Regulating technology: Code is not law