A. Michael Froomkin [FN 1]
[Cite as: A. Michael Froomkin,
Anonymity and Its Enmities,
1995 J. ONLINE L. art. 4, par. ___.]
{par. 1} Professor Froomkin explains the mechanics of how "anonymity" is effected for communication over the Internet and then analyzes the legal status of attempts to ban anonymity. Through a combination of public-key encryption and special "anonymous remailer" computers, messages can be sent over the net with a high degree of certainty that they cannot be traced to their originator. These techniques also make possible the creation of "pseudonymous" personalities that can both send and receive messages, with the originator's true identity concealed. The Supreme Court in the McIntyre case recently struck down state prohibitions on the use of anonymity in the context of political leaflets. But such state laws have generally been very broadly drawn, and have been applied to political speech. The possibility remains that a narrowly drawn statute banning anonymous political speech, or one directed to non-political speech, might nevertheless be upheld.
{par. 2} Henry Ford's Model T automobile is the direct ancestor of the suburb and the shopping mall, and through them the crisis of the inner city and, in part, the oil crisis and the greenhouse effect. The personal computer and the use of the Internet will, I believe, have an equally great effect on society. Most of these effects are as unpredictable today as the teen and pre-teen culture of the shopping mega-mall was unforeseeable in the 1920s. Even so, a few effects of the information technology revolution can already be anticipated: the democratization of access to information; the democratization of access to one-to-many media; and the ease of access to anonymous communication.
{par. 3} This essay focuses on the last of these: on anonymity in computer communications, a phenomenon at the intersection of law, policy, computer science with consequences for commerce, for personal liberty, and for the way we live and interact with each other.
{par. 4} Because I am a US citizen and US-trained lawyer and this is a short essay, in what follows I take a US-centered approach to the legal questions created by anonymity. Other countries that lack a First Amendment may find other solutions to these problems that are more or less restrictive than those suggested by US law, which itself remains unclear in important respects. Remarkably, however, the reality of the Internet is that the technology for sending e-mail messages anonymously ("anonymous remailers") is already in use both here and abroad: the whole world can now enjoy (or suffer) the fruits of anonymous remailers located anywhere.
{par. 5} The US legal regime can thus be viewed as a baseline; any country with a more restrictive approach to anonymity can expect to see it undermined by the US rules. Similarly, should the United State's rules change to restrict anonymity, as they might some day, these new rules can easily be undermined by persons in any another country with adequate connectivity and a legal regime more congenial to anonymous communication.
{par. 6} The remainder of this essay is divided into three parts. First, I will address the technology for achieving anonymity using available Internet communications facilities and the opportunities these create. Second, I will discuss the problems that readily-available anonymity will almost surely bring. Finally, I will address the legal issue of whether the U.S. government may ban, partially or entirely, the use of anonymity in communications.
{par. 7} Currently the Internet makes anonymity fairly easy-but only for the limited set of interpersonal transactions that require no manipulation of the physical realm. Basically, anything you can do with words and pictures, you can do anonymously on the Internet by routing your messages through an anonymous remailer. While limited in its scope, this communicative anonymity allows users to engage in political speech without fear of retribution, to engage in whistle-blowing while running a greatly reduced risk of detection, and to seek advice about embarrassing personal problems without fear of discovery-something that is hard to do by telephone in this age of caller ID.
{par. 8} If you want to publish leaflets anonymously in the old-fashioned way, you have to find a way to print and distribute them without being noticed; if the leaflets might attract the attention of someone armed with modern forensic techniques, you want to take great pains to avoid identifying marks such as distinctive paper or fingerprints.
{par. 9} In contrast, on the Internet communications are all digital; the only identifying marks they carry are information inserted by the sender, the sender's software, or by any intermediaries who may have relayed the message while it was in transit. Ordinarily, an e-mail message, for example, arrives with the sender's return address and routing information describing the path it took to get from sender to receiver; were it not for that information, or perhaps for internal clues in the message itself ("hi dad!"), there would be nothing about the message to disclose the sender's identity.
{par. 10} Enter the anonymous remailer. Remailers vary, but all share the common feature that they delete all the identifying information about incoming e-mails, substitute a predefined header identifying the remailer as the sender or using a cute tag such as nobody@nowhere. A list of remailers and their features, as well as current information about their recent performance statistics can be found at the University of California at Berkeley.
{par. 11} Before discussing remailers in any detail, it is useful to distinguish between four types of communication in which the sender's physical (or "real") identity is at least partly hidden: (1) traceable anonymity, (2) untraceable anonymity, (3) untraceable pseudonymity, and (4) traceable pseudonymity. The objective of these categories is to disentangle concepts that are otherwise conflated: whether and how an author identifies herself as opposed to whether and how the real identity of the author can be determined by others.
{par. 12} To make the examples that follow clearer, in each case Alice will be the person sending an e-mail message to Bob. Ted, Ursula, and Victor will be remailer operators, and Carol a judge with subpoena power.
{par. 13} Any electronic communication, even live two-way "chat" communication, can theoretically be made anonymous. In current practice, anonymous remailer technology applies to e-mail, and hence is used for communication to individuals, mailing lists, and "newsgroup" discussions. E-mail offers the simplest case, and although e-mail remailer technology may not yet be as user-friendly as it could be, it is available to anyone who knows where to look-and can even be found on an easy-to-use world wide web page.
