Author: Nikki Muggli

Pushing the Bounds: AI Risk Assessments as Accountability Moats

Nikki Muggli Blog, Paper , , , , ,

By Michael Moran

Introduction
Before the dust settled from Meta’s colossal but controversial child safety settlement, another trial kicked off in New Mexico bringing the Cambridge Analytica scandal of 2018 back into the news.[1] In that data breach and privacy scandal, Facebook violated an earlier Federal Trade Commission (FTC) order, and agreed to pay a $5 billion penalty and adopt organizational restructuring and safeguards including compliance with a mandatory privacy program.[2] Following the settlement, Meta made substantial investments into its privacy program, but recent actions suggests the company is taking advantage of “political tumult in the United States” [3] to outsource privacy compliance to AI, delegating accountability for future privacy harms to an algorithm.[4]

Meta’s Legal Obligation to Provide Data Protection Assessments
In 2019, Meta entered a 20-year settlement order with the FTC mandating the creation of a privacy program with particular staffing and independent reporting requirements. While the order attracted headlines as the largest financial penalty assessed by the FTC, Commissioner Chopra criticized the agreement for granting individual immunity to Mark Zuckerberg, Sheryl Sandberg, and other executive officers, citing the importance of individual liability to encourage corporate accountability and compliance.[5]  The 3-2 majority of the FTC believed staffing and reporting mandates could improve “the transparency of decision making and hold[] Facebook accountable via overlapping channels of compliance.”[6]

Staffing
To empower decision-makers and overlapping compliance channels, Meta was required to “[d]esignate a qualified employee or employees to coordinate and be responsible for the Privacy Program (‘Designated Compliance Officer(s)’)”.[7] The Designated Compliance Officer(s) and “Principal Executive Officer” (Mark Zuckerberg) have reporting and certification responsibilities to ensure the privacy program meets the structural safeguards mandated by the order.[8] An independent privacy committee within Facebook’s board of directors was required, in addition to contracting an external third-party assessor for additional oversight.[9] All members of the independent privacy committee must be able “to read and understand data protection and privacy policies and procedures” to exercise their oversight duties.[10]

Reporting
Related to increased transparency of decision-making, designated compliance officers are required to conduct a privacy review prior to implementing any new or modified product that presents a material risk to privacy.[11] This decision must be documented in a written “Privacy Review Statement”, which describes the product, information collected, affirmative express consent mechanisms, and a full description of privacy risks and safeguards implemented or rejected. [12] The order also obligated Meta to promptly document and report any covered incident data breaches involving 500 or more consumers.[13]The Designated Compliance Officer(s) must deliver quarterly reports to the Principal Executive Officer based upon (1) personal knowledge, (2) sub-certification by “knowledgeable personnel charged with implementing the Mandatory Privacy Program”, (3) material issues from any privacy review statements and decisions from the prior quarter, and (4) material issues raised in covered incident reports for the quarter. Based on these quarterly reports, their own personal knowledge, or sub-certification by knowledgeable charged personnel, the Principal Executive Officer certifies compliance with the order.[14]

In addition to these reporting requirements, the order specifically mandates collection of user’s affirmative express consent prior to the use of facial recognition templates, after clear and conspicuous disclosure, separate and apart from privacy policy notices.[15] Outside of the FTC order, numerous state and international laws also require Meta to conduct and document a “data protection assessment” (DPA) for any processing activity that presents a heightened risk of harm, such as collection of biometric data.[16]  

Meta’s Evolving Privacy Program
Meta marketed the FTC settlement as an opportunity to incorporate privacy by design across the organization, touting $8 billion invested in the privacy program and development of new privacy features across Meta platforms.[17] To meet the staffing requirements of the order, longtime Facebook executive, Michel Protti was promoted to Chief Compliance & Privacy Officer,  who was later joined by Erin Egan, Chief Privacy Officer, Policy, to serve as designated compliance officers. By 2024, Meta increased the number of employees focused on privacy from a few hundred to over 3000, evaluating an average of 1,4000 product features each month.[18] The “Privacy Legal team [became] embedded in the design and ongoing execution of [Meta] program[s] and advises on legal requirements during the course of our privacy review process.”[19]

