We Need to Stop Confusing Code for Law

This article was originally published in The Columbia Law School Blue Sky Blog. Any opinions in this article are not those of Winston & Strawn or its clients. The opinions in this article are the authors’ opinions only.

A fundamental misconception pervades American law’s engagement with blockchain technology. State legislatures, federal regulators, courts, and private market participants routinely treat the technical capabilities of blockchain systems as sources of legal rights and obligations, collapsing the distinction between what code can do and what law commands. This is not a merely theoretical problem. It produces flawed statutes, distorted regulatory guidance, contradictory judicial opinions, and private arrangements built on illusory foundations. The stakes are practical and immediate: When technical capabilities are mistaken for legal entitlements, the resulting structures fail, exposing developers, investors, and market participants to liabilities they believed they had avoided.

This conflation of what code enables with what law commands has a traceable intellectual genealogy. When Lawrence Lessig proclaimed “code is law,” his insight was descriptive. Code, he argued, is one of four constraints on behavior in cyberspace, alongside positive law, markets, and social norms. Code defines the boundaries of possible action: It is a potent form of “soft law,” but not a source of enforceable rights.

Blockchain technology collapsed this distinction. Cypherpunk ideology, which envisioned cryptography as a bulwark against state overreach, converged with blockchain technology to produce a bolder claim: that code is actual law, generating enforceable rights and obligations through execution alone. Scholars theorized lex cryptographia, a regime of self-executing smart contracts independent of any legal system. Others contended that blockchain operates “alegally,” beyond existing legal frameworks altogether. In commercial practice, a prominent NFT issuer declared that ownership of these tokens is “mediated entirely by the Smart Contract and the Ethereum Network,” as though property rights were a function of code rather than law. The fallacy has now traveled so far that litigants invoke “code is law” as a defense, arguing that conduct a protocol permits is, by definition, lawful.

Read the full article.