Artificial Intelligence and Criminal Responsibility: Reconstructing Mens Rea and Attribution for AI-Assisted Cybercrime in Pakistan
Author: Syed Mudassir Shah
Abstract
Artificial intelligence is changing the scale, speed, personalization, and technical complexity of cybercrime without eliminating the need to attribute criminal responsibility to human actors. In Pakistan, the principal substantive framework remains the Prevention of Electronic Crimes Act 2016, as amended in 2025, supplemented by the Pakistan Penal Code, the Qanun-e-Shahadat Order 1984, the Electronic Transactions Ordinance 2002, and the National Forensics Agency Act 2024. These laws are largely technology-neutral, yet AI-assisted offending creates evidential and conceptual pressure on traditional categories of intention, knowledge, authorization, causation, participation, and digital attribution. A person may use a generative model to draft phishing messages, automate reconnaissance, generate malicious code, create deepfakes, or optimize fraud while delegating numerous operational choices to software. The central legal problem is therefore not whether an AI system itself possesses criminal mens rea, but how courts should infer the mental state and causal contribution of programmers, operators, deployers, account holders, collaborators, and beneficiaries when machine output intervenes between human instruction and prohibited result. This paper argues against premature recognition of AI as a criminal subject. Current systems lack the normative agency, legal status, and punishment-sensitive interests that make criminal blame meaningful. Pakistani law should instead adopt a human-centred attribution framework built around purposeful use, knowledge of capabilities, control over deployment, foreseeability of system behaviour, acceptance of risk, contribution to the offence, and corroborated digital evidence. The paper proposes a four-layer attribution model covering identity, control, mental state, and causal contribution, together with evidential safeguards for logs, prompts, model outputs, account records, device forensics, and chain of custody. Reform should clarify AI-assisted liability without creating strict criminal responsibility for developers or users merely because an unpredictable model produced harmful output.
Keywords
Artificial Intelligence; Cybercrime; Mens Rea; Attribution; PECA 2016; Digital Evidence
References
Abbott, R., & Sarch, A. F. (2019). Punishing artificial intelligence: Legal fiction or science fiction.
UC Davis Law Review, 53, 323–384.
Council of Europe. (2001). Convention on Cybercrime (ETS No. 185).
Council of Europe. (2022). Second Additional Protocol to the Convention on Cybercrime on
enhanced co-operation and disclosure of electronic evidence (CETS No. 224).
Council of Europe. (2025). Working Group on Artificial Intelligence: Terms of reference on
cybercrime, electronic evidence and artificial intelligence. Cybercrime Convention Committee.
Council of Europe. (2026). Pakistan: Octopus Cybercrime Community—Country profile. Council of
Europe Cybercrime Programme Office.
Electronic Transactions Ordinance, 2002 (Ordinance LI of 2002) (Pakistan).
European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial
intelligence (Artificial Intelligence Act). Official Journal of the European Union.
Europol. (2023). ChatGPT: The impact of large language models on law enforcement. Publications
Office of the European Union.
Europol. (2026). Decoding the EU’s most threatening criminal networks—Issue 2: The blueprint of
criminal opportunism. Publications Office of the European Union.
Financial Action Task Force. (2026). Cyber-enabled fraud: Digitalisation and money laundering,
terrorist financing and proliferation financing risks. FATF.
Hallevy, G. (2010). The criminal liability of artificial intelligence entities—From science fiction to
legal social control. Akron Intellectual Property Journal, 4(2), 171–201.
Hallevy, G. (2013). When robots kill: Artificial intelligence under criminal law. Northeastern
University Press.
King, T. C., Aggarwal, N., Taddeo, M., & Floridi, L. (2020). Artificial intelligence crime: An
interdisciplinary analysis of foreseeable threats and solutions. Science and Engineering Ethics,
26, 89–120. https://doi.org/10.1007/s11948-018-00081-0
Lagioia, F., & Sartor, G. (2020). AI systems under criminal law: A legal analysis and a regulatory
perspective. Philosophy & Technology, 33, 433–465. https://doi.org/10.1007/s13347-019-
00362-x
Mangi, D. B., Butro, I., & Shaikh, A. (2025). The impact of artificial intelligence on data protection
laws in Pakistan: A critical analysis. ACADEMIA International Journal for Social Sciences, 4(2),
1653–1663. https://doi.org/10.63056/ACAD.004.02.0279
Ministry of Information Technology and Telecommunication, Government of Pakistan. (2025).
National Artificial Intelligence Policy 2025.
National Forensics Agency Act, 2024 (Act XXXVII of 2024) (Pakistan).
National Institute of Standards and Technology. (2024). Artificial Intelligence Risk Management
Framework: Generative Artificial Intelligence Profile (NIST AI 600-1). U.S. Department of
Commerce.
Nerantzi, E., & Sartor, G. (2024). ‘Hard AI crime’: The deterrence turn. Oxford Journal of Legal
Studies, 44(3), 673–701. https://doi.org/10.1093/ojls/gqae018
Pakistan Digital Authority. (2026). Islamabad AI Declaration on sovereign, responsible and
capability-driven artificial intelligence. Government of Pakistan.
Pakistan Penal Code, 1860 (Act XLV of 1860) (Pakistan).
Prevention of Electronic Crimes Act, 2016 (Act XL of 2016), as amended by the Prevention of
Electronic Crimes (Amendment) Act, 2025 (Act II of 2025) (Pakistan).
Qanun-e-Shahadat Order, 1984 (President’s Order No. 10 of 1984) (Pakistan).
Sattar, S. (2025). The next frontier of cybercrime law for artificial intelligence and criminal liability.
International Journal of Law and Policy. https://doi.org/10.59022/ijlp.355
Tabassi, E. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST AI
100-1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1
United Nations Interregional Crime and Justice Research Institute, Europol, & Trend Micro. (2020).
Malicious uses and abuses of artificial intelligence. UNICRI.
United Nations Office on Drugs and Crime. (2024). Transnational organized crime and the
convergence of cyber-enabled fraud, underground banking and technological innovation in
Southeast Asia: A shifting threat landscape. United Nations.
United Nations Office on Drugs and Crime. (2025). Emerging threats: The intersection of criminal
and technological innovation in the use of automation and artificial intelligence. United Nations.
United Nations. (2024). United Nations Convention against Cybercrime: Strengthening international
cooperation for combating certain crimes committed by means of information and
communications technology systems and for the sharing of evidence in electronic form of serious
crimes.
Vassilev, A., Oprea, A., Fordyce, A., Anderson, H., Davies, X., & Hamin, M. (2025). Adversarial
machine learning: A taxonomy and terminology of attacks and mitigations (NIST AI 100-
2e2025). National Institute of Standards and Technology
DOI: 10.52279/jlss.08.03.309321 | 309-321 | PDF