Blog

Pushing the Bounds: AI Risk Assessments as Accountability Moats

Nikki Muggli Blog, Paper , , , , ,

By Michael Moran

Introduction
Before the dust settled from Meta’s colossal but controversial child safety settlement, another trial kicked off in New Mexico bringing the Cambridge Analytica scandal of 2018 back into the news.[1] In that data breach and privacy scandal, Facebook violated an earlier Federal Trade Commission (FTC) order, and agreed to pay a $5 billion penalty and adopt organizational restructuring and safeguards including compliance with a mandatory privacy program.[2] Following the settlement, Meta made substantial investments into its privacy program, but recent actions suggests the company is taking advantage of “political tumult in the United States” [3] to outsource privacy compliance to AI, delegating accountability for future privacy harms to an algorithm.[4]

Meta’s Legal Obligation to Provide Data Protection Assessments
In 2019, Meta entered a 20-year settlement order with the FTC mandating the creation of a privacy program with particular staffing and independent reporting requirements. While the order attracted headlines as the largest financial penalty assessed by the FTC, Commissioner Chopra criticized the agreement for granting individual immunity to Mark Zuckerberg, Sheryl Sandberg, and other executive officers, citing the importance of individual liability to encourage corporate accountability and compliance.[5]  The 3-2 majority of the FTC believed staffing and reporting mandates could improve “the transparency of decision making and hold[] Facebook accountable via overlapping channels of compliance.”[6]

Staffing
To empower decision-makers and overlapping compliance channels, Meta was required to “[d]esignate a qualified employee or employees to coordinate and be responsible for the Privacy Program (‘Designated Compliance Officer(s)’)”.[7] The Designated Compliance Officer(s) and “Principal Executive Officer” (Mark Zuckerberg) have reporting and certification responsibilities to ensure the privacy program meets the structural safeguards mandated by the order.[8] An independent privacy committee within Facebook’s board of directors was required, in addition to contracting an external third-party assessor for additional oversight.[9] All members of the independent privacy committee must be able “to read and understand data protection and privacy policies and procedures” to exercise their oversight duties.[10]

Reporting
Related to increased transparency of decision-making, designated compliance officers are required to conduct a privacy review prior to implementing any new or modified product that presents a material risk to privacy.[11] This decision must be documented in a written “Privacy Review Statement”, which describes the product, information collected, affirmative express consent mechanisms, and a full description of privacy risks and safeguards implemented or rejected. [12] The order also obligated Meta to promptly document and report any covered incident data breaches involving 500 or more consumers.[13]The Designated Compliance Officer(s) must deliver quarterly reports to the Principal Executive Officer based upon (1) personal knowledge, (2) sub-certification by “knowledgeable personnel charged with implementing the Mandatory Privacy Program”, (3) material issues from any privacy review statements and decisions from the prior quarter, and (4) material issues raised in covered incident reports for the quarter. Based on these quarterly reports, their own personal knowledge, or sub-certification by knowledgeable charged personnel, the Principal Executive Officer certifies compliance with the order.[14]

In addition to these reporting requirements, the order specifically mandates collection of user’s affirmative express consent prior to the use of facial recognition templates, after clear and conspicuous disclosure, separate and apart from privacy policy notices.[15] Outside of the FTC order, numerous state and international laws also require Meta to conduct and document a “data protection assessment” (DPA) for any processing activity that presents a heightened risk of harm, such as collection of biometric data.[16]  

Meta’s Evolving Privacy Program
Meta marketed the FTC settlement as an opportunity to incorporate privacy by design across the organization, touting $8 billion invested in the privacy program and development of new privacy features across Meta platforms.[17] To meet the staffing requirements of the order, longtime Facebook executive, Michel Protti was promoted to Chief Compliance & Privacy Officer,  who was later joined by Erin Egan, Chief Privacy Officer, Policy, to serve as designated compliance officers. By 2024, Meta increased the number of employees focused on privacy from a few hundred to over 3000, evaluating an average of 1,4000 product features each month.[18] The “Privacy Legal team [became] embedded in the design and ongoing execution of [Meta] program[s] and advises on legal requirements during the course of our privacy review process.”[19]

To manage an increasing number of product developments, and expanding digital compliance requirements, Meta began incorporating AI automation into product design and privacy reviews in 2025; building privacy code scanning solutions to replace manual “point checking” controls by engineers. [20] Meta argues that these tools enable the compliance team to add rigor at scale; to detect and screen risks earlier, flagging issues that need mitigation or escalation, but pushing through risks deemed insignificant to avoid delays to product development.[21] Using tools such as the Diff Risk Score AI tool, Meta uses AI to assess risk, displaying a color-coded risk thresholds with potential corrective responses for engineers to incorporate.[22] Meta is aiming for 90% of all risk assessments to be automated, even in sensitive areas including AI safety, youth risk, and misinformation.[23] Assessments of novel and complex issue are reviewed by senior subject matter experts across technical, legal, and policy teams until these decisions can be mapped, codified, and phased into greater AI risk management system.[24] With the massive scale of ongoing product development at Meta, and lack of clearly articulated threshold for novel and complex issues, it is the possible the AI algorithm could dismiss risks the FTC might deem substantial, intentionally, or through pattern recognition on training data dismissing risks. Users must trust that Meta’s experts are conducting ongoing oversight, to double check for accuracy after AI’s first pass.[25]

Meta maintains that “[h]umans are still very much in control of the process”, but the strategic decisions around organizational structure and product development suggest otherwise.[26] While adjusting its risk review process to incorporate AI analysis, Meta has reduced privacy team influence and oversight, telling employees who questioned the changes to “push the bounds” of their FTC agreement.[27] Last October, Meta laid off an undisclosed number of employees in Product Risk Program Manager, Shared Services, and Global Security & Privacy teams, “moving from . . . manual [risk] reviews to a more consistent and automated process”.[28]

Pushing the Bounds
Meta is one of many companies adopting AI tools to address a complex regulatory environment.[29] In a compliance setting, AI poses familiar challenges due to the unexplainability of ‘black box’ processes, or the potential hazards of relying on AI outputs in decision-making with unknown bias.[30] AI audit trails may be improving, but organizational and legal questions remain around accountability and oversight, particularly for Meta with 13 years remaining on the FTC order mandates.

