Case Explained: On Accountability Gaps and the Minab School Strike – EJIL: Talk! – Legal Perspective

The use of artificial intelligence in military operations is a topic of enormous relevance, as the ongoing conflict in Iran well demonstrates. In particular, the United States has been using Anthropic’s Claude AI model, as part of its Maven project, as a decision support system in targeting. The Israeli military’s use of AI systems in the Gaza conflict has also been well documented, and they are surely being used in the Iran context as well.

There is now a substantial legal literature on the challenges that AI, especially when it is used in autonomous weapons systems and decision support systems, poses to international humanitarian law and international criminal law. Much of that literature points to various ‘accountability gaps’ that the use of AI might create or exacerbate. These challenges, and gaps, are real. But, in my view, and when it comes to international criminal justice in particular, there is a tendency in some of the literature to overemphasize the extent of these challenges and the game-changing nature of AI as a disruptive new technology. This tendency is perfectly understandable. On one hand, AI genuinely is potentially disruptive, in many different ways. On the other hand, it is difficult to sell an article or a book by saying that the challenges, such as they are, can be dealt with without too many problems.

Last week, I was privileged to speak at a conference at the International Criminal Court on artificial intelligence and international criminal justice, which was organized jointly by the judges of the Court and the European Society of International Law. My message there was – to put it crudely – that we’re going to be fine with the law as it stands today, at least insofar as the core business of international criminal courts and tribunals is concerned. AI does pose challenges, but they are not so radical and transformative that we won’t be able to effectively address them.

We’re Going to be Fine

Yes, we’re going to be fine – well, at least to the extent that the system of international criminal justice actually survives the ongoing unraveling of the international legal order. I’ll expand on that argument in this post, primarily dealing with AI decision support systems. A more extended version is available here, in a chapter forthcoming in an edited collection in the Lieber Studies Series, published by Oxford University Press.

I should say at this point that I’m the Special Adviser on Cyber-enabled Crimes at the ICC Office of the Prosecutor, and that in this capacity I worked, together with colleagues from the OTP, on its Policy on Cyber-enabled Crimes under the Rome Statute, which was adopted in December last year and presented as the session of the Assembly of States Parties. The Policy contains five very cautiously drafted paragraphs on AI (paras. 30-34), and these present the views of the Office. By contrast, nothing that I say in this post (or in the draft chapter), is in any way meant to reflect the views of the Office, nor is it based on any kind of confidential information that I am privy to (and for the avoidance of doubt, I am not privy to any such information relevant for any current investigation or case before the Court on matters discussed in this post). The views here are mine alone.

That said, the key message that the OTP Policy articulated – that the Rome Statute is technology-neutral and that its provisions, especially those on the definitions of crimes and modes of liability, can be applied to new technologies – is equally relevant to AI as it is to cyber. The bottom line is that AI, like cyber and like many other technologies before them, can be used as a means of committing or facilitating crimes under international law. We can apply existing international criminal law, including the Rome Statute, to such AI-enabled commission and facilitation. With one major caveat, we can do so without violating the nullum crimen sine lege principle and without having to amend the Statute or otherwise create new law.

That caveat is that if AI research advances to such a level that we see the emergence of genuine, sentient artificial general intelligence (AGI), which can in many respects approximate a person, one that can experience mental states and make moral judgments, dealing with that phenomenon would require new law in many fields. For example, under Article 25(1) of the Rome Statute, the ICC has jurisdiction over natural persons only. But that is not our problem today. Our problem is whether the use of current AI systems, which are a far cry from AGI, affects the responsibility of those individuals who decide to research, develop, sell, buy, deploy, or use AI autonomous weapons systems or decision support systems. The ‘decisions’ or ‘actions’ of current AI systems are simply the consequences of the actions of those humans who decided to use them.

The use of an AI system can complicate an inquiry into the criminal responsibility of individuals in two ways: by affecting the mens rea of that individual, or by making the causal chain between the individual’s conduct and some prohibited consequences too distant or attenuated. This is plainly true. My point is simply that, especially when looking at military operations, these problems arise for international criminal cases even without the use of AI. I just don’t think that AI changes things here so radically that the core business model of international criminal courts would somehow be affected. Why? Because these difficulties arise primarily when we assess criminal responsibility for isolated cases – especially in the conduct of hostilities – whereas criminal prosecutions at the international level for such crimes will generally be done in the context of a systematic commission of such crimes, where patterns of conduct and other circumstantial evidence can enable the inference of intent.

