Algorithmic Recommendations as an Act of Creation: How the Supreme Court’s Ruling in Gonzalez v. Google, LLC Could Completely Change the Internet

*Anastasia Couch

I. The Twenty-Six Words that Built the Internet

    The internet as we know it rests on a single sentence written in 1996.[1] Section 230 of the Communications Decency Act states: “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”[2] For nearly three decades, the internet has boomed under the protections of this blanket immunity without alteration.[3] However, § 230 will stand before the Supreme Court for the first time in the pending case Gonzalez v. Google, LLC.[4] At issue is the liability of any operator of a site that uses an algorithm to curate or recommend third-party content to users.[5] Gonzalez challenges the sweeping immunity that allows internet giants like Google and Facebook to flourish.[6] The internet that emerges after the Gonzalez decision could be barely recognizable.[7]

    Facially, the distinction made by § 230 is clear-cut. A site is a service provider if it “passively displays content” created by third parties, often in the form of user contributions.[8] Alternatively, if a site is a content provider, it either develops content itself or is responsible for content creation, either in whole or in part.[9] Under § 230, a site is only liable for the content it creates or develops itself, not for republishing or hosting third-party content.[10] Sites are often both service providers and content developers.[11] Typically, the distinction between the two types has been straightforward—the site only faces liability if it creates the material itself.[12] However, the plaintiff in Gonzalez asks a radically significant question: Does § 230 also immunize a service when it makes “targeted recommendations of information” made by a third party? In other words, is the use of an algorithm an act of creation?[13]

    II. Gonzalez v. Google, LLC.

      Plaintiff, Reynaldo Gonzalez, is the father of Nohemi Gonzalez, a student who lost her life in the November 13, 2015 Paris Attacks.[14] Three ISIS fighters opened fire into the crowd of a café where Nohemi was dining.[15] One of the fighters in the café shooting had appeared in a 2014 ISIS YouTube video delivering a recruitment monologue.[16] Following the attack, two of the fighters posted links to their ISIS recruitment videos, hosted on YouTube, on several media outlets.[17]

      Gonzalez alleges that Google (which owns YouTube) is liable for the ISIS content on its site specifically due to the website’s algorithmic recommendation and suggestion powers.[18] He argues that this is an act of content development because Google’s algorithm intentionally selects users to show ISIS videos to and targets “users whose characteristics indicated that they would be interested in ISIS videos[.]”[19] In doing so, Google has allegedly furthered the ISIS mission because it “‘recommended ISIS videos to users’ and enabled users to ‘locate other videos and accounts related to ISIS[.]’”[20] Gonzalez alleges that Google is aware of the illicit content in ISIS’ videos hosted on YouTube and recommended by YouTube and that YouTube has become “essential and integral” to ISIS’ global terror efforts.[21]

      Regardless, the circuit court applied the broad protection of § 230, holding that “a website’s use of content-neutral algorithms, without more, does not expose it to liability for content posted by a third party. Under our existing case law, § 230 requires this result.”[22] Gonzalez’s argument counters the assertion that § 230 would eliminate all liability for sites that nudge users toward harmful materials like inflammatory ISIS recruitment videos.[23]

      III. Algorithms: Neutral Tool or Act of Creation?

        In deciding Gonzalez, the Supreme Court will focus on the issue of how sites suggest third-party content.[24] The circuit court decision in Gonzalez held that an algorithm functions like a search engine,[25] which carries classic immunity under the basic principle that the site provides content by responding to user input.[26] The Gonzalez circuit court decision held that an algorithm works theoretically the same way—a user is inputting data about their preferences, and the service is responding in turn.[27] As noted by the lowercourt, § 230’s legislative history supports this general conclusion.[28] Courts have previously applied a “neutral tool” analysis to determine whether a site’s function is providing content or services.[29] A function has been deemed a neutral tool if it “does nothing more than provide options,” which users “may adopt or reject at their discretion.”[30] Previously, algorithmic recommendations have fallen within this category as “ordinary, neutral functions” of a site.[31]

        Unfortunately for Gonzalez, the traditional interpretation of this neutrality is broad enough to encompass instances where the website’s developers or owners are aware that third-party users are using the allegedly neutral tools to create illegal content.[32] A site providing neutral tools to enable illicit activities “does not amount to ‘development’” of the content.[33] Likewise, prior decisions have applied a narrow scope for the website company’s liability under these circumstances—only if the site elicits and makes “aggressive use of it in conducting its business” can it be found liable for that illicit third-party content.[34] Gonzales will have to upend several years of precedent to shift the long-standing application of § 230.[35]

        IV. Conclusion

          The current Court has already shown a willingness to disregard precedent,[36] if it chooses to do likewise in Gonzalez, the internet landscape will be fundamentally changed.[37] If the Supreme Court upholds case precedent, it will cement the broad, sweeping immunity from liability not just for tech giants but for any website that uses algorithmic recommendations. But there is hope for Gonzalez’s argument. The seemingly uniform conclusions of prior courts, in reality, are rife with close decisions and flaming dissents.[38] Dissenting justices note how algorithms nudge “susceptible souls . . . down dark paths”[39] and how “the benign aspects of Google/YouTube, Facebook, and Twitter have been transformed into a chillingly effective propaganda device.”[40] This issue is far from resolved and is easily swayed by political interests.[41] Moreover, the timing of the decision has reached a new fever pitch of urgency, as we slowly slip deeper into the age of the algorithm, where seemingly all internet content is curated “just for you.”[42] Now the Court has to decide—is the algorithm a mirror, merely reflecting back whatever the user is inputting, or is it something more powerful?[43]

          *Anastasia Couch is a second-year J.D candidate at the University of Baltimore School of Law, where she is a Staff Editor for Law Review and a member of the Royal Graham Shannonhouse III Honor Society. She is currently interning with Citizens for Responsibility and Ethics in Washington (CREW), and interned with the Maryland State Ethics Commission in Summer 2022. Anastasia pursues her passion for government oversight (specifically in warfare and technology) by volunteering with Women for Weapons Trade Transparency.

          [1] Christopher Cox, The Origins and Original Intent of Section 230 of the Communications Decency Act, Univ. Rich. J. L. Tech., ¶1 (Aug. 27, 2020), https://jolt.richmond.edu/2020/08/27/the-origins-and-original-intent-of-section-230-of-the-communications-decency-act/. As a former House Representative, Cox was one of the primary authors of § 230. Id.; Michael Hiltzik, Michael Hiltzik: The Supreme Court Holds the Internet’s Fate in Its Hands, and You Should Be Terrified, Waco Tribune-Herald (Oct. 14, 2022), https://wacotrib.com/opinion/columnists/michael-hiltzik-the-supreme-court-holds-the-internets-fate-in-its-hands-and-you-should/article_89050c17-94a9-5831-8ea2-2f82f2ab754a.html. When Section 230 was written, Google did not exist, neither did Facebook, Twitter, and YouTube. Id.

          [2] 47 U.S.C. § 230(c)(1). 