Related to the staffing and oversight requirements of the order, the use of agentic AI in risk assessment dilutes transparency of privacy decision-making. By concurrently reducing the headcount of employees tasked with oversight, and introducing AI tools to sort and triage risk assessment, Meta has at best delegated, and worst, neglected the FTC’s mandate to designate “knowledgeable personnel [to] implement[] the Privacy Program”.[31] The designated compliance officers rely on a skeleton crew that act as an accountability sink, lacking sufficient resources to provide the human oversight of privacy decisions mandated by the FTC.[32]

With agentic AI, risk research and documentation can be supercharged, but best practices recommend, and some regulators require, that humans retain decision-making authority.[33] 2019 Department of Justice guidance recommended that compliance programs design risk assessments to maintain a “finger on the pulse”, not “asleep at the switch”, almost forecasting compliance outsourcing first to vendors, and now AI.[34]

Even the most sophisticated tech and compliance professionals would be hard pressed to oversee the evolving privacy program at Meta, keeping track of the granular shift of risk decisions from novel to normal. There is no reason to assume that AI tools errors will be recognized, or self-reported, even with the order’s obligation to report covered incidents.[35] An AI analysis could underestimate a risk that that violates an uncoded concept of human dignity, or fail to recognize a risk that is novel in the aggregate, due to compounding internal or external variables. The opposite, that the tool catches risk humans miss is certainly true, but with less humans in the loop, it becomes far less likely that an engineer would internally flag borderline novel or ‘icky’ features for legal review, or whistle blow, alerting the public about pending or future privacy harms.[36] In delegating initial reviews to AI, with lower-level compliance employees serving as accountability moats, Meta’s designated compliance officers have created layers of insulation and detachment from each unique privacy decision, yet still are certifying the privacy programs, based on personal knowledge or knowledgeable personnel that is in fact an algorithm.

Move Fast and Break Things
Through AI-automated risk assessments and a model of continuous deployment of code, Meta has drastically shortened its product release cycle from nearly two months down to days.[37] The rapid development and deployment timeline is further testing the regulatory appetite of FTC, and unnerving civil libertarians with new products and features outpacing legislative privacy protections and surveillance restrictions. A recent example of Meta’s rushed and unrestrained product development challenging the plain language and spirit of the FTC order are its controversial smart glasses.[38]

Meta’s Stealth Introduction of Facial Recognition to Smart Glasses
In early June 2026, the entire computational and storage stack for on-device facial recognition was detected in the Android version of Stella, the companion app for Meta’s smart glasses.[39] This “NameTag” feature is capable of detecting, matching, and storing biometric identifiers, often called faceprints. This code had been shipped to user’s phones, and could be remotely activated by Meta, allowing users to “see [their] connections” and “[r]emember the people [they] met and make new connections”.[40] The feature had not been activated, nor was the code evident to most consumers, but WIRED and EFF researchers were able to activate the code in debug mode to demonstrate the face identification feature using the glasses and code in real time.

Following the reporting and public scrutiny, Meta removed the unactivated code from the app, dismissed the story as “misleading” and referred to the code as “exploratory”. A week after removing the code, WIRED discovered a license agreement between Meta and a vendor called Rank One, selling access to military-grade facial recognition and “liveness detection” software to differentiate between the actual live face of a person.[41] These active and substantial steps towards implementing biometric identification invited the scrutiny of state AGs and multiple class action lawsuits from parents in Illinois.[42] Even with this backlash, Meta’s new AI personal agent app Muse follows a similar playbook, probing privacy boundaries until civil society pushes back.[43] All the while, new footholds for data collection are established, speedrunning new product features while the mandated privacy program operates on AI-autopilot until the next major violation or breach is discovered.

Conclusion
Back in Albuquerque, Meta’s counsel argued that New Mexico’s case was outdated because the company has undertaken serious soul searching and implemented structural changes to protect user privacy.[44] It appears more likely that Meta has taken advantage of political tumult to delegate the responsibility of protecting human dignity and privacy further away from leadership. The New Mexico jury agreed, finding Meta leadership had made 26 misleading statements, promising consumers transparency, internal investigations and compliance initiatives that never materialized.[45] With the integration of AI assisted risk assessments, Meta has ignored the opportunity to provide greater transparency, in favor of increased productivity and blurred accountability.

[1] As part of Meta’s August 2026 teen social media addiction settlement, 48 states released Meta from liability related to the Cambridge Analytica scandal. New Mexico was not involved in that multistate agreement, having previously won its teen safety trial against Meta. The New Mexico lawsuit was filed in 2021. Mikaela Schuettler, Nearly A Decade After the Cambridge Analytica Scandal, New Mexico Alone is Taking Facebook to Trial, AP News (Sept. 9, 2026), https://apnews.com/article/facebook-meta-new-mexico-privacy-lawsuit-fe250dc752777abd4f95f49111a2008a [https://perma.cc/7VMB-N7AK].

[2] Fed. Trade Comm’n, FTC Imposes $5Billion Penalty and Sweeping New Privacy Restrictions on Facebook (July 24, 2019), https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook [https://perma.cc/JA6M-8EYX]. Meta changed its name from Facebook in 2018, hence the varying references.

[3] An internal memo at Meta recommended taking advantage of a “dynamic political environment where many civil society groups that we would expect to attack us would have their resources focused on other concerns” to release facial recognition on smart glasses. See Kashmir Hill, Kalley Huang & Mike Isaac, Meta Plans to Add Facial Recognition Technology to Its Smart Glasses,N.Y. Times (Updated Feb. 14, 2026), https://www.nytimes.com/2026/02/13/technology/meta-facial-recognition-smart-glasses.html [https://perma.cc/FM9H-GKNA].

