Lieber Studies Non-State Actor Attribution Volume Series – Artificial Intelligence and Attribution of Non-State Actors’ Conduct to States

Editors’ note: This post appears as an entry in a series dedicated to Dr Jennifer Maddocks’ monograph, Attribution of Non-State Actor Conduct during Armed Conflict, appearing in the Lieber Studies book series with Oxford University Press.

We are pleased to contribute to this forum marking the publication of Attribution of Non-State Actor Conduct During Armed Conflict, the new book by our friend and colleague Dr. Jenny Maddocks. In this piece, we address a topic that falls squarely within that subject—attributing non-State actors’ artificial intelligence (AI)-related conduct during armed conflict to States. It is particularly apropos for this forum, as Jenny is playing a central role vis-à-vis the law of State responsibility in a multi-year project to draft the Manual on International Law Applicable to Artificial Intelligence in Warfare. We are delighted to have her join us in that effort.

The question of accountability for non-State actor AI-related conduct during armed conflict could not be more pressing. As AI systems more frequently find their way onto the battlefield, private actors (from large corporations such as Palantir and Anduril Industries to small start-ups) are increasingly involved in developing, training, maintaining, updating, and even operating those systems. In this post, we catalog the bases for attribution of non-State actor conduct and ask how the fact that the conduct involves AI affects attribution. In other words, does AI exacerbate what Dr. Maddocks describes as the “unclear boundaries between the conduct of States on the one hand and the acts of armed groups and other non-State actors on the other?”

As we will explain, our answer is that, despite some hurdles, the legal framework governing attribution of their conduct to a State concerned is largely fit for purpose. Indeed, in our estimation, it is usually robust enough to encompass even unexpected or other “loss of control” AI behavior. That said, accountability may be difficult to establish in practice, not because of shortfalls in the law of State responsibility, but due to the fault requirement found in some “primary” rules of international law (those setting forth international obligations), as well as the practical challenges of identifying the origin of the conduct, especially with respect to AI-enabled cyber operations.

The Basics

The law of State responsibility is customary in character. However, although found in no treaty, the International Law Commission (ILC) has produced a non-binding restatement of that law, the Articles on the Responsibility of States for Internationally Wrongful Acts (ARSIWA), together with an accompanying in-depth commentary. Many ARSIWA provisions are widely regarded as reflecting customary international law, and international courts and tribunals frequently rely on them. We therefore use the Articles and their commentary as the framework for our analysis.

In the law of State responsibility, the issue is whether a State has committed an “internationally wrongful act” (a violation of international law). To qualify, the conduct must first breach an obligation under international law, whether through an action or omission. Second, the breach must be attributable to a State under the so-called “secondary” rules of State responsibility, meaning it can be said to be an act of a State under international law (ARSIWA, art. 2). The second element is the focus of our analysis.

AI systems, models, and agents are not subjects of international law. They do not qualify as persons or entities for the purposes of attributing State responsibility, have no rights, shoulder no obligations, and cannot qualify as non-State actors, such as organized armed groups or private companies, whose conduct may be attributed to a State (see also Boutin, p. 139-43). On the contrary, every attribution question concerning AI-related conduct is ultimately a question about human and institutional conduct associated with the system’s development, deployment, operation, supervision, or use. Once AI-related conduct breaches an international law rule, the attribution evaluation assesses the relationship between the individual or entity involved and the State concerned.

Various non-State actors may be involved in AI-related conduct at different stages of the AI lifecycle, with varying degrees of connection to both the conduct that constitutes the breach and the State to which attribution is being considered. For instance, a company may train a general-purpose model with no military application in mind which the armed forces later adapt. A government contractor might integrate that model into a weapons system. A subcontractor operating in a third State could provide the datasets needed to fine-tune the model for the specific military application. A university laboratory may conduct performance testing under a government grant. A cloud provider might host the AI system during ongoing operations. The State involved may transfer the system to an organized armed group, which then uses it on the battlefield. And forward-deployed engineers from commercial partners might maintain, update, and modify it in the field.

