By Andrea O’Sullivan and Adam Thierer (First published at The Bridge on August 1, 2018.)

Technology is changing the ways that entrepreneurs interact with, and increasingly get away from, existing government regulations. The  ongoing legal battles surrounding 3D-printed weapons provide yet another timely example.

For years, a consortium of techies called Defense Distributed has sought to secure more protections for gun owners by  making the code allowing someone to print their own guns available online. Rather than taking their fight to Capitol Hill and spending billions of dollars lobbying in potentially fruitless pursuits of marginal legislative victories, Defense Distributed ties their fortunes to the mast of technological determinism and blurs the lines between regulated physical reality and the open world of cyberspace.

The federal government moved fast, with gun control advocates like Senator Chuck Schumer (D-NY) and former Representative Steve Israel (D-NY)  proposing legislation to criminalize Defense Distributed’s activities. They failed.

Plan B in the efforts to quash these acts of 3D-printing disobedience was to classify the Computer-aided design (CAD) files that Defense Distributed posted online as a kind of internationally-controlled munition. The US State Department engaged in a years-long legal brawl over whether or not Defense Distributed  violated established International Traffic in Arms Regulations (ITAR). The group pulled down the files while the issue was examined in court, but the code had long since been uploaded to sharing sites like The Pirate Bay. The files have also been available on the Internet Archive for many years. The CAD, if you will excuse the pun, is out of the bag.

In a surprising move, the  Department of Justice suddenly moved to drop the suit and settle with Defense Distributed last month. It agreed to cover the group’s legal fees and cease its attempt to regulate code already easily accessible online. While no legal precedent was set, since this was merely a settlement, it is likely that the government realized that its case would be unwinnable.

Gun control advocates did not react well to this legal retreat. This week, a group of eight state attorneys general (AGs) filed a lawsuit against the Trump administration and Defense Distributed to undo the group’s freedom to distribute their code online. Part of their argument is that the administration violated the Administrative Procedure Act as well as the Tenth Amendment by “infringing on states’ rights to regulate firearms.” But the move looks more like a last ditch effort by the AGs to exert control. Yesterday, a federal judge issued an injunction against Defense Distributed to prevent the files from being uploaded online. But as we mentioned, the files are and have been available across the internet for years now.

The case faces long odds. After all, they are essentially trying to regulate speech, which raises some clear First Amendment flags. This is precisely why the Department of Justice backed away from the case against Defense Distributed, and it echoes the  federal government’s previous attempts to crackdown on strong encryption practicesmore than two decades ago. Then, like now, a group of security-minded technologists wanted to bring defense technologies that were still controlled by ITAR regulations to the masses. And then, like now, activists correctly argued that any attempt to stop their online exchanges amounted to an illegal barrier to free speech in the United States. Besides, there wasn’t much that the government could do to turn back the tide of information that had already dispersed across the wide expanse of the web.

As Cody Wilson, the founder of  Defense Distributed put it: “This has been a continuous process of different levels of authority figures trying to stop it from happening and thus allowing it to happen…Of course we are going to succeed—because you all are trying to stop me. That seemed natural and ended up being true.”

Cody Wilson and Defense Distributed are not the only ones using additive manufacturing to change the world and challenge public policy in the process. The  “maker” revolution is a phenomenon that is widespread and growing. A 2016 Mercatus journal article on “Guns, Limbs, and Toys: What Future for 3D Printing?” discussed several examples of how additive manufacturing is making the governance of various emerging technologies quite challenging.

For example, “e-NABLE,” which is short for “ Enabling the Future,” is volunteer effort that brings together individuals from across the globe who design 3D–printed prosthetics for individuals (especially children) with limb deficiencies. Volunteers share open source blueprints and other information on various websites with others across the world. Then, they use their own printers to fabricate the limbs. Other entrepreneurs are creating custom 3D-printed orthoses to help children with cerebral palsy walk comfortably and without the aid of crutches. Off-the-shelf solutions were often ineffective and uncomfortable for many kids, which led some parents to craft custom-made orthoses for their own children to help them walk.