[4] Michel Protti, How AI Is Ushering in the Next Era of Risk Review at Meta, Meta (Mar. 31, 2026),https://about.fb.com/news/2026/03/how-ai-is-ushering-in-the-next-era-of-risk-review-at-meta/  [https://perma.cc/UW4E-94RM].

[5] Dissenting Statement of Commissioner Rohit Chopra, Regarding the Matter of Facebook, Inc. Comm’n File No. 1823109, at 19 (F.T.C. July 24, 2019) (Referencing a Dept. of Justice Policy Statement on Individual Liability). Commissioner Chopra also asserts that Designated Compliance Officer certification and CEO signature to ascribe compliance without benchmarks is simply a checkbox activity at 13.

[6] Fed. Trade Comm’n supra note 2.

[7] Facebook, Inc., Docket No. C-4365, Decision and Order, § VII, at 8 (F.T.C. Apr. 27, 2020).

[8] Id. at 8-11, 16-17.

[9] Id. at 12.

[10] Id. at 4.

[11] Id. at 14.

[12] Id.

[13] Id. at 5, 13.

[14] Id. at 23.

[15] Id. at 11.

[16] Cal. Code Regs. tit. 11, § 7150 (Lexis Advance through Register 2026, No. 34, August 21, 2026); Colo. Rev. Stat. § 6-1-1309(1), (2); N.H. Rev. Stat. Ann. § 507-H:8, Article 6(1)(f); Regulation 2016/679 of the European Parliament and of the Council of Apr. 27, 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation), art. 35, 2016 O.J. (L 119) 33 (EU).

[17] Michel Protti, Reflecting on Meta’s $8 Billion Investment in Privacy, Meta (Jan. 28, 2025),https://about.fb.com/news/2025/01/meta-8-billion-investment-privacy/, [https://perma.cc/UW4E-94RM].

[18] Michel Protti, Investing in Privacy, Meta (Jan. 25, 2024),https://about.fb.com/news/2024/01/investing-in-privacy/ [https://perma.cc/A79S-46GJ].

[19] Meta Privacy Progress Updates; Governance, https://www.meta.com/actions/privacy-progress/ [https://perma.cc/X73T-KH25].

[20]  The Privacy Aware Infrastructure allows Meta to demark “policy zones” across systems with distinct embedded purpose limitation rules for data. Wenlong Dong et. al, How Meta Enforces Purpose Limitation Via Privacy Aware Infrastructure at Scale, Engineering at Meta (Aug. 27, 2024), https://engineering.fb.com/2024/08/27/security/privacy-aware-infrastructure-purpose-limitation-meta/ [https://perma.cc/638N-WHE8].

[21] Meta, Responsible AI in Practice, https://www.meta.com/actions/privacy-and-risk/ [https://perma.cc/ZGL3-G35B], Responsible AI in Practice video.

[22] Rui Abrea et al., Moving Faster and Reducing Risk: Using LLMs in Release Deployment, Meta (Oct. 8, 2024), https://arxiv.org/abs/2410.06351 [https://perma.cc/C44S-AYJA].

[23] All Things Considered, Meta Plans to Replace Humans with AI to Assess Risks, NPR (May 31, 2025),  https://www.npr.org/2025/05/31/nx-s1-5407870/meta-ai-facebook-instagram-risks.

[24] Meta, supra note 17.

[25] Protti, supra note 4.

[26] Joe Duball, Meta’s Risk Assessment Updates Look Toward ‘Holistic’ Approach, IAPP (June 11, 2025), https://iapp.org/news/a/meta-s-risk-assessment-updates-look-toward-holistic-approach [https://perma.cc/U43S-HSK7].

[27] Hill, supra note 3.

[28] Jyoti Mann, Meta Tells Some Employees Their Jobs Are Being Replaced by Tech — Read the Memo, Business Insider (Oct. 23, 2025), https://www.businessinsider.com/meta-job-cuts-risk-org-replaced-by-tech-layoffs-2025-10 [https://perma.cc/N789-RUBF].

[29] JPMorgan Chase, Goldman Sachs, and Salesforce have announced plans to bolster their compliance programs with AI, in lieu of hiring. Jonathan Vanian, Meta Replacing Humans with AI for FTC-mandated Privacy Reviews CNBC (Oct. 23, 2025), https://www.cnbc.com/2025/10/23/meta-replacing-humans-with-ai-for-ftc-mandated-privacy-reviews.html [https://perma.cc/XE3H-H4J4].

[30] Explainability and model validation are particularly necessary in compliance settings to justify appropriate incorporation of AI-outputs in risk-management decisions. Int’l Compliance Ass’n, AI in Compliance – What It Is, How It’s Used, and Why Governance Matters (May 2026), https://www.int-comp.org/insight/ai-in-compliance/ [https://perma.cc/7KK5-ZE8N].

[31] Facebook, Inc., Dkt. No. C-4365 (F.T.C. Apr. 27, 2020), p. 17.

[32] By tasking employees with oversight over ever-increasing AI outputs, inevitable errors can be tied to the employee, not the corporate leadership decision to adopt the AI tool. Cory Doctorow borrows the term“accountability sink” from Dan Davies, applicable here to insulate both the CEO and Chief Compliance Officers from accountability for the risk assessments. Berkman Klein Ctr. Internet & Soc’y, Cory Doctorow on Enshittification and Reverse Centaurs at 17:57(YouTube, Oct. 8, 2026), https://www.youtube.com/watch?v=fYtIt0NjX2s.

