Hacking

This Article addresses a fluid and increasingly salient category of cases involving the First Amendment right to publish information that was hacked, stolen, or illegally leaked by someone else. Twenty years ago, in Bartnicki v. Vopper, the Supreme Court appeared to give broad constitutional cover to journalists and other publishers in these situations, but Justice Stevens’ inexact opinion for the Court and Justice Breyer’s muddling concurrence left the boundaries unclear. The Bartnicki framework is now implicated in dozens of new cases – from the extradition and prosecution of Julian Assange, to Donald Trump’s threatened suit of the New York Times over his tax records, to the civil suits spawned by the hack of DNC servers – so there is a pressing need for clarity.

The empirical part of this Article presents the results of a comprehensive analysis of every case applying Bartnicki over the past two decades to determine if lower courts have answered the questions Bartnicki left open and to identify points of confluence and conflict. The analysis shows courts are divided about nearly every aspect of Bartnicki. There is a circuit split regarding the amount of separation a publisher must have from a source in order to be protected, division about the relevance of statutory prohibitions on receiving or possessing certain information, and confusion about how to assess whether publications, particularly those involving large caches of data, address matters of public concern.

The normative part of this Article proposes a reorientation of courts’ approaches to these issues by 1) untethering liability for the procurement, receipt and publication of information, treating each as a legally discrete act; 2) denying Bartnicki protection only to those who directly participate or assist in the illegal procurement of information; 3) treating as a First Amendment violation any law punishing those who merely receive or possess newsworthy information; and 4) engaging in more contextual analyses of “public concern.” All of these changes will help stabilize the law, strike a better balance between newsgathering and secrecy, and vitalize press and citizen communication at a time of decreasing government and private-sector transparency.

Hacking is a set of practices with code that provides the state an opportunity to defend and expand itself onto the internet. Bringing together science and technology studies and sociology scholarship on boundary objects and boundary work, we develop a theory of the practices of the hacker state. To do this, we investigate weaponized code, the state's boundary work at hacker conferences, and bug bounty programs. In the process, we offer a depiction of the hacker state as aggressive, networked, and adaptive. The contemporary networked state is dynamic and process-orientated. It is a logistical and informational assemblage composed of technological infrastructures like 4G networks, surveillance satellites, internet exchange points and fiber optic cables as well as official bureaus concerned with areas like law enforcement, environmental protection, national security and diplomacy. These domains of competence and action are populated by researchers and scientists, police officers and policy analysts, military contractors and covert operatives-that is, an assortment of humans with differing mandates, levels of agency, expertise and proximity to official structures and objectives. This circuitry of power is increasingly underwritten and interwoven with the nonhuman components of the networked age. Software and malware, algorithms, viruses, exploits and zero-days increasingly form a connective tissue that links these state actors. This dynamic constellation of state structures seems to be historically and empirically distinctive from the more static characterizations that have appeared and continue to appear in the sociology of the state. Indeed, besides the formal exchanges and encounters that are typically understood as the domain of the state (e.g., diplomacy, treaty negotiation, foreign policy, etc.), a set of less formal and more tenuous forms of engagement-mediated through software, conducted through cyber-proxies and governed by networks-have increasingly complemented the "work" of the state.