Is Forensics Law?

I’ve blogged on these pages before about the claim, popularized by Larry Lessig, that “code is law.”  During the Concurring Opinions symposium on Jonathan Zittrain’s 2010 book The Future of The Internet (And How To Stop It), I cataloged the senses in which architecture or “code” is said to constitute a form of regulation.  “Primary” architecture refers to altering a physical or digital environment to stop conduct before it happens.  Speed bumps are a classic example.  “Secondary” architecture instead alters an environment in order to make conduct harder to get away with—for instance, by installing a traffic light camera or forcing a communications network to build an entry point for law enforcement.

Zittrain made an interesting, further distinction.  He noted that some interventions erase unlawful conduct that has already occurred.  Thus, when EchoStar lost a legal battle over the right to include digital recording as part of its satellite service, a court forced the company to reach into thousands of households and zap the capability out of existence.  The years since Zittrain’s book have given us the (literally) Orwellian example of Amazon erasing copies of George Orwell’s Nineteen Eighty-Four and Animal Farm from everyone’s Kindle following a copyright license dispute.  We can think of these examples as suggesting a distinction between pre-primary and post-primary architecture.  Impossibility after the fact.

It occurs to me in writing a new essay that compares popular regulatory alternatives that there may be a fourth way code is law, corresponding to the empty box below.  Forensic science or “forensics” refers to the use of science and technology to investigate and establish facts in connection with crimes or civil wrongs.  It includes everything from the magnifying glass of yesteryear to today’s handheld sensor that can detect whether a body is buried under the ground.  Its basic mechanism is to turn the scene of a crime into a crime scene, i.e., to convert the ordinary stuff of life into clues and evidence.  Like traffic light cameras, forensics makes crimes harder to get away with.  But unlike standard secondary architecture, forensics does so after the fact.  Sometimes long after the fact, as when brand new techniques permit investigators to reopen cold cases.

Accordingly, I submit that all of forensics is a kind of post-secondary architecture, thus filing out the fourth quadrant of code as law.  Thoughts welcome, as always.

You may also like...

17 Responses

  1. A.J. Sutter says:

    It’s possible that some or all of the evidence recovered through forensic scientific interventions won’t have any legal impact, because of constitutional or other rules. In some cases, such an intervention might even be illegal itself. Does that distinguish it from the other examples of things you’re calling “law”?

  2. Orin Kerr says:

    In what way does forensics make crime harder to get away with “after the fact”? Forensics is just investigation: It’s just the process of looking at the world that exists to figure out what happened.

  3. Ryan Calo says:


    Thanks for your question. The claim is that as forensic science advances, the world that exists reveals more factual information than it once did. This is turn means certain crimes become harder to get away with. So, for instance, the advent of DNA in the mid-eighties made it less likely for murderers to go free, including those who committed the crime before DNA testing became available. Where am I losing you?


  4. Ryan Calo says:


    Interesting point. Traffic light cameras will not catch all perpetrators, and speed bumps won’t slow everyone down. So I don’t think the possibility of failure differentiates forensics from the other candidates. One thing I do think might be different, however, is that forensics can be challenged and tested by the legal system. As I argue in the essay, one problem with many substitutes for law is that they often cannot be.


  5. Orin Kerr says:


    But that’s only a part of the story. Sometimes the government gets new techniques and can learn more about the world. But sometimes criminals get new techniques and have new ways to hide crime. In the case of computer forensics, for examples, the government might get a better forensic tool to find evidence from the bad guys; the bad guys might get better encryption tools to hide evidence from the police. More broadly, each side can take steps backwards as well as forward: A government agency might lose funding and have to settle for less effective forensic tools, or a wrongdoer might switch to a way of committing crimes that are more exposed than before. In all of these cases, the dynamic is that of a cat-and-mouse game: Each side tries to use new technologies to help their side in ongoing competition. Given the cat-and-mouse game, I don’t think it works to present one side and try to distill its essence without considering the other side.


  6. Jamie says:

    Forensics is people asking, what just happened?