          [3] Ian Millhiser, A New Supreme Court Case Could Fundamentally Change the Internet, Vox (Oct. 6, 2022) https://www.vox.com/policy-and-politics/2022/10/6/23389028/supreme-court-section-230-google-gonzalez-youtube-twitter-facebook-harry-styles; CDA 230: The Most Important Law Protecting Internet Speech, Elec. Frontier Found., https://www.eff.org/issues/cda230 (last visited Oct. 19, 2022).

          [4] Rebecca Kern, SCOTUS to Hear Challenge to Section 230 Protections, Politico (Oct. 3, 2022), https://www.politico.com/news/2022/10/03/scotus-section-230-google-twitter-youtube-00060007.

          [5] Petition for Writ of Certiorari, Gonzalez v. Google, LLC., (No. 21-1333) at 3—4.

          [6] See Cox, supra note 1, at ¶ 60.

          [7] Kern, supra note 4.

          [8] Fair Housing Council of San Fernando Valley v. Roommates.com, LLC, 521 F.3d 1157, 1162 (2008) [hereinafter Roommates]. For example, a restaurant owner cannot sue Yelp if a customer posts a defamatory review on the website. See Millhiser, supra note 3.

          [9] Roommates,521 F.3d at 1162; 47 U.S.C. § 230 (f)(3).

          [10] Roommates, 521 F.3d at 1162;Elec. Frontier Found., supra note 3.

          [11] Roommates, 521 F.3d at 1162.

          [12] See discussion infra Section III.

          [13] Petition for Writ of Certiorari, Gonzalez v. Google, LLC., (No. 21-1333) at 8.   

          [14] Gonzalez v. Google LLC, 2 F.4th 871, 881 (9th Cir. 2021).

          [15] Id.

          [16] Id.

          [17] Id.

          [18] Id.

          [19] Petition for Writ of Certiorari, Gonzalez v. Google, LLC., (No. 21-1333) at 10.

          [20] Gonzalez, 2 F.4th at 881.

          [21] Id. at 882–83.

          [22] Gonzalez, 2 F.4th at 896 (emphasis added).

          [23]Petition for Writ of Certiorari, Gonzalez v. Google, LLC., (No. 21-1333) at 8; Gonzalez, 2 F.4th at 881.

          [24] See id. at 895; Roommates, 521 F.3d at 1175.

          [25] Gonzalez, 2 F.4that 895.

          [26]Roommates, 521 F.3d at 1175.

          [27] Gonzalez, 2 F.4that 895.

          [28] See Dyroff v. Ultimate Software Group. Inc., No. 17-CV-05359, 2017 WL 5665670 at *9 (N.D. Cal. Nov. 26, 2017) (holding that the site “merely provided content-neutral social-network functionalities—recommendations and notifications about posts”).

          [29] Dyroff, 2017 WL 5665670 at *8; Roommates, 521 F.3d at 1167 (“Reading the exception for co-developers as applying only to content that originates entirely with the website . . . ignores the words ‘development . . . in part’ in the statutory passage.”).

          [30] Goddard v. Google, Inc., 640 F.Supp.2d 1193, 1198 (2009).

          [31] Dyroff, 2017 WL 5665670 at *8.

          [32] Goddard, 640 F.Supp.2d at 1196.

          [33] Roommates, 521 F.3d at 1168–69; see also Force v. Facebook, Inc., 934 F.3d 53, 70 (2d Cir. 2019) (“Facebook’s algorithms may have made content more visible or available, but held this did not amount to developing the underlying information”).

          [34]Roommates, 521 F.3d at 1172. Development of content is determined if a site “contributes materially to the alleged illegality of the conduct.” Id. at 1168.

          [35] Dyroff, 2017 WL 5665670 at *7 (“In similar cases, courts have rejected plaintiffs’ attempts to plead around immunity by basing liability on a website’s tools”).

          [36] David Cole & Rotimi Adeoye, A Radical Supreme Court Term in Review, American Civil Liberties Union (July 7, 2022), https://www.aclu.org/news/civil-liberties/a-radical-supreme-court-term-in-review.

          [37] Evan Gerstmann, Supreme Court To Decide Whether YouTube Can Be Sued For Abetting Terrorism, Forbes (Oct. 3, 2022), https://www.forbes.com/sites/evangerstmann/2022/10/03/supreme-court-to-decide-whether-youtube-can-be-sued-for-abetting-terrorism/?sh=4049a8d10162.

          [38] See, e.g.,Roommates,521 F.3d at 1189 (McKeown, J., concurring in part, dissenting in part) (“Because the statute itself is cumbersome to interpret in light of today’s Internet architecture, and because the decision today will ripple through the billions of web pages already online, and the countless pages to come in the future, I would take a cautious, careful, and precise approach to the restriction of immunity, not the broad swath cut by the majority.”).

          [39] Gonzalez v. Google LLC, 2 F.4th 871, 950–51(9th Cir. 2021) (Katzmann, C.J., concurring in part, dissenting in part).

          [40] Gonzalez, 2 F.4th at 921 (Gould, J., concurring in part, dissenting in part).

          [41] See Gerstmann, supra note 37; Hiltzik, supra note 1.

          [42] See generally, Kyle Chayka, The Age of Algorithmic Anxiety, New Yorker (July 25, 2022), https://www.newyorker.com/culture/infinite-scroll/the-age-of-algorithmic-anxiety (describing the omnipresence of the algorithm).

          [43] See Eleanor Cummins, The Creepy TikTok Algorithm Doesn’t Know You¸ Wired (Jan. 3, 2022), https://www.wired.com/story/tiktok-algorithm-mental-health-psychology/.

          What’s Next for Forensic Genetic Genotyping in Maryland?

          *Natalie Murphy

          I. Introduction

          In 2021, Maryland passed the world’s first law regulating the use of forensic genetic genealogy (FGG).[1] Although this law constitutes a massive step towards safeguarding public privacy, broader criticisms of forensic science call attention to additional areas to monitor regarding Maryland’s FGG usage.[2] Maryland’s FGG policies leave open questions regarding Fourth Amendment protections against unreasonable government search and seizure, the Fifth Amendment Takings Clause, and underlying issues surrounding forensic DNA science.

          II. How does FGG work?

          FGG uses consumer genetic databases to identify suspects in criminal cases based on their relatives.[3] Forensic DNA practices begin when law enforcement officers collect biological samples at a crime scene.[4] Next, laboratory technicians attempt to create a genetic profile by extracting DNA from the samples. If successful, the process results in a single genetic profile unique to one individual—the suspect.[5] Law enforcement employs the FGG process when they cannot identify the genetic profile using a known subject sample or law enforcement databases.[6] In jurisdictions that allow the practice, forensic technicians re-test the sample and attempt to use consumer genetic databases to identify individuals who share genetic commonalities with the suspect.[7] Consumer databases, like GEDmatch or FamilyTree, allow users to upload their DNA data to learn more about their health or ancestry.[8] If investigators find even a partial match on one of these sites, they can use data ranging from census records to social media to construct a family tree spanning generations and ultimately identify a suspect.[9]