These “amateur” prosthetics are already being widely distributed today and helping to save many individuals and families significant amount of money, assuming they could have afforded “professional” prosthetics at all. While prosthetics are medical devices in a traditional regulatory sense, no one making their own is going to the FDA to ask permission for or a right to try new 3D–printed limbs. Instead, they are just going ahead and making new prosthetics for people in need. How should we regulate all this bottom-up innovation by average citizens (especially considering how much of it is non-commercial in character)?

Another interesting example from 2016 involved  Amos Dudley, a 23-year-old college student with no prior dentistry experience who used a 3D printer and laser scanner at his university to make his own orthodontics for just $60. Dudley’s DIY plastic braces were a dangerous experiment that could have put him, or others, at risk if they followed his lead. But what should the law say about people like Dudley or the eNable innovators who are creating their own specialized medical devices in an open source, non-commercial fashion?

For a more radical example, we can look to the  Four Thieves Vinegar Collective, a self-styled techno-anarchist collective dedicated to open sourcing and manufacturing alternatives to costly pharmaceutical medicines. Four Thieves harnesses the combined research output of distributed volunteer chemists, physicists, and programmers to compile and publish step-by-step instructions on how to reverse engineer treatments for maladies like AIDS and anaphylaxis. The group’s offers downloadable instructions on how to create what it calls the Apothecary MicroLab, a kind of hacked-together at-home compounding kit. The FDA is aware of, and unamused by, Four Thieves’ activities; yet it finds its hands tied by the fact that they haven’t actually done anything illegal in merely exercising their free speech rights.

These are examples of what MIT economist Eric von Hippel calls “ free innovation,” or “innovations developed and given away by consumers as a ‘free good.’” Another term for this is “social entrepreneurialism.” As the name implies, an underlying social goal or mission drives social entrepreneurship.

For example, our Mercatus Center colleagues have written about how social entrepreneurs help others in need in their community  following disasters. Social entrepreneurial activities are not typically in pursuit of compensation or profit, but that need not always be the case, and the distinction social and economic entrepreneurialism is sometimes quite blurry.

A great deal of additive manufacturing innovation today springs from a multitude of such “grassroots” or “household” efforts. As this sort of “ evasive entrepreneurialism” spreads, it will challenge regulatory regimes that are not equipped to cope with the astonishing pace of change occurring in many technology markets today.

This does not necessarily mean that governments will be completely powerless to stop highly decentralized, bottom-up innovation of this sort. For example, with firearms regulation, a gun is still a gun, regardless of how it is manufactured. Laws governing how and where firearms are carried and used will still be in effect. But “point-of-sale” type regulatory prohibitions will not work as well, obviously.

Likewise, efforts to limit the free flow of information about 3D-printed designs will be almost impossible to enforce once blueprints are available on the internet through peer-to-peer distribution mechanisms and platforms. Finally, it would not make sense for policymakers to affix liability on the makers or distributors of 3D printers because this is a general purpose technology with many other non-controversial uses.

This means that regulation should remain focused on the user and uses of firearms or other 3D-printed devices, regardless of how they are manufactured. There may also be some other steps that governments can take to educate the public about the potential risks associated with these and other examples of free innovation and social entrepreneurship.

But policymakers should also understand that many of these bottom-up innovations are being created or used by the average citizens because they fill a public need that many felt was going unmet. Entrepreneurial efforts tend to be hard to bottle up when enough demand exists for action, and the tools are becoming increasingly decentralized, low-cost, and easy to use. Instead of trying to put those technological genies back in their bottles, we are going to need to figure out how to coexist with them.

I’m pleased to announce the publication of my latest law review article, “Guns, Limbs, and Toys: What Future for 3D Printing?” The article, which appears in Vol. 17 of the Minnesota Journal of Law, Science & Technology, was co-authored with Adam Marcus. Here’s the abstract:

We stand on the cusp of the next great industrial revolution thanks to technological innovations and developments that could significantly enhance the welfare of people across the world. This article will focus on how one of those modern inventions–3D printing–could offer the public significant benefits, but not without some serious economic, social, and legal disruptions along the way. We begin by explaining what 3D printing is and how it works. We also discuss specific applications of this technology and its potential benefits. We then turn to the policy frameworks that could govern 3D printing technologies and itemize a few of the major public policy issues that are either already being discussed, or which could become pertinent in the future. We offer some general guidance for policymakers who might be pondering the governance of 3D printing technologies going forward. Contra to the many other articles and position papers that have already been penned about 3D printing policy, which only selectively defend permissionless innovation in narrow circumstances, we endorse it as the default rule across all categories of 3D printing applications.