    As an IT person, not a lawyer, that is generally the concern. I’ve got a problem, someone somewhere got access they shouldn’t have. My boss wants to know, basically, the five W questions. Oh, and how it won’t happen again This is where law and operations are aligned – if only we could make that work. I have to say, when I’ve worked with LE in the past, they wanted me to do things that were not in my firm’s best interest. That is not a good place to be in, which makes me more reluctant to talk about these sorts of things with them.

  7. Lawrence Cunningham says:

    I devote a section of my book, Introductory Accounting, Finance and Auditing for Lawyers (6th ed. 2013) to the topic of forensic accounting. A few passages follow, which speak to the question this post raises. The question the comment raises: can “all of forensics” be “a kind of post-secondary architecture” as the post asserts?

    The term “forensic” means “belonging to courts of justice.” Branches of knowledge implicated in legal disputes have long been designated by the term. Forensic pathology, for example, is the branch of medicine dealing with diseases of the body in relation to legal principles and cases (such as whether someone who is brain dead can have testamentary capacity) and forensic psychiatry is the branch of medicine dealing with disorders of the mind in that relation (such as fitness for trial or insanity as a defense in a criminal prosecution).

    The continental European word for this is forensis which in turn derives from the Latin term forensis homo, indicating an advocate or a pleader of causes, one who practices in court. Specialized disciplines have practiced in this intersection with law for centuries, including forensic medicine, forensic linguistics and forensic engineering.

    Forensic accounting, a relative newcomer, is the branch of the public accounting profession dealing with dysfunctional financial reporting in relation to criminal and civil law. One [discovery that forensic accounting has confirmed] is that accounting shenanigans arise repeatedly in favorite spots [such as revenue misstatements]. Accounting games also congregate in certain industries, with computer hardware and software makers restating more often . . . than all other industries. This is partly due to novel arrangements arising in technology sectors untested by accounting rules. Some of the novelty produces honest errors but some produces gamesmanship and these are not always easy to distinguish. . . .

  8. Ryan Calo says:

    Thanks all for these great insights. Lawrence, I intend to use your helpful account in a footnote defining the term.


    I think you may be assuming that I share a view of Larry’s that you’ve criticized in the past, namely that architecture is law no matter who wields it. I don’t. I believe that architecture acts like regulation only in the hands of the government. Accordingly, I would not say that encryption by citizens is law anymore than hiding one’s license plate from traffic light cameras is law.

    I certain agree that there is more to the picture. The balance between cat and mouse has to do with both sides’ access to technology, but also a wide variety of other factors. The sheer number of people engaging in bootlegging, for instance, and the sudden will on the part of the public to end a widespread practice, probably has as much to do with reexamining the balance between citizen rights and police power as, say, the invention of the automobile. At least that’s what the Wickersham Commission seemed to conclude. In short, I don’t mean to suggest the picture is not quite complicated!


  9. Orin Kerr says:


    I’m not addressing what is “law” at all. I’m just responding to your statement that forensics — that is, the practice of learning about the world to reconstruct a past event — “makes crimes harder to get away with. . . after the fact” and is “a kind of post-secondary architecture.” I don’t understand why you think that is true, or even what you think it means. Anyway, sorry to bother you with my questions; thanks for responding.

  10. Ryan Calo says:


    Your questions are, as always, thought provoking. I thank you for them, and apologize myself for not managing to be clear enough in how I’m asserting the claim.