{par. 14} A remailer that gives the recipient no clues as to the sender's identity but leaves this information in the hands of a single intermediary, is a system of traceable anonymity. In the simplest example, Alice sends an unencrypted e-mail to a remailer operated by Ted, with instructions to forward the e-mail to Bob. Ted's remailer deletes Alice's identifying return address and sends the message on to Bob purporting to be from "nobody@remailer.com".
{par. 15} Alice has no way of knowing whether Ted has logged the message, keeping a record of Alice and Bob's e-mail addresses, or indeed the entire text of the message. If Ted has done this, then Bob can find out who sent him the message by persuading Ted to tell him-or, in some cases, if the message appears to violate a law, by enlisting the aid of Carol, a judge with subpoena power. Of course, if Ted lives in another country, outside Carol's jurisdiction, there may be little that Carol can do to assist Bob in his quest to persuade Ted to reveal Alice's identity. Many countries do have agreements for judicial assistance, but these can be costly, difficult, and in many cases require that the act complained of be illegal in both nations. [FN 2]
{par. 16} Although traceable anonymity offers the lowest security of the four categories, it suffices for many purposes. Some messages do not require any more security than a new header. There have been occasions when I have posted messages to newsgroups and received a great deal of unwanted e-mail in reply because my e-mail signature identifies me as a law professor. One way to avoid getting requests for free legal advice is to delete the signature and route comments through a remailer. That simple expedient suffices because the consequences of my being discovered as the author of my posts on legal topics are not terribly severe.
{par. 17} In general, however, sending a message with sensitive information directly to a remailer for immediate forwarding to the intended recipient requires an inordinate amount of trust that the remailer operator will not read or copy the message or report the sender to the appropriate authorities. I have often thought that a nice novel could be written using a crooked remailer operator as its central character: imagine that Ted opens up for business, runs a fine remailer for a few years, collects many guilty secrets, and then retires on his blackmail profits.
{par. 18} Much greater security, and nearly iron-clad anonymity, can be achieved at the price of somewhat greater complexity through the use of "untraceable anonymity."
{par. 19} By "untraceable anonymity" I mean a communication for which the author is simply not identifiable at all. For example, if Alice drops an unsigned leaflet with no fingerprints on Bob's doorstep in the dead of night when no one is looking, her leaflet is "untraceably anonymous."
{par. 20} Current Internet technology allows this form of anonymity by the routing of messages through a series of anonymous remailers. This technique is called "chained remailing" and is about as anonymous as directed communication gets these days. Nothing is foolproof, however: as explained below, if Alice has the bad luck to use only compromised remailers whose operators are willing to club together to reveal her identity, she is just out of luck. Assuming the good faith of even one member of the chain, however, Alice can ensure that no single remailer operator can connect her to the message Bob receives so long as she uses both encryption and chaining. [FN 3]
{par. 21} At the simplest level, encryption ensures that the first remailer operator cannot read the message and effortlessly connect Alice to Bob and/or the contents. But encryption also has a far more important and subtle role to play. Suppose that Alice decides to route her anonymous message via Ted, Ursula, and Victor, each of whom operates a remailer and each of whom has published a public key in a public-key encryption system such as PGP. [FN 4] Alice wants to ensure that no member of the chain knows the full path of the other remailers handling the message; anyone who knew the full path would be able to identify Alice from the message Bob will receive. On the other hand, each member of the chain will necessarily know the identity of the immediately previous remailer from which the message came, and of course the identity of the next remailer to which the message will be sent.
{par. 22} Alice thus wants Ted, the first member of the chain, to remove all the information linking her to the message; she is particularly anxious that Ted not be able to read her message since he is the one party in the chain who will know that Alice sent it. Alice also wants Ted to know only that the message should go to Ursula, and to remain ignorant of the message's route thereafter. Alice wants Ursula, the second member of the chain, to know only that the message came from Ted and should go to Victor; Victor should know only that it came from Ursula and should go to Bob, although by the time the message reaches Victor, Alice may not care as much whether Victor can read the message since her identity has been well camouflaged.
{par. 23} Alice achieves these objectives by multiply encrypting her message, in layers, with Ted, Ursula and Victor's public keys. As each remailer receives the message, it discards the headers identifying the e-mail's origins and then decrypts the message with its private key, revealing the next address, but no more. If one thinks of each layer of encryption as an envelope, with an unencrypted address on it, one can visualize the process as the successive opening of envelopes, as follows:
{par. 24} Alice sends a message to Ted as follows:
TO: Ted ------message encrypted with Ted's public key------ | | Please forward to: Ursula | | --message encrypted with Ursula's public key-- | | | | Please forward to: Victor | | | | --message encrypted with Victor's pub. key--- | | | | | | Please forward to: Bob | | | | | | Text of anonymous message. | | | | | | Ideally this is encrypted with | | | Bob's public key, but even if it | | | is plaintext, Victor should be | | | unable to connect it to Alice so | | | long as Alice remembers not to | | | sign her name. | | | | | | | | | ---------------------------------------------------{par. 25} Chaining the message through Ted, Ursula, and Victor means that no remailer operator alone can connect Alice to either the text of the message or Bob. Of course, if Ted, Ursula and Victor are in a cabal, or all in Carol's jurisdiction and keep logs that could be the subject of a subpoena, Alice may find that Bob is able to learn her identity. All it takes to preserve Alice's anonymity, however, is a single remailer in the chain that is both honest and either erases her logs or is outside Carol's jurisdiction
{par. 26} By now the reader may be wondering what sort of information would be worth all of this trouble. I confess that I have never used more than a single remailer myself, and have never bothered to encrypt any of my messages; I created my own PGP key [FN 5] purely for demonstration purposes.
