Hacking Speech: Informational Speech and the First Amendment

Privacy and Security

Article Snapshot


Andrea Matwyshyn


Northwestern University Law Review, Vol. 107, No. 2, pp. 792-846, 2013


Some “informational” speech can be used to commit crimes, including speech that identifies flaws in technical systems. This article proposes a test to determine when such speech is protected by the first amendment. Speech that reveals security flaws should be protected, if the speaker is careful and his goal is to be helpful.

Policy Relevance

Research that reveals security flaws is vital to improving security.

Main Points

  • In 2010, a researcher revealed flaws in ATM security at a computer security conference; he had delayed release of the information and worked with ATM makers to correct the flaw.
  • The speaker’s revelation was “informational speech,” which contains factual information that could be used in crime; “vulnerability speech,” which reveals a security flaw in a technical system, is a special type of informational speech.
  • One scholar argues that informational speech should not be protected by the first amendment when the risk of harm from the speech outweighs its value.
  • Cases involving computer code make free speech analysis harder; code can give instructions to a machine, blurring the boundaries between digital speech and hazardous materials.
  • The possibility that code or speech will be replicated complicates the analysis further; recordings of a speech can be distributed online, and anyone can see it at any time.
  • Vulnerability speech is critical to fix security flaws in key technological systems; trying to maintain security by keeping flaws secret is not effective.
  • Courts should determine when “vulnerability speech” is protected by the first amendment by considering these four key factors:
    • Whether the speaker’s goals was to be helpful, or if it was criminal.
    • Whether the speaker selected a reputable forum.
    • Whether the speech represented expert knowledge.
    • Whether the speaker took reasonable measures to reduce risk.


Get The Article

Find the full article online

Search for Full Article