          III. How does FGG raise privacy concerns?

          FGG raises privacy concerns due to the sensitive nature of DNA, the investigation of non-suspects, and the racial inequities that arise in practice.[10] Genetic data is sensitive by nature because it can expose present and future health concerns, familial relations, relatives, physical traits, and ancestral origins.[11] Senator Charles Sydnor calls the FGG process a “genetic dragnet” for scrutinizing the sensitive information of non-suspect relatives.[12] Using law enforcement databases alone to identify suspects based on partial matches is already a highly controversial practice barred in Maryland.[13] Sydnor’s concerns regarding FGG are heightened given the more granular and, thus, more revealing data used to create profiles for consumer genetic databases compared to law enforcement databases.[14]

          Many users of consumer genetic databases also view law enforcement access to their genetic profiles without consent as overreach, particularly when it breaches the database’s terms of service.[15] Law enforcement has amplified overreach concerns by using deceptive practices to secure DNA in several cases.[16] Black and African-American users of genetic databases face additional problems. For example, one study on familial DNA testing revealed that although the rate of false identification was low, African-American matches had twice the probability of being targeted for further investigation compared to other users.[17] Other scholars note that for Black and African-American descendants of slavery, access to ancestral lineage data is particularly sensitive as “a piece to a puzzle that was stripped away by force” due to chattel slavery in the early United States.[18] Finally, FGG resources are disproportionately directed at solving crimes perpetrated against white women.[19] Maryland’s recent legislation implements use limitations responsive to general privacy concerns but is silent on specific concerns based on race and gender.

          IV. How does Maryland’s Forensic Genealogy statute address privacy concerns?

          Maryland’s law is the first to provide regulation and privacy protections to consumer genetic database users who may face law enforcement investigation.[20] FGG has not faced significant scrutiny at the federal level, and state courts have taken a “hands-off approach” to regulating law enforcement use of such databases.[21] The major components of the new Maryland law relating to privacy are as follows:

          • Law enforcement requires judicial authorization before conducting FGG;[22]
          • Judicial authorization for FGG can only be granted as a last resort for investigating violent crimes or threats to public safety;[23]
          • FGG is only permitted on databases that provide explicit notice and seek affirmative consent from users that law enforcement may use their data to investigate crimes;[24]
          • Law enforcement must obtain informed consent to collect DNA from non-suspects (like family members) unless it compromises the investigation;[25]
          • Law enforcement must compile an annual public report on FGG practices;[26]
          • Defendants seeking postconviction relief are permitted access to FGG processes;[27]
          • Maryland imposes consequences for FGG statute violations such as unauthorized disclosure of information or failure to destroy data and allows payment to people whose genetic data was wrongfully disclosed or collected; and[28]
          • Labs conducting testing for FGG must be licensed, and the Office of Health Care Quality must train technicians.[29]

          Through these safeguards, Maryland’s statute significantly limits the use of FGG, better protects the privacy of non-suspects, and ensures ex ante supervision of the process at every step.[30] Unlike similar legislation recently passed in Montana, Maryland’s statute does not require a warrant to search consumer genetic databases.[31]

          V. Ongoing Areas to Monitor

          Because FGG is a recent development, many aspects of the Maryland law have yet to be tested in court. Many concerns about FGG continue to be relevant in Maryland today.

          A. Fourth Amendment Concerns

          Privacy groups and legal scholars are engaged in an ongoing debate over Fourth Amendment implications for FGG.[32] Under the third-party doctrine, courts have traditionally held that a person can have no reasonable expectation of privacy or Fourth Amendment protection for information shared with third parties.[33] The Supreme Court narrowed this view in Carpenter v. United States, forbidding law enforcement from accessing a plaintiff’s cell phone data without a warrant.[34] Although the plaintiff had already shared the data with his phone carrier, the Court considered the seizure of data an unreasonable search given that cell phones are almost “a feature of human anatomy” and provide an “all-encompassing record” with ease.[35] Carpenter creates a colorable argument that DNA qualifies for the same exception to the third-party doctrine, given that DNA is an actual feature of human anatomy and provides present and future information about its owner.[36]

          An alternate viewpoint suggests that the cell phone databases in Carpenter are distinguishable from consumer genetic DNA databases because DNA database users affirmatively consent to give their information to third parties.[37] However, genetic data poses a potential “loophole” to the third-party doctrine.[38] The shared nature of DNA among biological family members means that an individual’s privacy may be violated by a relative without ever consenting to a database’s terms of service.[39]  

           B. Fifth Amendment Takings Clause Questions

          FGG practices also potentially conflict with the Fifth Amendment takings clause, which states, “. . . nor shall private property be taken for public use, without just compensation.”[40] One scholar argues that “law enforcement access to DNA profiles on consumer genetics databases constitutes a physical taking of private genetic property . . . for the purpose of promoting the general welfare.”[41] Individuals who upload their information to forensic genetic genealogy databases are not compensated monetarily, and in fact pay for the service.[42]

          Further, “the lack of compensation scheme” for appropriating consumer genetic profiles constitutes a Takings Clause violation.[43] Takings are not limited to real property and could theoretically encompass genetic profiles,[44] and many consumer DNA databases regard genetic profiles as user property.[45] Courts traditionally hold that “interference with the right to exclude others is close to a per se taking of property.”[46] Thus, a court could potentially find a Fifth Amendment Takings Clause violation where law enforcement officers access genetic profiles in violation of a database’s terms of service.[47]

          Maryland’s new law offers a limited avenue for compensation to individuals whose data was wrongfully disclosed, collected, or maintained.[48] However, whether the statute meets the standard for constitutional compensation under the Fifth Amendment Takings Clause remains an open question.

          C. Carceral Abolitionist Critiques of Forensics

          Forensics scholar Maneka Sinha (Sinha) recently published a comprehensive criticism of forensic science as a discipline frequently used “to legitimize prosecutions rather than advance justice.”[49]  Sinha’s examination indicates several weak areas in Maryland’s recent FGG legislation. She cautions that FGG is only as accurate as the DNA profiling underlying it, which is an active field in need of consistent monitoring.[50] DNA profiling increasingly relies on algorithms protected by trade secrets through a method known as “probabilistic genotyping.”[51] While probabilistic genotyping is especially useful for poor quality or complicated samples, several such algorithms have not been peer-reviewed, are only validated by their creators, and are protected from view by trade secrecy laws.[52] The lack of independent validation and level of secrecy surrounding many probabilistic genotyping programs raises serious concern regarding how genotyping is actually conducted and if it is accurate.[53]

          Additionally, Sinha draws attention to the inherent complications of finding a reliable laboratory.[54] Forensic labs are often operated by police departments, and utilizing labs independent from law enforcement is one popular recommendation for dissolving conflicts of interest.[55] Still, Sinha suggests “the inherited cultural alignment between law enforcement and the forensic system” means that even independent labs carry a culture of carceral bias and failure to meet scientific rigor.[56] She further notes the reputation of for-profit labs for “pursuing analyses beyond the reliable limits of the software system and for lack of transparency around how their systems operate.”[57] Independent labs thus represent an incomplete solution due to their cultural relationship to law enforcement and purported unreliability. Maryland’s law states that an advisory committee shall establish “best practices” for labs performing the single nucleotide polymorphism (SNP) analysis necessary for FGG[58] and does not legislate who should operate such labs.[59] The advisory committee has not yet issued a report, and whether they will take criticisms, such as Sinha’s, into account in their laboratory recommendations remains to be seen.