[33] The EU requires human in the loop for any high-risk AI systems, and California also requires human corroboration for any AI-powered employment decisions. The NIST AI Risk ManagementFrameworkfocuses on a human-centric approach. See Regulation (EU) 2024/1689 of the European Parliament and of the Council, art. 14, 2024 O.J. (L 2024/1689); see also Chris Marr, State AI Laws Up the Ante for Human Oversight of Job Decisions, Bloomberg Law (Oct. 8, 2026)

 https://news.bloomberglaw.com/daily-labor-report/state-ai-laws-up-the-ante-for-human-oversight-of-job-decisions [https://perma.cc/MKB8-N5KP]; see generally Natl’t Inst. of Standards & Tech. NIST AI 100-1, Artificial Risk Management Framework (AI RMF 1.0) (Jan. 2023), https://doi.org/10.6028/NIST.AI.100-1.

[34] William D. Semins & Lauren Norris Donahue DOJ Revises Corporate Compliance Guidance Calling Attention to Three Areas Where Most Companies Fall Short, K&L Gates (May 16, 2019), https://www.klgates.com/thought-leadership/DOJ-Revises-Corporate-Compliance-Guidance-Calling-Attention-to-Three-Areas-Where-Most-Companies-Fall-Short-Risk-Assessments-Compliance-Culture-and-Continuous-Compliance-Program-Improvement-05-16-2019 [https://perma.cc/F6PN-37RX].

[35] In 2023, based on continued violations, the FTC sought to prohibit Meta from releasing new or modified products, services, or features without written confirmation of compliance. A heavily redacted public version indicates the independent assessor, Protiviti, identified deficiencies in risk assessment, transparency, and reporting. In re Facebook, Inc., Docket No. C-4365, Order to Show Cause, at 5-9. (F.T.C. May 3, 2023).

[36] Former Facebook execs and leadership report that Meta CEO Mark Zuckerman doesn’t like being told no, nor being told how Facebook products were hurting people. See Sarah Wynn-Williams, Careless People: A Cautionary Tale of Power, Greed, and Lost Idealism (Flatiron Books, 2025); Video posted by CBC Docs, Facebook, Whistleblower Frances Haugen: “Mark [Zuckerberg] doesn’t want to be told that he’s hurting people.” (Aug 21, 2026),https://www.facebook.com/cbcdocs/videos/facebook-whistleblower-frances-haugen-mark-zuckerberg-doesnt-want-to-be-told-tha/1344912297713251/

[37] Chuck Rossi et al., Continuous Development of Mobile Software at Facebook, Int’l Symposium on Found. Software Eng’g at 12, (Nov. 13, 2016), https://research.facebook.com/file/956687151563855/fse-rossi.pdf [https://perma.cc/SZ4M-HJ2N].

[38] Stories of users easily disabling the glasses minimal privacy measures and filming strangers has led to multiple lawsuits involving the “pervert glasses”. Victor Tangermann, Zuckerberg’s Pervert Glasses Have Been So Publicly Shamed That Meta’s Reportedly Now Working on a Version With No Camera, Futurism (Sep. 16, 2026), https://futurism.com/future-society/zuckerberg-pervert-glasses-shamed-meta-no-camera [https://perma.cc/6Q9B-XMPZ].

[39] Buchodi, Meta’s Smart Glasses Companion App Ships a Complete, Dormant Face-recognition Pipeline on a Stock Account, (June 4, 2026), https://www.buchodi.com/meta-glasses-facial-recognition/ [https://perma.cc/AZ9X-G85Y].

[40] Dhruv Mehrotra & Dell Cameron, Meta Silently Added Face-Recognition Code for Its Smart Glasses to Millions of Phones, WIRED (June 4, 2026), https://www.wired.com/story/meta-smart-glasses-face-recognition-nametag-connections/ [https://perma.cc/5V44-TG6U].

[41] Dell Cameron & Dhruv Mehrotra, Meta Tapped a Pentagon Supplier to Prototype Face Recognition for Its Glasses, WIRED (June 15, 2026), https://www.wired.com/story/meta-rank-one-computing-face-recognition-smart-glasses/ [https://perma.cc/7ADH-3CZL].

[42] Alvarez v. Meta Platforms, Inc., No. 1:26-cv-10773, Compl. (N.D. Ill. Sept. 4, 2026). https://www.biometricupdate.com/wp-content/uploads/2026/09/Alvarez_et_al_v_Meta_Platforms_Inc__ilndce-26-10773__0001.0.pdf ; Mike Scarcella & Jody Godoy Meta to Pay $1.4 Billion to Settle Texas Facial Recognition Data Lawsuit, Reuters (July 31, 2024), https://www.reuters.com/technology/cybersecurity/meta-platforms-pay-14-bln-settle-texas-lawsuit-over-facial-recognition-data-2024-07-30/  [https://perma.cc/F978-MEB4].

[43] Default settings allow Meta to further train its AI models, and encouraging users to share personal details with the Labubu-esque personal agent. Jonathan Vanian, Meta Pushes into Personal AI Agents As Company Faces Public Reckoning Over Privacy and Safety, CNBC (Updated Sept. 8, 2026, 3:09PM)

 https://www.cnbc.com/2026/09/08/meta-personal-ai-agents-public-reckoning-privacy-safety.html [https://perma.cc/M2FG-CS7V].

[44] Schuettler supra note 1.

[45] Special Verdict Form at 21-29, State of New Mexico v. Meta Platforms, Inc, No. D-101-CV-2021-00132 (N.M. Dist. Ct. Santa Fe. Cty., Sept. 25, 2026).

Fiscal Sovereignty, Cyberattacks, and the Case for Collective Counterattacks 

Nikki Muggli Blog , , , , ,

By Rebecca Hatt

            Charles Tilly famously said that “war made the state, and the state made war.”[1] Whatever the limitations of the war-making theory of state formation may be, it articulates an enduring truth: states need resources to exercise sovereignty.[2] Historically, a state had to be able to extract revenue to raise armies, secure her borders, and govern the territory. In the modern world fiscal capacity is just as essential, but the threats to it are no longer as straightforward. Increasingly threats to the fiscal capacity of a government can come from states, criminal organizations, corporations, individuals, and even AI bots that are not actively controlled by a human, all organized outside of the country’s sovereign space and designed to leverage unwilling host infrastructure around the globe.