{par. 27} Nevertheless, it is not difficult to imagine that some people might have a legitimate need for untraceable anonymous communication. Persons who wish to criticize a repressive government or foment a revolution against it may find remailers invaluable. Indeed, given the ability to broadcast messages widely using the Internet, anonymous e-mail may become the modern replacement of the anonymous handbill. Other examples include corporate whistle-blowers, people criticizing a religious cult or other movement from which they might fear retaliation, and persons posting requests for information to a public bulletin board about matters too personal to discuss if there were any chance that the message might be traced back to its origin.
{par. 28} Unlike the anonymous handbill, the anonymously remailed e-mail can allow Alice and Bob to communicate without knowing each other's identity, and while preserving the "untraceable" nature of their communications. If Alice wants Bob to be able to reply to her message, she can include her return address encrypted with the public keys belonging to a series of remailers, e.g. Victor, Ursula and Ted; Alice then instructs Bob to mail his reply to Victor. Cryptography thus vastly enhances communicative privacy and anonymity.
{par. 29} Untraceable anonymous electronic speech also opens the door to a darker side of undetectable communication: anonymous communication is a great tool for evading detection of illegal activity. Conspiracy, electronic hate-mail and hate-speech in general, electronic stalking, libel, disclosure of trade secrets and other valuable intellectual property all become low-risk activities if conducted via anonymous communications. (These activities are merely low-risk rather than no-risk because it always remains possible to infer the identity of the author of some messages from clues intrinsic to the message itself. For example, a whistle-blower can sometimes be identified if the circle of people who had access to the information was small).
{par. 30} Although opinions in different parts of the world may differ as to whether this is a good or a bad thing, easily available anonymous communication spells the end of restrictive national policies regarding information. Any government that allows its citizens to become a part of the global electronic network will be forced to live with a freedom of speech even greater than contemplated by the authors of the First Amendment, as citizens will be able to criticize their society with little fear of retribution, and will have easy access to messages from around the world giving alternative points of view. Rules seeking to limit the importation of "subversive" or "obscene" speech become essentially impossible to enforce so long as the country remains connected to the Internet. Similarly, rules seeking to control the export of information such as the International Traffic in Arms Regulations or "ITAR" will become even more difficult to enforce. [FN 6]
{par. 31} Suppose Alice is a repeat participant in a broadcast medium such as USENET or a mailing list. She may not wish to sign her name to her messages, but she desires to engage in discussion and debate with other list members and she wishes to do so under a continuous identity. Alice decides to sign her messages as "Andrea". Alice could, however, have chosen to sign her messages as "Frank", on the theory that this might allow her to avoid anti-female discrimination. Indeed, either sex can masquerade as the other; children as adults (and vice-versa). If nothing else, this creates some potential for embarrassment, and concerns some parents.
{par. 32} Like fully anonymous messages, pseudonymous messages come in two varieties: traceable and untraceable. The advantage of traceable pseudonymity is that it gives the sender a nom de plume that allows other parties to send replies far more easily than is possible with any untraceable system.
{par. 33} Untraceable pseudonymity works just like untraceable anonymity, except that Alice chooses to sign her message as Andrea, a pseudonym. If Alice is worried that someone else may try to masquerade as Andrea, she can sign her message with a digital signature generated specially for "Andrea," which will uniquely and unforgeably distinguish an authentic signed message from any counterfeit. By participating in discussions under a consistent pseudonym-often abbreviated to "nym" on the Internet-Alice can establish Andrea as a digital persona.
{par. 34} As computer security consultant Hal Finney noted,
{par. 35} [N]yms allow for continuity of identity to be maintained over a period of time. A person posting under a nym can develop an image and a reputation just like any other online personality. Most people we interact with online are just a name and an e-mail address, plus whatever impression we have formed of them by what they say. The same thing can be true of nyms. Cryptography can also help maintain the continuity of the nym, by allowing the user to digitally sign messages under the name of the nym. The digital signature cannot be forged, nor can it be linked to the True Name of the user. But it makes sure that nobody can send a message pretending to be another person's nym. [FN 7]
{par. 36} Traceable pseudonymity is communication with a nom de plume attached which can be traced back to the author (by someone), although not necessarily by the recipient. While a traceable pseudonymous system makes it much easier for someone to discover Alice's identity, it usually offers one large compensating advantage: the recipients of Alice's message can usually reply to it by sending e-mail directly to the pseudonymous e-mail address in the "From:" field of the message. The message will then either go to Ted, the remailer operator, who keeps an index of the addresses that link Andrea to Alice, or in the case of commercial service providers who allow subscribers to use pseudonymous IDs, directly to Alice's account.
{par. 37} Anon.penet.fi, probably the best-known "anonymous" remailer, is in fact merely a traceable pseudonymous remailer:
{par. 38} [Anon.penet.fi] provides a front for sending mail messages and posting news items anonymously. As you send your very first message to the server, it automatically allocates you an id of the form anNNN, and sends you a message containing the allocated id. This id is used in all your subsequent anon posts/mails. Any mail messages sent to your-id@anon.penet.fi gets redirected to your original, real address. Any reply is of course anonymized in the same way, so the server provides a double-blind. You will not know the true identity of any user, unless she chooses to reveal her identity explicitly.