To manage an increasing number of product developments, and expanding digital compliance requirements, Meta began incorporating AI automation into product design and privacy reviews in 2025; building privacy code scanning solutions to replace manual “point checking” controls by engineers. [20] Meta argues that these tools enable the compliance team to add rigor at scale; to detect and screen risks earlier, flagging issues that need mitigation or escalation, but pushing through risks deemed insignificant to avoid delays to product development.[21] Using tools such as the Diff Risk Score AI tool, Meta uses AI to assess risk, displaying a color-coded risk thresholds with potential corrective responses for engineers to incorporate.[22] Meta is aiming for 90% of all risk assessments to be automated, even in sensitive areas including AI safety, youth risk, and misinformation.[23] Assessments of novel and complex issue are reviewed by senior subject matter experts across technical, legal, and policy teams until these decisions can be mapped, codified, and phased into greater AI risk management system.[24] With the massive scale of ongoing product development at Meta, and lack of clearly articulated threshold for novel and complex issues, it is the possible the AI algorithm could dismiss risks the FTC might deem substantial, intentionally, or through pattern recognition on training data dismissing risks. Users must trust that Meta’s experts are conducting ongoing oversight, to double check for accuracy after AI’s first pass.[25]

Meta maintains that “[h]umans are still very much in control of the process”, but the strategic decisions around organizational structure and product development suggest otherwise.[26] While adjusting its risk review process to incorporate AI analysis, Meta has reduced privacy team influence and oversight, telling employees who questioned the changes to “push the bounds” of their FTC agreement.[27] Last October, Meta laid off an undisclosed number of employees in Product Risk Program Manager, Shared Services, and Global Security & Privacy teams, “moving from . . . manual [risk] reviews to a more consistent and automated process”.[28]

Pushing the Bounds
Meta is one of many companies adopting AI tools to address a complex regulatory environment.[29] In a compliance setting, AI poses familiar challenges due to the unexplainability of ‘black box’ processes, or the potential hazards of relying on AI outputs in decision-making with unknown bias.[30] AI audit trails may be improving, but organizational and legal questions remain around accountability and oversight, particularly for Meta with 13 years remaining on the FTC order mandates.

Related to the staffing and oversight requirements of the order, the use of agentic AI in risk assessment dilutes transparency of privacy decision-making. By concurrently reducing the headcount of employees tasked with oversight, and introducing AI tools to sort and triage risk assessment, Meta has at best delegated, and worst, neglected the FTC’s mandate to designate “knowledgeable personnel [to] implement[] the Privacy Program”.[31] The designated compliance officers rely on a skeleton crew that act as an accountability sink, lacking sufficient resources to provide the human oversight of privacy decisions mandated by the FTC.[32]

With agentic AI, risk research and documentation can be supercharged, but best practices recommend, and some regulators require, that humans retain decision-making authority.[33] 2019 Department of Justice guidance recommended that compliance programs design risk assessments to maintain a “finger on the pulse”, not “asleep at the switch”, almost forecasting compliance outsourcing first to vendors, and now AI.[34]

Even the most sophisticated tech and compliance professionals would be hard pressed to oversee the evolving privacy program at Meta, keeping track of the granular shift of risk decisions from novel to normal. There is no reason to assume that AI tools errors will be recognized, or self-reported, even with the order’s obligation to report covered incidents.[35] An AI analysis could underestimate a risk that that violates an uncoded concept of human dignity, or fail to recognize a risk that is novel in the aggregate, due to compounding internal or external variables. The opposite, that the tool catches risk humans miss is certainly true, but with less humans in the loop, it becomes far less likely that an engineer would internally flag borderline novel or ‘icky’ features for legal review, or whistle blow, alerting the public about pending or future privacy harms.[36] In delegating initial reviews to AI, with lower-level compliance employees serving as accountability moats, Meta’s designated compliance officers have created layers of insulation and detachment from each unique privacy decision, yet still are certifying the privacy programs, based on personal knowledge or knowledgeable personnel that is in fact an algorithm.

Move Fast and Break Things
Through AI-automated risk assessments and a model of continuous deployment of code, Meta has drastically shortened its product release cycle from nearly two months down to days.[37] The rapid development and deployment timeline is further testing the regulatory appetite of FTC, and unnerving civil libertarians with new products and features outpacing legislative privacy protections and surveillance restrictions. A recent example of Meta’s rushed and unrestrained product development challenging the plain language and spirit of the FTC order are its controversial smart glasses.[38]

Meta’s Stealth Introduction of Facial Recognition to Smart Glasses
In early June 2026, the entire computational and storage stack for on-device facial recognition was detected in the Android version of Stella, the companion app for Meta’s smart glasses.[39] This “NameTag” feature is capable of detecting, matching, and storing biometric identifiers, often called faceprints. This code had been shipped to user’s phones, and could be remotely activated by Meta, allowing users to “see [their] connections” and “[r]emember the people [they] met and make new connections”.[40] The feature had not been activated, nor was the code evident to most consumers, but WIRED and EFF researchers were able to activate the code in debug mode to demonstrate the face identification feature using the glasses and code in real time.

