firms, wield considerable influence within Internet governance processes, and the turn to multistakeholderism reflects a long-standing and largely bipartisan preference in the United States for a strong private-sector role in Internet governance.³² It is unsurprising, then, that the responses of marquee institutions such as ICANN and the IETF to the policy problems that have repeatedly bedeviled them – from privacy and surveillance to content regulation and censorship to intellectual property enforcement to network security – have tended to reflect the particular norms of flow enshrined in US information law and policy.

Legal Standards Wars: The Problem of Regulatory Arbitrage

A second striking characteristic of emerging global network-and-standard-based legal-institutional arrangements relates to the mechanisms available for changing a governing standard. On one hand, mandated standardization intensifies lock-in to the current standard by foreclosing many of the pathways for change that ordinarily would exist. On the other, it incentivizes efforts at regulatory disintermediation by those favoring a different or modified standard, and those efforts may gain purchase to the extent that the network remains accessible via new points of interconnection.

It is useful to begin by considering the mechanisms through which standards can change over time in market settings. Carl Shapiro and Hal Varian distinguish between evolution and revolution, with the former consisting of gradual change while maintaining backward compatibility with the original standard and the latter involving a sharp, disjunctive break between new and old standards.³³ Such changes may be implemented cooperatively, or two (or more) parties may seek conflicting changes, as in the case of the Blu Ray and HD DVD standards for digital video storage and playback, which maintained backward compatibility with the regular DVD format but were incompatible with one another. If the parties cannot agree on which course is best, a standards war may ensue.

In struggles to shape the future of a legally mandated standard, the mandatory structure of networked legal-institutional arrangements narrows the universe of possible outcomes. Gradual evolution is most feasible when it moves in directions that are compatible with the dominant standard’s underlying policy commitments. In theory, gradual retrenchment from the hegemonic norm is also possible; in practice, however, one cannot fall below the threshold level of compliance that the standard requires unless there is cooperative agreement to extend forgiveness.

Revolution against a background of mandated standardization is more difficult still. Absent cooperative agreement to depart from the dominant standard, revolutionary change – or, in the language of technologists, forking the standard – requires not only confidence in one’s installed base but also willingness to court diplomatic or even geopolitical instability. In the domain of world trade, disjunctive changes without backward compatibility risk starting trade wars; in the various domains of transnational business regulation, departure or threatened departure from agreed conventions can roil markets and create diplomatic incidents. Internet governance institutions have powerful norms against forking network standards. When such proposals have originated – generally from states that are geopolitical outsiders – they have commanded little support and have been unable to generate momentum.³⁴ A systemic shock can create impetus for a mutually agreed disjunctive break; so, for example, the 2008 financial crisis generated the momentum required to tighten standards for measuring bank capital adequacy.³⁵ Absent such a shock, however, revolutionary change is unlikely.

Standards wars can be horizontal or vertical, however, and this means that even dominant standards are characterized by their potential amenability to disintermediation by a rival standard that sits closer to the relevant activity. So, for example, although Microsoft’s Windows operating system still dominates the personal computing market, it is no longer the most important interface for those wishing to market applications to personal computer users. Web browsers provide an alternative interface for many applications, as do social networks and mobile operating systems. More recently still, the “Internet of things” and the emergent market for smart home assistants have opened new channels for companies seeking to become the intermediary of choice for as many online interactions as possible.

Networked governance arrangements organized around legally mandated standardization are similarly vulnerable to disintermediation by adjacent governance arrangements. So, for example, when developing nations began to balk at additional extensions to the TRIPS agreement that they saw as benefiting developed economies, US trade negotiators simply routed around the WTO, negotiating new bilateral and multilateral agreements incorporating the stronger provisions they wanted to see enshrined as new network standards. Developing nations fought back, gradually organizing around a proposed “development agenda” for the World Intellectual Property Organization (WIPO), a constituent body of the United Nations. The WIPO Development Agenda thereby briefly became an entry in an intellectual property standards war. Developing nations’ effort at “regime shifting” enjoyed only temporary success, however, because developed countries returned to WIPO in force and asserted their own interests.³⁶ Meanwhile, the copyright industries of the Global North have appropriated regime-shifting tactics to their own ends, working to introduce interdiction mandates directly into arrangements for Internet governance.³⁷

As a different example, consider evolving arrangements for governance of crossborder transfers of personal information. The European Union has worked to export its high standards for personal data protection to the rest of the world, whereas parties seeking greater liberalization – including especially dominant global platform firms headquartered in the US – have shifted their emphasis toward inserting strengthened mandates for crossborder flow into bilateral and multilateral trade agreements, including especially agreements involving the Asian nations that are increasingly significant players in the emerging crossborder data servicing economy.³⁸ Privacy NGOs have worked to thwart trade workarounds for data protection obligations, but that project has become more difficult as the center of gravity has shifted into trade governance, which had not traditionally been a focus of transnational privacy activism, and toward Asia, where civil society organizations focused on privacy and data protection have not traditionally had a significant presence. And here again, Internet governance has emerged as an important focus of regime shifting efforts; for example, even European data protection authorities have largely acquiesced in ICANN’s continuing failure to require adequate privacy protections for WHOIS registry data.³⁹ Each of these developments destabilizes settled expectations about where authority to regulate crossborder transfers of personal data resides and about what the reigning standard requires.

In theory, at least, a system of the rule of law is not supposed to work this way. An important principle associated with the ideal of the rule of law is that legal rules should be applied consistently, and the ideal of consistency in turn implies a degree of constancy. In fact, those ideals have been under siege since the complex legal ecologies of the late twentieth century began to offer a wider and more complex array of possibilities for regulatory arbitrage than those within which the rule-of-law ideal was first articulated. Even so, in domestic settings each strategy confronts built-in limits. At the end of the day, there is an institutional actor with the power to exercise jurisdiction over the challenged conduct, to superintend a reasoned but finite process of contestation, and to say what the law is. Relative to that benchmark, the new networked governance arrangements manifest both frustrating path dependence and a destabilizing failure of finality.

Network Power and Moral Hazard: The Problem of the Authoritarian End Run

A third distinctive attribute of global network-and-standard-based governance arrangements is a particular kind of moral hazard that concerns the relative importance of economic and political liberalization. As economic liberalization has become the primary driver of innovation in transnational legal ordering, and the overriding importance often ascribed to facilitating flows of crossborder economic activity sets up the conditions for a dynamic that I will call the authoritarian end run. In brief, an authoritarian regime wishing to stint its liberalization obligations in the interest of maintaining its political control often may do so with impunity because of the dominant network’s interest in maintaining and consolidating its economic dominance.

Recall that network power operates by harnessing and disciplining the desire for inclusion. That mechanism presents tradeoffs for the policy hegemon – the party that enjoys dominant hub status – as well as for other network participants. Simply put, there are downsides to sanctioning or expelling members for standards violations, and those downsides may lead both the policy hegemon and other network participants to overlook certain types of infraction – especially those that can plausibly be characterized as purely domestic in scope – to preserve flows of goods, services, and information across borders and within corporate supply chains. So, for example, developed nations historically have been willing to minimize the importance of certain labor practices in developing countries, to overlook local restrictions on religious and press freedoms, and to excuse certain endemic forms of gender discrimination.⁴⁰

To the extent that the authoritarian end run entails subverting the dominant standard for purposes dictated by conflicting political goals, it is broadly consistent with the dynamic of the legal standards war described in the previous section, but it is also different. In the short term, it is not an exit strategy but rather a shirking strategy available to entities lacking the power or the motivation to provoke a standards war. In the longer term, it is a strategy for alternative network making around standards that blend elements of economic liberalization with elements of mercantilist central planning and political control. Above all else, authoritarian states seek to control unwanted flows of information within and across their borders.