{par. 39} In the anonymization process all headers indicating the true originator are removed. [FN 8]
{par. 40} The anon.penet.fi system keeps a record of each user's e-mail address. Its security therefore depends critically on the willingness of the operator, Johan Helsingius, a Finnish computer scientist, to refuse to disclose the contents of his index which maps each anonymous ID to an e-mail address. In February 1995, the Church of Scientology successfully enlisted the aid of the Finnish police, via Interpol, to demand the identity of a person who had, the Church of Scientology claimed, used anon.penet.fi to post the contents of a file allegedly stolen from a Scientology computer to a USENET group called "alt.religion.scientology." Unprepared for the request, Helsingius surrendered the information, believing that the only alternative would have been to have the entire database seized by the police.
{par. 41} Cryptologists have worked out methods for creating and transmitting the equivalent of cash over a network like the Internet. This "electronic cash" or "ecash" would allow buying and selling goods or services over the Internet without a record of the buyer's identity being maintained by either seller or bank, in just the way that cash transactions take place today. These methods are more complicated than can be explained here, but essentially involve patented and other techniques that rely on intelligent "smart cards" and/or sophisticated forms of encryption, plus the cooperation of banks and merchants. [FN 9] Some complexity is, however, required to prevent people from copying their digital cash and spending it twice. Using these techniques, customers can acquire e-cash from a bank without disclosing their identity, and the bank can issue it knowing that anyone who tries to spend it twice will risk revealing their identity. [FN 10]
{par. 42} Any digital cash system vastly expands the commercial possibilities of the Internet, particularly if the system has low transaction costs. With low transaction costs, pay-per-view/pay-per-byte systems in which pennies or less are charged to view an article or picture on the world wide web become a real possibility. Without anonymous digital cash, however, each payment creates the possibility of a record, which when combined with other similar records becomes a consumer profile.
{par. 43} Some persons may not wish to have their purchases recorded because they would be embarrassed to be identified as purchasers of subversive or erotic materials; others will want to avoid the junk mail that may result from being identified as the likely purchaser of a particular kind of good. All other things being equal, I personally would prefer not to have my buying habits profiled, partly because as a contrarian I just resent it, and partly because it weakens my negotiating position. If sellers know that I have bought the last fifteen virtual reality simulators with an underwater theme, they may decide not to offer me a discount on the next one; if they practice perfect price discrimination, they may try to charge me extra. On the other hand, if my digital persona can pay with anonymous e-cash, I may be in a better bargaining position.
{par. 44} Electronic anonymity is an empowering technology: it gives users the power to do some things without being identified. Anonymity, nymity, and anonymous e-cash protect both valuable and harmful things: the congenitally shy and the electronic political pamphleteer benefit as much as the hate mailer or the perpetrator of perfect crimes.
{par. 45} The introduction of anonymous, untraceable, e-cash will greatly increase the range of interpersonal transactions that can be conducted anonymously. One can imagine on-line fraud, in which a digital personality provides attestations from hundreds of satisfied customers, each of whom is nothing more than another digital personality created by the author of the fraud. While it is possible to envision sophisticated reputation systems that would reveal many such manufactured attestations, these do not currently exist, and might be cumbersome to use.
{par. 46} Other unsavory possibilities include vastly simplified insider trading in securities transactions, the sale of corporate and personal secrets, blackmail and other "perfect crimes." A perfect crime works as follows: The criminal commits an act of extortion, for example, blackmail or kidnapping, which does not require face-to-face contact with the victim to make the demand for money. Instead of demanding small unmarked bills, the extortionist demands that the victim publish the digital signatures of a large quantity of e-cash in a newspaper. Because the payoff occurs via publication in a broadcast medium such as a newspaper of a USENET group the extortionist faces no danger of being captured while attempting to pick up the ransom. And because the e-cash is untraceable, the extortionist is able to spend it without fear of marked bills, recorded serial numbers, or other forms of detection. [FN 11]
{par. 47} If untraceable e-cash becomes a reality, any transaction that one could persuade an agent to undertake for a digital payment could be commanded anonymously, with even the agent ignorant as to the identity of the principal. One can imagine that some people might be more willing to hire hit-men, for example, if they felt secure that the crime could never be traced back to them; on the other hand, the hit men might not be that interested in advertising their true identities either, which might dissuade potential customers from making the necessary payments in advance. Crypto-anarchist philosopher Tim May has thoughtfully described a protocol for a system involving a mutually trusted (and also anonymous) third party who makes a business of selling escrow services and thus needs to maintain a good reputation, who facilitates such transactions by holding on to the money until the hit is verified. [FN 12]
{par. 48} Although the implications of anonymous transactions for taxes, product liability, and copyright, remain to be worked out, it seems to me likely that the effects will be unevenly distributed. I do not believe that the tax system will be deeply affected, since most production and even more consumption involves transactions that are easily monitored for tax compliance. Furthermore, any transaction that encounters the banking system-for example, deposits placed on short-term interest-will be easily traceable for tax purposes so long as the bank is located in a jurisdiction that enlists banks as enforcers of its, or its treaty-partners', tax rules. I, for example, get my income from a salary paid by an institution that has no incentive to make it easy for me to engage in tax avoidance. My house is plainly visible from the street, and as easily taxed as it can be linked to me. Most of what I buy is tangible-things like groceries, diapers and baby shoes-and can easily be taxed under a VAT system if our current tax system should show signs of collapse. Though some knowledge workers may be able to demand that payment be routed through untaxed off-shore addresses, thus causing an effect at the margin, I think such schemes will remain only marginal for the foreseeable future.