          VI. CONCLUSION

          Although Maryland’s law represents a novel advancement for FGG legislation, it does not eliminate Fourth and Fifth Amendment concerns or respond to fundamental critiques of forensics as a discipline. Sinha even indicates that without truly interrogating the role of forensics “as an engine for control and criminalization of marginalized communities,” reforms like Maryland’s embed rather than challenge forensics as a carceral weapon.[60] However, the mere existence of legislation on a novel forensic method like FGG indicates a groundswell of much-needed attention towards the modern role of forensic techniques in criminal law. Attentive minds coupled with an understanding of forensics as a carceral tool and creative analyses like Sinha’s are exactly the right ingredients for truly re-imagining forensics in a way that protects the rights and of all Marylanders.

          *Natalie Murphy is a second-year J.D. candidate at the University of Baltimore Law School. She is currently interning at the Forensics Division of the Maryland Office of the Public Defender and intends to be a public defender in Baltimore City after graduating. She is fascinated by the relationship between science and the law and thinks reading science fiction is crucial for helping everyone (but especially lawyers) imagine a better world.

          Image credit: Tomasz Steifer, Wikimedia Commons

          [1] Natalie Ram et al., Regulating Forensic Genetic Genealogy: Maryland’s New Law Provides a Model for Others, 373 Sci. Mag., 1444, 1444 (2021).

          [2] See infra Part V.

          [3] Ram et al., supra note 1

          [4] George M. Dery III, Can a Distant Relative Allow the Government to Access Your DNA?, 10 Hastings Sci. Tech. L. J., 103, 139 (2019) (noting common biological samples collected from crime scenes include blood, semen, or sweat, all of which contain DNA); Sarah A. Bates, Deoxyribonucleic Acid (DNA), Nat. Hum. Genome Rsch. Inst. (Aug. 28, 2022), https://www.genome.gov/genetics-glossary/Deoxyribonucleic-Acid (explaining that DNA carries unique genetic information telling an individual’s cells how to grow, reproduce, and function). Law enforcement can collect DNA for analysis at several points in an investigation, including from buccal swabs taken upon or following arrest. Maryland v. King, 569 U.S. 435, 464 (2013). Since FGG is used when the individual associated with a genetic profile is unknown, samples that undergo FGG usually originate from crime scenes. Genevieve Carter, The Genetic Panopticon: Genetic Genealogy Searches and the 4th Amendment,18 Nw. J. Tech. Intell. Prop., 311, 321 (2021).

          [5] See Sarah Chu & Susan Friedman, Maryland Just Enacted a Historic Law Preventing the Misuse of Genetic Information, Innocence Project (Jun. 6, 2021), https://innocenceproject.org/maryland-passes-forensic-genetic-genealogy-law-dna/; Aja Nunn, Far From Batman and Robin: Why Investigative Genetic Genealogy Cannot be Law Enforcement’s Trust Sidekick, 365 Howard L. J., 143, 152 (2021); Rich Press, DNA Mixtures: A Forensic Science Explainer, Nat’l. Inst. Stands. & Tech. (Apr. 3, 2019), https://www.nist.gov/feature-stories/dna-mixtures-forensic-science-explainer. Biological samples collected at crime scenes can contain DNA from multiple individuals, meaning forensic analysts must properly isolate each person’s individual DNA before proceedings with the investigation. Id.

          [6] The Combined DNA Index System (CODIS) contains approximately 20 million DNA profiles from suspects and convicted offenders and is typically the first place law enforcement officials attempt to locate a genetic profile match. See The FBI’s Combined DNA Index (CODIS) Hits Major Milestone, Fed. Bureau Inv. Nat. Press Off. (May 21, 2021), (https://www.fbi.gov/news/press-releases/press-releases/the-fbis-combined-dna-index-system-codis-hits-major-milestone).

          [7] See sources cited supra note 3; see sources cited infra note 13 (explaining forensic technicians conduct short tandem repeat (STR) analysis to collect data for comparison on CODIS, whereas genetic genealogy websites require the more granular data available from single nucleotide polymorphism (SNP) analyses). Technicians must thus conduct a secondary SNP analysis to existing samples before uploading to genetic genealogy websites. Id..

          [8] Natalie Jones, Maryland House Bill Seeks to Prohibit Using Familial DNA Databases to Solve Crime, Balt. Sun (Feb. 20, 2019), https://www.baltimoresun.com/politics/bs-md-maryland-house-bill-dna-databases-0221-story.html.

          [9] Id.

          [10] Ram et al., supra note 1 (citing Maryland v. King, 569 U.S. 435, 464 (2013) (summarizing the controversy surrounding sensitivity of DNA information); Jones, supra note 8 (featuring several critiques of FGG concerned about the privacy of non-suspects); Jacob Stern & Sarah Zhang, The Victims Left Behind by Genetic Genealogy, Atlantic (Jan. 27, 2021) https://www.theatlantic.com/science/archive/2021/01/genetic-genealogy-race/616171/ (finding a disproportionate number of cases solved with FGG feature white women even though the average murder victim is a Black man).

          [11] Ram et al., supra note 1 (citing Maryland v. King, 569 U.S. 435, 464 (2013)).

          [12] Jones, supra note 8.

          [13] Samuel D. Hodge Jr., Current Controversies in the Use of DNA in Forensic Investigations, 48 U. Balt. L. Rev., 39, 50 (2018) (explaining familial DNA matching is only allowed in 12 states); Natalie Ram, Fortuity and Forensic Familial Identification, 63 Stan. L. Rev., 751, 754–55 (2011).

          [14] Chu & Friedman, note 5 (citing What Are Single Nucleotide Polymorphisms (SNPs)?, Nat. Lib. Med., https://medlineplus.gov/genetics/understanding/genomicresearch/snp/ (last visited Aug. 29); What is STR analysis?, Nat. Inst. Just.  (Mar. 2, 2011), https://nij.ojp.gov/topics/articles/what-str-analysis).

          [15] Ram et al., supra note 1 (describing the controversy surrounding consumer genetic database GEDmatch after they violated their own terms of service by allowing a law enforcement officer to search the database for matches in an assault case).

          [16] Id.; see, e.g., Paige St. John, The Untold Story of How the Golden State Killer Was Found: A Covert Operation and Private DNA, L.A. Times (Dec. 8, 2020), https://www.latimes.com/california/story/2020-12-08/man-in-the-window.

          [17] Hodge, supra note 13, at 52, (citing Rori V. Rohlfes et al., The Influence of Relatives on the Efficiency and Error Rate of Familial Searching, 9 Plos One (2013)). The issue is likely compounded by the overrepresentation of Black individuals in law enforcement DNA databases. See Maneka Sinha, Radically Reimagining Forensic Evidence, 73 Al. L. Rev., 880, 893 (2022).

          [18] Nunn, supra note 5, at 145.

          [19] Stern & Zhang, supra note 10.

          [20] Ram et al., supra note 1.

          [21] Department of Justice Announces Interim Policy on Emerging Method to Generate Leads for Unsolved Violent Crimes, U.S. DOJ: Off. Pub. Aff’s (Sept. 24, 2019), https://www.justice.gov/opa/pr/department-justice-announces-interim-policy-emerging-method-generate-leads-unsolved-violent (explaining the Department of Justice issued a preliminary report on FGG practices at the federal level, and a final policy was forthcoming. No final policy has been released as of Aug. 2022); Ram et al., supra note 1,(finding state courts have taken a “hands-off” approach to regulating FGG).