Following the reporting and public scrutiny, Meta removed the unactivated code from the app, dismissed the story as “misleading” and referred to the code as “exploratory”. A week after removing the code, WIRED discovered a license agreement between Meta and a vendor called Rank One, selling access to military-grade facial recognition and “liveness detection” software to differentiate between the actual live face of a person.[41] These active and substantial steps towards implementing biometric identification invited the scrutiny of state AGs and multiple class action lawsuits from parents in Illinois.[42] Even with this backlash, Meta’s new AI personal agent app Muse follows a similar playbook, probing privacy boundaries until civil society pushes back.[43] All the while, new footholds for data collection are established, speedrunning new product features while the mandated privacy program operates on AI-autopilot until the next major violation or breach is discovered.

Conclusion
Back in Albuquerque, Meta’s counsel argued that New Mexico’s case was outdated because the company has undertaken serious soul searching and implemented structural changes to protect user privacy.[44] It appears more likely that Meta has taken advantage of political tumult to delegate the responsibility of protecting human dignity and privacy further away from leadership. The New Mexico jury agreed, finding Meta leadership had made 26 misleading statements, promising consumers transparency, internal investigations and compliance initiatives that never materialized.[45] With the integration of AI assisted risk assessments, Meta has ignored the opportunity to provide greater transparency, in favor of increased productivity and blurred accountability.

[1] As part of Meta’s August 2026 teen social media addiction settlement, 48 states released Meta from liability related to the Cambridge Analytica scandal. New Mexico was not involved in that multistate agreement, having previously won its teen safety trial against Meta. The New Mexico lawsuit was filed in 2021. Mikaela Schuettler, Nearly A Decade After the Cambridge Analytica Scandal, New Mexico Alone is Taking Facebook to Trial, AP News (Sept. 9, 2026), https://apnews.com/article/facebook-meta-new-mexico-privacy-lawsuit-fe250dc752777abd4f95f49111a2008a [https://perma.cc/7VMB-N7AK].

[2] Fed. Trade Comm’n, FTC Imposes $5Billion Penalty and Sweeping New Privacy Restrictions on Facebook (July 24, 2019), https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook [https://perma.cc/JA6M-8EYX]. Meta changed its name from Facebook in 2018, hence the varying references.

[3] An internal memo at Meta recommended taking advantage of a “dynamic political environment where many civil society groups that we would expect to attack us would have their resources focused on other concerns” to release facial recognition on smart glasses. See Kashmir Hill, Kalley Huang & Mike Isaac, Meta Plans to Add Facial Recognition Technology to Its Smart Glasses,N.Y. Times (Updated Feb. 14, 2026), https://www.nytimes.com/2026/02/13/technology/meta-facial-recognition-smart-glasses.html [https://perma.cc/FM9H-GKNA].

[4] Michel Protti, How AI Is Ushering in the Next Era of Risk Review at Meta, Meta (Mar. 31, 2026),https://about.fb.com/news/2026/03/how-ai-is-ushering-in-the-next-era-of-risk-review-at-meta/  [https://perma.cc/UW4E-94RM].

[5] Dissenting Statement of Commissioner Rohit Chopra, Regarding the Matter of Facebook, Inc. Comm’n File No. 1823109, at 19 (F.T.C. July 24, 2019) (Referencing a Dept. of Justice Policy Statement on Individual Liability). Commissioner Chopra also asserts that Designated Compliance Officer certification and CEO signature to ascribe compliance without benchmarks is simply a checkbox activity at 13.

[6] Fed. Trade Comm’n supra note 2.

[7] Facebook, Inc., Docket No. C-4365, Decision and Order, § VII, at 8 (F.T.C. Apr. 27, 2020).

[8] Id. at 8-11, 16-17.

[9] Id. at 12.

[10] Id. at 4.

[11] Id. at 14.

[12] Id.

[13] Id. at 5, 13.

[14] Id. at 23.

[15] Id. at 11.

[16] Cal. Code Regs. tit. 11, § 7150 (Lexis Advance through Register 2026, No. 34, August 21, 2026); Colo. Rev. Stat. § 6-1-1309(1), (2); N.H. Rev. Stat. Ann. § 507-H:8, Article 6(1)(f); Regulation 2016/679 of the European Parliament and of the Council of Apr. 27, 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation), art. 35, 2016 O.J. (L 119) 33 (EU).