International law has not yet adapted to this shift. Traditional frameworks use rules that purport to govern state responsibility and countermeasures by relying heavily on the concepts of identifiable states, identifiable conduct, attribution, and conventional ideas of injury.[OG1] [3] Cyberattacks quickly frustrate those frameworks by obfuscating actors and actions and ultimately [OG2] producing unique injuries. It is no longer necessary to create physical damage to seriously impair and harm a state. Furthermore, cyberspace allows private actors to mount increasingly sophisticated attacks against civilian and state targets. The ease of moving virtual currency relatively anonymously provides a powerful profit motive that incentivizes top minds to keep improving their black hat skills. [OG3] The ability to route attacks through otherwise unconnected third parties also creates additional opportunities to avoid detection or enforcement actions[OG4] .

These types of issues become particularly severe when cyber operations threaten a state’s fiscal institutions. Because fiscal capacity is an important component and even a prerequisite of effective sovereignty, international law should meaningfully address threats against this capacity and allow for substantial deterrence efforts. The fluidity of cyber threats allows any number of state, non-state, or AI actors [OG5] to cross borders in cyberspace and inflict untold international damage and nonetheless evade traditional attribution rules. This reality increasingly demands that states act collectively to address sophisticated threat actors.

Fiscal Capacity is Key to Sovereignty

A state cannot govern effectively without the ability to raise and deploy resources. Margaret Levi’s work explains the idea that states survive because they extract resources and that in doing so they balance relationships between coercion, legitimacy, compliance, and capacity.[4] Because successful taxation is one of the defining characteristics of an effective state, fiscal capacity is itself a mechanism and an exercise of sovereignty. Douglas North’s institutional theory further suggests that taxation is a part of the political and economic architecture that structures state authority and shapes economic performance.[OG6] [5] Strong governments can tax predictably because their citizens trust governmental institutions.[6] Making credible commitments thus expands fiscal capacity. Michael Mann similarly distinguishes the power of rulers from the “infrastructural power” of state institutions to implement decisions throughout society.[7] Modern scholars like Besley and Persson have treated fiscal and legal capacity as foundational components of state capacity.[8] International organizations like the OECD [OG7] increasingly reflect similar ideas, describing financial capacity as central to resilience, emergency response, and governance.[9] NATO has also incorporated financial resilience and critical infrastructure into its concept of security[OG8] .[10]

            The Montevideo Convention on the Rights and Duties of States defines statehood through assessments of permanent population, defined territory, government, and capacity to enter relations [OG9] with other states .[OG10] [11] Fiscal capacity does not appear on that list,[OG11]  however, each of those attributes relies on the state’s ability to raise and deploy resources.[12] Without a practical ability to raise, control, and distribute capital, formal sovereignty may persist, but there is minimal capacity to exercise and protect that sovereignty.[13]

Cyberattacks produce exactly this type of harm without triggering any of the options normally available to a country under attack in accordance with international law. The 2022 ransomware attack against Costa Rica serves as an important example. Multiple institutions and government ministries [OG12] were attacked simultaneously, which impaired tax collection, customs, international trade, healthcare, government administration, and other public services until resolved, and ultimately led to a declaration of national emergency.[14] Some scholars have called this a “data disaster,” a new category of risk to sovereignty that demonstrates that relying on physical damage in international legal frameworks overlooks [OG13] the most serious modern threats[OG14] .[15]

The Limitations of Current Countermeasures

If cyber operations can meaningfully impair sovereignty without producing conventional physical destruction, then what does international law permit states to do to combat such measures?

S[OG15] tates have increasingly viewed legal [OG16] countermeasures as a mechanism for enforcing international obligations[OG17] , and this tactic could serve as a possible solution to the problem at hand. International law lacks a centralized mechanism of enforcement authority to resolve every interstate issue and to subsequently compel compliance. Instead the international arena is made up of a relatively loose collection of relationships between nations with varying degrees of formality and organization. This structure, or absence of structure, makes countermeasures [OG18] an effective tool to deter aggression and encourage compliance by allowing an injured state to take limited actions against the state to which the attack has been attributed that would otherwise violate their international obligations. The International Law Commission’s Articles on Responsibility of States for Internationally Wrongful Acts (“ARSIWA”) provide the principal framework and explain that the injured state is limited to countermeasures that are proportionate and designed to induce compliance rather than inflicting punishment.[16]

This structure makes sense when State A commits a physical wrongful act against State B. Acts in Cyberspace are rarely so straightforward. A ransomware attack may be committed by a criminal organization operating from State A, routed through infrastructure in State C, and directed against government or “too big to fail” private financial institutions in State B. The “home state” of the attackers may support but not control the hackers, knowingly allow them to operate, lack the investigatory or enforcement capacity to address the issue, or have no knowledge of them whatsoever. This makes traditional attribution difficult if not impossible.

Costa Rica is again a good example. The attacks that crippled portions of the government were financially motivated professional operations from a hacker group not technically affiliated with their host state. While this makes attribution impossible under current law, it does little to change the perception that Costa Rica was the victim of another state’s attempt to extract their resources. The absence of a flag does not defray the harm.

Resolving the Ambiguity Around Collective Countermeasures

            In addition to the attribution problem, whether uninjured states are allowed to participate in countermeasures on behalf of another, and to what extent, is not settled law.[17]

ARSIWA acknowledges that certain obligations are owed to the international community as a whole, particularly regarding serious breaches such as genocide and violations of other erga omnes[OG19]  obligations. In these cases, other countries should be able to invoke responsibility despite the harm being indirect.[18] However, Article 54 does not address measures taken by states other than the injured state(s).[19] Conversely, collective retorsions, merely unfriendly acts, are generally uncontroversial. Nevertheless, given the severity of the threat and the prevalence of non-state actors retorsions are unlikely to be a sufficient deterrent.

