The Dangers of Computational Law and Cybersecurity; Perspectives from Engineering and the AI Act

TL;DR

This paper discusses the risks and cybersecurity challenges of computational law, emphasizing the importance of legislation, safety measures, and human oversight to prevent failures that could cause significant harm.

Contribution

It highlights the cybersecurity vulnerabilities specific to computational law, especially with machine learning, and proposes recommendations aligned with safety engineering principles.

Findings

Computational law faces similar cybersecurity risks as other software systems.

Failures can lead to financial, physical, or justice-related damages.

EU's AI Act offers a framework addressing some of these issues.

Abstract

Computational Law has begun taking the role in society which has been predicted for some time. Automated decision-making and systems which assist users are now used in various jurisdictions, but with this maturity come certain caveats. Computational Law exists on the platforms which enable it, in this case digital systems, which means that it inherits the same flaws. Cybersecurity addresses these potential weaknesses. In this paper we go through known issues and discuss them in the various levels, from design to the physical realm. We also look at machine-learning specific adversarial problems. Additionally, we make certain considerations regarding computational law and existing and future legislation. Finally, we present three recommendations which are necessary for computational law to function globally, and which follow ideas in safety and security engineering. As indicated, we find that computational law must seriously consider that not only does it face the same risks as other types of software and computer systems, but that failures within it may cause financial or physical damage, as well as injustice. Consequences of Computational Legal systems failing are greater than if they were merely software and hardware. If the system employs machine-learning, it must take note of the very specific dangers which this brings, of which data poisoning is the classic example. Computational law must also be explicitly legislated for, which we show is not the case currently in the EU, and this is also true for the cybersecurity aspects that will be relevant to it. But there is great hope in EU's proposed AI Act, which makes an important attempt at taking the specific problems which Computational Law bring into the legal sphere. Our recommendations for Computational Law and Cybersecurity are: Accommodation of threats, adequate use, and that humans remain in the centre of their deployment.