[17] Michel Protti, Reflecting on Meta’s $8 Billion Investment in Privacy, Meta (Jan. 28, 2025),https://about.fb.com/news/2025/01/meta-8-billion-investment-privacy/, [https://perma.cc/UW4E-94RM].

[18] Michel Protti, Investing in Privacy, Meta (Jan. 25, 2024),https://about.fb.com/news/2024/01/investing-in-privacy/ [https://perma.cc/A79S-46GJ].

[19] Meta Privacy Progress Updates; Governance, https://www.meta.com/actions/privacy-progress/ [https://perma.cc/X73T-KH25].

[20]  The Privacy Aware Infrastructure allows Meta to demark “policy zones” across systems with distinct embedded purpose limitation rules for data. Wenlong Dong et. al, How Meta Enforces Purpose Limitation Via Privacy Aware Infrastructure at Scale, Engineering at Meta (Aug. 27, 2024), https://engineering.fb.com/2024/08/27/security/privacy-aware-infrastructure-purpose-limitation-meta/ [https://perma.cc/638N-WHE8].

[21] Meta, Responsible AI in Practice, https://www.meta.com/actions/privacy-and-risk/ [https://perma.cc/ZGL3-G35B], Responsible AI in Practice video.

[22] Rui Abrea et al., Moving Faster and Reducing Risk: Using LLMs in Release Deployment, Meta (Oct. 8, 2024), https://arxiv.org/abs/2410.06351 [https://perma.cc/C44S-AYJA].

[23] All Things Considered, Meta Plans to Replace Humans with AI to Assess Risks, NPR (May 31, 2025),  https://www.npr.org/2025/05/31/nx-s1-5407870/meta-ai-facebook-instagram-risks.

[24] Meta, supra note 17.

[25] Protti, supra note 4.

[26] Joe Duball, Meta’s Risk Assessment Updates Look Toward ‘Holistic’ Approach, IAPP (June 11, 2025), https://iapp.org/news/a/meta-s-risk-assessment-updates-look-toward-holistic-approach [https://perma.cc/U43S-HSK7].

[27] Hill, supra note 3.

[28] Jyoti Mann, Meta Tells Some Employees Their Jobs Are Being Replaced by Tech — Read the Memo, Business Insider (Oct. 23, 2025), https://www.businessinsider.com/meta-job-cuts-risk-org-replaced-by-tech-layoffs-2025-10 [https://perma.cc/N789-RUBF].

[29] JPMorgan Chase, Goldman Sachs, and Salesforce have announced plans to bolster their compliance programs with AI, in lieu of hiring. Jonathan Vanian, Meta Replacing Humans with AI for FTC-mandated Privacy Reviews CNBC (Oct. 23, 2025), https://www.cnbc.com/2025/10/23/meta-replacing-humans-with-ai-for-ftc-mandated-privacy-reviews.html [https://perma.cc/XE3H-H4J4].

[30] Explainability and model validation are particularly necessary in compliance settings to justify appropriate incorporation of AI-outputs in risk-management decisions. Int’l Compliance Ass’n, AI in Compliance – What It Is, How It’s Used, and Why Governance Matters (May 2026), https://www.int-comp.org/insight/ai-in-compliance/ [https://perma.cc/7KK5-ZE8N].

[31] Facebook, Inc., Dkt. No. C-4365 (F.T.C. Apr. 27, 2020), p. 17.

[32] By tasking employees with oversight over ever-increasing AI outputs, inevitable errors can be tied to the employee, not the corporate leadership decision to adopt the AI tool. Cory Doctorow borrows the term“accountability sink” from Dan Davies, applicable here to insulate both the CEO and Chief Compliance Officers from accountability for the risk assessments. Berkman Klein Ctr. Internet & Soc’y, Cory Doctorow on Enshittification and Reverse Centaurs at 17:57(YouTube, Oct. 8, 2026), https://www.youtube.com/watch?v=fYtIt0NjX2s.

[33] The EU requires human in the loop for any high-risk AI systems, and California also requires human corroboration for any AI-powered employment decisions. The NIST AI Risk ManagementFrameworkfocuses on a human-centric approach. See Regulation (EU) 2024/1689 of the European Parliament and of the Council, art. 14, 2024 O.J. (L 2024/1689); see also Chris Marr, State AI Laws Up the Ante for Human Oversight of Job Decisions, Bloomberg Law (Oct. 8, 2026)

 https://news.bloomberglaw.com/daily-labor-report/state-ai-laws-up-the-ante-for-human-oversight-of-job-decisions [https://perma.cc/MKB8-N5KP]; see generally Natl’t Inst. of Standards & Tech. NIST AI 100-1, Artificial Risk Management Framework (AI RMF 1.0) (Jan. 2023), https://doi.org/10.6028/NIST.AI.100-1.