The question in each case is whether the relationship between the non-State actor and the State justifies treating the non-State actor’s AI-related conduct as if it were the State’s. If so, the State will have committed an internationally wrongful act when the conduct satisfies the criteria for a breach of a primary rule of international law (e.g., because the decision taken to employ an autonomous weapons system that begins to attack civilian objects was unreasonable in the attendant circumstances).

An important preliminary point is that attributing non-State conduct to a State does not require causation or fault. Thus, unintended conduct resulting from erroneous AI output or behavior does not preclude attributing that conduct to a State (see also Milanovic, p. 5). However, the fact that such conduct was unintended may affect whether it qualifies as a breach under the primary rule in question. For instance, some LOAC rules require intent, such as the prohibitions on terrorizing the civilian population and on perfidy, while targeting rules usually turn on ex ante assessments based on the information reasonably available at the time, including expected civilian harm. Similarly, situations in which a third party intervenes in the operation of an AI system, for instance by deploying data poisoning attacks or evasion techniques, may bear on whether the relevant primary-rule requirements were satisfied by the attacker and the actor employing the counter-AI measures, but will seldom alter the attribution analysis.

Bases for Attribution of AI-related Non-State Actor’s Conduct

Multiple legal bases for attributing non-State actors’ AI-related conduct to a State exist. We address them below, from those we believe most likely to apply to the least likely, at least with respect to AI relevance.

Instructions or Direction or Control

ARSIWA’s Article 8 restates the attribution rule most likely to apply to a non-State actor’s conduct in the context of AI.

The conduct of a person or group of persons shall be considered an act of a State under international law if the person or group of persons is in fact acting on the instructions of, or under the direction or control of, that State in carrying out the conduct.

This rule distinguishes two bases for attribution. The first is instructions. For attribution based on instructions to apply, the State must specifically instruct the non-State actor to engage in the relevant conduct. But the relationship between the State and the actor need not be continuous. For example, this rule would extend to ad hoc instructions provided piecemeal to an AI firm, even absent a contract or when those instructions exceed contractual terms.

The second basis for attribution under this rule is direction or control. Under this standard, the issue is not whether the State gave a specific instruction to engage in AI-related activity, but the degree of authority it exercises over the non-State actor’s conduct at issue. The ILC commentary to Article 8 explains that the actor’s conduct is attributable to the State “[o]nly if it directed or controlled the specific operation and the conduct complained of was an integral part of that operation. The principle does not extend to conduct which was only incidentally or peripherally associated with an operation and which escaped from the State’s direction or control” (para. 3). The International Court of Justice has labeled such control “effective control,” which exists when the “State had effective control of the military or paramilitary operations in the course of which the alleged violations were committed” (Paramilitary Activities, para. 115; see also Bosnian Genocide, paras. 400-07). Note that merely funding or training a non-State group does not, without more, reach the effective control threshold.

Attribution of a non-State actor’s AI-related conduct to a State based on effective control depends on a factual assessment of the relationship between the State and the actor. AI systems can enable, and even enhance, such control. For instance, consider a case in which a State supplies an organized armed group with AI-enabled loitering munitions. Before each mission, the State’s engineers remotely set system parameters for the area to be searched, the objects that may be attacked, and the period during which the munitions may remain active. The group launches the munitions, and one strikes a school within the programmed area. That attack is attributable to the State, for it determined what could be attacked, where, and when during that operation. Likewise, the State’s retention of override functions or kill switches for AI-enabled weapons systems used by the non-State actor could also indicate effective control over the operations. By contrast, if the State had merely delivered the munitions, and the group decided where, when, and how to use them, the State would have lacked effective control over the operations, and the school attack would not be attributable to it.