In principle, any state with sufficient economic and geopolitical power can wield what Manuel Castells calls network-making power – or the power to constitute its own network by establishing alternative conditions of interconnection.⁴¹ In the contemporary geopolitical landscape, the principal author of the authoritarian end run is China. Chinese trade policy and information technology policy have emerged as powerful and mutually reinforcing components of a larger strategy for pursuing dominance of standards for global economic and technical exchange. The Chinese program for physical infrastructure development, now known in English as the Belt and Road initiative, seeks to facilitate flows of labor, goods, and raw materials across continents and oceans under conditions that advance Chinese economic interests.⁴² The Chinese information technology sector has grown rapidly and now includes two firms that rank among the world’s twenty largest: search and social networking firm Tencent and e-commerce giant Alibaba.⁴³

As the Chinese information technology sector has matured and turned toward new markets, affordances for both economic development and state control of communications infrastructure play key roles. Tencent, Alibaba, and other Chinese platform companies have begun to make inroads in developing markets across Asia, Africa, and the Middle East, and Chinese hardware manufactures like Huawei and Xiaomi sell equipment ranging from backbone servers to mobile phones across the developing world. In terms of development, capabilities for mobile payment, banking, and credit have driven rapid penetration within populations hungry for modernization.⁴⁴ For client states inclined to control information flows to their own populations, meanwhile, Chinese firms’ relative willingness to work with host governments to implement filtering and surveillance in their own markets is a selling point.⁴⁵ The combined result of these technology policy initiatives is “a geopolitical enclave in which computational architectures and informational actors are coming together into what could be deservedly termed the Red Stack” – a networked communications infrastructure offering the ability to layer separation and control on top of the underlying connectivity afforded by the basic Internet protocols.⁴⁶

The authoritarian end run has an ambivalent relationship to the rule of law. On one hand, both Chinese trade policy and Chinese technology policy emphasize centralized control by state institutions. One byproduct of China’s accession to membership in the WTO and its movement toward greater economic liberalization has been modernization of domestic courts and other formal governance institutions along the lines that the WTO’s obligations require. To the extent that concerns about the rule of law in the era of networked governance hinge on the disintegration of sovereign authority, one might argue that some components of the Chinese strategy address those concerns. On the other, the rule-of-law construct that Chinese global governance initiatives enshrine is thin, emphasizing regularity and predictability over transparency and contestability – features that Chinese Internet policy, in particular, works to eliminate.

Extreme Multistakeholderism: The Problem of Public Accountability

A fourth striking characteristic shared by the processes described in this chapter is their unusual mechanisms for political accountability. Emergent networked governance arrangements are strikingly inhospitable to traditional mechanisms for instilling accountability within legal institutions, and they have invited powerful new variations on rent seeking by nonstate actors. That development marks the emergence of a new model of public participation in governance, which I will call extreme multistakeholderism. It is amenable to practice by those entities or coalitions that are both sufficiently well-resourced to monitor governance processes unfolding concurrently at multiple sites and sufficiently well-connected to gain access to processes and documents that may be shrouded in secrecy.

In theory, many of the transnational regulatory processes described in this chapter incorporate delegation-based accountability mechanisms.⁴⁷ In the US for example, trade policy is the domain of the executive, and the executive in turn is accountable to the Senate and to the voting public. Interventions in transnational business regulatory processes also emanate from the executive branch and its constituent agencies and commissions. In practice, however, both trade policy processes and transnational regulatory processes are far more accountable to special interests than to their official constituencies. In the U.S., members of the industries affected by trade agreements sit on trade advisory councils that operate outside the purview of open-government laws, and new “fast-track” procedures have been devised to move newly ratified agreements through the congressional approval process; both arrangements are thought to be justified by the executive’s broad authority to conduct diplomatic relations with foreign countries.⁴⁸ Transnational regulatory processes are procedurally entrepreneurial and may also incorporate substantial privatization components, so the traditional mechanisms for executive branch accountability tend not to reach them directly. The courts, for their part, are inclined to regard both trade policy choices and transnational regulatory undertakings as nonjusticiable because they involve matters committed to the discretion of political actors.⁴⁹

Internet governance processes that rely on delegation-based accountability work differently and somewhat better. The particular form of incorporation chosen for ICANN – that of a Californian public benefit corporation – imposes a set of accountability mandates that include both stakeholder representation and transparency obligations. ICANN has adopted a variety of measures to keep its constituencies informed, some taken from the corporate toolkit (e.g., quarterly performance calls) and others from the transnational governance toolkit (e.g., multilingual reporting).⁵⁰ In practice, however, the stakeholder-based model for public input has produced – and was intended to produce – a significant policy tilt toward relatively well-resourced interests concerned chiefly with protection of trademarks and other intellectual property and more recently also concerned with access to the rich trove of personal information contained in WHOIS domain registry databases.⁵¹

The other traditional mechanism for political accountability involves direct participation. Some Internet standards governance arrangements adopt this model, but here too underlying patterns of power and access can operate to impede participatory democracy. Although membership in the IETF and a number of other technical professional organizations active in Internet standard making is exercised on an individual basis, as a practical matter participation is heavily corporatized. The World Wide Web Consortium, a private membership organization that oversees the development of the Web’s hypertext protocols, has different tiers of membership for different types of stakeholder, with large technology corporations paying the highest fees and wielding corresponding levels of clout.

From a theoretical perspective, these developments are unsurprising. Within networked governance arrangements, one would expect both assertions of power and assertions of counterpower to exhibit returns to scale.⁵² The lengthy, intricate, and globally distributed nature of transnational legal-institutional processes sets an effective lower bound on the kinds of entity that can participate effectively. The affordances of networked media and communication infrastructures offset geographical limits to some extent but also favor those best positioned to make use of them to coordinate interventions across multiple, farflung sites. Civil society organizations too have learned to play the multistakeholder game, forming transnational networks that enable them to pool their resources and act cooperatively, but corporate actors and business NGOs, including the International Chamber of Commerce and the International Trademark Owners Association, have followed suit, mobilizing the comparatively greater resources of their memberships to shift policymaking efforts into more congenial arenas.⁵³

The flipside of procedures guaranteeing both orderly contestation and finality is a political culture prepared to honor their requirements and abide by their results. The political culture of extreme multistakeholderism is different. The rewards flow to those who can access the most up-to-date information and marshal it most effectively on a global playing field. Those who lack comparable resources are doomed to play catch-up, continually pursuing a threshold of influence that remains out of reach.

Technocracy and Its Discontents: The Problem of Publicly Available Law

A final distinctive attribute of emergent arrangements for global business governance and global network governance is their highly technocratic character. Some legal scholars who study transnational regulatory processes have worried that those processes lend themselves to capture by elites.⁵⁴ It is helpful to understand that tendency as bound up with essential but imperfectly assimilated sociotechnical shifts. The mandated standards around which networked legal institutions are organized exemplify an approach that scholars who study sociotechnical assemblages for financial regulation have called the numericization of governance.⁵⁵ They are developed via expert proceedings and encoded in lengthy, highly technical specifications whose implementation requires ongoing supervision by cadres of managerial elites.

The particular expert register in which transnational governance is conducted varies from setting to setting. In the Internet governance context, the language of governance is produced by and for computer scientists and engineers. In world trade governance and transnational financial regulation, the language of governance is predominantly economic and, particularly in financial governance settings, highly quantitative. Environmental and food and drug regulatory processes incorporate technical vernaculars from fields such as climate science, marine ecology, and epidemiology. In other transnational settings, the prevailing vernacular is more generally managerial. For example, detailed operational standards geared to the rhythms of organizational processes and to the benchmarks and reporting conventions used by professional auditors are increasingly common features of transnational environmental and labor regulation.⁵⁶

In each case, reliance on technical vernaculars produces both some obvious entry barriers and some less obvious obstacles to broadly democratic policymaking. Even where participation in network governance processes is formally open to all comers, as in the case of the IETF’s working groups, the learning curve for those without appropriate technical facility is often steep. Civil society organizations in particular have struggled to attain technical parity with their better-resourced counterparts in the business and technology communities.⁵⁷ Expertise is required, as well, to understand the ways in which methods and analytical commitments that are ostensibly technical also implicate, reflect, reinforce, and sometimes predetermine policy commitments. Disentangling fact from value and understanding the social construction of technology are perennial problems in science and technology policy, but network organization under mandated standardization exacerbates them.⁵⁸ As substantive policy choices are folded into mandated standards, they become more and more difficult to disentangle, and certain types of especially incommensurable concern – for example, concerns relating to development of capabilities for human flourishing and protection of fundamental rights – may seem to disappear altogether.⁵⁹