[34] William D. Semins & Lauren Norris Donahue DOJ Revises Corporate Compliance Guidance Calling Attention to Three Areas Where Most Companies Fall Short, K&L Gates (May 16, 2019), https://www.klgates.com/thought-leadership/DOJ-Revises-Corporate-Compliance-Guidance-Calling-Attention-to-Three-Areas-Where-Most-Companies-Fall-Short-Risk-Assessments-Compliance-Culture-and-Continuous-Compliance-Program-Improvement-05-16-2019 [https://perma.cc/F6PN-37RX].

[35] In 2023, based on continued violations, the FTC sought to prohibit Meta from releasing new or modified products, services, or features without written confirmation of compliance. A heavily redacted public version indicates the independent assessor, Protiviti, identified deficiencies in risk assessment, transparency, and reporting. In re Facebook, Inc., Docket No. C-4365, Order to Show Cause, at 5-9. (F.T.C. May 3, 2023).

[36] Former Facebook execs and leadership report that Meta CEO Mark Zuckerman doesn’t like being told no, nor being told how Facebook products were hurting people. See Sarah Wynn-Williams, Careless People: A Cautionary Tale of Power, Greed, and Lost Idealism (Flatiron Books, 2025); Video posted by CBC Docs, Facebook, Whistleblower Frances Haugen: “Mark [Zuckerberg] doesn’t want to be told that he’s hurting people.” (Aug 21, 2026),https://www.facebook.com/cbcdocs/videos/facebook-whistleblower-frances-haugen-mark-zuckerberg-doesnt-want-to-be-told-tha/1344912297713251/

[37] Chuck Rossi et al., Continuous Development of Mobile Software at Facebook, Int’l Symposium on Found. Software Eng’g at 12, (Nov. 13, 2016), https://research.facebook.com/file/956687151563855/fse-rossi.pdf [https://perma.cc/SZ4M-HJ2N].

[38] Stories of users easily disabling the glasses minimal privacy measures and filming strangers has led to multiple lawsuits involving the “pervert glasses”. Victor Tangermann, Zuckerberg’s Pervert Glasses Have Been So Publicly Shamed That Meta’s Reportedly Now Working on a Version With No Camera, Futurism (Sep. 16, 2026), https://futurism.com/future-society/zuckerberg-pervert-glasses-shamed-meta-no-camera [https://perma.cc/6Q9B-XMPZ].

[39] Buchodi, Meta’s Smart Glasses Companion App Ships a Complete, Dormant Face-recognition Pipeline on a Stock Account, (June 4, 2026), https://www.buchodi.com/meta-glasses-facial-recognition/ [https://perma.cc/AZ9X-G85Y].

[40] Dhruv Mehrotra & Dell Cameron, Meta Silently Added Face-Recognition Code for Its Smart Glasses to Millions of Phones, WIRED (June 4, 2026), https://www.wired.com/story/meta-smart-glasses-face-recognition-nametag-connections/ [https://perma.cc/5V44-TG6U].

[41] Dell Cameron & Dhruv Mehrotra, Meta Tapped a Pentagon Supplier to Prototype Face Recognition for Its Glasses, WIRED (June 15, 2026), https://www.wired.com/story/meta-rank-one-computing-face-recognition-smart-glasses/ [https://perma.cc/7ADH-3CZL].

[42] Alvarez v. Meta Platforms, Inc., No. 1:26-cv-10773, Compl. (N.D. Ill. Sept. 4, 2026). https://www.biometricupdate.com/wp-content/uploads/2026/09/Alvarez_et_al_v_Meta_Platforms_Inc__ilndce-26-10773__0001.0.pdf ; Mike Scarcella & Jody Godoy Meta to Pay $1.4 Billion to Settle Texas Facial Recognition Data Lawsuit, Reuters (July 31, 2024), https://www.reuters.com/technology/cybersecurity/meta-platforms-pay-14-bln-settle-texas-lawsuit-over-facial-recognition-data-2024-07-30/  [https://perma.cc/F978-MEB4].

[43] Default settings allow Meta to further train its AI models, and encouraging users to share personal details with the Labubu-esque personal agent. Jonathan Vanian, Meta Pushes into Personal AI Agents As Company Faces Public Reckoning Over Privacy and Safety, CNBC (Updated Sept. 8, 2026, 3:09PM)

 https://www.cnbc.com/2026/09/08/meta-personal-ai-agents-public-reckoning-privacy-safety.html [https://perma.cc/M2FG-CS7V].