          [22] Md. Code Ann., Crim. Proc. § 17-102 (b) (West 2022).

          [23] § 17-102 (b)(1), 17-102 (b) (3–4).

          [24] § 17-102 (d).

          [25] §17-102 (f).

          [26] §17-105.

          [27] §17-103.

          [28] §17-102 (i–k).

          [29] §17-104.

          [30] Ram et al., supra note 1, at 1445.

          [31] Virginia Hughes, Two New Laws Restrict Police Use of DNA Search Method, N.Y. Times (May 31, 2021), https://www.nytimes.com/2021/05/31/science/dna-police-laws.html (comparing Maryland and Montana’s FGG laws).

          [32] See generally Megan Molteni, Should Cops Use Family Tree Forensics? Maryland Isn’t So Sure, Wired(Feb. 6, 2019), https://www.wired.com/story/maryland-considers-banning-genetic-genealogy-forensics/ (describing FGG pushback surrounding Fourth Amendment rights from Maryland privacy groups); Jones, supra note 7 (quoting Maryland Senator Charles Sydnor’s assertion of Fourth Amendment violations in FGG procedures); Dery, supra note 3 (analyzing Fourth Amendment implications of law enforcement’s FGG search for the Golden State Killer); Carter, supra note 4 (considering Fourth amendment concerns related to genetic genealogy searches).

          [33] See Smith v. Maryland, 442 U.S. 735, 743–44 (1979) (“this court consistently has held that a person has no legitimate expectation of privacy in information that he voluntarily turns over to third parties.”).

          [34] Carpenter v U.S., 138 S. Ct. 2206, 2221–23 (2018).

          [35] Id. at 2211–18.

          [36] Ram, supra note 1.

          [37] Carter, supra note 32, at 331.

          [38] Id. at 332.

          [39] Id.

          [40] U.S. Const. amend. V, § 5.

          [41] Nunn, supra note 5, at 160 (arguing consumer genetic profiles constitute intangible personal property according to both traditional definitions of personal property and the terms of service employed by consumer genetic databases).

          [42] Geoff Williams, How Much it Costs to Research Your Family Tree, U.S. News & World Report (Jan. 26, 2018, 4:04 PM), https://money.usnews.com/money/personal-finance/family-finance/articles/how-much-it-costs-to-research-your-family-tree.

          [43] Id.

          [44] Horne v. Dep’t Agric, 576 U.S. 351, 352 (2015) (“the Fifth Amendment requires that the Government pay just compensation when it takes personal property, just as when it takes real property.”); Nunn, supra note 4, at 161 (“consumer genetics profiles gain their value from the information they possess…[and] an individual’s genetic profile can be valuable for multiple reasons. The profiles carry sensitive health information, information on one’s ancestral background, and can provide a means of connecting with unknown relatives.”).

          [45] Nunn, supra note 5, at 161.

          [46] Id. at 162.

          [47] Id. at 162–63.

          [48] § 17-102(k).

          [49] Sinha, supra note 17, at 956.

          [50] Sinha, supra note 17, at 931—932.

          [51] Id. at 931; see also Lauren Kirchner, Where Traditional DNA Testing Fails, Algorithms Take Over, ProPublica (Nov. 4, 2016), https://www.propublica.org/article/where-traditional-dna-testing-fails-algorithms-take-over (explaining the rising use of algorithms for probabilistic genotyping for complicated biological samples); Michelle Taylor, Bill Questions Proprietary Algorithms Used in Probabilistic Genotyping Software, Forensic Magazine (Jul. 27, 2020), https://www.forensicmag.com/566619-Bill-Questions-Proprietary-Algorithms-Used-in-Probabilistic-Genotyping-Software/ (describing the protection of probabilistic genotyping algorithms under trade secrecy laws).

          [52] Sinha, supra note 17, at 931–32.

          [53] Id.

          [54] Sinha, supra note 17, at 943–946.

          [55] Id. at 943.

          [56] Id. at 887, 994.

          [57] Id. at 945.

          [58] Md. Code Ann., Crim. Proc. § 17-104(c) (West 2022).

          [59] See id.

          [60] Sinha, supra note 17, at 955.

          Emboldened and Relentless: Students for Fair Admissions, Inc., Edward Blum, and an Attack on Affirmative Action in Higher Education Admissions

          *Paige Boyer

          I. Introduction

          Their name is deceptive, but their mission is clear: to remove affirmative action from the higher education admissions process.[1] Students for Fair Admissions, Inc. (SFA) is in the midst of two legal battles attacking affirmative action in higher education admissions; Students for Fair Admissions, Inc. v. The University of North Carolina and Students for Fair Admissions, Inc. v. President & Fellows of Harvard.[2] The Supreme Court heard both cases on October 31, 2022.[3] These cases look to overturn the Supreme Court case Grutter v. Bollinger and instead enforce race-neutral admissions practices.[4] While any attack on civil rights and affirmative action is one for concern, the history and relentless efforts of a relatively new nonprofit group bring pause. Who is the SFA, and why are they attacking affirmative action now?

          II. Students for Fair Admissions, Inc. and Edward Blum

          The nonprofit group boasts a membership of over “20,000 students, parents, and others who believe that racial classifications and preferences in college admissions are unfair, unnecessary, and unconstitutional.”[5] Prior to creating and owning SFA, Edward Blum set out on his legal career to limit voting rights in Texas.[6] In the early 1990s, Blum lost a congressional election in Texas.[7] Blum sued Texas and alleged that his election loss was due to the manipulation of voter districts in a way that favored African American and Hispanic voters.[8] The case, Bush v. Vera, created the term “racial gerrymandering” and eroded the Voting Rights Act protections afforded to citizens.[9] Blum went on to win this suit and began to challenge additional civil rights policies in America.[10] In an attempt to attack affirmative action, Blum represented the plaintiff in the Supreme Court case Fisher v. University of Texas at Austin in 2016, and after losing the case, began SFA.[11]

          Petitioner Abigail Fisher, a white woman, alleged she was rejected from the University of Texas Austin due to her race and claimed the university’s admissions practices were unconstitutional under the Equal Protection Clause of the Fourteenth Amendment of the U.S. Constitution.[12] The Supreme Court held that the university’s admissions processes were not unconstitutional and met the standards established in Grutter v. Bollinger and Regents of University of California v. Bakke.[13] Grutter upheld Bakke and protected affirmative action in college admissions so long as a compelling interest and narrowly tailored process exist.[14] However, the case was not a total loss for Fisher and Blum. Justice Thomas, Justice Alito, and Chief Justice Roberts filed a joint dissent in which they called for a stricter level of specificity in outlining the university’s interest in race-based admissions and referred to the majority’s conclusion as “remarkably wrong.”[15] The dissent is strongly worded and leaves the door open for further attacks on affirmative action.[16]