The Minab School Strike as a Case Study

Let’s illustrate this point by looking at some examples. On 28 February, a school was struck in Minab, Iran, resulting in the death of some 175 civilians, many of them children. The school was next to a compound of the naval component of the Iranian Revolutionary Guard Corps (IRGC). In the past that building was part of the same compound, before it was walled off, repurposed and separated. From the information that is available – see extensive reporting by the New York Times and analysis by Human Rights Watch – I think that we can already reasonably draw some conclusions about what likely happened.

The attack was almost certainly conducted by the United States (although Trump now appears to be patently falsely blaming Iran for the attack). Further, the school and numerous buildings in the IRGC compound were each struck individually by some kind of precision munition. This is a very important point. This was not some kind of weaponeering error, where a missile or bomb misfired and did not hit the intended target, or the school was inadvertently within its blast radius. No, the individuals who made the targeting decisions – unidentified US military officers – clearly intended to strike the building of the school.

However, it seems highly unlikely that these American officers knew that the building was a civilian object, that it was in fact a school, or that there were hundreds of civilians present in it. The likeliest explanation is that they misidentified the building as part of the adjacent IRGC compound, for example because they relied on outdated maps or imagery made before the school building was repurposed and separated from that compound.

To be clear, this kind of error is not a violation of the IHL principle of proportionality. That principle is to be applied from the subjective standpoint of the commander who ordered the attack – what was the civilian loss of life of injury that he or she expected, and what was the military advantage that he or she anticipated – bearing in mind the information they had at the time. The likeliest explanation here is that the commander simply did not expect any civilian loss of life (or expected very little), because they thought that the school was an IRGC building. No sane American commander would have launched an attack on a school and justified it by saying that its destruction was somehow incidental to the military advantage obtained from destroying the IRGC base. Nothing could be gained from such an act, and the US would only suffer tremendous reputational damage. Nor would that make any military sense: remember, each building in the compound was targeted individually, by its own precision weapon. All one would have needed to avoid any kind of proportionality problem would be to simply not target the school building.

So, again, from what we know proportionality is simply not an issue here. The issue is the misidentification of the target as being part of a wider set of buildings that unambiguously were a valid military objective. There is no indication whatsoever that the school itself was a military objective – there is no argument here that, for instance, it was used to store military equipment or supplies. But the principle of distinction too depends on the information that the commander subjectively possessed at the time they ordered the attack, because it prohibits directing attacks against civilian objects. Thus, it is highly likely that the IHL principles of distinction and proportionality were not directly violated by this attack. What almost certainly was violated was the principle of taking feasible precautions in attack, in particular the rule requiring that a party to do the conflict must do everything feasible to verify that the targets it pursues are in fact military objectives. Any violation of distinction is essentially a consequence of failing to take all feasible precautions in attack.

I just don’t see how it could reasonably be argued that the US officers who conducted this attack did everything feasible to verify that the school building was a military objective. If journalists using only open access sources could relatively quickly establish what went wrong, and trace the separation of the school from the wider IRGC compound, I’m pretty sure that the US officers, with all the tools at their disposal, could have done the same before launching this attack. This is especially because this was not some kind of dynamic target, which had to be pursued quickly upon sight of the enemy, but was likely part of long list of targets that were previously planned for in anticipation of any conflict with Iran. The US had the time, the means and the opportunity to do more.

So, barring the release of some kind extraordinary new information, the attack seems to have been a clear violation of IHL because feasible precautions were not taken. Yet, even so, this kind of case would never be prosecuted before the ICC. I couldn’t imagine the ICC Prosecutor even asking for an arrest warrant, let alone getting one, or the case successfully proceeding to a conviction. (Again, please note the caveat above that I am writing here in my personal capacity only; note also that the ICC has no territorial jurisdiction over anything happening in Iran today, because Iran is not a state party – the case is simply being used as an illustrative example).

Why? Because the default mens rea standards under the Rome Statute are intent and knowledge; because the war crimes of intentionally directing attacks against civilians or civilian objects essentially require that the person directing the attacks knows that the persons or objects being targeted are civilian; and because, under Article 32(1) of the Statute, a mistake of fact that negates the mental element of the crime is a ground for excluding criminal responsibility.

Thus, we here have a case in which the likeliest explanation is that the relevant US military officers made a mistake which was subjectively honest (i.e. they genuinely thought they were targeting a military objective), but was objectively unreasonable (i.e. they failed to do what they could and should have done to verify the identity of the target) – for more on honest and reasonable mistakes in the context of uses of lethal force, see here. With the facts as we know them, I just don’t see how the officers in question could be prosecuted before the ICC, where the prosecutor has the burden of proving, beyond a reasonable doubt, that the individuals concerned intentionally directed their attacks against civilians or a civilian object. Failures to take precautions in attack are not criminally punishable as such, at least not at the international level.