[44] Schuettler supra note 1.

[45] Special Verdict Form at 21-29, State of New Mexico v. Meta Platforms, Inc, No. D-101-CV-2021-00132 (N.M. Dist. Ct. Santa Fe. Cty., Sept. 25, 2026).

Fiscal Sovereignty, Cyberattacks, and the Case for Collective Counterattacks 

Nikki Muggli Blog , , , , ,

By Rebecca Hatt

            Charles Tilly famously said that “war made the state, and the state made war.”[1] Whatever the limitations of the war-making theory of state formation may be, it articulates an enduring truth: states need resources to exercise sovereignty.[2] Historically, a state had to be able to extract revenue to raise armies, secure her borders, and govern the territory. In the modern world fiscal capacity is just as essential, but the threats to it are no longer as straightforward. Increasingly threats to the fiscal capacity of a government can come from states, criminal organizations, corporations, individuals, and even AI bots that are not actively controlled by a human, all organized outside of the country’s sovereign space and designed to leverage unwilling host infrastructure around the globe.

International law has not yet adapted to this shift. Traditional frameworks use rules that purport to govern state responsibility and countermeasures by relying heavily on the concepts of identifiable states, identifiable conduct, attribution, and conventional ideas of injury.[OG1] [3] Cyberattacks quickly frustrate those frameworks by obfuscating actors and actions and ultimately [OG2] producing unique injuries. It is no longer necessary to create physical damage to seriously impair and harm a state. Furthermore, cyberspace allows private actors to mount increasingly sophisticated attacks against civilian and state targets. The ease of moving virtual currency relatively anonymously provides a powerful profit motive that incentivizes top minds to keep improving their black hat skills. [OG3] The ability to route attacks through otherwise unconnected third parties also creates additional opportunities to avoid detection or enforcement actions[OG4] .

These types of issues become particularly severe when cyber operations threaten a state’s fiscal institutions. Because fiscal capacity is an important component and even a prerequisite of effective sovereignty, international law should meaningfully address threats against this capacity and allow for substantial deterrence efforts. The fluidity of cyber threats allows any number of state, non-state, or AI actors [OG5] to cross borders in cyberspace and inflict untold international damage and nonetheless evade traditional attribution rules. This reality increasingly demands that states act collectively to address sophisticated threat actors.

Fiscal Capacity is Key to Sovereignty

A state cannot govern effectively without the ability to raise and deploy resources. Margaret Levi’s work explains the idea that states survive because they extract resources and that in doing so they balance relationships between coercion, legitimacy, compliance, and capacity.[4] Because successful taxation is one of the defining characteristics of an effective state, fiscal capacity is itself a mechanism and an exercise of sovereignty. Douglas North’s institutional theory further suggests that taxation is a part of the political and economic architecture that structures state authority and shapes economic performance.[OG6] [5] Strong governments can tax predictably because their citizens trust governmental institutions.[6] Making credible commitments thus expands fiscal capacity. Michael Mann similarly distinguishes the power of rulers from the “infrastructural power” of state institutions to implement decisions throughout society.[7] Modern scholars like Besley and Persson have treated fiscal and legal capacity as foundational components of state capacity.[8] International organizations like the OECD [OG7] increasingly reflect similar ideas, describing financial capacity as central to resilience, emergency response, and governance.[9] NATO has also incorporated financial resilience and critical infrastructure into its concept of security[OG8] .[10]

            The Montevideo Convention on the Rights and Duties of States defines statehood through assessments of permanent population, defined territory, government, and capacity to enter relations [OG9] with other states .[OG10] [11] Fiscal capacity does not appear on that list,[OG11]  however, each of those attributes relies on the state’s ability to raise and deploy resources.[12] Without a practical ability to raise, control, and distribute capital, formal sovereignty may persist, but there is minimal capacity to exercise and protect that sovereignty.[13]

Cyberattacks produce exactly this type of harm without triggering any of the options normally available to a country under attack in accordance with international law. The 2022 ransomware attack against Costa Rica serves as an important example. Multiple institutions and government ministries [OG12] were attacked simultaneously, which impaired tax collection, customs, international trade, healthcare, government administration, and other public services until resolved, and ultimately led to a declaration of national emergency.[14] Some scholars have called this a “data disaster,” a new category of risk to sovereignty that demonstrates that relying on physical damage in international legal frameworks overlooks [OG13] the most serious modern threats[OG14] .[15]

The Limitations of Current Countermeasures

If cyber operations can meaningfully impair sovereignty without producing conventional physical destruction, then what does international law permit states to do to combat such measures?