More specifically, we do a deep dive into 3 primary public policy “fault lines” for 3D printing: firearms, medical devices, and intellectual property concerns. Read the whole thing for more details.

The success of the Internet and the modern digital economy was due to its open, generative nature, driven by the ethos of “permissionless innovation.” A “light-touch” policy regime helped make this possible. Of particular legal importance was the immunization of online intermediaries from punishing forms of liability associated with the actions of third parties.

As “software eats the world” and the digital revolution extends its reach to the physical world, policymakers should extend similar legal protections to other “generative” tools and platforms, such as robotics, 3D printing, and virtual reality.

In other words, we need a Section 230 for the “maker” movement.

The Internet’s Most Important Law

Today’s vibrant Internet ecosystem likely would not exist without “Section 230” (47 U.S.C. § 230) of the Telecommunications Act of 1996. That law, which recently celebrated its 20^th anniversary, immunized online intermediaries from onerous civil liability for the content and communications that travelled over their electronic networks.

The immunities granted by Section 230 let online speech and commerce flow freely, without the constant threat of legal action or onerous liability looming overhead for digital platforms. Without the law, many of today’s most popular online sites and services might have been hit with huge lawsuits for the content and commerce that some didn’t approve of on their platforms. It is unlikely that as many of them would have survived if not for Section 230’s protections.

For example, sites such as eBay, Facebook, Wikipedia, Angie’s List, Yelp, and YouTube all depend on Section 230 immunities to shield them from potentially punishing liability for the content that average Americans post to those sites. But Section 230 protects countless small sites and services just as much as those larger platforms and it has been an extraordinary boon to online commerce and speech.

Extending Immunities to Other General-Purpose Technologies: 3 Models

To foster generativity and permissionless innovation for the next wave of tech entrepreneurs, it may be necessary to immunize some intermediaries (i.e., platform providers or device manufacturers) from punishing forms of liability, or at least to limit liability in some fashion to avoid the chilling effect that excessive litigation can have on life-enriching innovation. Specifically, they should be immunized from liability associated with the ways third-parties use their platforms or devices to speak, experiment, or innovate.

“The past ten years have been about discovering new ways to create, invent, and work together on the Web,” noted Chris Anderson in his book Makers: The New Industrial Revolution. “The next ten years will be about applying those lessons to the real world.” But that can only happen if we get public policy right.

Thus, the creators of newer general-purpose technologies may need to receive certain limited immunizations from liability for the ways third-parties use their devices. If troublemakers use general-purpose technologies to do harm—i.e., cybersecurity violations, privacy invasions, copyright infringement, etc.—it is almost always more sensible to hold those problematic users directly accountable for their actions.

The other approach—holding those intermediaries accountable for the actions of third parties—will discourage innovators from creating vibrant, open platforms and devices that could facilitate new types of speech and commerce. Therefore, an embrace of permissionless innovation requires a rejection of such middleman deputization schemes.

There are three different existing immunity models we might consider applying to emerging general-purpose technologies.

Model #1: Section 230 & online services

The first model, of course, is Section 230 itself.  Section 230 stipulated that it is the policy of the United States “to promote the continued development of the Internet and other interactive computer services and other interactive media,” and “to preserve the vibrant and competitive free market that presently exists for the Internet and other interactive computer services, unfettered by Federal or State regulation.” To accomplish that, the law made it clear that, “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”

Since implementation of Section 230 two decades ago, courts have generally read this immunity fairly broadly, so much so that some critics have argued that 230’s scope has been enlarged well beyond congressional intent. Even if that is true, I believe that has been a net positive (excuse the pun) and that it is not only wise to preserve that sweeping immunity but extend it to other technologies and sectors.

Model #2: Firearm manufacturing

Another immunization model can be found in the Protection of Lawful Commerce in Arms Act of 2005 (Pub. L. No. 109-92, 119 Stat. 2095). Although “lawsuits alleging negligent distribution plagued the firearm industry until 2005,” the Protection of Lawful Commerce in Arms Act “effectively ended the ‘gun tort’ era,” notes Peter Jensen-Haxel. The law did so by granting gun manufacturers immunities for such legal actions. (It would seem that, by extension, those who use 3D printers to create firearms will also be immunized from civil actions.)

