ABSTRACT-The Supreme Court has never articulated the extent of First Amendment protection for instructional or "informational" speech-factual speech that may be repurposed for crime. As technology advances and traditional modes of speech become intertwined with code speech, crafting a doctrine that expressly addresses the First Amendment limits of protection for informational speech becomes pressing. Using the case study of "vulnerability speech"-speech that identifies a potentially critical flaw in a technological system but may indirectly facilitate criminality-this Article proposes a four-part "repurposed speech scale" for crafting the outer boundaries of First Amendment protection for informational speech.
Our cases have not yet considered whether, and if so to what extent, the First Amendment protects . . . instructional speech.
-Justice John Paul Stevens[dagger]
This is the story of Jack and the jackpot. In July 2010, an information security researcher named Barnaby Jack1 caused an Automated Teller Machine (ATM) to spew pretend money2 into an uproariously cheering audience of "hackers"3 at DEF CON, a leading information security conference held annually in Las Vegas.4 Although his ability to succeed in this "exploit"-or act of information security compromise-demonstrated his skill as a security researcher, his ability to control the ATM in this manner existed not only because of his hacking prowess, but also because of flaws in the way that the software running the ATM had been coded.5 Step by step, Jack demonstrated the vulnerabilities in the build of the machine to the audience. He also highlighted critical problems in physical security around the machine: the ATM was available for purchase and delivery on eBay, a key circumstance that had facilitated the months of code analysis (from the comfort of Jack's own home) and had led him to select that particular ATM.6
This is also the story of the First Amendment and instructional speech, or, what Professor Martin Redish has termed "informational" speech7-speech that conveys factual information that can be repurposed for crime.8 The idea of someone explaining how to cause a potentially improperly programmed ATM to eject-or, as the industry calls it, "jackpot"9-money will viscerally strike many legal academics and judges as speech that brazenly advocates criminality. They will question the social value of such speech and ask whether it treads into the territory of unprotected speech under the First Amendment. Meanwhile, this initial legal instinct sits diametrically opposed to the dominant thinking in the burgeoning information security research community: the default assumption among seasoned researchers and ingénues alike is one of full First Amendment protection for this type of speech. In reality, the doctrinal First Amendment truth lies somewhere in the middle: the law is unclear.10 The Supreme Court has never expressly addressed the doctrinal question.
Building on the work of Professor Redish, this Article grapples with the legally undertheorized but critically important doctrinal tensions around the First Amendment status of informational speech-a doctrinal question flagged but leftunresolved by the Supreme Court. 11 Specifically, this Article examines the broader dynamics of informational speech through a case study of what I term "vulnerability speech"-informational speech that identifies a potentially critical flaw in a technological system or product but also indirectly potentially facilitates criminality. Technology advancements further complicate the doctrinal tensions the Court has leftunresolved regarding informational speech. Informational speech, such as vulnerability speech, now blends traditional modes of informational speech with a second bundle of doctrinally unresolved First Amendment issues-those around code speech.12
This Article offers a novel technology-neutral First Amendment paradigm for addressing informational speech-a "repurposed speech scale. …