    Let me try one more time:

    i. The classic example of code as law involves changes to architecture that make a crime harder to do, as when a city reduces speeding by adding speed bumps.

    ii. Some people (Lessig, Gary Marx, Edward Cheng) claim that changing an environment to make crimes harder to get away with is also a kind of regulation by architecture, which Marx and Cheng label “secondary.” The example I keep coming back to is the installation of a traffic light camera.

    iii. Few think either primary or secondary architecture is perfect in its capacity to prevent or detect crime. Many (Tim Wu, James Grimmelmann) acknolwedge that individuals can and often do take steps to counter architectural regulations, as when someone covers their license plate to block a traffic light camera, publishes how to break DRM, and so forth. This complicates the dynamic between the state and the civilian, but it does on its own invalidate the claim that code can be a kind of law.

    vi. Others (Jonathan Zittrain) have pointed out with respect to primary architecture that it need not stop conduct in advance, but could erase unlawful conduct retroactively.

    vii. Even where the government has not modified an environment prior to the commission of the crime—e.g., has not installed a camera at the street corner—the government can later bring new technology to bear to make it more likely that the perpetrator will be caught.

    As a thought exercise, imagine a new camera that can record what happened the day before. Do you see what I mean? If an ordinary camera is installed before the crime—secondary architecture. If our new time camera is trained on the scene after the crime—forensics.

    viii. Thus, rather than erase a crime after the fact, a new forensic technology can lessen the likelihood that criminals will get away with a particular crime or even an entire category of crimes.

    ix. Developments in forensics that post date the commission of a crime can make that crime harder to get away with. In this sense, what we think of as simply the practice of learning about the world, can be seen as a kind of secondary architecture.

    I hope this helps, and any more context you can offer for your skepticism would be much appreciated. Thanks again,


  11. Orin Kerr says:

    Thanks for the explanation, Ryan.

    It seems to me that under this framework, everything in the world is “architecture,” and anything that doesn’t do an act directly is “secondary architecture.” So saying that something is “secondary architecture” just means that it is something in the world that leads to something else in some way. If I’m following the argument, then, the claim that forensics is “secondary architecture” that makes it harder to get away with crime just means that the effect of investigative tools by law enforcement is to increase the chances that people will get caught. If that’s the argument, then it is true but obvious — after all, that’s why governments hire investigators. Is that the argument, or have I misunderstood you?

    I suppose part of the difficulty I’m having is that I don’t know what work the categories of “architecture” and “secondary architecture” are doing. I’m probably just misunderstanding you, but in my (likely mistaken) understanding they seem to apply so broadly that they don’t have much meaning.

    Another question I have relates to your view that forensics is transformative — as you put it, forensics “convert[s] the ordinary stuff of life into clues and evidence.” To an investigator, though, there is no difference between “the ordinary stuff of life” and potential “clues and evidence.” The investigator’s job is to seek clues and evidence from the world, which necessarily is a world of the ordinary stuff of life. In that sense, forensics doesn’t transform anything: It is just observing the world closely to understand the past. Although I suppose it depends on how you conceptualize the point; whether transformations occur depends on the perspective of the viewer, I suppose.

  12. Ryan Calo says:


    I think the criticism you are leveling may go to the whole “code is law” enterprise, rather than specifically to my proposal for a fourth quadrant. I also confess not to share your intuition that there is no difference between the ordinary stuff of life and clues and evidence, even to a trained investigator. New developments in technology move something from the first category to the second all of the time.

    I’m even a little surprised given your helpful frame of a hypothetical “year zero” in recent work. Imagine a year zero (or so) when there is no fingerprinting much less DNA testing. An investigator would pick up a cigarette at the crime scene, maybe note the brand, and then throw it out. But an investigator today would be crazy to do so. What accounts for the difference? Why is the cigarette just a cigarette in year zero but suddenly a treasure trove of evidence in year 2013? Perhaps because advances in forensics has transformed something once mundane into something legally crucial.

    One question I recall having about equilibrium adjustment theory ( was just when, exactly, changes in technology become significant enough to warrant changes to Fourth Amendment law. But at some point, the ability of the government to seek, or the criminal to hide, triggers a perceived need on the part of courts to change how they interpret the Constitution. (Whereas Larry argued in Code that changes to technology reveal “latent” conflicts within the Fourth Amendment, I read you to argue that the conflicts are the same–only the balance different.) I worry that your comments here that “forensics” or “the effect of investigative tools by law enforcement” “doesn’t transform anything” may cut against your elegant thesis.