Attribution of the conduct of non-State actors operating under instructions or effective control does not extend to ultra vires actions or omissions, as is the case for certain other bases for attribution discussed below. Conduct is ultra vires when it “exceeds its authority or contravenes instructions” (ARSIWA, art. 7). A key point is that ultra vires refers to human conduct, not the machine’s. Thus, if a non-State actor acted contrary to, or in a manner that was clearly inconsistent with, the State’s instructions or effective control, its actions would be non-attributable. Consider a contractor that, contrary to the State’s direction, takes it upon itself to manipulate a system’s object-detection capabilities and direct attacks at civilian objects; that conduct would be ultra vires and not attributable to the State.

But departure from a State’s instructions does not automatically end the attribution inquiry under this rule. The commentary to Article 8 cautions that the question is whether “the unlawful or unauthorized conduct was really incidental to the mission or clearly went beyond it” (para. 8, emphasis added). What matters is the extent of the deviation from the State’s instructions or direction; if the deviation is “incidental,” the related conduct remains attributable to the State.

In the context of AI, it is unclear what would constitute incidental conduct. For instance, consider a contractor supporting a unit’s fires cell. The contractor is instructed to route any AI-generated target nomination that falls below a specific confidence threshold to a human in the cell for assessment and verification before proceeding to engage. However, given the very high operational tempo and a lack of human resources to verify AI outputs, the individual slightly lowers the confidence threshold during the shift. The mission, target set, geographic limits of engagement, and the rules of engagement remain unchanged.

Whether that change to the system’s confidence threshold is merely incidental or, instead, contravenes the State’s instructions will be assessed contextually. In some situations, it may not have materially contributed to the resulting violations. In others, changing the confidence threshold may lead to significantly more false positives, potentially qualifying such attacks as indiscriminate under the law of armed conflict (LOAC). As this example illustrates, determining whether updates to the models, changes to the parameters, or adjustments to the modes of deployment (e.g., semi-autonomous, supervised, requiring target authorization) were incidental will be highly contextual, for even minimal changes can sometimes have substantial effects on the outcome of AI output or behavior.

Entities Exercising Elements of Government Authority

Under the rule outlined in Article 5 of ARSIWA, non-State actors’ conduct is attributable to the State if they “exercise elements of government authority.” Such attribution requires the satisfaction of three conditions: (i) the conduct must be an exercise of government authority; (ii) the non-State actor must be empowered by the State’s internal law to exercise that authority; and (iii) the actor must be acting in that capacity at the time. The group, however, is not completely dependent upon the State, as in the case of de facto organs, a basis for attribution explained below.

With respect to the first condition, the conduct of hostilities is a paradigmatic exercise of governmental authority. Thus, for example, if a contractor employs an AI decision-support system to nominate targets, operates an AI-enabled weapons system, or mounts AI-enabled cyber operations against the enemy, this condition is fulfilled. However, AI-related conduct prior to military operations—such as when a contractor trains a model for potential future use, annotates data sets, provides human feedback for reinforcement learning models, or integrates AI into an existing weapons system far from the battlefield—is less likely to qualify as “governmental authority.” This is because while employing an AI system to support ongoing military operations is an exercise of governmental authority, merely engaging in commercial activities for the armed forces is not.

The distinction can be difficult to apply in practice because AI development is iterative and involves multiple commercial activities related to model training, retraining, and maintenance throughout the lifecycle. Consider a forward-deployed contractor who addresses vulnerabilities, retrains, and fixes errors in an AI targeting support system. Whether their conduct constitutes the exercise of governmental authority will depend, inter alia, on the extent to which it is tied to the specific operation, such that the contractor is effectively involved in the conduct of hostilities. Reasonable arguments can be made on both sides about whether the conduct satisfies the first condition for attribution. (As an aside, this scenario illustrates the fact that conduct may be attributable on multiple bases. Thus, an act attributable to the State because the armed forces carry out the AI-enabled attack may also be attributable on other bases, such as the non-State actor’s contribution to the act.)