          III. Current SFA Supreme Court Cases

          Originally filed jointly, the University of North Carolina and the President & Fellows of Harvard cases were argued in front of the Supreme Court this fall and once again asked the justices to weigh in on affirmative action in higher education admissions.[17] Since 2016, the Court has changed dramatically and currently has a conservative majority.[18] Furthermore, all three dissenting justices in Fisher have the opportunity they have been waiting for to overturn the previous decision in favor of the new majority’s beliefs.[19] This would not be the first precedent the current justices have overturned.[20] In his concurring opinion in Dobbs, Justice Thomas urged his colleagues to reconsider other due process precedent cases, including Griswold, Lawrence, and Obergefell.[21]

          After Blum’s loss in Fisher, he claimed he would need to use Asian Americans to strike down affirmative action in higher education admissions.[22] Blum has done just that in his case against Harvard.[23] In his petition for certiorari, Blum claimed that African American and Hispanic students are selected over their Asian American and white peers simply because of their race.[24] Blum made this same claim in his petition for certiorari in the SFA case against the University of North Carolina (UNC).[25] In both cases, SFA calls on the Court to overturn Grutter v. Bollinger.[26] Further, the SFA asks the Court to determine whether Harvard violated Title IV of the Civil Rights Act and whether UNC can reject a race-neutral admissions alternative.[27] Overturning Grutter could open the door to limiting or reversing affirmative action policies across the nation.

          IV. Conclusion

          In a perfect storm, SFA and Blum presented these cases to a court with a conservative majority, including the original three Justices who dissented in Fisher, demanding strict scrutiny and specificity.[28] While the precedent established in Grutter and Bakke supports affirmative action in higher education admissions, the current majority has made it clear that they are willing to overturn even heavily relied on precedents.[29] The cases may seem only to impact higher education admissions, but Blum has shown from his attack on the Voting Rights Act in Bush and continued attacks on civil rights that it will not end with these cases.[30]

          *Paige Boyer is a second-year evening student and Staff Editor for the University of Baltimore Law Review. Paige has been a member of the University of Baltimore community since 2019. She graduated with her Master of Public Administration in December 2021 and is currently working for the University’s Office of Human Resources. After graduating with her J.D., Paige is interested in pursuing a legal career in child advocacy and public interest law. 

          Photo Credit: Rizka (This file is licensed under the Creative Commons Attribution-Share Alike 3.0 Unported license.)

          [1] Students for Fair Admissions, https://studentsforfairadmissions.org/about/ (last visited Aug. 28, 2022).

          [2] Students for Fair Admissions, Inc. v. University of North Carolina, et al., No. 21-707 (S. Ct. filed Nov. 11, 2021); Students for Fair Admissions, Inc. v. President and Fellows of Harvard College, No. 20-1199 (S. Ct. filed Feb. 25, 2021).

          [3] See cases cited supra note 2.

          [4] See cases cited supra note 2.

          [5] Students for Fair Admissions, supra note 1.

          [6] Id.

          [7] Id.

          [8] Id.; Bush v. Vera, 517 U.S. 952 (1996).

          [9] Bush, 517 U.S. at 956.

          [10] Id.; Sarah Hinger, Meet Edward Blum, the Man Who Wants to Kill Affirmative Action in Higher Education, ACLU: Speak Freely (Oct. 18, 2018), https://www.aclu.org/blog/racial-justice/affirmative-action/meet-edward-blum-man-who-wants-kill-affirmative-action-higher.

          [11] Hinger, supra note 10.

          [12] Fisher v. University of Texas at Austin, 579 U.S. 365 (2016).

          [13] Id. A university may use race-based admission processes if a compelling interest and a narrowly tailored program can be shown. See Grutter v. Bollinger, 539 U.S. 306 (2003); see also Regents of University of California v. Bakke, 438 U.S. 265 (1978).

          [14] See cases cited supra note 2.; see also Grutter v. Bollinger, 539 U.S. 306 (2003); Regents of University of California v. Bakke, 438 U.S. 265 (1978).

          [15] Fisher, 579 U.S. at 437 (Alito, J., Roberts, J., & Thomas, J., dissenting).

          [16] Id.

          [17] See cases cited supra note 2.

          [18] Supreme Court of the United States, Ballotopedia, https://ballotpedia.org/Supreme_Court_of_the_United_States (last visited Aug. 28, 2022); Michael A. Bailey, If Trump Appoints a Third Justice, the Supreme Court Would be the Most Conservative it’s Been Since 1950, Wash. Post (Sept. 22, 2020), https://www.washingtonpost.com/politics/2020/09/22/if-trump-appoints-third-justice-supreme-court-would-be-most-conservative-its-been-since-1950/.

          [19] Id.

          [20] Ann E. Marimow et al., How the Supreme Court Ruled in the Major Decisions of 2022, Wash. Post (June 30, 2022), https://www.washingtonpost.com/politics/interactive/2022/significant-supreme-court-decisions-2022/; see Dobbs v. Jackson Women’s Health Organization, 124 S. Ct. 2228 (2022).

          [21] Dobbs, 124 S. Ct. at 2301.

          [22] Hinger, supra note 10.

          [23] See cases cited supra note 2.

          [24] See cases cited supra note 2.

          [25] See cases cited supra note 2.

          [26] See cases cited supra note 2.

          [27] See cases cited supra note 2.

          [28] See cases cited supra note 2.

          [29] See cases cited supra note 26 and accompanying text.

          [30] See Hinger, supra note 10; see also Bush v. Vera, 517 U.S. 952 (1996).

          The Fifth Amendment: You Have the Right to Remain Silent, but Should You?

          *Hannah Krehely

          I. Introduction

          In August 2022, former President Donald Trump took full advantage of his Fifth Amendment right to remain silent in a deposition with the New York State Attorney General.[1] The deposition was part of a civil investigation into whether Trump and the Trump Organization fraudulently misrepresented the value of its properties to lenders.[2] The investigation has spanned three years, but Trump’s deposition may prove to be a pivotal moment in the case to come. Trump reportedly invoked the Fifth Amendment over four hundred times during his deposition, refusing to answer any of the Attorney General’s questions to avoid the risk of self-incrimination.[3]

          The Fifth Amendment provides that “[n]o person shall be . . . compelled in any criminal case to be a witness against himself.”[4] However, the right to remain silent does not necessarily guarantee that your silence will not be used against you in a future court proceeding.[5] By invoking the Fifth Amendment in his August deposition, Trump may face an adverse inference instruction if the case against him ever goes to trial.[6] An adverse interference instruction is known for its applicability in discovery matters where a party has failed to preserve electronic evidence in “anticipation or conduct of litigation.”[7] If such a failure occurs, the court may instruct the jury to “presume that the lost information was unfavorable to the party.”[8]

          II. The Complicated History of the Fifth Amendment

          While the U.S. Constitution does not explicitly provide the right to remain silent, courts have long held that the Fifth Amendment provides this right to criminal defendants.[9] In more recent years, the Supreme Court has guaranteed criminal defendants the right to remain silent “unless [they] choose[] to speak in the unfettered exercise of [their] own will.”[10] The Court notably expanded on this idea in Miranda v. Arizona, holding that the “knowing and intelligent waiver” of one’s right against self-incrimination cannot be assumed “on a silent record.”[11] The Supreme Court has also held that civil defendants are entitled to this right, stating that the privilege is “not ordinarily dependent upon the nature of the proceeding.”[12]