A corollary is that, as technocratic oversight of regulatory functions becomes more solidly entrenched, the (explicit or implicit) political commitments of the expert regulators themselves may become more difficult to identify, contest, and dislodge. So, for example, the pathbreaking “end-to-end” design of technical protocols for the Internet reflected solid technical judgment about robustness to certain kinds of disruption and also encoded the generally libertarian commitments of the original Internet pioneers. As a result, although the Internet overall is extraordinarily resistant to disruptions of service, it has proved extraordinarily hospitable to other kinds of threat that exploit networked interconnection.⁶⁰ The discourses of risk management and cost-benefit analysis that play increasingly important roles in financial and environmental regulation charge can fail to reckon adequately with certain kinds of large systemic threat.⁶¹ In the domain of world trade, the leading theoretical models generally have viewed liberalization as an unqualified good and have tended to discount evidence suggesting that it is also important to provide for equitable distribution and domestic capability building.⁶²

An important element of the rule-of-law ideal is commitment to publicly accessible rules and publicly accessible reasoning about the justifications for official decisions. From that perspective, network organization under mandated standardization creates a paradox: Effective control of highly informationalized processes requires governance institutions capable of responding in kind, but the very process of optimizing regulatory controls to highly informationalized processes makes governance arrangements more opaque and less accountable to broader global publics.

Platforms as Emergent Transnational Sovereigns?

So far, the discussion has presumed that, within networked governance arrangements, nonstate entities act as stakeholders but only sovereign states function as policy hubs. But that implicit division of roles ignores both the leveling effects of network logics and the amenability of standards to disintermediation. Commentators have long puzzled over the undeniable fact that, although they are nominally stakeholders in transnational networked governance processes, transnational corporations speak with increasingly independent voices in their relationships with sovereign states and also wield considerable governance authority of their own over globally distributed labor and supply chains.⁶³ Dominant global platform firms – firms that have attained positions as dominant intermediaries within the emerging global, networked information and communications infrastructure – push both tendencies to new extremes.

Over the last several decades, the platform has emerged as the core organizational logic of the political economy of informationalism. In other work, I have explored the intertwined functions that platforms provide – intermediation between would-be counterparties and techniques for rendering users legible – and explained how those functions afford unprecedented control of commercial and social interaction.⁶⁴ From an economic perspective, platforms represent infrastructure-based strategies for introducing friction into networks. Platforms provide services that participants view as desirable and empowering, thereby generating and enabling participants to leverage network externalities. At the same time, they use a combination of legal boilerplate and technical protections to assert ownership and control of user data, to police access by app developers and potential competitors, and to maintain their algorithms for search, user profiling, and ad targeting as valuable trade secrets. Those strategies work to pull users closer and keep would-be competitors further away, generating the rich-get-richer dynamics that have produced dominant platforms and continually reinforce their preeminence.

As a result of their enormous and growing power over the conditions of information exchange, platforms are unmatched by other transnational corporations in the extent of the authority they wield over the day-to-day experiences and activities of their users. Here again, the distinctions developed by Manuel Castells in his exploration of communication power in the networked digital era are useful for explicating the various kinds of power that platforms possess. By virtue of their privileged and infrastructural access to flows of information, platforms wield both network power – which, as we have seen, inheres in the self-reinforcing power of a dominant network and by extension in its standards – and network-making power – or the power to constitute the network and perhaps to reconstitute it along different lines by altering the conditions for interconnection.⁶⁵

From the traditional international relations perspective, it makes no sense to speak of platforms or any other private corporations as sovereigns. Within the Westphalian international legal order, a sovereign state is, most minimally, an entity with a defined territory and a permanent population, the authority to govern its territory, and the capacity to enter into relations with other states.⁶⁶ Platform firms own premises within the territories of nation states and provide services to citizens of those states. Unlike state sovereigns, they lack authority to use physical force to assert the primacy of their laws or defend the sanctity of their borders.

Yet the growing practical sovereignty of platforms over many aspects of their users’ everyday lives blurs the boundaries that the traditional criteria impose. The network power and the network-making power of platforms are rooted in the very considerations of territory, population, and enforcement authority that platforms supposedly lack. Both technically and experientially, platform territories are clearly demarcated spaces.⁶⁷ Google and Facebook also operate substantial privatized Internet “backbone” infrastructures – the interconnection facilities that link different pieces of the Internet together.⁶⁸ Dominant platforms such as Facebook, Google, and Apple have user populations that number in the billions, vastly eclipsing the populations of all but the largest nation states.⁶⁹ The logic of platform membership is a network logic that relies on lock-in, and it persistently undercuts the strategies of exit and voice through which users police more ordinary commercial relationships. The benefits of membership accrue most visibly and predictably to users who maintain permanent and consistent membership. In part for that reason and in part because of the way that platform protocols mediate access to platform territories, the enforcement authority of platforms is real and immediate. Platform protocols structure the forms and flows of permitted conduct – e.g., sponsored search results, Facebook “likes” and “tags,” Twitter retweets – and enable swift imposition of internal sanctions that may range from content removal to account suspension or cancellation.⁷⁰

Sovereign authority also must be recognized as such by other sovereigns, and here the picture is muddier. On one hand, the dominant US platform firms actively and theatrically resist both incursions by nation states on their governance authority and various kinds of national and local regulation. On the other, platform firms have at times pursued more collaborative relationships with governments on both matters of national security and law enforcement and matters of technology policy more generally.⁷¹ As noted earlier, Chinese platform firms have more systematically collaborated with government authorities both at home and abroad. On the global stage, platforms firms increasingly practice both diplomacy and transnational networked policymaking in the manner of sovereign actors. Facebook’s privacy team travels the world meeting with government officials to determine how best to satisfy their concerns while continuing to advance Facebook’s own interests, much as a secretary of state and his or her staff might do.⁷² Speaking at a recent network security conference, Microsoft’s president sketched a vision of a future in which platform firms function as “a trusted and neutral digital Switzerland,” safeguarding private communications against all types of sovereign incursion.⁷³

In short, networked legal-institutional form allows for the possibility of nonstate but functionally sovereign power, and platforms represent an (arguable and emergent) example of such power. Concentrated stakeholder control of the networked communications infrastructure can produce and perhaps is beginning to produce an inversion of law- and policymaking authority, through which certain very powerful platform stakeholders become policy hubs in their own right. Theories of international relations that deny the possibility of private sovereignty are ill-equipped to respond to that possibility. Reconceptualizing transnational governance in a way that accounts for the network-making power of dominant platforms has become an increasingly important project.

Conclusion

Taking networks and standards seriously as organizing principles for a new legal-institutional form provides a helpful framework for understanding various features of transnational governance arrangements that have perplexed scholars across a number of disciplines. If what such institutions do is not “just” governance – if they represent an emergent form of law for the informational economy, and an increasingly important one – the disconnects between network-and-standard-based governance and rule-of-law ideals point to the beginning of an important institutional design project directed toward rendering them more accountable to global networked publics. That project also must contend with the growing practical sovereignty of platforms and with the challenges such sovereignty poses for the practical realization of rule-of-law aspirations within networked information environments.

3 Tech Dominance and the Policeman at the Elbow

Tim Wu ^*

Introduction

What drives the “digital tornado,” to use the evocative phrase coined by Kevin Werbach to describe the fierce, concentrated winds of technological change? One school of thought, neo-libertarian at its core, sees it as an entirely private process, driven by brave scientists, risk-taking entrepreneurs, and the capital markets. If government is relevant, it is merely through the guarantee of property rights and contract; otherwise it does best by staying out of the way.