In their report, Human Rights Watch argue that, under customary international law, criminal responsibility in cases such as these can exist for intent and recklessness, a somewhat lower form of mens rea, and that the US must conduct a war crimes investigation. In particular, they note that

Investigations into the attack on the Shajareh Tayyebeh school should consider whether those responsible acted recklessly, including if they should have known that they were attacking a school, and that an attack during the middle of the day on a school day would have most likely resulted in a large number of civilian casualties. 

This is a misunderstanding of the relevant law (and that mistake is repeated several times in the HRW report). ‘Should have known’ is not a recklessness standard – it’s a negligence, constructive knowledge standard. If the relevant US officers honestly subjectively believed that they were targeting a military objective, i.e. that the school was just one of many buildings in the IRGC compound, they were not reckless – although they almost certainly were (grossly) negligent. The failure to take all feasible precautions to verify the identity of the target is essentially where that negligence lies. But I can’t see how a war crimes prosecution of these individuals could succeed in any court, even one which used recklessness rather than intent. The mistake of fact would negate the mental element of the crime, even if that element was recklessness. It is only if the US officers subjectively knew with certainty, or at least subjectively had doubts, that the building was a civilian object that they could be regarded as reckless. Their objective negligence is well below that subjective standard.

A good point of comparison here would be the attack on the Grdelica Gorge bridge during the 1999 bombing of Serbia. That attack consisted of two bomb strikes. In the first strike, the operator released the bomb on the bridge, without realizing that a civilian train was about to move onto the bridge, and hit the train. That attack was likely negligent in terms of doing everything feasible to minimize loss of civilian life. But then, when he saw that the bridge was still standing, the operator fired a second bomb on the opposite side of the bridge from where the train was. The train was, however, sliding down the tracks and the second bomb affected it as well. That attack was very likely reckless, in that the operator subjectively was aware the civilian train was there and took a conscious risk to strike the bridge again, knowing that there was a possibility that the train would again be damaged – but the ICTY prosecutor decided not to pursue this case.

What About AI?

Which brings me to my main point. Note that in this whole discussion of the Minab school strike I didn’t mention AI once. And that’s for a very good reason. Mistakes involving the misidentification of targets, including friendly fire incidents, happen all the time in military operations, AI or no AI. It is very possible that the mistake of the US officers was caused by their (over)reliance on an AI decision support system. It is very possible that Claude/Maven generated a target list, and that whatever data it produced never flagged the fact that, years ago, the school building was separated from the IRGC compound. Whether AI was used in the targeting process here, and if so how, is a hugely important fact that must be explored in any investigation. But – and this is my point – nothing changes from the perspective of any international criminal prosecution regardless of whether AI was used here or not. The US officers would still be able to plead an honest mistake, regardless of whether their error was a purely human one or an AI-enabled one.

It is true that cases such as these present an ‘accountability gap.’ But we’ve always had that gap in the conduct of hostilities context. The prosecution of such cases has always been difficult, especially when we’re dealing with one-off, isolated incidents (even if there may be systemic causes behind such incidents). AI can have a huge impact here, in that it will vastly multiply the number of attacks conducted while facilitating the cognitive errors of humans in the loop, so that even if the relative error rate is the same or lower than with human intelligence analysists, the absolute number of civilians killed or injured is higher.

This is exceptionally important from the perspective of ensuring respect for IHL and taking constant care to minimize the impact of military operations on civilians. But the impact on the core business of the ICC or some other international criminal tribunal is small. These kinds of cases are simply not going to be prosecuted, AI or no AI.

Which brings me to my second key point. The subset of conduct of hostilities case that very much are part of the core business of international criminal justice are those in which war crimes are committed systematically and at scale. In those cases, civilians or civilian objects are targeted repeatedly, in a pattern that, together with other circumstantial evidence, enables an inference of intent.

Take as an example the arrest warrants issued by the ICC (here and here) against four high-ranking Russian officers for the war crimes of targeting civilian objects and disproportionate attacks, due to the strikes repeatedly conducted against Ukrainian energy infrastructure, especially during winter. This is a case in which, if we looked at each attack in isolation, it could plausibly be argued that the given object being targeted was a military objective, because of its dual use (see more Mike Schmitt here and here). But when such attacks are conducted against power and heating plants all over Ukraine, regardless of any evidence of military use, for many years and particularly in winter, it becomes relatively straightforward to infer the intent of the persons who ordered these attacks. Time and again they’ve ordered attacks on targets that are not plausibly military objectives, and, even if they were, the anticipated impact on the civilian population was clearly disproportionate.