The second requirement is satisfied as long as either legislation (or another domestic legal instrument) or a lawful contractual relationship with the government authorizes the non-State actor to engage in conduct that satisfies the first requirement. Essentially, the State is delegating its authority to the non-State actor. In the AI context, this requirement will typically be met through the government procurement process.

Finally, the non-State actor must be acting in the specific governmental capacity when the conduct occurs. Consider a firm that operates AI-enabled biometric screening at military detention facilities in an occupied territory. It also provides similar services to a commercial port operator nearby to control access. If the firm’s conduct breaches an applicable human rights obligation of the State with which it has contracted—for instance, by repurposing data collected from civilians in the detention facility to train its models for commercial purposes, which goes beyond the necessary and proportionate use of that personal data under the right to privacy (see, e.g., A/HRC/39/29, para. 29)—the breach is attributable to that State. This is not the case for screening on behalf of the port operator.

Unlike attribution based on instructions or effective control, even ultra vires activities by non-State actors performing these functions are attributable to a State (ARSIWA, art. 7), provided the actor was acting in an apparent or official capacity. In the context of AI, it is important to understand that what is ultra vires depends on the conduct of human actors, not on machines. Even if an AI system unexpectedly led to a breach of international law, the fact that the person or entity used it (e.g., deployed, activated, launched) while engaged in governmental functions they were legally authorized to perform provides a sufficient basis for attributing their conduct.

Consider a private firm performing cyber defense for the State’s private and governmental cyber infrastructure during an armed conflict, a clear governmental function. The firm uses a new experimental version of an AI agent to identify the source of hacker attacks. However, upon activation, the AI agent unexpectedly (and initially without the technical group’s knowledge) begins to counterattack the hackers it has identified in a neutral State, despite the State’s clear contractual instructions not to engage in active cyber defense. The violations of the territorial State’s sovereignty and its rights as a neutral are attributable to the State the group is defending, even though the group deploying the system did not anticipate the consequences.

If the three elements are met, the rule of attribution fails to apply only when the non-State actor acts in a wholly private capacity. For instance, in the previous example, if individuals in a private firm misuse the AI agent to identify vulnerabilities in a bank in the neutral State and steal funds for personal gain, the conduct would not be attributable.

Conduct of De Facto State Organs

Although AI-related non-State actor conduct is most likely to be attributable to a State on the basis of the two rules discussed above, it is also attributable if a non-State actor qualifies as a de facto organ of the State. This basis for attribution is outlined in Article 4 of ARSIWA. It provides for attribution when the entity that has engaged in the conduct is an “organ” of the State, that is, it enjoys that status under the domestic law of the State concerned; it is an organ de jure (ARSIWA, art. 4). But of relevance to the issue at hand, the conduct of non-State actors may also fall under this basis for attribution if they are acting as a “de facto organ” of the State (ARSIWA, art. 4 commentary, para. 11). In this regard, the International Court of Justice has stated that when a non-State actor acts in “complete dependence” on the State, its acts (actions or omissions) are attributable on the same basis as formal organs of the State (Bosnian Genocide, para. 392; Paramilitary Activities, para. 109).

The de facto organ rule would, for instance, apply to AI-related technical organizations created outside a State’s formal governmental structure. Consider a nominally private group of volunteers that exists solely to support the State’s defense against hostile cyber operations. The group is wholly funded and equipped by the State, receives its missions exclusively from State authorities, and lacks meaningful operational autonomy. Yet it is not provided for in law. Depending on the facts, such complete dependence could justify treating the organization as a de facto State organ. Its AI-enabled cyber conduct would then be attributable on the same basis as conduct by a formal State organ that performs such functions, such as the armed forces or a State cyber agency. The fact that the relevant conduct of a de facto organ is AI-enabled or otherwise related to the development or use of AI-enabled systems may factor into the determination of whether there was a breach, but it does not affect the factual assessment of the actor’s dependence on the State necessary to establish attribution.