Cyber threats make resolving this uncertainty around collective countermeasures increasingly important. A smaller or less technologically sophisticated state may lack the capacity to identify and defend against an attacker operating on its networks.[20] Malicious operations may also pass through third states without their knowledge. In those circumstances, international cooperation can provide technical expertise, intelligence, and resources that the affected state otherwise does not have access to. Under existing sovereignty principles, however, states assisting another state’s territory or networks, and possibly transiting or working in others, must remain vigilant and diligent to ensure compliance with the requirements for consent and their own international obligations.[21]

            Another ambiguity that must be addressed by international law arises when a state knows that serious malicious cyber activity originates from its territory but is unwilling or unable to address it. What obligations, if any, should the state have to prevent their territory or infrastructure from being used for cyber operations that cause harm abroad? How would this fit with 0 person companies where it becomes possible for an independent AI to be created in State A, and choose to operate without human input from compromised networks in State B, resulting in the ransom of private or public entities in States C, D, and E? The threat actor is functionally international and independent with the possibility to strike indiscriminately and simultaneously wherever and whenever it identifies an exploitable vulnerability. This reality favors collective countermeasures simply because that is the only way to attempt to match the structure of the threat itself. There are not clear borders in cyberspace, and the threat actor is not constrained by the limits of sovereignty. Thus new structural solutions such as collective countermeasures must be contemplated to address the novel form and nature of the opponent.[22] [OG20] 

Attribution is Only Getting Harder

            Attribution requires tracing an act to a human being and then up to the state they were acting on behalf of. In cases with traceable actors and physical actions it is still often impossible to gather sufficient evidence to show that the state is legally responsible for the person’s actions[OG21] . Layers of autonomous systems become far removed from a person or a state; yet the damage an AI agent can do is no less real. Neatly mapping responsibility will become increasingly impractical as technology continues to evolve.

            The obligations and responsibilities of each state that served as a host, knowingly or unknowingly, during the creation and operation of the AI agent are open and urgent questions. Furthermore, there is a practical imbalance between states with varying levels of expertise and resources in this area. This reality counsels against an overly strict standard and makes it challenging to consistently defend against increasingly sophisticated attacks that may have an international ripple effect.[23]

[OG22] 

Adapting to the Threat

            Traditional frameworks of international law do not have to be entirely discarded  to deal with the uncertainty in cyberspace. Caution is advisable to avoid mistakes that might escalate tension between states.[OG23]  However, the traditional safeguards can and must evolve to effectively reconcile the realities of modern statehood with the fluidity of the threat. Fiscal institutions are parts of the infrastructure through which modern states exercise sovereignty. Their importance must be acknowledged. When cyber operations threaten fiscal capacity, even if there is no physical damage, there must be a legal and effective method of deterrence under international law. Simultaneously, the multiparty nature of cyber operations makes bilateral countermeasures increasingly impractical.[24] While the legality of collective countermeasures remains contested, this area of the law demands more attention and a set of rules specific to engagements in cyberspace. Those rules must balance the benefits of collaborative countermeasures and preventative measures with both a state’s right to sovereignty and an individual citizen’s right to privacy during interventions.[OG24] [OG25] 

[1] Charles Tilly, Coercion, Capital and European States, A.D. 990 – 1992 (1992). 

[2] Id.

[3] See Gabčíkovo-Nagymaros Project (Hung./Slovk.), Judgment, 1997 I.C.J. 7, 55–57, ¶¶ 82–87 (Sept. 25).

[4] Margaret Levi, Of Rule and Revenue (1989).

[5] See Douglass C. North, Institutions, Institutional Change and Economic Performance. (James Alt & Douglass North eds., 1990).

[6] Barry R. Weingast, The Economic Role of Political Institutions: Market-Preserving Federalism and Economic Development,11 J. L. Econ. & Org.1, 1-31 (1995).

[7] Michael Mann, The Autonomous Power of the State: Its Origins, Mechanisms and Results, 25 Eur. J. Socio. 185, 185-213 (1984).

[8] Timothy Besley and Torsten Persson, The Origins of State Capacity: Property Rights, Taxation, and Politics, 99 Am. Econ. Rev. 1218, 1218-44(2009).

[9] OECD, Restoring Public Finances (2025).

[10] NATO, 2026 Resilience Baseline Requirements, Baseline Requirement 1, Objective 1(3) (Sept. 15, 2026), https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2026/09/15/2026-resilience-baseline-requirements

[11] Convention on Rights and Duties of States art. 1, Dec. 26, 1933, 49 Stat. 3097, 165 L.N.T.S. 19.

[12] See id.; Besley & Persson, supra note 8, at 1218–19.

[13] See François Delerue, Cyber Operations and International Law, Cambridge Univ. Press, 2020.

[14] See Matt Burgess, Conti’s attack against Costa Rica Sparks a new ransomware era, Wired: Security (June 12, 2022, at 07:00), https://www.wired.com/story/costa-rica-ransomware-conti/ [https://perma.cc/JRQ2-86EF].

[15] See Tomer Simon & Ben Haklai, Data Disaster – A new threat for sovereignty, 125 Int’l J.  Disaster Risk Reduction 1, 1-9 (2025).

[16] Draft articles on Responsibility of States for Internationally Wrongful Acts, with commentaries (2001), https://legal.un.org/ilc/texts/instruments/english/commentaries/9_6_2001.pdf [https://perma.cc/M7B3-G69J].

[17] Alexandra Hofer, Third-Party Countermeasures: Making Custom Out of Ambiguous Practice?, 74 Int’l & Compar. L. Q. 287, 287-317 (2025).

[18] See Martin Dawidowicz, Third-Party Countermeasures in International Law (Cambridge Univ. Press, 2017).

[19] Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries, arts. 22, 42, 48–54, [2001] 2 Y.B. Int’l L. Comm’n, U.N. Doc. A/56/10.

[20] Samuli Haataja, Cyber Operations and Collective Countermeasures Under International Law, 25 J. Conflict & Sec. L. 33, 33–51 (2020).

[21] See Miles Jackson & Federica Paddeu, The Countermeasures of Others: When Can States Collaborate in the Taking of Countermeasures?, 118 Am. J. Int’l L. 231 (2024).