Importantly, unlike Section 230, which provided broad immunity by default to all online platforms, the Protection of Lawful Commerce in Arms Act applied to manufactures/sellers that fit into the certain qualifications (i.e., they get immunity if they comply with certain licensing rules, record keeping requirements, etc.). This tension between broad versus targeted immunity will become the subject of debate for emerging general-purpose technologies as scholars and policymakers contemplate optimal default liability rules.

Model #3: Vaccines

A final legal immunization model comes, ironically, from the world of medical immunizations. As part of the National Childhood Vaccine Injury Act of 1986 (42 U.S.C. §§ 300aa-1 to 300aa-34), Congress created The National Vaccine Injury Compensation Program, “after lawsuits against vaccine companies and health care providers threatened to cause vaccine shortages and reduce U.S. vaccination rates, which could have caused a resurgence of vaccine preventable diseases.”

As described by the U.S. Department of Health and Human Services, the program, “is a no-fault alternative to the traditional legal system for resolving vaccine injury petitions.” Thus, those suffering injuries from vaccines are able to seek compensation from this program instead of having to sue vaccine companies.

As Avery Johnson of the Wall Street Journal noted in 2009 article about the program, “A spate of lawsuits against vaccine makers in the 1970s and 1980s had caused dozens of companies to get out of the low-profit business, creating a public-health scare. The strategy worked and the public health implications have been sizable. Vaccines have driven huge reductions — and in the case of smallpox, for instance, complete eradications — of major childhood diseases.”

This model is obviously very different than Section 230 and the Protection of Lawful Commerce in Arms Act in that it includes a government-created compensation fund provided as an alternative to civil lawsuit remedies. In all likelihood, such a compensation fund would not be necessary for new general-purpose “maker” technologies or sectors.

Nonetheless, this model could, perhaps, have some relevance for certain narrow classes of those technologies. For example, 3D-printed medical devices might be one area where it would make sense to exempt from liability the creators of 3D printers and the platforms over which 3D printer blueprints are distributed. But if there is significant resulting harm from some of those devices or plans, it remains unclear how compensation would work and who would be picking up the tab for it. The National Vaccine Injury Compensation Program offers one potential answer, although it may not be wise to craft such a consumer-funded or taxpayer-supported program for other reasons. Even if creating a government-run compensation fund was eventually seen as a good idea, we cannot determine how big the fund should be until some actual harms occur.

Three Sectors to Cover

Next, we should consider which sectors or technologies should be eligible for such immunities.

I wish it was possible to craft some sort of “General-Purpose Technology Immunization Act” that would shield such platforms and technologies from onerous liability associated with third-party uses. Realistically, however, it is not likely such a broad-based regime could achieve political traction. There would just be too many opposing forces. Moreover, there may be some unique distinctions between technologies and sectors which necessitate specialized legal regimes.

In any event, I believe a good case can be made for adopting some sort of legal immunity regime for three specific technologies: Robotics, 3D printing, and immersive technology (i.e., virtual reality and augmented reality).

Robotics

Ryan Calo, professor of law at the University of Washington School of Law, has done important work on the law of robotics and he has suggested that such legal immunities may need to be extended to this field. In his 2011 Maryland Law Review article on “Open Robotics,” Calo made his case as follows:

To preempt a clampdown on robot functionality, Congress should consider immunizing manufacturers of open robotic platforms from lawsuits for the repercussions of leaving robots open.  Specifically, consumers and other injured parties should not be able to sue roboticists, much less recover damages, where the injury resulted from one of the following: (1) the use to which the consumer decided to put the robot, no matter how tame or mundane; (2) the nonproprietary software the consumer decided to run on the robot; or (3) the consumer’s decision to alter the robot physically by adding or changing hardware. This immunity would include lawful and unlawful uses of the robot. (p. 134) . . . The immunity I propose is selective: Manufacturers of open robots would not escape liability altogether. For instance, if the consumer runs the manufacturer’s software and the hardware remains unmodified, or if it can be shown that the damage at issue was caused entirely by negligent platform design, then recovery should be possible. The immunity I propose only applies in those instances where it is clear that the robot was under the control of the consumer, a third party software, or otherwise the result of end-user modification. Because this issue will not always be easy to prove, we should expect litigation at the margins. I am thus arguing for a compromise position: A presumption against suit unless the plaintiff can show the problem was clearly related to the platform’s design. (p. 136)

I find this entirely convincing and I also believe Calo is wise to begin with robotics as the first target for such legal immunization because such technologies are already being widely manufactured and deployed today.