{par. 49} In contrast, I suspect that the intellectual property regime faces a much greater threat. The recent disclosure of source code for what purported convincingly to be the proprietary unpatented RC4 algorithm is a case in point. The proprietary value of that trade secret is now much less than it was a few months ago.
{par. 50} I have argued elsewhere that digital anonymity may be a rational response to a world in which the quantity of identifying data on each of us grows daily, and the data become ever easier for government and private parties to access. Not everyone agrees. Justice Scalia summed up put the case against anonymity in McIntyre, v. Ohio Elections Commission [FN 13] Anonymity, he wrote, is generally dishonorable: "It facilitates wrong by eliminating accountability, which is ordinarily the very purpose of the anonymity." [FN 14] To create legal protection for anonymous communication absent a reason to expect "threats, harassment, or reprisals," he argued, "seems to me a distortion of the past that will lead to a coarsening of the future." [FN 15]
{par. 51} Many agree with Justice Scalia that widespread anonymity will lead to an unpleasant society. Sissela Bok argues eloquently that a society in which "everyone can keep secrets impenetrable at will" be they "innocuous ... [or] lethal plans," noble acts or hateful conspiracies, would be undesirable because "[i]t would force us to disregard the legitimate claims of those persons who might be injured, betrayed, or ignored as the result of secrets inappropriately kept." [FN 16]
{par. 52} This inability to redress legitimate claims is, I believe, the strongest moral objection to the increase in anonymous interaction. It is also clearly an objection with popular resonance, as a recent Wall Street Journal column [FN 17] critiquing the growth of anonymous communication on the Internet illustrates. It is not, however, an objection that receives much support from the Constitution-although the issue is less settled than one might believe from the pro-anonymity outcomes of recent Supreme Court decisions.
{par. 53} Anonymity has often had a good press in the United States. Perhaps the most famous political tract in this country's history, the Federalist Papers, were written pseudonymously. In 1958, The Supreme Court upheld the right of members of the NAACP to refuse to disclose their membership lists to a racist and surely vengeful state government, [FN 18] a decision that I imagine almost every lawyer in the US would endorse today. Simultaneously, however, the United States has nurtured a deep-seated fear of conspirators and conspiracy, [FN 19] with the McCarthyite witch-hunts of the 1950's being only one of the more lurid examples. Anonymous communication is of course a superb tool for the conspirator.
{par. 54} The US Constitution does not guarantee a right to be anonymous in so many words. The First Amendment's guarantees of free speech and freedom of assembly have, however, been understood for many years to provide protections for at least some, and possibly a great deal, anonymous speech and secret association.
{par. 55} Political speech receives the highest Constitutional protection because it "occupies the core of the protection afforded by the First Amendment;" [FN 20] other types of speech, notably "commercial speech," sometimes receive a reduced level of First Amendment protection. Core political speech need not center on a candidate for office, but can affect any matter of public interest-especially if it is an issue in an election. [FN 21]
{par. 56} The Supreme Court has repeatedly noted the existence of a "profound national commitment to the principle that debate on public issues should be uninhibited, robust, and wide-open," [FN 22] which would presumably include protections for anonymous speech. Indeed, the Supreme Court's most recent opinion on the right to anonymous speech states that "an author's decision to remain anonymous, like other decisions concerning omissions or additions to the content of a publication, is an aspect of the freedom of speech protected by the First Amendment" and "the anonymity of an author is not ordinarily a sufficient reason to exclude her work product from the protections of the First Amendment." [FN 23] Despite these ringing words, whether there is a right to be anonymous in the US remains unclear as a general matter, since difficult cases are precisely those in which exceptions are made to fit facts that sit uncomfortably within the rules that apply "ordinarily."
{par. 57} Broad prohibitions of anonymous speech, such as ordinances prohibiting all anonymous leafleting, are an unconstitutional abridgment of free speech. [FN 24] The Supreme Court has also tended to be highly solicitous of the need of dissidents and others to speak anonymously when they have a credible fear of retaliation for what they say. Thus, the Supreme Court has struck down several statutes requiring public disclosure of the names of members of dissident groups. [FN 25]
{par. 58} Nevertheless, the right to privacy in one's political associations and beliefs can be overcome by a compelling state interest. The state interest in forbidding discrimination in places of public accommodation has been held to be sufficiently compelling to meet this test. [FN 26] In contrast, the recent McIntyre decision found that the state's "interest in preventing fraudulent and libelous statements and its interest in providing the electorate with relevant information" was insufficiently compelling to justify a ban on anonymous speech. [FN 27] .