[22] See Michael N. Schmitt,  ‘Below the Threshold’ Cyber Operations: The Countermeasures Response Option and International Law, 54 Va. J. Int‘l L. 698, 698-730 (2015).

[23] See Jeff Kosseff, Collective Countermeasures in Cyberspace, 10 Notre Dame J. Int’l & Comp. L. 18 (2020).

[24] See Michael N. Schmitt & Sean Watts, Collective Cyber Countermeasures?, 12 Harv. Nat’l Sec. J. 373, 373–411 (2021).

Can Vehicles be Criminal Voyeurs?

mdecrow@maine.edu Article, Blog , , ,

Can Vehicles be Criminal Voyeurs?

Rebecca Hatt

 

New vehicles come equipped with cameras and microphones that surveil the exterior, and often the interior, of the car in the name of safety and interactivity.[1] Some cameras only help with parking, however, many go much further than that.[2] For instance, Tesla’s exterior cameras surveil the outside of the car in Sentry mode, on the lookout for vandals or collisions, and the interior cabin cameras are known to record on impact and to monitor for attentiveness while using supervised features.[3] The theory is that these cameras help protect against damage, theft, and unsupervised use.[4] While these are laudable goals, the theoretical intention and the opt-in model of data sharing isn’t enough to escape state voyeurism laws in states like Maine.[5] In Maine, a person is guilty of violation of privacy if that person intentionally installs or uses in a “private place without the consent of the person or persons entitled to privacy in that place, any device for observing, photographing, recording, amplifying or broadcasting sounds or events in that place.”[6] When these vehicles, or those equipped with after-market dashcams, are parked in private garages, or used for private purposes in such a way that activity in them would normally be private, the recording conflicts with a person’s reasonable expectations of privacy, and with this criminal statute. An opt-in from the driver is not sufficient to allow the vehicle to breach the privacy of others under the law, and even if the driver sought to obtain consent from every passenger or passerby, some people are not able to give legal consent. Despite the impossibility, car makers like Tesla include disclaimers that “[i]t is your sole responsibility to consult and comply with all local regulations and property restrictions regarding the use of cameras.”[7] So when a child is changing at the back of the car using towels or a Car Cabana to provide privacy, who’s watching, how do we know, and who does the law protect?[8]

Continue reading →

Challenges with Adopting Blockchain Technology in the Wine Industry

mdecrow@maine.edu Article, Blog ,

Challenges with Adopting Blockchain Technology in the Wine Industry

Amanda Violette

 

I. Introduction

A bottle of wine encapsulates a complex narrative shaped by geography, craftsmanship, logistics, and market dynamics, and, more recently, climate change.[1] Traditionally, much of this narrative has remained opaque, especially to American consumers.[2] While French wines have been highly regulated since the early 20th century with the intent of preventing fraudulent products from damaging the wine industry, American wines became regulated by the Alcohol and Tobacco Tax and Trade Bureau (TTB) later using American Viticultural Area regulation to provide warnings about the dangers of alcohol on the label.[3] However, now, with American wines, only information about the grape origin is required, leaving the consumer to question whether the wine lived up to its intended character and authenticity.[4]

Continue reading →

No Harm, No Court: An International Approach to Data Privacy Harms and Article III Standing

mdecrow@maine.edu Article, Blog , ,

No Harm, No Court: An International Approach to Data Privacy Harms and Article III Standing

Emily Fowler

 

In the United States, cases brought regarding privacy violations are being dismissed early in the litigation process because U.S. law remains tied to historical analysis of injuries, whereas other legal systems around the world are taking a more forward-thinking approach to these issues. Trends in recent cases show that claims for privacy violations, such as the capture of individual interactions with websites through session-replay technology, are being dismissed for lack of standing.[1] Article III standing is a concept based in Constitutional Law. Under Article III, federal courts’ authority is limited so that they may only hear “Cases” and “Controversies”.[2] To bring a case or controversy before a federal court, plaintiffs must have standing (a “personal stake” in the case).[3] Three elements must be met to have standing: (1) there is “an ‘injury in fact’ that is both ‘concrete and particularized’ and ‘actual or imminent’”; (2) “the injury is ‘fairly traceable’ to the challenged conduct”; and (3) the injury likely “‘will be redressed by a favorable decision.’”[4]

Continue reading →

When Design Becomes Harmful: Why Social Media Addiction Harms Trials Could Have Lasting Impacts on Privacy Harm Remediation

mdecrow@maine.edu Article, Blog , ,

When Design Becomes Harmful: Why Social Media Addiction Harms Trials Could Have Lasting Impacts on Privacy Harm Remediation

Alex Logan

 

I. Introduction

In late January 2026, a landmark trial kicked off in California via a proceeding led by an unnamed plaintiff, “K.G.M.”. The plaintiff alleges that social media companies/platforms such as TikTok, Snapchat, YouTube, and Meta have intentionally designed platforms so as to addict children and keep them hooked on said platforms through mindless scrolling, auto-play features, other engagement techniques, and suggested or tailored content specific to their individual behaviors.[1] This is just one of several similar lawsuits which are all making their way through the courts.[2] The plaintiffs allege that the addictive design of these platforms has led to long-term mental health issues, such as depression, anxiety, tendencies toward self-harm, and even suicidal thoughts and actions.[3] The social media companies are relying heavily on Section 230 protections and publisher immunity in their defense.[4] These cases collectively could be a major step toward remediating more conceptual harms that plaintiffs have long struggled to prove in similar cases due in large part to Section 230 of the Communications Decency Act.[5] Successful plaintiff outcomes in these cases could potentially help pave the way for corporate accountability when addressing similarly squishy or conceptual privacy harms through resulting reconceptualization and generation of harm.