    I’m going to think about this more. Thanks again for the helpful engagement. I really appreciate it.


  13. Orin Kerr says:


    You’re right that I’m underwhelmed by the “code is law” argument more generally, as I think it ends up taking an idea that most people intuitively recognize and dressing it up in academic language. For most people, the reason why they don’t do a harmful act is that they don’t want to do it, they find it hard to do it, and/or they’re worried that they’ll be punished for doing it. I’m somewhat skeptical of efforts to create complex theoretical frameworks surrounding what I take to be a relatively apparent set of choices.

    As for the point about transformation, I suppose it just depends on what kind of transformation you have in mind: In one sense, every change whether large or small transforms the world from what it was before to what it is now. Whether the change is “transformative” just depends on the criteria you are using by which to measure it. Anyway, thanks for the exchange.

  14. A.J. Sutter says:


    Thanks for your reply to my earlier comment. But your analogy among traffic light cameras not catching all perpetrators::speed bumps not slowing everyone down::forensic evidence failing to catch a criminal is not quite what I was trying to highlight. Your most recent reply to Orin gets more to it: the 4th Amendment.

    A valid search of a house that finds forensic evidence leading nowhere is more like the speed bump member of the analogy above — didn’t do what was intended, but kosher Constitutionally. An intervention such as unwarranted eavesdropping, taking an unauthorized DNA swab, etc. fails for a categorically different reason: it’s illegal. If I read you correctly, you seem to be lumping what might be called a benign functional failure together with failure on grounds of illegality — I’m not sure that’s a distinction to be abandoned.

  15. Ryan Calo says:

    Thanks again for the insightful comments, which are why I love guest blogging on Concurring Opinions. The discussion of forensics is all of two paragraphs in my essay, but I intend to revisit those paragraphs in light of these great thoughts.


  16. Bruce Boyden says:

    Ryan, if I could pile on a comment for when you get to editing this (small) part of your essay, there’s a part of your categorization I’m not getting. I get the distinction between changes to the world that make behavior more difficult, and changes that make enforcement easier. I would agree with Orin et al. that we don’t want to spout neologisms when ordinary English will do, but “architecture” seems like a useful term in thinking about such issues, to me at least, and the distinction between barriers and enforcement also seems useful in policy-type discussions over how best to prevent or limit certain behaviors.

    The part I don’t get is Zittrain’s “further distinction” that you mention above, that then sets up your array of possibilities. You describe the deletion of files or upgrades of software on user devices as “retroactive.” But it’s not really retroactive. It doesn’t reach into the past and prevent you from having read something you’ve already read. It prevents you from reading it in the future. I’m not sure I see a significant difference between that, in terms of the effect on behavior, and Amazon deleting “1984” from its own servers. Is that retroactive too? In short, I’m not grasping the difference between “pre-primary” and “post-primary” — pre and post what? Which means that I don’t really see the difference between enforcement and forensics. Forensics seems to be a tool for enforcement — discovering what happened. How is that distinguishable from other tools, like police officers or red-light cameras or civil liability? I’m not seeing a time-related difference — all enforcement occurs after the fact, so it’s all “post”. What’s the “pre”?

  17. Ryan Calo says:


    First, thanks for your note about architecture. It’s not for everyone, but many find it a useful frame.

    Zittrain distinguishes between “preemption” like the speed bump and “specific injunction,” which he notes “takes advantage of the communication that routinely occurs between a particular tethered appliance and its manufacturer, *after* it is in consumer hands…” (his emphasis). He also refers to “post hoc changes to technology that consumers may not want.” But, to be clear, he never says the action is “retroactive.”

    It seems like you’re focusing on the act of reading the book versus the status of owning it. A court (rather, the threat of a lawsuit) forced Amazon to undo your ownership. Or imagine that your chances of getting away with a crime at the time of commission are 1 in 2 given the investigative technology available to police. Later, the government invests in a new technology that lessens your likelihood of getting away with the same crime to 1 in 4. I feel these changes are retroactive—but I’ll think more about my word choice.