{par. 59} As ringing a defense of the First Amendment as the Talley and McIntyre decisions may be, they involved political speech. At most, they merely suggest the outcome for cases involving anonymous speech that is not "political speech" and hence not "core" First Amendment speech. It is also important to understand that the anonymity cases decided by the Supreme Court involved very broadly drafted statutes, and that the Supreme Court has carefully left open the question whether a statute regulating (or prohibiting) anonymous speech would survive review if the statute were narrowly tailored, e.g. to "provid[e] a way to identify those responsible for fraud, false advertising and libel." [FN 28]
{par. 60} Quite possibly the Supreme Court would uphold a "narrowly tailored" statute prohibiting anonymity even in the context of political speech if the statute had clear and palatable objectives. This possibility seems all the more real when one considers the contexts in which the Supreme Court has already sustained limitations on the privacy of individuals engaged in the political process.
{par. 61} Not even political speech is immune from regulation. Despite its privileged position, political speech can be regulated given sufficient cause, especially if the regulation is content-neutral. An example of sufficient cause is the state interest in ensuring compliance with campaign finance contribution limits.
{par. 62} For example, in Buckley v. Valeo, [FN 29] the Supreme Court upheld a statute forbidding donations of more than $1,000 to a candidate for federal office, and compelling disclosure to the Federal Election Commission of the names of virtually all cash donations. [FN 30] Since the Court in the same decision essentially equated the expenditure of money in campaigns with the ability to amplify political speech, [FN 31] the decision appears to say that given a sufficiently weighty objective, and a statute carefully written to minimize the chilling or otherwise harmful effects on speech, even political speech can be regulated.
{par. 63} Similarly, in First Nat. Bank of Boston v. Bellotti, [FN 32] the Supreme Court struck down a state requirement forbidding corporations from making political contributions except for ballot measures directly affecting its business, but it contrasted the unconstitutional state law with others that it suggested would surely be acceptable: "Identification of the source of advertising may be required as a means of disclosure, so that the people will be able to evaluate the arguments to which they are being subjected." [FN 33] The Supreme Court again noted the communicative importance of the identity of a speaker, albeit in a different context, in City of Ladue v. Gilleo. [FN 34]
{par. 64} The implications for the regulation of anonymity-even in the context of political speech-are obvious, and were not lost on the Supreme Court of California, which recently upheld a state statute forbidding anonymous mass political mailings by political candidates. [FN 35] The facts involved a political dirty trick: Griset had sent a mass mailing attacking his opponent and pseudonymously purporting to be from a neighborhood association. The court concluded that prospective voters could have been deceived into thinking that Griset had "grass roots" support. [FN 36]
{par. 65} The California court reasoned that this sort of deception was the evil that the statute was designed to cure, and that the ban was necessary to further the state's interest in "well-informed electorate" at election time and was "narrowly drawn to meet that goal." [FN 37] The Court therefore distinguished Griset from federal Supreme Court decisions, such as Talley, supra, Bates v. City of Little Rock, [FN 38] and NAACP v. Alabama, [FN 39] that the First Amendment freedom of association limited the state's ability to pierce an organization's anonymity.
{par. 66} Once down this slippery slope of regulation it is notoriously difficult to find a logical place to stop. (I can't help quoting my first year Torts teacher, however, who derided slippery slope arguments as "fear of doing the right thing today for fear of being forced to do the right thing tomorrow.")
{par. 67} A particularly difficult case might be a statute that sought to ban all anonymity in political campaigns on the theory that if the message is not signed with the actual name of the author, it is impossible to know whether it originated in a political campaign, and thus constitutes actionable lies about an opponent, or potentially violates campaign finance expenditure limits. This would juxtapose the Talley-McIntyre line of cases with the Buckley-Griset line of cases. Without forcing everyone to sign their messages there may, it could be argued, be no way to monitor what campaigns spend, and thus no way to ensure they do not seek to get an edge by spending beyond the legal limits.
{par. 68} In the glow of McIntyre's rhetoric about the importance of anonymity to the political and literary tradition, it is all too easy to think that anonymity in cyberspace would surely triumph. Yet there is reason to doubt, especially because in McIntyre Justice Stevens himself carefully distinguished earlier cases upholding statutes that sought to preserve the integrity of the voting process, e.g. Anderson v. Celebrezze, [FN 40] Storer v. Brown, [FN 41] Burdick v. Takushi, [FN 42] and Burson v. Freeman. [FN 43] The issue is far from resolved.
{par. 69} If anonymous political speech, the type of anonymous speech that would receive the highest level of protection, is potentially subject to considerable regulation, then other forms of anonymous and pseudonymous speech are potentially subject to even greater controls. Despite the turmoil in Commerce clause jurisprudence recently introduced by United States v. Lopez, [FN 44] I think it would remain within the commerce clause power of Congress to ban anonymous digital cash. Since we know that money equals speech in some political contexts, but that money can nonetheless be regulated in that context, it seems likely that anonymous money could be regulated more generally.
{par. 70} Whether any of this would be a wise policy, however, is a different question.
{par. 71} Lilly Tomlin used to do a routine as an elementary school teacher in which she threatened children that they had better do as she said, or she would make an entry on their "permanent record that will follow you for the rest of your life." If it seemed far-fetched back then, it seems all too plausible now.
{par. 72} As records proliferate, fresh starts are harder to come by, privacy, even personal identity, are becoming less personal, more commodified. The drift towards national identity cards, whether de facto or de jure, exemplifies these trends. Anonymity is the great potential corrective to all these trends, and is relatively easy to achieve in electronic communication over the Internet through a combination of encryption and chained computers running remailer programs. Yet anonymity can further undesirable goals as well. Thus the dilemma.