Imagine if we now introduced AI into this case. Could Sergei Shoigu et al plausibly rely on some kind of mistake of fact defence – we used an AI decision support system or an autonomous weapon and had no idea that the objects targeted were civilian? I mean, come on. Even if they did use some kind of AI system to support their targeting, if you continue using such a system over and over again despite the fact that its supposed ‘errors’ lead to strikes against the same type of civilian object, one can easily infer either purpose (direct intent) or oblique, indirect intent. As with our previous example, AI changes nothing. The case would be exactly the same regardless of any AI use.

It must be underlined here that, in any criminal prosecution involving the military use of AI, the relevant evidence would not just be technical in nature. The prosecutor and the judges would take all relevant evidence into account, including any circumstantial evidence about the intent of the persons in question. And there often is plenty of such evidence, including stuff that suspects stupidly say on social media. Sure, cases involving the use of AI would be difficult to prove, especially at the conviction stage where the standard of proof is one of beyond a reasonable doubt. But, as noted above, conduct of hostilities cases are already difficult to prove. I just fail to see how the military use of AI radically changes things for that subset of these cases, like Shoigu et al, which is the core business of international criminal justice. In those cases that matter the most, those cases on which international prosecutors and judges have focused their efforts and resources, the outcomes will broadly speaking be the same, AI or no AI.

Conclusion

In short, we’re going to be fine (or at least, the status quo will not be radically changed). This is not complacency. This is just reality. For those who argue otherwise, I would simply ask them the following question: go through the cases that have been prosecuted before international criminal courts and tribunals and that concerned the conduct of hostilities. Change the facts to introduce the use of an AI-enabled weapons system or a decision support system. Would, in this thought experiment, the outcome of these cases be any different? In a great majority of cases, my sense is that the outcomes would broadly be the same – despite the AI-specific challenges (‘black box’, ‘many hands’ etc). I am, of course, willing to be persuaded otherwise, but to do that we need to look at those kinds of conduct hostilities cases which international criminal justice has dealt with and is meant to deal with.

The same goes for the facilitation of international crimes by AI means, which I extensively discuss in my paper. The kinds of cases that are likely to be prosecuted (successfully) are those in which an accomplice provides their assistance to the perpetrator repeatedly, knowing exactly what would happen because there is a pattern of similar conduct, thus enabling the inference of the required degree of mens rea. Take, for example, a corporate executive who keeps providing an AI system to a state, which is then repeatedly used, over months or years, to systematically surveil the civilian population in a broader campaign of persecution on ethnic or religious grounds – that’s the kind of case that can be effectively prosecuted internationally.

Isolated one-offs are simply not what these courts are designed to do. Where AI will be much more of a game changer for international prosecutors and judges is in how it is used to gather and analyze evidence, even in those cases in which the commission of the crime has nothing to do with AI. When it comes to military uses of AI, however, I just don’t see how things will be radically different when compared to where we stand today – at least until the advent of AGI.

Again, this is not to deny the reality of accountability gaps, nor to deny the enormous impact that military uses of AI can have on the application of, and compliance with, IHL. I am here talking solely about international criminal prosecutions, especially in the context of the conduct of hostilities. These international prosecutions are only a tiny element of the kind of accountability framework that is needed to ensure effective compliance with IHL.

It is horrible that the mistakes of military officers cause the deaths of dozens or hundreds of children (and remember, when it comes to Iran the whole war is already illegal as a violation of the UN Charter). It may even be morally warranted to criminally punish some of these individuals, like those who, through their negligence, caused the deaths of so many children in Minab. But that accountability gap can only be dealt with domestically (and even that is highly unlikely as things stand). To plug that gap at the international level, we would need new law. We would need to have a clear basis for prosecuting individuals on the basis of negligence. The relevant offence could not be a war crime that requires intent, and even recklessness could cover only a small subset of additional cases.

If, however, one thinks that is desirable to prosecute soldiers who negligently cause the deaths of civilians, the same standard has to apply across the board, regardless of whether AI is being used. Remember – we still don’t know whether AI was in fact used to inform the target decisions in the Minab school strike. I fail to see what exactly would change for the personal legal or moral responsibility of those who ordered that strike, regardless of whether AI was used or not. I am, however, pretty sure that there is simply no political appetite at the international level to change the current framework to accommodate negligence-based prosecutions, AI or no AI.