But what if powerful firms seek to slow down, modulate, or co-opt the winds of change? The view just described takes this as an inherently hopeless task, for it is axiomatic that the rate of technological change is always accelerating, so that any firm or institution dependent on a given technology is therefore automatically doomed to a rapid obsolescence. Even well-meaning laws designed to catalyze innovation, at best, merely risk interfering with a natural progression toward a better technological future, hindering “the march of civilization.” As the general counsel of Standard Oil once put it, government cannot control the aggregation of private power: “You might as well endeavor to stay the formation of the clouds, the falling of the rains, or the flowing of the streams.”¹

This view, which was widely held in the early 2000s through the 2010s, has great relevance for the antitrust law, the subject of this chapter, and particularly, the parts of the law concerned with monopolization. For if we can indeed assume that the rate of technological innovation is always accelerating, it follows that there can be no such thing as lasting market power, the concern of the law. The dominant firm, necessarily dependent on an older technology, will be quickly surpassed and replaced by a new firm. In its strongest version, it suggests that the antimonopoly portions of the antitrust law are obsolete.

Over the 1980s through 2010s, a series of powerful anecdotes supported this narrative, so much so that it became a broadly accepted wisdom. After all, IBM, in the 1970s and 1980s, once thought lord of everything, was bested by a college dropout named Bill Gates and a few of his buddies. Microsoft, in turn, was ravaged by a series of garage startups with goofy names like Yahoo!, Google, and Facebook. AOL rose and then fell like a rocket that fails to achieve orbit, as did other firms, such as MySpace, Netscape, and so on. The chaos and rapid change made it obvious to many that there could be no such thing as a lasting monopoly. A three-year old firm was middle-aged already; a five-year old firm almost certainly near death, for “barriers to entry” were a twentieth-century concept. The best, indeed the only thing the antitrust law should do is to stand well back and watch.

But what if the supposed new order itself were itself just a phase? What if the assumption of constant accelerating technological change is wrong – or a function of market structure? As these questions may suggest, this chapter joins the challenge to the narrative described. I say join because it is a larger conversation, not to be settled with one single chapter. The contribution of this chapter is to examine a foundational part of the narrative – the erosion of IBM’s dominance in the 1970s and the case of United States v. IBM.

Why focus on IBM? The decline of IBM’s dominance over the 1980s has long been a foundational part of the story that we described in the introduction, one that casts the “new economy” as an exception to the usual rules of industrial organization. As the story goes, IBM, bested by Microsoft, Compaq, Dell, Intel, and other competitors, serves as strong proof that lasting monopoly in unachievable in high-tech industries. Even the mighty IBM could not hold out, given the inevitable challenge from new inventions and innovators.

Unfortunately, that account tends to overlook the fact that IBM was not subject only to the forces of technological change, but also faced significant legal challenges, targeted directly at the exercise of monopoly power. This chapter suggests, with the benefit of decades of hindsight, that subjecting IBM to an antitrust lawsuit and trial actually catalyzed numerous transformational developments key to the growth and innovation in the computing industries. The undeniable fact is that the “policeman at the elbow” can and does change conduct. The IBM case put a policeman at the elbow of the world’s dominant computer firm during a crucial period of change and development in the technology industries. This, I suggest, aided an ongoing process of transformational or Schumpeterian innovation.² Contrary to conventional wisdom, I also think that United States v. IBM is a valuable guide to enforcement policy in the technology-centered industries. This chapter, in short, is a revisionist history of the IBM case, one that casts serious doubt on the narrative of law’s irrelevance in aiding technological change.

The goal is not just to give the IBM case its due among those who study law and technology, but also to rehabilitate its reputation within antitrust law, where, it is given, conventional wisdom has not been kind. United States v. IBM has been cast as among antitrust’s lowest moments, and among the Justice Department’s greatest mistakes. Robert Bork memorably dubbed the litigation “Antitrust’s Vietnam”; Joseph Lopatka termed it a “monument to arrogance”; while an appellate judge quipped that it “went on longer than World War II and probably cost as much.”³ Lasting from 1969 through 1982, the case included a six-year trial; the government’s presentation took 104,000 pages of transcript, while for its part, IBM called 856 witnesses and cited 12,280 exhibits. Yet after years of trial, the Justice Department withdrew the case in 1982, without settlement or judicial remedy. The failure of the case to reach a verdict added ammunition to a Reagan-era movement against antitrust’s “big case” tradition.⁴ This has yielded, for many, one lasting “lesson” from IBM: that “big antitrust” – the industry-clearing Section 2 cases – should be used sparingly, at best, given the costs and potential for failure.

This chapter challenges the conventional wisdom and suggests that the IBM lawsuit and trial, despite never reaching a verdict, actually catalyzed numerous transformational developments key to the growth and innovation of the computing industries.

I do not seek to defend everything about the IBM trial. It is admittedly difficult, if not impossible, to defend the manner in which the Justice Department and court managed the litigation and allowed it to last so long. It is also true, as the critics have charged, that the government could have had a clearer theory from the outset. However, in spite of the lack of a remedy, the historic materials made available since the litigation have made it clear that the antitrust case did substantially change IBM’s behavior in specific ways. Perhaps the most important was the case’s role in pushing IBM to unbundle its software offerings from its hardware, and therefore to leave room for the birth of an independent software industry. While the effects are less direct, the case seems to have also influenced the manner of IBM’s PC launch and its conduct thereafter. These developments appear to have at least contributed to the thriving of an independent computer software industry, and later, to a new market for competing, IBM-compatible personal computers, as well as a slew of related, independent industries in storage, processing, printing, modems, and otherwise. During this period, IBM’s avoidance of exclusive contracts and its failure to acquire or seek control of obvious targets (like Microsoft itself) all suggest a firm with “antitrust phobia,” and thereby one that allowed competition to flourish.

Of course, there were a great number of other factors in the late 1970s affecting the software and hardware industries, and there is no claim here that the IBM antitrust litigation drove everything that happened during this era. However, many of the existing narratives are too quick to assume that the developments were “inevitable,” or, alternatively, all the byproduct of the particular genius of Bill Gates, a favorite thesis of the Microsoft-centered books. As discussed earlier, it is well understood by legal scholars that both firms and individuals may behave differently when enforcement is more likely, especially “with a policeman at the elbow.”⁵ The operating theory of this chapter is that a pending monopolization case, which focuses on exclusionary and anticompetitive acts and scrutinizes efforts to dominate new industries, may affect firm conduct in recognizable ways. And the thesis is that the policeman standing at the elbow of the dominant computing firms during the 1970s and early 1980s had an important impact on the development of the software and personal computing industries.

This reexamination of IBM also has important implications for antitrust enforcement policy, for an enforcer interested in “big cases” in the tech industries filed under Section 2 of the Sherman Act. To say that antitrust has, in the late 2010s, regained relevance is to state the obvious. For since the turn of the millennium, when it seemed that market power was indeed always going to be fleeting, the tech industries have consolidated into a much smaller number of “big tech” firms. The question, therefore, of when to bring a big tech case and against whom has returned to first-order importance.

This chapter suggests three things. First, that government lawyers should look for situations where it appears that a single firm is sitting as gatekeeper on what might, plausibly, be several innovative industries, and where breakups or lesser remedies might therefore unleash substantial growth. Specifically, beyond the usual search for monopoly power and anticompetitive practices, enforcers should be looking for “bundled” or “tied” markets that have the potential to be those nascent industries. The presence of stunted cottage industries might suggest an underlying potential. Second, the IBM case suggests the importance of a credible threat – that is, an investigation that seeks dissolution or other important remedies – so as to induce actual changes in conduct and deter anticompetitive behavior. Finally, the IBM case cautions enforcers to be concerned, but not overly concerned with the costs of investigation and trial, which are multimillion dollars questions, when there are billions and possibly trillions at stake.

Background: The Company and the Market

The predecessor firm to International Business Machines was founded in 1911, as a manufacturer of machines for tabulating and data processing. By the 1960s, IBM had become a dominant manufacturer of general purpose, or “mainframe” computers designed to be used by corporations, government agencies, and other large institutions. “Big Blue” was, by then, the largest computer manufacturer in the world. By 1971, IBM had grown to 258,662 employees and $7.2 billion in annual revenues, and its IBM System/360 was the nation’s, indeed the world’s, most successful computer line.⁶ It was a proud company, and its anthem went as follows:

EVER ONWARD – EVER ONWARD!