Continue reading →

AI, a Watchful Eye: The Less than Stellar Performance of AI Security and the Consequences Thereof

mdecrow@maine.edu Article, Blog , , ,

AI, a Watchful Eye: The Less than Stellar Performance of AI Security and the Consequences Thereof

James Hotham

 

The use and abuse of widespread camera surveillance is not a novel fear. For decades, media has explored this concept. However, a new threat has arisen in a new form. It has not taken the form of an oppressive government, a terrorist group, or a supreme artificial intelligence. Rather, it comes from private party security providers. Several security providers have begun to work AI into their  security cameras for the use of threat detection.[1] However, the success of these threat detection models is dubious. Just this year in late October, one of these systems placed in a Baltimore school, detected an individual carrying a firearm.[2] Police arrived and identified the suspect as sixteen-year-old Taki Allen.[3] However, after the police drew their weapons and handcuffed young Allen, they discovered the “firearm” was actually just an empty bag of Doritos.[4]

Despite the fact that AI technology of this level of sophistication is relatively new, it has sprouted into a multimillion-dollar industry in just a few years. But despite years of development, mishaps like these still occur. This article will explore how these systems work, why they malfunction, ways consumers can avoid these malfunctions, and potential liability for when they malfunction.

Continue reading →

The Collapse of Capability Theory: Ambriz, Popa, and the Future of Article III Standing in AI Privacy Cases

mdecrow@maine.edu Article, Blog , , , , ,

The Collapse of Capability Theory: Ambriz, Popa, and the Future of Article III Standing in AI Privacy Cases

Caroline Aiello

 

Introduction

In February 2025, the Northern District of California denied Google’s motion to dismiss in a class action lawsuit that claimed Google’s artificial intelligence (“AI”) tools violated the California Invasion of Privacy Act (“CIPA”) by transcribing phone calls of users.[1] The court in this case, Ambriz v. Google, ruled that Google’s technical “capability” to use customer call data to train its AI models was enough to state a claim under California’s Invasion of Privacy Act, regardless of whether or not Google actually exploited that data.[2] Six months later, the Ninth Circuit took the opposite approach. The later ruling in Popa v. Microsoft held that routine website tracking did not constitute actual harm and the claims were dismissed for lack of Article III standing before reaching the merits.[3]

These two decisions present privacy law with incompatible standards. Ambriz asks what a technology could do with personal data and finds liability in that potential. Popa demands proof of what a technology actually did and requires concrete injury beyond the action itself. The collision between the two theories is inevitable. When a plaintiff sues an AI company under Ambriz’s capability theory, alleging that the defendant’s system has the technical ability to misuse data, and the defendant responds with a Popa-based standing challenge, the courts will face an impossible choice. The capability to cause harm is not the same as harm itself, and if capability cannot satisfy Article III’s concrete injury requirement, then Ambriz’s approach becomes constitutionally unenforceable in federal court. While Popa has not technically overruled Ambriz, the Ninth Circuit will inevitably need to choose which standard to adopt. 

Continue reading →

Spoiled for Choice: AI Regulation Possibilities

mdecrow@maine.edu Blog , , ,

Spoiled for Choice: AI Regulation Possibilities

William O’Reilly

 

I. Introduction

Americans want innovation and they believe advancing AI benefits everyone.[1] One solution to encourage this is to roll back regulations.[2] Unfortunately, part and parcel with the innovations are several harms that are likely to result from the inappropriate use of personal and proprietary data and AI decision-making.[3]  There is an option to ignore this potential harm and halt regulations to encourage the spread of personal information.[4] This option is not in the best interest of the country because the U.S. is already losing the innovation race in some respects. Innovation can still occur despite heavy regulations. Virginia is the latest state to pursue the “no regulation” strategy, and it provides a good microcosm to highlight the challenges and advantages of this approach.[5] Virginia’s absence of regulation falls on a spectrum of legislation that demonstrates options for states to protect rights and innovation. As this article discusses further, curbing AI regulation on companies will not advance innovation enough to justify the civil rights violations perpetuated by current AI use.

Continue reading →

Privacy and Free Speech in the Age of the Ever-Present Border

mdecrow@maine.edu Blog , , ,

Privacy and Free Speech in the Age of the Ever-Present Border

Viv Daniel

 

I. Introduction and Legal Background

On his first day in office, President Trump signed Executive Order 1461 (EO 1461), titled “Protecting the United States from Foreign Terrorists and Other National Security and Public Safety Threats.”[1] The Order, as the name might suggest, directs executive agencies to coordinate to enhance screening for foreign nationals coming to, or living within, the United States.[2] The Order instructs these agencies to ensure that non-citizens “are vetted and screened to the maximum degree possible.”[3]

To enforce the provisions of the Order, U.S. Citizenship and Immigration Services (USCIS) has put forward a proposed rule, with comments open until May 5th, to require non-citizens to disclose all of their social media usernames when filling out forms to access immigration benefits.[4] USCIS says it will then use this information to enhance identity verification, vet and screen for national security, and conduct generalized immigration inspections under its purview.[5]

This is not the first time something like this has happened. In 2019 under the previous Trump administration, Visa applicants were required to register all recent social media accounts with the government as part of the application,[6] a rule which was upheld when a District Judge for the District of Columbia dismissed a case challenging it.[7]

President Trump vests EO 1461 in his executive authority under the Immigration and Nationality Act (INA).[8] The Act, passed in 1952, was heavily amended in 1996 by the Illegal Immigration Reform and Immigrant Responsibility Act (IIRIRA) to retroactively make harsher the immigration consequences of certain conduct.[9] Although terrorism as-such was not implicated in the act, the update to the INA was partially motivated by a need to respond to the 1993 World Trade Center Bombings, and violent and conspiratorial conduct which could constitute terrorism was covered by the act.[10]

Although IIRIRA drastically expanded the number of deportable immigrants in the U.S. overnight, subjecting many non-citizens to removal proceedings over minor infractions committed decades ago,[11] the act did not go so far as to explicitly punish noncitizens for their free speech.[12] The executive authority now claimed under the Act to monitor social media, however, aligns with a troubling trend which may change this norm.

Continue reading →