S[OG15] tates have increasingly viewed legal [OG16] countermeasures as a mechanism for enforcing international obligations[OG17] , and this tactic could serve as a possible solution to the problem at hand. International law lacks a centralized mechanism of enforcement authority to resolve every interstate issue and to subsequently compel compliance. Instead the international arena is made up of a relatively loose collection of relationships between nations with varying degrees of formality and organization. This structure, or absence of structure, makes countermeasures [OG18] an effective tool to deter aggression and encourage compliance by allowing an injured state to take limited actions against the state to which the attack has been attributed that would otherwise violate their international obligations. The International Law Commission’s Articles on Responsibility of States for Internationally Wrongful Acts (“ARSIWA”) provide the principal framework and explain that the injured state is limited to countermeasures that are proportionate and designed to induce compliance rather than inflicting punishment.[16]

This structure makes sense when State A commits a physical wrongful act against State B. Acts in Cyberspace are rarely so straightforward. A ransomware attack may be committed by a criminal organization operating from State A, routed through infrastructure in State C, and directed against government or “too big to fail” private financial institutions in State B. The “home state” of the attackers may support but not control the hackers, knowingly allow them to operate, lack the investigatory or enforcement capacity to address the issue, or have no knowledge of them whatsoever. This makes traditional attribution difficult if not impossible.

Costa Rica is again a good example. The attacks that crippled portions of the government were financially motivated professional operations from a hacker group not technically affiliated with their host state. While this makes attribution impossible under current law, it does little to change the perception that Costa Rica was the victim of another state’s attempt to extract their resources. The absence of a flag does not defray the harm.

Resolving the Ambiguity Around Collective Countermeasures

            In addition to the attribution problem, whether uninjured states are allowed to participate in countermeasures on behalf of another, and to what extent, is not settled law.[17]

ARSIWA acknowledges that certain obligations are owed to the international community as a whole, particularly regarding serious breaches such as genocide and violations of other erga omnes[OG19]  obligations. In these cases, other countries should be able to invoke responsibility despite the harm being indirect.[18] However, Article 54 does not address measures taken by states other than the injured state(s).[19] Conversely, collective retorsions, merely unfriendly acts, are generally uncontroversial. Nevertheless, given the severity of the threat and the prevalence of non-state actors retorsions are unlikely to be a sufficient deterrent.

Cyber threats make resolving this uncertainty around collective countermeasures increasingly important. A smaller or less technologically sophisticated state may lack the capacity to identify and defend against an attacker operating on its networks.[20] Malicious operations may also pass through third states without their knowledge. In those circumstances, international cooperation can provide technical expertise, intelligence, and resources that the affected state otherwise does not have access to. Under existing sovereignty principles, however, states assisting another state’s territory or networks, and possibly transiting or working in others, must remain vigilant and diligent to ensure compliance with the requirements for consent and their own international obligations.[21]

            Another ambiguity that must be addressed by international law arises when a state knows that serious malicious cyber activity originates from its territory but is unwilling or unable to address it. What obligations, if any, should the state have to prevent their territory or infrastructure from being used for cyber operations that cause harm abroad? How would this fit with 0 person companies where it becomes possible for an independent AI to be created in State A, and choose to operate without human input from compromised networks in State B, resulting in the ransom of private or public entities in States C, D, and E? The threat actor is functionally international and independent with the possibility to strike indiscriminately and simultaneously wherever and whenever it identifies an exploitable vulnerability. This reality favors collective countermeasures simply because that is the only way to attempt to match the structure of the threat itself. There are not clear borders in cyberspace, and the threat actor is not constrained by the limits of sovereignty. Thus new structural solutions such as collective countermeasures must be contemplated to address the novel form and nature of the opponent.[22] [OG20] 

Attribution is Only Getting Harder

            Attribution requires tracing an act to a human being and then up to the state they were acting on behalf of. In cases with traceable actors and physical actions it is still often impossible to gather sufficient evidence to show that the state is legally responsible for the person’s actions[OG21] . Layers of autonomous systems become far removed from a person or a state; yet the damage an AI agent can do is no less real. Neatly mapping responsibility will become increasingly impractical as technology continues to evolve.