{par. 73} The legal fight over anonymity is likely to be fought on the terrain of free speech. Increasing use of anonymity on the net will lead to anonymity being seen as a First Amendment problem, to be filtered through the lenses of McIntyre, Buckley, and related cases. These cases show that anonymity has a long pedigree in our society and a valued role in our political life. But, like speech generally, anonymity will not necessarily trump all opposing values. It appears likely that limited bans on the practice might well be upheld. The harder question, of course, is: should they be?
{par. 74} A wealth of information on anonymous remailers is located at <http://chaos.taylored.com:1000/1/Anonymous-Mail>.
{par. 75} An introductory "Anonymous Remailer FAQ" maintained by Andé Becard (author of The Computer Privacy Handbook (1995), can be found at <http://www.cs.berkeley.edu/ ~raph/remailer-faq.html>.
{par. 76} A good essay on importance of latency, and on mixmaster, <http://nately.ucsd.edu/~loki/remailer-essay.html>.
Copyright to the Journal of Online Law as a collective work belongs to the editor. Authors retain the copyright to their individual articles, but unless otherwise noted in an individual article, all authors and the journal's editor agree to the following:
Classroom use. Electronic or paper copies of the journal or its individual articles may be made for classroom use, provided that the copies are distributed at or below the cost of reproduction and the author(s) and the Journal of Online Law are credited and identified as the copyright holders.
Other uses. The journal may be distributed by individuals to individuals for non-commercial purposes, but not by means of distribution lists, listserv lists, newsgroups, BBS postings, multiple copies, or other bulk distribution, access, or reproduction mechanisms that substitute for a subscription or authorized individual access, or in any manner that is not a good faith attempt to comply with these restrictions.
Other postings. Because the WWW posting of the journal will likely be somewhat interactive, issues and articles may evolve and change over time. To ensure that readers are reading the up-to-date version, we ask that JOL not be posted on the Web except in its authorized location (currently Cornell University). But _
Links. Links from other sites to JOL's WWW and Gopher sites are encouraged.
NOTE 1: Copyright 1995 A. Michael Froomkin, Associate Professor of Law, University of Miami School of Law, B.A. 1982, Yale College; M.Phil. 1984, Cambridge University; J.D. 1987, Yale Law School. Thanks are due to Trotter Hardy for asking me to write this article; to Caroline Bradley; and to Mark Lemley. E-mail address: Michael Froomkin: <http://acr.law.miami.edu>.
NOTE 2: But see discussion of the anonymous remailer "anon.penet.fi," in this article, at par. 36ff.
NOTE 3: Actually, even these two may not be enough to foil a determined eavesdropper who is able to track messages going in and out of multiple remailers over a period of time. To foil this level of surveillance, which has nothing to do with the good faith of the remailer operators, requires even more exotic techniques including having the remailers alter the size of messages and ensuring that they are not remailed in the order they are received. See Lance Cottrell's home page on Mixmaster: <http://obscura.com/~loki/ Mixmaster.FAQ.html>.
NOTE 4: "PGP" stands for "Pretty Good Privacy." It is a type of robust encryption, which when used with a long key is unbreakable in any reasonable period of time by currently known techniques.
NOTE 5: My key is
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6
mQCNAi4ztDUAAAEEAMjCVU3S9YJDTYD3f3XO1bZGCC0+zGLXrUE3ww0YwCktzp5r
OCR1sE4OxoLlGrECH9A/BVw0KAm7mpwb7n3wIg7TfasRmbDEKcc9jZfc9xlPpavD
TSXAx3a3Ab3R5PTJEl76EF2lU2jnVE7wo2GI1wZQuRDYFPWHwXpsXYZGTrN1AAUR
tC9NaWNoYWVsIEZyb29ta2luIDxtZnJvb21raUB1bWlhbWkuaXIubWlhbWkuZWR1
Pg==
=qpGN
-----END PGP PUBLIC KEY BLOCK-----
NOTE 6: Anonymous communication will be less effective in undermining the ITAR to the extent that their true goal is to restrict the emergence of a standard mass-market encryption product. Until anonymous e-cash is wide-spread, no commercial software publisher in the US will risk violating the ITAR since there is no effective means for them to charge for their products and yet maintain the anonymity they would require to avoid any risk of prosecution.
NOTE 7: Archived at <Gopher copy>.
NOTE 8: The anon.penet.fi help file can be found at <HTTP copy>.
NOTE 9: See David Chaum, Achieving Electronic Privacy, SCI. AM., Aug. 1992, at 96, 96-97 (discussing electronic cash), also available at <HTTP copy>. Chaum's protocols ensure that spending e-cash more than once reveals the identity of the person spending the token.
NOTE 10: See <HTTP copy> and <HTTP copy>
NOTE 11: See Sebastiaan von Solms and David Naccache, On Blind Signatures and Perfect Crimes, 11 COMPUTERS & SECURITY 581, 582-83 (1992) (describing the mathematical steps that must be followed in order to effectuate a "perfect crime").
NOTE 12: See Timothy C. May, The Cyphernomicon secs. 2.9, 8.5 (Sept. 10, 1994), <FTP copy>. A hypertext version of this document is available from <HTTP copy>. See secs. 2.13.9 & 16.16.