In light of the substantial investments by States in the AI industry and the numerous individuals who hold both government positions and decision-making roles in AI companies (see e.g., here), it is important to note that State ownership, whether full or partial, does not, by itself, render a company a State organ (ARSIWA, art. 5, para. 3). A government-owned company (one that performs commercial functions) that develops, trains, or deploys AI capabilities for the armed forces is an organ only if it satisfies the complete dependence standard. Mere ownership, State funding, or the presence of government officials on a board of directors does not suffice. This, however, does not preclude the possibility that the company’s conduct may be attributable to a State under another rule of attribution, such as instructions, direction or control, or the exercise of governmental authority (see above).

As with non-State actors empowered by law to exercise elements of governmental authority, this rule extends attribution to ultra vires conduct (ARSIWA, art. 7). The discussion of the parameters of attribution in that context applies mutatis mutandis to de facto organs.

Acting in the Absence or Default of Official Authorities

By the State responsibility attribution rule restated in Article 9 of ARSIWA, if a person or group exercises elements of governmental authority when official authorities are absent or failing to fulfill their duties, the conduct is attributable to the State concerned, although a State’s mere unwillingness to perform the function, or ineffective performance, does not suffice. Rather, the rule applies only when the non-State actor’s action is clearly called for. And attribution attaches only when the conduct constitutes an exercise of governmental authority, as discussed above.

Attribution on this basis is perhaps more likely than in non-AI-enabled military operations because military AI performance relies heavily on commercial firms for specialized technical support that may be unavailable or scarce among government personnel. Consider a situation in which a specially trained operator of a highly complex AI-enabled weapons system is killed or wounded during combat. Soldiers in the unit cannot replace the operator because they lack sufficient knowledge of and training with the system. As a result, private engineers who had previously provided some support for the system under contract take control of the AI-enabled system’s operations against advancing enemy forces on their own initiative.

They are exercising governmental authority by conducting hostilities in the absence of military operators and in circumstances calling for it. Thus, if, for instance, the system’s model unexpectedly begins engaging vehicles containing civilians in addition to enemy vehicles, the State will be responsible for the system’s continued operation, even though the private engineers were not authorized to take that action. Whether an internationally wrongful act occurred would then depend on the applicable primary LOAC rules, including distinction, the prohibition of indiscriminate attacks, proportionality, and precautions in attack. Again, attribution turns on human conduct and the factual determination of whether the acts were carried out in the absence of governmental authority, rather than on whether AI was leveraged in that conduct.

Conduct Acknowledged and Adopted by a State as its Own

An attribution rule set out in ARSIWA Article 11 provides that conduct not attributable to the State at the time it occurred will nevertheless be attributable if the State acknowledges and adopts it as its own. A State acknowledges and adopts conduct when it does more than merely approve or endorse what a non-State actor has done. It must treat the conduct as its own and assume responsibility for it. The International Court of Justice addressed the issue in its Tehran Hostages judgment, which concerned the 1979 seizure by militants of the U.S. Embassy in Iran, taking its diplomats and military personnel hostage. The court found that the seizure itself was not attributable to Iran because the militants had acted on their own initiative. Nevertheless, Ayatollah Khomeini’s subsequent decision that the occupation and detention should continue until the United States met Iran’s demands, together with the approval of other Iranian authorities, transformed the occupation and detention into an act of State for which Iran bore international responsibility (paras. 73-74).

In general, under this rule, it is not significant that the conduct was AI-related. But a State that adopts, for instance, an organized armed group’s AI-enabled attacks as its own assumes responsibility for the strike on the same basis as it would if the group had instead conducted conventional attacks. The system’s technical characteristics mainly influence whether the attack breached LOAC or other international law rule, not whether the operation is attributable to the State.

Conduct of an Insurrectional or Other Movement

A further basis for attributing non-State actor conduct, which is of little direct significance in the AI context, appears in Article 10 of ARSIWA. Under that rule, if an insurrectional movement succeeds and becomes the new government of that State, or of a new State, its conduct during the insurrection is attributable to the State the group now governs. Again, the fact that AI was involved may bear on whether the elements of a primary rule of international law have been satisfied, but not on attribution. As long as the insurrectional movement would have been responsible for the conduct if it had been the government at the time, the conduct will be attributable.