These liability questions are already being widely debated, for example, in the field of autonomous systems and driverless cars in particular. I’d like to believe that the common law would sort out these things fairly quickly and that an efficient liability regime would emerge from autonomous technologies in short order.

Alas, because America lacks a “loser pays” rule, a perverse incentive exists for overly-zealous trial lawyers to file an avalanche of lawsuits at the first sign of any problem. This could significantly hamper the development of autonomous technologies, which have the potential to immediately decrease the staggering death toll associated with human error behind the wheel. Therefore, it may be necessary for Congress to craft some sort of limited immunity regime for autonomous technology makers to ensure that the development of these potential life-saving technologies is not discouraged by the looming threat of perpetual litigation.

3D Printing

3D printing would be my second choice for a general-purpose technology that should be covered by some sort of intermediary immunity model.

In a forthcoming law review article for the Minnesota Journal of Law, Science & Technology, Adam Marcus and I argue that “the manufacturers of 3D printing devices and the website operators hosting blueprints for 3D-printed objects may need to be protected from liability to avoid chilling innovation. In this sense, a ‘Section 230 for 3D printing’ might be needed.”

We discuss three specific ways that 3D printers could be used by third-parties in such a way that existing laws or regulations are implicated and someone might seek to bring action against the manufacturers of 3D printers or 3D printing marketplaces, like Shapeways or Thingiverse. These cases involve things like 3D-printed prosthetics, which could raise policy concerns at the Food and Drug Administration, and 3D-printed toys or sculptures, which could present intellectual property issues.

But perhaps the most interesting case study for liability purposes will be 3D-printed firearms, which are already raising a great deal of controversy. Marcus and I argue, once again, that “the proper focus of regulation should remain on the user and uses of firearms, regardless of how they are manufactured.” And because, as already noted, the Protection of Lawful Commerce in Arms Act immunizes gun manufacturers from legal liability for third-party actions, it would seem logical that the law’s protections would extend to 3D-printed firearms. Moreover, Section 230 itself (and perhaps also the First Amendment) might also apply to 3D printing design schematics that appear on various websites or 3D printing marketplaces.

Generally speaking, Marcus and I argue, “imposing liability on third parties—sites hosting schematics, search engines, and manufacturers of devices—seems neither workable nor wise. There exists a broad spectrum of general-purpose technologies that can be used to facilitate criminal activity,” we note, such as cars, computers, or paper printers. But we don’t blame those intermediaries when those technologies are used by third parties in criminal acts. The same principle should apply to 3D printers.

Things get more complicated when intellectual property issues are brought into the debate. In an important 2014 article, “Patents, Meet Napster: 3D Printing and the Digitization of Things,” Deven R. Desai and Gerard N. Magliocca sketched out the potential case for some sort of limited immunity as it pertains to patent infringement and 3D printing. “An obstacle to the growth of 3D printing that Congress should consider addressing is that individuals who engage in that activity are strictly liable if they infringe a patent,” they note, but they continue on to add that:

Exempting personal 3D printing from patent infringement without undermining other aspects of the regulatory scheme will not be easy. It would not be a good idea for Congress to create a fair use exception for all patents or make infringement an intentional tort, as those changes would sweep too far. Targeting 3D printing itself is a possibility, but in that case the legislation would have to distinguish between personal and commercial activity, as there is no rationale for saying that all 3D printing leading to patent infringement, including what Fortune 500 firms do, should be permitted. Drawing that kind of line with a substantive legal standard, though, will generate years of litigation and may not effectively separate the good from the bad. One alternative, should Congress opt to give personal 3D printing some immunity, would be to set a relatively high minimum amount-in-controversy for federal jurisdiction over any [patent] infringement claims involving this technology. (p. 1717)

Getting this balance right will be tricky, yet essential. “Patent law and industries that rely on patents will have to adapt to this new environment or face potential obsolescence,” Desai and Magliocca correctly conclude.