NOTE 13: 63 U.S.L.W. 4279 (U.S. April 18, 1995). Scalia, J. dissenting slip. op. No. 93-986 April 19, 1995).
NOTE 14: 63 U.S.L.W. 4279, 4293-94 (Scalia, J., dissenting).
NOTE 15: Id. at 4294.
NOTE 16: SISSELA BOK, SECRETS: ON THE ETHICS OF CONCEALMENT AND REVELATION 16, 28 (1982).
NOTE 17: The Wall Street Journal, Thursday January 26, 1995, p. B1.
NOTE 18: NAACP v. Alabama ex rel. Patterson, 357 U.S. 449 (1958).
NOTE 19: I discuss the US hypersensitivity to conspiracy in A. Michael Froomkin, The Metaphor Is the Key: Cryptography, the Clipper Chip, and the Constitution, 143 U. PENN. L. REV. 709, 850-62 (1995).
NOTE 20: McIntyre v. Ohio Elections Commission, 63 U.S.L.W. 4279 (U.S. April 18, 1995) (slip. op. No. 93-986 April 19, 1995).
NOTE 21: See First Nat. Bank of Boston v. Bellotti, 435 U.S. 765, 776-777 (1978).
NOTE 22: New York Times Co. v. Sullivan, 376 U.S. 254, 270 (1964).
NOTE 23: McIntyre v. Ohio Elections Commission, 63 U.S.L.W. 4279 (U.S. April 18, 1995).
NOTE 24: McIntyre v. Ohio Elections Commission, 63 U.S.L.W. 4279 (U.S. April 18, 1995); Talley v. California, 362 U.S. 60 (1960).
NOTE 25: See, e.g., Brown v. Socialist Workers' 74 Campaign Comm., 459 U.S. 87, 91 (1982) (holding that the "Constitution protects against the compelled disclosure of political associations"); Hynes v. Mayor of Oradell, 425 U.S. 610, 623-28 (1976) (Brennan, J., concurring in part) (asserting that a disclosure requirement puts an impermissible burden on political expression); Shelton v. Tucker, 364 U.S. 479, 485-87 (1960) (holding invalid a statute that compelled teachers to disclose associational ties because it deprived them of their right of free association); Talley v. California, 362 U.S. 60, 64-65 (1960) (voiding an ordinance that compelled the public identification of group members engaged in the dissemination of ideas); Bates v. City of Little Rock, 361 U.S. 516, 522-24 (1960) (holding, on freedom of assembly grounds, that the NAACP did not have to disclose its membership lists); NAACP v. Alabama ex rel. Patterson, 357 U.S. 449, 462 (1958) ("It is hardly a novel perception that compelled disclosure of affiliation with groups engaged in advocacy may constitute ... restraint on freedom of association ...."); Joint Anti-Fascist Refugee Comm. v. McGrath, 341 U.S. 123, 145 (1951) (Black, J., concurring) (expressing the fear that dominant groups might suppress unorthodox minorities if allowed to compel disclosure of associational ties). But see Communist Party of the United States v. Subversive Activities Control Bd., 367 U.S. 1, 85 (1961) (declining to decide whether forced disclosure of the identities of Communist Party members was an unconstitutional restraint on free association); New York ex rel. Bryant v. Zimmerman, 278 U.S. 63, 77 (1928) (holding that a required filing of group members' names with the state constituted a legitimate exercise of police power).
NOTE 26: See Board of Directors of Rotary Int'l v. Rotary Club of Duarte, 481 U.S. 537, 544 (1987); see also New York State Club Ass'n v. City of New York, 487 U.S. 1, 13 (1988) (stating that freedom of expression is a powerful tool used in the exercise of First Amendment rights); Roberts v. United States Jaycees, 468 U.S. 609, 617-19 (1984) (recognizing that an individual's First Amendment rights are not secure unless those rights may be exercised in the group context as well).
NOTE 27: 63 U.S.L.W. 4279, 4283 (U.S. April 18, 1995).
NOTE 28: See Talley, 362 U. S., at 64, also discussed in McIntyre, 63 U.S.L.W. 4279, 4282 n. 7.
NOTE 29: 424 U.S. 1, 143 (1976).
NOTE 30: Id. at 23-29, 60-84.
NOTE 31: Id. at 19.
NOTE 32: 435 U.S. 765 (1978).
NOTE 33: Id. at 792 n.32.
NOTE 34: 114 S. Ct. 2038, 2046 (1994) (noting that a poster in front of a house associates speech with the identity of the speaker).
NOTE 35: Griset v. Fair Political Practices Comm'n, 884 P.2d 116, 126 (Cal. 1994) (upholding Cal. Government Code sec. 84305).
NOTE 36: Id. at 125.
NOTE 37: Id. at 123.
NOTE 38: 361 U.S. 516 (1960).
NOTE 39: 357 U.S. 449 (1958).
NOTE 40: 460 U.S. 780 (1983).
NOTE 41: 415 U.S. 724 (1974).
NOTE 42: 504 U.S. 428 (1992).
NOTE 43: 504 U.S. 428 (1992) (upholding law forbidding campaign-related speech within 100 feet of the entrance to polling place).
NOTE 44: 63 U.S.L.W. 4343 (April 26, 1995) (holding that the Commerce clause did not authorize Congress to regulate the use of guns near schools, at least in the absence of factual findings by Congress that the guns affected interstate commerce).