          III. The No-Adverse-Inference Instruction

          A defendant may be entitled to remain silent according to the Fifth Amendment, but this means little if a jury is allowed to use that silence as evidence of the defendant’s guilt.[13] Criminal defendants often move for a “no-adverse-inference” instruction when they choose not to testify at trial.[14] This instruction prohibits a jury from drawing an adverse inference from the defendant’s decision not to testify.[15] Unfortunately for criminal and civil defendants, there is no guarantee that a defendant’s decision to remain silent will come without consequence.[16] For example, a defendant’s decision to “plead the Fifth” could be brought to a jury later in the case or used in sentencing.[17] Additionally, invoking the Fifth Amendment may also be used to impeach the defendant, even though it is not considered determinative of guilt.[18] Recently, the Supreme Court declined to hold that a criminal defendant was entitled to a jury instruction that prohibited the jury from using the invocation of the defendant’s Fifth Amendment right during the penalty phase of his trial.[19] Although Justice Breyer dissented, stating that the Court was expressly going against the general rules established by prior cases,[20] the majority felt that it was “not uncommon for a constitutional rule to apply somewhat differently at the penalty phase than it does at the guilt phase.”[21]

          IV. Adverse Consequences in Civil Cases

          A. Implications for All Defendants

          While the water seems muddied in criminal cases, civil defendants face even tougher odds when exercising their Fifth Amendment rights, as they are more likely to face an adverse inference jury instruction. In Baxter v. Palmigiano, the Supreme Court recognized “the prevailing rule that the Fifth Amendment does not forbid adverse inferences against parties to civil actions when they refuse to testify in response to probative evidence offered against them.”[22] A different treatment of the Fifth Amendment may be warranted in civil cases where the stakes are not as high as in criminal cases, as a civil defendant does not face the risk of prison or death.[23]

          However, in a civil case, the plaintiff is not motivated by the desire to convict the defendant. Instead, a settlement may be considered a favorable ending.[24] Because of this, courts have been willing to allow adverse inferences when a defendant invokes the Fifth Amendment so long as some probative evidence otherwise exists and outweighs the danger of prejudice or misleading the jury.[25] A lack of federal guidance on this issue means that lower courts are left to decide the weight assigned to a defendant’s decision to remain silent,[26] resulting in variations in the strength of the adverse inference instruction, as well as a general expansion of its use.[27]

          B. Implications for Former President Trump

          Through Trump’s exercise of his privilege against self-incrimination in his August deposition, he likely saved himself from the risk of self-incrimination. This risk is especially heightened for Trump as he faces a criminal investigation into similar matters.[28] However, if the civil investigation against Trump reaches the courtroom, the trial court will have the discretion to weigh the evidence against him and the significance of his silence.[29] If found to be significant enough, the prosecutor may have the opportunity to instruct the jury to infer that Trump’s silence was intended to hide information that was “unfavorable” to Trump and his case.[30] The “weight” given to the adverse inference instruction will be left to the court to decide.[31]

          V. Conclusion

          In both civil and criminal cases, defendants are entitled to exercise their Fifth Amendment right to remain silent to avoid self-incrimination.[32] However, in civil cases especially, courts have modified this right by allowing a jury to infer that the defendant chose to remain silent rather than provide a self-incriminating answer.[33] Trump must contend with the possibility of receiving an adverse inference instruction and prepare for its repercussions as the case against him continues through the New York legal system.

          *Hannah Krehely is a second-year day student at the University of Baltimore School of Law, where she is a Staff Editor for the Law Review and a Distinguished Scholar of the Royal Graham Shannonhouse III Honor Society, a Legal Writing Fellow, a member of the National Moot Court Team, a research assistant for Professor Robert Lande, and a teaching assistant for Professor Jaros’s ILS/Criminal Law class. Prior to law school, Hannah spent two years working as a Senior Judiciary Clerk in the Anne Arundel County Circuit Court. In summer 2022, Hannah worked as a judicial intern for the Honorable Judge Laura S. Ripken on the Maryland Court of Special Appeals.

          [1] Jonah Bromwich et al., Trump Invokes Fifth Amendment, Attacking Legal System as Troubles Mount, N.Y. Times (Aug. 10, 2022), https://www.nytimes.com/2022/08/10/nyregion/trump-james-deposition-fifth-amendment.html [hereinafter Trump Invokes Fifth Amendment].

          [2] Jonah Bromwich et al., Hyperbole or Fraud? The Question at the Heart of Trump Investigation, N.Y. Times (Jan. 19, 2022), https://www.nytimes.com/2022/01/19/nyregion/trump-investigation-letitia-james.html.

          [3] Trump Invokes Fifth Amendment, supra note 1.

          [4] U.S. Const. amend. V.

          [5] See Baxter v. Palmigiano, 425 U.S. 308, 318–19 (1976).

          [6] See 6 Moore’s Federal Practice – Civil § 26.51 (2022).

          [7] Fed. R. Civ. P. 37 (e).

          [8] Id.

          [9] See, e.g., Ullmann v. United States, 350 U.S. 422, 428 (1956).

          [10] Malloy v. Hogan, 378 U.S. 1, 8 (1964).

          [11] Miranda v. Arizona, 384 U.S. 436, 498–99 (1966).

          [12] McCarthy v. Arndstein, 266 U.S. 34, 40 (1924).

          [13] Cameron Oakley, You Might Have the Right to Remain Silent: An Erosion of the Fifth Amendment with the Use of Pre-Arrest Silence, 49 Creighton L. Rev. 589, 622 (2016).

          [14] See White v. Woodall, 572 U.S. 415, 418 (2014).

          [15] See id.

          [16] See id. at 420–21.

          [17] See id.; see also State v. Carr, 314 Kan. 615, 688–89 (2022) (“Whether the Fifth Amendment to the United States Constitution compels a district court to provide a requested no-adverse-inference instruction during the penalty phase of a capital trial remains an open question that the United States Supreme Court has yet to resolve.”).

          [18] David S. Romantz, “You Have the Right to Remain Silent”: A Case for the Use of Silence as Substantive Proof of the Criminal Defendant’s Guilt, 38 Ind. L. Rev. 1, 23 (2005).

          [19] White, 572 U.S. at 427.

          [20] Id. at 428 (2014) (Breyer, J., dissenting)

          [21] Id. at 421.

          [22] Baxter v. Palmigiano, 425 U.S. 308, 318 (1976).

          [23] Id. at 318–19.

          [24] Id.

          [25] Fed. R. Evid. 403.

          [26] Dennis J. Bartlett, Adverse Inferences Based on Non-Party Invocations: The Real Magic Trick in Fifth Amendment Civil Cases, 60 Notre Dame L. Rev., 370, 379 (1985).

          [27] Id.

          [28] Jonah Bromwich, Manhattan D.A. Leaves Office With One Big Case Up in the Air, N.Y. Times (Dec. 30, 2021), https://www.nytimes.com/2021/12/30/nyregion/cy-vance-trump-investigation.html.

          [29] See Brink’s, Inc. v. New York, 717 F.2d 700, 710 (2d Cir. 1983).