That’s the spirit that has brought us fame!

We’re big, but bigger we will be

We can’t fail for all can see

That to serve humanity has been our aim!

During the 1960s, the “mainframe” was the dominant computer design – one large computer, covered with blinking lights, designed to handle the most challenging tasks, or to serve many users at once. There was no such thing as a personal computer: At that point the cheapest computers sold by IBM cost over $100,000, and the more expensive units were priced in the millions.

IBM’s design philosophy was characteristic of the era of its greatest success – it embodied the system design thinking of the 1950s and 1960s, which favored centralized, fully integrated designs, of which AT&T “Bell System” was the exemplar.⁷ Hence, IBM’s mainframe computers integrated, or bundled, all hardware, software and peripherals in one package. Of particular interest to us, software was not made available for sale or lease as an independent product: It was a service provided to buyers of IBM hardware.

IBM was not without competitors. The mainframe market was lucrative, and by the mid-1960s, IBM faced competition from seven smaller firms (the “seven dwarfs”), with their own mainframes, such as Burroughs, Univac, NCR, CDC, GE, RCA, and Honeywell. Firms like Univac typically targeted the lower end of the mainframe market, and attempted to win consumers with lower prices. In the early parts of mainframe history, all of the computers offered for sale were incompatible: That is, a firm usually bought all of its computers and peripheries from either IBM or Univac, for the computers were incapable of working together. Later, some firms began to offer peripheral hardware, like disk drives, designed to be “plug-compatible” with IBM’s System/360 mainframes, which meant one could plug the peripherals into IBM’s machines. Finally, other firms, like Control Data, focused on superior performance, and in particular, the supercomputer market, crafting computers faster (and even more expensive) than IBM’s offerings.

The Case

Over the 1960s, there were long-standing complaints that IBM was maintaining its mainframe monopoly and scaring people away from supercomputers using anticompetitive, predatory, and unethical practices. IBM and its management had faced antitrust complaints before: Tom Watson Sr., IBM’s longtime CEO, was convicted of criminal violations of antitrust back in 1913 (when he worked for NCR), and actually sentenced to prison.⁸ What’s more, in 1956, IBM entered into a consent decree with the Justice Department surrounding its leasing practices.⁹

Matters came to a head when, in 1968, rival Control Data sued IBM in a private antitrust action, focusing on its predatory conduct in the supercomputer and mainframe markets.¹⁰ In 1969, after a long investigation, the Justice Department filed its own suit, also charging IBM with monopoly maintenance in violation of Section 2 of the Sherman Act.¹¹ According to the Justice Department, IBM had undertaken “exclusionary and predatory conduct” to maintain its dominant position in “general purpose digital computers.”¹² That was a market, according to the government’s estimates, in which IBM took some 70 percent of annual revenue.

Most important for our purposes were the government’s allegations surrounding software.¹³ IBM was accused of tying software to “related computer hardware equipment” for a single price in a manner that the Justice Department alleged to be anticompetitive. IBM, it was alleged, also gave away software for free for “the purpose or with the effect of . . . enabling IBM to maintain or increase its market share.”¹⁴

Beyond the software practices, the government also accused IBM of predatory practices. In particular, it accused IBM of developing specific “fighting machines” designed not to make a profit but rather to intimidate would-be competitors. It also accused IBM of vaporware practices, that is, announcing “future production and marketing [of certain products] when it believed or had reason to believe that it was unlikely to be able to produce and market such products within the announced time frame.”

For these violations, the government sought divestiture – that is, a full breakup of IBM into constituent parts. In that sense, the case was a classic example of the “big case” tradition in antitrust, in the model of the Northern Securities or Standard Oil litigation, whose goal was to restructure the industry entirely.¹⁵

After some six years of discovery, the case finally went to trial in 1975. The early stages of the trial were somewhat complicated by the fact that IBM was also defending the private antitrust lawsuit brought by Control Data, the manufacturer of supercomputers. At the beginning, Control Data actively cooperated with the Justice Department, and had accumulated a massive database of alleged predatory acts perpetrated by IBM and its salesmen over the 1960s. It was information from this file that the Justice Department hoped to deploy in its lawsuit. However, in 1973, Control Data settled with IBM, and agreed to hand over its file.¹⁶ IBM immediately destroyed (in some accounts burned) the files, thereby setting back the Justice Department’s discovery.

During the trial, IBM put on a vigorous defense, and spent untold millions of 1970s’ dollars defending the case.¹⁷ The judge, David Edelstein, permitted the calling of a seemingly unlimited number of witnesses, for indefinite periods of time. One government witness testified for more than six months. Other trial days consisted of reading of depositions into the record.¹⁸ Many of these details were chronicled by legal writer Steven Brill, in a scathing piece that portrayed the entire trial as a complete fiasco, or, in his words, “a farce of such mindboggling proportions that any lawyer who now tries to find out about it … will be risking the same quicksand that devoured the lawyers involved in the case.”¹⁹ The trial continued for an astonishing six years, until the Justice Department finally rested in 1981.²⁰

But here we are interested less in the trial itself, and more in the effects of the litigation on IBM’s conduct and decision making. For during the lengthy trial and its aftermath, there is little dispute among business historians and journalists that IBM’s management was influenced by the very fact of being under investigation and being on trial. As Don Waldman writes, “the filing and prosecution of the antitrust case affected IBM’s business behavior for the next twenty years.”²¹ Furthermore, as he writes, “lawyers gained control over even the most technical elements of IBM’s business.”²² William Kovacic concurs: “DOJ’s law-suit exacted a high price from IBM. Along with the private lawsuits, the DOJ case caused IBM to elevate the role of lawyers in shaping commercial strategy and seems to have led the firm to pull its competitive punches.”²³ Reporter Paul Carroll, in his insider account Big Blues, gave a detailed portrayal of the effects of efforts to avoid strengthening the antitrust case by producing evidence of market share or anticompetitive conduct: “Lawyers, who were developing a stranglehold on the business, decided what could be said at meetings. No one could talk about IBM’s market share, or if they did, they’d talk in meaningless terms, describing the market for word processors as though it included everything from the supercomputer on down to paper and pencils. Executives couldn’t do any competitive analysis. Developers weren’t allowed to buy a competitor’s machine; they were just supposed to know what was in it.”²⁴

Critics have emphasized the sheer size of the case, which did last an astonishing thirteen years, at the end of which, the Reagan Administration simply dropped the case.²⁵ Was it, then, all just a waste of resources? That’s no trip to the county courthouse, and no one can defend how the Justice Department managed the litigation, which became as bloated as a 1970s’ muscle car. On the other hand, consider the stakes: The computer and software industries were already bringing in billions in revenue and today are collectively worth trillions of dollars, encompassing many of the most valuable companies on earth. Small effects on this industry would and did have major long-term effects. Neither was the IBM case, as G. David Garson writes, “without its effects” for the early computing industry.²⁶

Effects and Impact

It is one thing to suggest that the IBM trial may have caused IBM to behave more cautiously, evade obvious anticompetitive conduct, and generally avoid strengthening Justice’s case. Among other things, that may simply have weakened IBM as a competitor. But it seems more important to point out specific decisions and outcomes that seem to have been strongly influenced by the “antitrust phobia” resulting from being the subject of a Sherman Act case designed to break up the company. In this section I focus on three key moments: (1) IBM’s unbundling of software from hardware, (2) its entry into the microcomputer market, IBM PC, in partnership with Microsoft and others, and (3) its pattern of non-acquisitions in the aftermath of the PC’s success.

Unbundling and the Rise of an Independent Software Industry

The clearest impact of the antitrust case was its contribution to the rise of an independent software industry. This development is no small matter, given that software today is a $1.2 trillion-dollar industry in the US ($3 trillion globally), employing 2.5 million people. However, most of the legal and economics critics of the IBM litigation have, unaccountably, failed to acknowledge the case’s contribution to the software industry.