            The obligations and responsibilities of each state that served as a host, knowingly or unknowingly, during the creation and operation of the AI agent are open and urgent questions. Furthermore, there is a practical imbalance between states with varying levels of expertise and resources in this area. This reality counsels against an overly strict standard and makes it challenging to consistently defend against increasingly sophisticated attacks that may have an international ripple effect.[23]

[OG22] 

Adapting to the Threat

            Traditional frameworks of international law do not have to be entirely discarded  to deal with the uncertainty in cyberspace. Caution is advisable to avoid mistakes that might escalate tension between states.[OG23]  However, the traditional safeguards can and must evolve to effectively reconcile the realities of modern statehood with the fluidity of the threat. Fiscal institutions are parts of the infrastructure through which modern states exercise sovereignty. Their importance must be acknowledged. When cyber operations threaten fiscal capacity, even if there is no physical damage, there must be a legal and effective method of deterrence under international law. Simultaneously, the multiparty nature of cyber operations makes bilateral countermeasures increasingly impractical.[24] While the legality of collective countermeasures remains contested, this area of the law demands more attention and a set of rules specific to engagements in cyberspace. Those rules must balance the benefits of collaborative countermeasures and preventative measures with both a state’s right to sovereignty and an individual citizen’s right to privacy during interventions.[OG24] [OG25] 

[1] Charles Tilly, Coercion, Capital and European States, A.D. 990 – 1992 (1992). 

[2] Id.

[3] See Gabčíkovo-Nagymaros Project (Hung./Slovk.), Judgment, 1997 I.C.J. 7, 55–57, ¶¶ 82–87 (Sept. 25).

[4] Margaret Levi, Of Rule and Revenue (1989).

[5] See Douglass C. North, Institutions, Institutional Change and Economic Performance. (James Alt & Douglass North eds., 1990).

[6] Barry R. Weingast, The Economic Role of Political Institutions: Market-Preserving Federalism and Economic Development,11 J. L. Econ. & Org.1, 1-31 (1995).

[7] Michael Mann, The Autonomous Power of the State: Its Origins, Mechanisms and Results, 25 Eur. J. Socio. 185, 185-213 (1984).

[8] Timothy Besley and Torsten Persson, The Origins of State Capacity: Property Rights, Taxation, and Politics, 99 Am. Econ. Rev. 1218, 1218-44(2009).

[9] OECD, Restoring Public Finances (2025).

[10] NATO, 2026 Resilience Baseline Requirements, Baseline Requirement 1, Objective 1(3) (Sept. 15, 2026), https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2026/09/15/2026-resilience-baseline-requirements

[11] Convention on Rights and Duties of States art. 1, Dec. 26, 1933, 49 Stat. 3097, 165 L.N.T.S. 19.

[12] See id.; Besley & Persson, supra note 8, at 1218–19.

[13] See François Delerue, Cyber Operations and International Law, Cambridge Univ. Press, 2020.

[14] See Matt Burgess, Conti’s attack against Costa Rica Sparks a new ransomware era, Wired: Security (June 12, 2022, at 07:00), https://www.wired.com/story/costa-rica-ransomware-conti/ [https://perma.cc/JRQ2-86EF].

[15] See Tomer Simon & Ben Haklai, Data Disaster – A new threat for sovereignty, 125 Int’l J.  Disaster Risk Reduction 1, 1-9 (2025).

[16] Draft articles on Responsibility of States for Internationally Wrongful Acts, with commentaries (2001), https://legal.un.org/ilc/texts/instruments/english/commentaries/9_6_2001.pdf [https://perma.cc/M7B3-G69J].

[17] Alexandra Hofer, Third-Party Countermeasures: Making Custom Out of Ambiguous Practice?, 74 Int’l & Compar. L. Q. 287, 287-317 (2025).

[18] See Martin Dawidowicz, Third-Party Countermeasures in International Law (Cambridge Univ. Press, 2017).

[19] Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries, arts. 22, 42, 48–54, [2001] 2 Y.B. Int’l L. Comm’n, U.N. Doc. A/56/10.

[20] Samuli Haataja, Cyber Operations and Collective Countermeasures Under International Law, 25 J. Conflict & Sec. L. 33, 33–51 (2020).

[21] See Miles Jackson & Federica Paddeu, The Countermeasures of Others: When Can States Collaborate in the Taking of Countermeasures?, 118 Am. J. Int’l L. 231 (2024).

[22] See Michael N. Schmitt,  ‘Below the Threshold’ Cyber Operations: The Countermeasures Response Option and International Law, 54 Va. J. Int‘l L. 698, 698-730 (2015).

[23] See Jeff Kosseff, Collective Countermeasures in Cyberspace, 10 Notre Dame J. Int’l & Comp. L. 18 (2020).

[24] See Michael N. Schmitt & Sean Watts, Collective Cyber Countermeasures?, 12 Harv. Nat’l Sec. J. 373, 373–411 (2021).