Immersive Technology

A final sector we might eventually want to apply some sort of intermediary immunity model to is immersive technology. “Immersive technology” refers to services that currently utilize wearable devices (such as a head-mounted display or headset) to let users explore virtual worlds, virtual objects, or hologram-like projections. Immersive technology can be separated into two different, but related groups: virtual reality (VR) and augmented reality (AR).

These technologies are still in the cradle, but many companies are already developing VR and AR technologies for both entertainment and professional uses. As they gain more widespread usage, immersive technologies could raise some policy issues, including concerns about privacy, intellectual property (ex: who owns certain “experiences”), and potentially even worries about distraction and addiction.

It would not be surprising, therefore, if some critics begin advocating greater regulation of, or liability for, VR and AR intermediaries. If that happens, policymakers will need to consider immunizing them from the threat of lawsuits or else innovation will die in these sectors.

Conclusion

Following the general logic of permissionless innovation, and understanding the importance of keeping intermediaries free of punishing liability for what others might do with their general-purpose technologies and platforms, the proper focus of regulation should remain on the user and uses of those technologies.

Accordingly, policymakers should craft a “Section 230 for the maker movement” by adopting legal protections for robotics, 3D printing, and immersive technology. At the same time, we should seek out better solutions—legal and otherwise—to the old problems that might persist or new ones that might come about due to the use of these new devices and platforms. But we should not let hypothetical worst-case scenarios and concerns about future technologies lead us down a path where intermediaries are “deputized” or hit with punishing liability for downstream actions by third parties.

Note#1 : This is a preliminary sketch of a law review article I would eventually like to write entitled, “A Section 230 for the “Makers” Movement: Extending Section 230 Immunities to Robotics, 3D Printing & Virtual Reality.” Toward that end, I welcome suggestions for (a) which general-purpose technologies deserve some sort of immunization, and also (b) what other legal immunity regimes exist that we could learn from. Please forward any ideas you might have along to me.

Note #2: My thanks to Adam Marcus and Christopher Koopman for their helpful suggestions on this essay.

And so the series continues.  The Washington Post reports that the Department of Justice has just released “a scathing report” finding that over a 5-year period the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) “lost dozens of weapons and hundreds of laptops that contained sensitive information.” The DOJ’s Inspector General Glenn A. Fine found that 418 laptop computers and 76 weapons were lost. According to the report:

Yesterday’s report showed that ATF, a much smaller agency than the FBI, had lost proportionately many more firearms and laptops. “It is especially troubling that that ATF’s rate of loss for weapons was nearly double that of the FBI and [Drug Enforcement Administration], and that ATF did not even know whether most of its lost, stolen, or missing laptop computers contained sensitive or classified information,” Fine wrote.  […] Many of the missing laptops contained sensitive or classified material, according to the report. ATF began installing encryption software only in May 2007. ATF did not know what information was on 398 of the 418 lost or stolen laptops. The report called the lack of such knowledge a “significant deficiency.” Of the 20 missing laptops for which information was available, ATF indicated that seven — 35 percent — held sensitive information. One missing laptop, for example, held “300-500 names with dates of birth and Social Security numbers of targets of criminal investigations, including their bank records with financial transactions.” Another held “employee evaluations, including Social Security numbers and other [personal information].” Neither laptop was encrypted.

The findings regarding lost weapons were equally troubling, if not a bit humorous:

Two weapons were subsequently used to commit crimes. In one incident, a gun stolen from the home of a special agent was fired through the window of another home. Ten firearms were “left in a public place.” One of them was left on an airplane, three in bathrooms, one in a shopping cart and two on the top of cars as ATF employees drove away. A laptop also fell off the top of a car as an agent drove off. Another weapon “fell into the water while an agent was fishing,” according to the report.

Now I know the private sector actors lose things too, but as I’ve pointed out before, if any of this happened in the private sector, trial lawyers would be salivating and lawsuits would be flying. By contrast, when the government loses personal information—information that his usually more sensitive than that which private actors collect—about the most that ever comes out of it is another report calling for “more accountability.” Few ever are actually held accountable (i.e., lose their jobs or get sued.)