In the 1960s, it was IBM’s practice, and the practice of most other mainframe manufacturers, to “bundle” software with hardware.²⁷ That is, software was sold as a service that was tied to the sale of its hardware – the IBM mainframe unit came with a contract by which IBM programmers wrote software customized to the needs of the customer. Any prepackaged software was meant merely to illustrate for the customer what software might look like, like a model home for a prospective customer.²⁸ There were those within IBM who also thought that there might be a profitable market for packaged software, but they were unable to persuade the firm to break from its traditional practices.²⁹ The software industry itself was a “small, offbeat, almost cottage industry” and there was, interestingly, little customer demand for independent software.³⁰

In the late 1960s, as it became apparent that the Justice Department was planning on bringing an antitrust lawsuit, IBM’s legal team began to conclude, as a legal matter, that the software–hardware tie would be difficult to defend. A key figure was IBM’s general counsel, Burke Marshall, who “saw bundling as a glaring violation of antitrust law” and suggested that, if forced to defend the tie, IBM “would lose.”³¹ Faced with this assessment, and hoping for a quick settlement, IBM President and CEO Thomas Watson Jr. made the decision, late in 1968, to begin the process of unbundling IBM’s software offerings from its hardware offerings.³² While the unbundling decision was made before the formal filing of complaint, it was an effort to avoid the complaint’s being filed; such efforts to settle preemptively as is common in antitrust practice.³³ If there was once some controversy over why IBM unbundled, Watson’s description of the decision, in his autobiography, coupled with the writings of other IBM insiders, seems to have settled the matter.

On June 23, 1969 – sometimes called the “independence day” for the software industry – IBM, for the first time, made seventeen applications independently available for lease (not yet for sale). With the first release of prepackaged software products by the world’s dominant computer firm, the world of computing was never the same again. Richard Lilly, founder of a prominent 1970s software firm, said in 1989, “It created the industry we’re in.”³⁴

Consistent with Lilly’s statement, most experts agree that IBM’s unbundling was one key factor in the development of an independent software industry.³⁵ Nonetheless, a few caveats are in order. First, it is not that IBM was the first firm to release software as a product – there were others, albeit very few. By becoming the largest firm to enter the industry itself, IBM played a role in validating the idea that software could be a product at all, and also the idea that software was valuable. Second, it is also true that there were other factors necessary for the birth of a software industry. One was IBM’s own development of the 360-mainframe architecture, which was a standardized platform; another, the rise of the minicomputer, a smaller and cheaper alternative to the mainframe. Nonetheless, in its action, IBM both gave life to the industry and, critically, reconceptualized what software was. Its unbundling, as Martin Campbell-Kelly writes, transformed “almost overnight the common perception of software from a free good to a tradable commodity.”³⁶ The decision also had important consequences for IBM, both in terms of what it was and what it could control. As Burton Grad, of IBM, writes: “As a consequence of unbundling, IBM unquestionably became the largest supplier of computer software and services during the 1970s and 1980s. However, it never could control that business in the same way that it had (and has) dominated the mainframe hardware market.”³⁷ The ongoing antitrust suit, moreover, prevented IBM from rebundling and risking new liability. Hence, the suit and the unbundling helped create the model of computing that drove development through the 1970s and beyond – the concept of a platform for which applications are developed.

Estimating the economic importance of this development – and the contribution of IBM’s unbundling – is not easy, if only because the transformation was so far reaching. An important fact, however, is that the impact was not felt all at once. Hardware continued to be more important than software, and even into the 1980s, the software industry remained relatively small. One economic analysis suggests that “in 1987, the receipts of U.S. software programming service companies (SIC 7371) were $14.2 billion, the receipts for computer integrated systems design (SIC 7373) were $7.1 billion, and the receipts from prepackaged software (SIC 7372) sales were $5.9 billion.”³⁸ Other developments, like the triumph of the personal computer over all aspects of business computing, were yet to come. Yet by the 2010s, providers of software, even narrowly construed, were responsible for over a trillion dollars in US revenue, and broadly construed, far more of the world’s economic activity. In the words of Marc Andreessen, “software is eating the world.”³⁹

We cannot know for sure whether, without IBM’s decision, software would have become unbundled anyhow – that it was, in some way, the natural order of things. But it seems hard to deny that the antitrust case sped that development. And the failure to take account of the significance and effect of IBM’s unbundling of its software is a major flaw in many of the critiques of the IBM litigation. Take, for example, the work of economic historians Robert W. Crandall and Charles L. Jackson and their highly skeptical analysis of the effects of the IBM antitrust litigation, published in 2011, on the computing industry. The two do mention that unbundling was among the Justice Department’s goals, yet fail to even mention that it actually achieved this goal. That omission allows them to make the incorrect conclusion that: “It is difficult to see how an antitrust action brought in 1969 and dismissed in 1982 could have been a major contributor”⁴⁰ to dramatic changes in the industry.

* * *

If unbundling succeeded in transforming the history of computing, unfortunately for Watson and IBM, it failed in its goal of mollifying the Justice Department, which persisted with other claims of predation and anticompetitive behavior. It seems that the Justice Department continued to litigate based on its large collection of potentially predatory activities – in particular, related to pricing and misleading consumers about IBM’s forthcoming supercomputers (a vaporware strategy). The persistence of the lawsuit led to its influence over another transformational development: The arrival of the personal computer.

The Personal Computer and Microsoft

Another major development that occurred during the pendency of the IBM antitrust lawsuit was the development of the personal computer industry. While Apple and competitors Commodore and Tandy may have ignited the market with the successful launch of the first mass market personal computers, IBM would come to play a central role by developing and releasing the IBM PC, the personal computer whose design would come to dominate the market, with its radically modular, or open, design. This section examines the influence of IBM’s “antitrust phobia” over the core decisions made during this period.

There are two dominant, and conflicting, narratives surrounding the development of the personal computer. The first lionizes IBM’s rapid creation of a personal computer that would come to dominate the new industry. The second describes a blundering IBM, and credits Bill Gates for his brilliant outwitting of a myopic and foolish IBM based on an inability of the latter to understand the future. It isn’t hard to see the contradiction: If IBM was too stupid or backward to understand the personal computer market, how did it come to dominate it in just a few years? And if Bill Gates had such a brilliant sense of the future, why did he only grudgingly come to understand the potential in selling a standardized operating system? But most mysterious of all: Once the IBM PC began to take off, why was it so inert in the defense of its position? Why, for example, did it decline to acquire control of the companies critical to the PC, as IBM’s philosophy of centralized control would suggest? The point of this section is not to suggest that the traditional narrative is entirely wrong, but that it is incomplete. Particularly when it comes to Microsoft, it implies that IBM was simply too bone-headed to appreciate the future, rather than, potentially, concerned about its fate in the antitrust trial, and later, the possibility of reigniting antitrust litigation. There were so many dogs that did not bark during the launch of the PC and its aftermath, many of which are consistent with a fear that too aggressive a posture might yield renewed antitrust pressures based on the monopolization of the PC markets or software.

A moment, first, on the IBM PC itself and its significance. IBM, as already discussed, was the great champion of the mainframe computer – “big iron,” the monster machines designed to serve the needs of an entire business unit. (To be fair, mainframes were actually much smaller than the computers of the 1950s, which sometimes took up entire buildings, and were employed mainly by the military, but that is another matter.) Priced in the millions of dollars, they were obviously not intended for home usage. In the late 1960s through the 1970s, however, a number of researchers, particularly those associated with Xerox’s Palo Alto Research Center, and hobbyists like Steve Jobs and Steve Wozniak, had come up with the idea of a “personal” computer, intended for individual usage or for small businesses. A group of firms, led by Apple and its introduction of the Apple II, and also including Commodore, Atari, Sinclair, Tandy, and others, had by the 1970s proved both that personal computers could be produced for less than $2,000, and that there was a market for them.