Establishing Attribution

Finally, although the law of State responsibility provides a framework for attributing AI-related conduct by non-State actors to States, AI may pose evidentiary and investigative challenges. Identifying the source, operator, or relevant human actors behind AI-enabled conduct can be difficult, particularly when AI facilitates concealing an actor’s identity or enables conduct to be carried out while masquerading as a third party. For instance, in a recently published Cyber Law Toolkit scenario, Dr. Jonathan Kwik describes a hypothetical situation in which a goal-oriented AI agent “learned independently that spoofing certain identities in cyberspace reduced the net amount of successful attempts against military data and networks under its protection, thereby allowing it to optimise its reward.” Such AI system behavior could complicate establishing the factual chain linking the conduct to a non-State actor and, ultimately, a State.

The challenges should not, however, be overstated. Whether AI-enabled conduct can be traced to its relevant actors will depend heavily on the attendant circumstances. A recent incident in Ukraine reported by the New York Times illustrates this point. After a drone attack killed three civilians at a gas station, Ukrainian investigators recovered what they identified as a Russian drone containing an Nvidia computer module. Because the module was reportedly unencrypted, investigators were able to examine stored imagery and code that indicated the categories of objects the system had been trained to recognize, including propane tanks.

The incident illustrates that employing an autonomous or AI-enabled system does not necessarily render the underlying conduct untraceable. Depending on the available evidence, investigators might still be able to identify the system, how it operated, the actors involved in its deployment, and even the State connected to the operation.

Concluding Thoughts

As the overview of the relevant bases of attribution set out above demonstrates, the fact that a non-State actor engaged in AI-related conduct rarely affects the legal analysis of whether that conduct is attributable to a State under the law of State responsibility. In part, this is because attribution does not depend on establishing what the State or non-State actor knew, whether AI errors were foreseeable, or why a particular output was produced, issues that are more likely to arise when evaluating whether AI-enabled conduct breached a primary rule of international law.

To the extent AI context bears on attribution, it is most likely to complicate assessment when attribution depends on the State’s instructions to, or effective control over, a non-State actor. That an AI system was used could make it harder to establish the scope of the State’s instructions, the extent of control, or whether the conduct that ultimately occurred remained within the parameters of that relationship. In particular, where the conduct in question deviates from the State’s instructions or effective control because of an AI system’s operation, it may be harder to determine whether that departure was merely incidental or significant enough to affect attribution.

The real significance of AI, then, may lie less in any gaps in the law it creates than in its capacity to complicate efforts to reconstruct the relationships among non-State actors, their conduct, and the State concerned when assessing attribution. As warfare increasingly relies on AI, those relationships will become more complex and less visible. The international law challenge will be to ensure that the involvement of non-State actors and the complexity of AI do not together create a pathway to practical impunity.

***

Michael N. Schmitt is Professor of International Law at the University of Reading (UK), Distinguished Scholar at the Reiss Center for Law and Security, NYU Law School, and Professor Emeritus at the United States Naval War College.

Klaudia Klonowska is a Postdoctoral Researcher at Sciences Po Paris, where she coordinates the DIGILAW clinic. She is also Managing Director of the Manual on International Law Applicable to AI in Warfare and a member of the International Law Association’s (ILA) Committee on AI & Technology Law.

The views expressed are those of the authors, and do not necessarily reflect the official position of the United States Military Academy, Department of the Army, or Department of Defense. 

Articles of War is a forum for professionals to share opinions and cultivate ideas. Articles of War does not screen articles to fit a particular editorial agenda, nor endorse or advocate material that is published. Authorship does not indicate affiliation with Articles of War, the Lieber Institute, or the United States Military Academy West Point.

 

 

 

 

 

 

 

 

 

Photo credit: U.S. Army, Pfc. Nathan Arellano Tlaczani