IBM had experimented with smaller, entry-level computers, but they were generally smaller versions of its mainframes, and still priced way beyond the reach of any individual. In 1980, with the success of Apple and others, IBM decided to enter the microcomputer market in earnest. In an impressive twelve months, it had introduced the IBM PC, coupled with an advertising campaign featuring Charlie Chaplin’s “Little Tramp.” More powerful than the Apple II or Commodore 64, and soon the beneficiary of a “killer app” in the VisiCalc and then Lotus 1–2-3 spreadsheet program for businesses, the PC would soon become the best-selling personal computer in history to that point, and the dominance of its design had a profound influence on the subsequent history of computing.

What made that design so interesting is that the IBM PC was built in a manner unlike any other IBM product, a fact that would have enormous long-term consequences for the industry. As suggested earlier, IBM, whose system design traditions dated from the 1950s, has been among the champions of a fully integrated system design. Like AT&T, the company whose design philosophy was the most similar, IBM had long believed that the best products required that every component and service be provided in-house. Its practice of bundling, stated differently, was not limited to software; it included all hardware as well – it tended to source all of its hardware and software from itself.

The first IBM PC, however, was an extraordinarily radical break from that design, with a modular, open design philosophy that was essentially the opposite of IBM’s closed and centralized philosophy. The IBM PC team (as we shall see, an experimental subunit of IBM proper) selected a hard drive manufactured by Seagate, a printer made by Epson, and a processor made by Intel, instead of using its own hardware. Most importantly over the long term, an operating system provided by the company then named “Micro-Soft,” then a small startup, headed by one Bill Gates who was just twenty-four at the time and lacking a college degree. Gates, for his part, did not, in fact, write the operating system, but acquired it from a partner (Seattle Software) to whom he paid a license of $25,000 (reportedly, he didn’t mention to Seattle Software that the customer was IBM, or that it had paid him $700,000).⁴¹ In the end, when the PC came out, only the keyboard, screen, motherboard, and its hardware BIOS (Basic Input Output System) were actually produced by IBM’s internal divisions. Of those, only the BIOS was proprietary.

There is one competitive detail of particular importance in the story of the IBM PC. When IBM contracted with Microsoft to provide the main operating system for the computer,⁴² it neither bought the rights to the software nor required an exclusive license. The agreement was, instead, nonexclusive, leaving Microsoft free to sell its MS-DOS to other computer manufacturers as well. This nonexclusivity was a crucial factor in facilitating competition in the market for IBM-compatible PCs (like Compaq, or Dell). But this is something of a tangent. The question this chapter is trying to assess is what role, if any, the antitrust investigation played in influencing IBM’s original design and subsequent strategic conduct. Unlike unbundling, the causation is much more diluted, but no less important.

First, we do need return back to the original 1969 software unbundling and its effect on the development of the personal computer. Among the effects of IBM’s prior unbundling decision was to create the conditions for the platform/application model that would become the foundation of the personal computer industry. Burton Grad, again, writes that “[u]nbundling mainframe software established a framework for the independent microcomputer software industry’s later growth, which followed the model of separately priced offerings by major software suppliers.”⁴³ In other words, perhaps the larger influence of unbundling in 1969 was setting a model for firms like Microsoft, VisiCalc, and Lotus (the last two being among the first spreadsheet producers) to follow, which were a major factor in the success of the IBM PC. The unbundling also made possible Microsoft, which we shall discuss in greater detail in a moment.

The second matter was the question of how IBM would come to enter the market for personal computers. A dominant view is that the industry had too little revenue to attract or interest a mighty firm like IBM. However, there is evidence that, as early as the mid-1970s, IBM management, including its chairman, had gained interest in low-cost, entry-level computers, based on the accurate perception that lower-cost computers would come to be important, and also that rival Xerox might dominate that market. (Xerox had developed an advanced personal computer, the Alto, by 1973, that even had a graphical user interface, but had kept it for internal use, and did not bring a computer to market until the mid-1980s.) IBM considered the acquisitions that might help it forestall the emergence of competitors, but that path was discouraged by its lawyers, who were at that point involved in every level of decision making. For example, IBM considered the acquisition of Atari, and later considered working with Atari to produce its PC, but never did so – whether out of antitrust concerns or not, is unclear.

The IBM PC’s production was also influenced by IBM’s internal restructuring. By the late 1970s, both in the hope of promoting innovation, and also in anticipation of a potential breakup, IBM had divided the firm. Frank Cary, IBM’s CEO, created a separate division to contain all of IBM’s non-mainframe businesses, and it was in this division that the PC was launched. More specifically, IBM created a series of independent business units designed to be innovative and also potential survivors of a breakup, just as AT&T concentrated its choice assets (or so it thought). It was one of these, the “entry level computing” division based in Boca Raton, Florida, that both proposed and then built the IBM PC (codenamed Project Chess).

It is this team that made the decisions to create the modular and open design already discussed. That decision, in turn, is said to have been somewhat inspired by both Wozniak’s Apple II design as well as the Chess team’s desire to get around IBM’s slow-moving methodical culture and arrive to market quickly and cheaply. The evidence leaves little doubt that this was the primary reason behind the design. As Bill Lowe, the first head of the PC team, later said: “[A]t IBM it would take four years and three hundred people to do anything, I mean it’s just a fact of life. And I said no sir, we can provide with product in a year. … To save time, instead of building a computer from scratch, [the team] would buy components off the shelf and assemble them – what in IBM speak was called ‘open architecture.’ IBM never did this.”⁴⁴ Lowe explained that “the key decisions were to go with an open architecture, non-IBM technology, non-IBM software, non-IBM sales and non-IBM service.”

But while speed was surely a predominant factor in the design, it does not provide an explanation for everything. It fails to explain certain matters, like the crucial agreement to a nonexclusive license for Microsoft’s PC-DOS (an exclusive contract would not have been slower), and to leave Microsoft with full control of the source code. Those who have studied that agreement and its creators have tended to focus on Bill Gates’ side of the story, and attribute to him great savvy and foresight, based mainly on his own testimony.⁴⁵ While seeing the potential in the operating system and in nonexclusivity deserves enormous credit, it doesn’t explain why IBM would agree to such a thing. It takes two parties to reach agreement, and as a small firm negotiating with the dominant computing power, it is safe to say that Microsoft would not necessarily have the final say. We also have the fact that IBM made an offer to buy a competing operating system, CP/M, outright.⁴⁶ What is lacking is a reason for IBM’s non-assertion of its market power, and the implicit assumption that IBM was simply too stupid or short-sighted is an inadequate explanation.

The studies of IBM’s side of the deal and its motivations for agreeing to nonexclusivity are fewer, but more important for our purposes. Joseph Porac, in a comprehensive study of the deal, suggests a variety of factors. One was that IBM did not want to manage the code or develop the operating system itself, having had several bad experiences with doing so in recent years. But the other leading reason, according to Porac, was “antitrust phobia.” As he writes: “[A] reluctance to overcontrol small companies that could become potential competitors [was an] offshoot of the company’s antitrust phobia. Signing a nonexclusive contract with Microsoft that was clearly to Microsoft’s benefit was one way of avoiding any future claim that IBM was dominating the personal computer market.”⁴⁷ His assertion is echoed by Charles Ferguson and Charles Morris, who write: “[B]ecause of the still-pending antitrust action, IBM was wary of owning operating system software for fear of suits from software writers” for “IBM was extremely sensitive to even the appearance of having an unfair advantage over a small supplier.”⁴⁸

It is difficult, in the final analysis, to deny that IBM’s antitrust lawyers strongly influenced elements of the legal and technical design of the IBM PC, for it was essentially antitrust-proof. Indeed, after IBM’s successful rise to dominance in the PC market, there was some complaining about “IBM dominance” but no serious antitrust scrutiny or assertion that the firm had employed tying or other exclusionary strategies. The avoidance of even a hint of exclusivity in the design is notable. It is the non-assertion of market power or obvious failures to protect itself from competition that suggest a firm exceptionally intent on avoiding anything that might strengthen the antitrust case against it. Unfortunately for IBM, but fortunately for the economy, the very design of the PC made it much harder for IBM to control the PC market.

The Non-Acquisitions, and More Dogs that Did Not Bark

In 1984, after the success of its PC, IBM was unquestionably the world’s dominant computer firm. In fact, at that point, IBM was the world’s single most valuable company, its stock price rising to $79 billion by the end of that year. It had upended the personal computer industry, and achieved, for a while, a dominant market share in that market. The last point we consider, in terms of the lasting effects of antitrust scrutiny, was IBM’s astonishing failure to take some of the classic measures used by a monopolist to defend its market position.

As already suggested, IBM entered the market in a manner that can only be described as unusually and exceptionally stimulating to competition, and indeed in a manner that breathed life into firms and nascent industries. The level of competition ended up being much greater than IBM could possibly have anticipated. Some of this was surely a blunder on the part of IBM. A key matter was IBM’s assumption that its ownership of the BIOS code would protect it from those seeking to create 100 percent IBM compatibles, based on the premise that it might use copyright infringement lawsuits to block any direct copies. However, Compaq and other firms effectively reverse-engineered and cloned IBM’s BIOS, using clean-lab techniques (that is, its engineers had no access to the relevant code).⁴⁹ This development, which IBM clearly did not anticipate, created a major breach in the barriers to competition it thought it had, and yielded a flourishing PC market from the 1980s onward.

An easier way to protect its dominance would have been control over Microsoft’s DOS,⁵⁰ and we have already discussed IBM’s decision not to insist that the Microsoft’s DOS be exclusive to IBM, or even partially exclusive. That single decision, as many have noted, might have ensured a far longer domination of the PC market for the firm. But even if this might have been, in part, at least an oversight, it is hard to explain IBM’s subsequent non-acquisition of PC-DOS, of Microsoft, or even of a share of Microsoft, without crediting some concern of renewed antitrust problems.

In the 1990s, reporters first revealed that, in fact, IBM was offered various opportunities to buy Microsoft or its software. In 1980, according to the Wall Street Journal, Microsoft offered to let IBM buy its operating system outright, an opportunity that IBM declined, for the reasons discussed above. Later, in 1986, after the IBM PC had successfully taken over personal computing, Bill Gates offered IBM the opportunity to buy 10 percent of Microsoft.⁵¹ There is some reason to think that, while surely the price would have been steep, IBM might have even have tried to acquire Microsoft in its entirety. IBM – still the most valuable firm in the world – demurred, concerned that its purchase would reignite antitrust concerns by being seen as “throwing its weight around.”⁵² Paul Carroll reports Bill Lowe of the PC team stating that “IBM didn’t want to be seen as dominating the PC market too thoroughly.”⁵³

Given the runaway success of the PC, it was also plausible that an IBM that was behaving more like Facebook, Microsoft, or other less inhibited giants would have sought to either acquire or clone the other units, including hard drive manufacturer Seagate, and Epson. However, it made no efforts whatsoever to acquire these actors, which would go on to earn most of the profits in the PC industry.

* *

The various design decisions surrounding the IBM PC and IBM’s subsequent failure to defend its position are of such great importance over the long term for both the computer industry and the entire high-tech economy that they must be carefully examined.⁵⁴ We have already noted that the nonproprietary design left the market open to challengers to the IBM PC, which manufactured cheaper but compatible computers, also using MS-DOS. Over the long run, this development would erode IBM’s early dominance. But more generally, an important consequence was the fostering of a whole series of new and independent industries: an industry for hard drives and other forms of storage, another for processors and memory, and, of course, the market for personal computer software. It is true that these industries existed previously, but their growth was catalyzed by the IBM PC and its later competitors. It is interesting to contrast the PC, in this respect, with Apple, the previous leader, which was slightly less open than IBM, and with the launch of the Apple Macintosh, retreated to an entirely closed architecture with most components manufactured by Apple. In an alternative universe without IBM, had some version of the Apple Macintosh became the dominant business computer, it is very possible that the storage and software industries, in particular, would have been greatly reduced in independence and significance.

Lessons for Enforcers

Today, the concentration of the high-tech industries has become, one again, a matter of major public concern. That’s why the IBM case merits careful study by enforcers, for it was the first major tech antitrust case of the computing era, and a neglected member of the big three cases of the late twentieth century (IBM, AT&T, and Microsoft). Close study of the case offers guidance and insight into what might be the dynamic justifications for bringing a major antitrust lawsuit in the 2020s.

IBM was just one company. Yet, in retrospect, it was sitting atop what turned out to be an enormous number of important industries, from software through storage, processing and operating systems. The subsequent flourishing of the industries that were once in areas controlled, or potentially controlled, by IBM has unquestionably transformed the modern economy.

Given the complexity of any historical period, it is almost always impossible to claim that one factor – one leader, one case, one invention, or one critical decision – changed everything. However, it is not impossible to claim a contribution or a catalyst. And even if we don’t know what would have happened in the absence of antitrust – if, in fact, software might have been unbundled anyhow, or the PC might have developed more or less the same – there is good reason to believe that the pervasive evidence of antitrust phobia hastened the outcome.

If an enforcer wanted to duplicate the catalytic effects of the IBM case, what would he or she do? A close look at the history recommends that antitrust enforcers, particularly when thinking about big Section 2 cases, should spend time thinking about what industries or potential future markets and industries the dominant firm sits on top of or can potentially control the development of. The intuition is that there is a difference, say, between a shoe monopoly and monopoly on sidewalks, given that the latter might be an input into and entwined in so many other businesses. This suggests that antitrust enforcers should, when considering cases, begin by thinking about how many markets are influenced or dependent on the product or service.

A similar logic suggests prioritizing Sherman 2 cases where the problem isn’t just competition in the primary market, but where competition in adjacent markets looks to be compromised or threatened. The long cycles of industrial history suggest that what are at one point seen as adjacent or side industries can sometimes emerge to become of primary importance, as in the example of software and hardware. Hence, the manner of how something is sold can make a big difference. In particular, “bundling” or “tying” one product to another can stunt the development of an underlying industry. Even a tie that seems like “one product” at the time the case is litigated, as, for example, software and hardware were in the 1960s, or physical telephones and telephone lines, might contribute to such stunting. If successful, an antitrust prosecution that breaks the tie and opens a long-dominated market to competition may serve to have very significant long-term effects.

While all things are clearer in retrospect, the existence of a cottage or nascent industry might serve as a clue that, in fact, a vibrant industry might emerge from breaking the tie. If some firms manage to survive even in the presence of a tie, that suggests the possibility that there is far more potential there. In the example of the software industry, as we’ve suggested, the concept of prepackaged software existed, and a scattering of firms sold it and made a profit thereby. That pattern suggested plenty of room to grow, even if it would take many years for premade software to develop into the thriving industry it became.

A last lesson that might be gleaned from the IBM litigation is this: If the government wants to spur a change in conduct, it should seek maximum remedies in the cases it brings. In IBM, the Justice Department brought a complaint seeking dissolution – a full structural remedy. IBM’s concern about such a remedy had a major effect on its thinking and decision making, and seemed to yield the antitrust phobia that proved important over the 1970s. That suggests that the Justice Department cannot induce improved behavior without making credible threats of punishment at the outset of the case. In particular, there is a risk that a case that begins seeking a mere consent decree might not have any real effect on firm conduct.

A full discussion of what should go into case selection is beyond the scope of this or perhaps any article. But the final caveat or warning is this: While I think it is correct to suggest that the costs of litigation should not be fetishized – although the millions matter less when there are billions at stake – one thing that does matter are the effects on the company itself. IBM was, arguably, a reduced entity during the antitrust case (although it remained extremely profitable, and actually quadrupled its stock price). Knowing that the effect of litigation is to damage the firm, the enforcer needs to have some confidence that the damage will be salutary – that is, it will yield room for competitors to take the ball and run with it. While “do not harm” cannot be the mantra of antitrust enforcement, no one should seek outcomes that make things worse. And this is what makes timing all important, and suggests that enforcement policy will always be a matter requiring, above all, good judgment and a clear eye toward what one hopes to achieve.