          [30] See Baxter v. Palmigiano, 425 U.S. 308, 318 (1976).

          [31] Bartlett, supra note 26.

          [32] McCarthy v. Arndstein, 266 U.S. 34, 40 (1924).

          [33] See Baxter, 425 U.S. at 318.

          Not Different, Not the Same: International Humanitarian Law’s Problem with Cyberattacks

          *Anastasia Couch

          I. Introduction

          On the 175th day of war, the Ukrainian company “Energoatom” reported that Russian hackers launched a three-hour attack on its website.[1] Though the initial attack did not cause significant impact, the attempted assault raised a significant concern because Energoatom is Ukraine’s state nuclear power company.[2] The attack was not directly attributed to the Russian government but to Russia’s “popular cyberarmy” group, which, through its Telegram channel, prompted its followers to attack Energoatom.[3] The attack was the most powerful cyber operation directed at the website since the start of the Russian invasion of Ukraine.[4] As “the first major conflict involving large-scale cyber operations,” Ukraine is the testing site for how modern-era cyber warfare could look.[5] Cyberattacks define the ongoing Russian invasion,[6] and each instance impacts the international community’s ability to address them.[7]

          II. Distinguishing between Cyber and Kinetic Operations

          Kinetic operations are the “conventional” means of warfare, defined by the manifestation of physical force within the physical realm.[8] In contrast, cyber operations are defined by the origin point of their target in cyberspace; however, the effects can ripple into the corporeal world.[9] Cyberattacks are often executed alongside conventional methods to secure the same or similar goals.[10] For example, on March 1,2022, a Russian missile struck a Kyiv TV tower.[11] The same day, Kyiv-based media companies faced destructive attacks and data exfiltration through Russian-based cyberattacks.[12]

          III. International Humanitarian Law Application to Cyber Operations in Armed Conflicts

          International humanitarian law (IHL) has faced problems with cyberspace attacks for nearly two-decades.[13] After the 2022 United Nations Open-Ended Working Group (UN OEWG) on information and communications technology, the UN OEWG committee affirmed the applicability of IHL to the use of cyber warfare in armed conflict.[14] The global norm also bends in the same direction: many State and international organizations like the European Union (EU) and North Atlantic Treaty Organization (NATO) have likewise affirmed IHL’s applicability.[15]

          However, there is no specific framework of law surrounding cyberspace, unlike fields such as space law which is the domain of codified international legal rules.[16] In the absence of an established framework, IHL resorts to definitions already within its structure: those for conventional warfare.[17] Many have criticized IHL’s applicability to cyber warfare, because the language of kinetic warfare does not easily translate to cyber warfare.[18] It remains to be seen whether the oversight of cyber warfare can ever be disentangled from kinetic warfare.[19] As recognized by the recent UN OEWG, two contentious factors keep cyber warfare on this threshold: determining what qualifies as an attack and attributing these attacks to actors.[20]

          IV. The Consequences

          A. Defining a Cyber “Attack”

          Defining an “attack” is one of the primary principles of customary IHL, which has comprehensively provided prohibitions for its many forms, from the indiscriminate to the disproportionate.[21] However, there are diverging interpretations of how IHL governs cyberattacks that do not render “tangible” damage but only some loss of functionality, such as the effects of malware on network systems.[22] In theory, both cyber and kinetic means have similar “operational access” and impacts on the physical world.[23] The similarity ends in the distance between access and impact.[24] Where kinetic operations are nearly immediate between access and impact, cyber operations have a characteristic gap between the two, which yields a very different attack result.[25] This gap is what makes a cyber-attack that much more distinct: an incoming missile strike is guaranteed to be immediate, whereas the effects of a cyberattack can ripple and linger for months after.[26] 

          The International Committee of the Red Cross (ICRC) has previously expressed concerns that a restrictive definition of “attack,” such as one that only encompasses results like death, injury, or physical damage, would remove the protection of IHL from many of the civilian targets of cyberattacks.[27] Many argue that cyber operations alone cannot reach these destructive capabilities[28] and lack the same impact of decisive results and assured, instant effects as that of kinetic operations.[29] As one source quipped, “No one has ever died by a cyberattack.”[30] However, Ukrainians have lost power in the middle of winter[31] and received spambot messages urging defection and treason against Ukraine.[32] Most cyberattacks may not have instantly visible, tangible results, but there is, with some certainty, still a felt effect. To be perceived as an attack and to fall under the protection of IHL, each of these examples would have to stretch the existing, constrained definitions currently found within IHL—the definitions that typically emphasize the dramatically immediate physical effects of kinetic warfare.[33]

          B. Actor Recognition

          Another core principle of customary IHL is the enforceable norm of a State’s responsibility for its actors.[34] Typically, a State is responsible for violations committed by its own forces and for the people it empowers to exercise governmental authority, people or groups acting on the State’s instructions or control, and actions by private persons or groups which the State “acknowledges and adopts as its own conduct.”[35]

          Further, cyber warfare frustrates the opposition’s ability to identify and hold individual actors responsible, and, by extension, any affiliated or sponsoring State.[36] For example, members of military cyber units are considered combatants under IHL because they are members of the armed forces of a party to an international armed conflict.[37] However, advanced persistent threats (APT), like anonymous hacker organizations are not always clearly military or State-sponsored entities.[38] At the start of the Russian invasion, a private Brazilian hacker company attacked Ukrainian universities’ websites, an action not claimed by either Russia or Brazil.[39] On an even larger scale, Ukraine has amassed a cyber-army of volunteers, who, while undoubtedly retaining connections to Ukraine’s established defense forces, remain decentralized and without traditional State oversight mechanisms.[40] In the era of global privatized and decentralized forces,[41] it is no surprise that the trend extends to cyberspace. As a result, the often-elusive actors committing cyberattacks confound the old concepts of attribution under IHL.

          V. Conclusion

          The mass cyber army mobilization on both sides of the Russian invasion provides a glimpse into what the future of cyber warfare could look like: attacks performed largely by non-State or quasi-State forces. Consider the opening example again: an attack that yielded no physical result at the time[42] conducted by individuals recruited through a Telegram channel.[43] Not only was the effect markedly different from a conventional kinetic attack, but the associated actors evade the standard attribution of a State or state-sponsored actor. IHL stands to guide States and organizations toward a more detailed and specific understanding of cyberattacks, especially as global conflicts continue to wage new and evolving forms of conflict.[44] The language of kinetic warfare remains the standard, but for IHL to effectively address cyberwarfare, it must be informed of the similarities, and also the drastic differences, between the two.

          *Anastasia Couch is a second-year day student at the University of Baltimore School of Law, where she is a Staff Editor for Law Review and a member of the Royal Graham Shannonhouse III Honor Society. In summer 2022, Anastasia interned with the Maryland State Ethics Commission and looks forward to interning with Citizens for Responsibility and Ethics in Washington (CREW) in the upcoming spring semester. Anastasia hopes to continue to work in government oversight after receiving her J.D. and currently pursues her passion by volunteering with Women for Weapons Trade Transparency.

          Photo credit: Stefan Kuhn (This file is licensed under the Creative Commons Attribution-Share Alike 3.0 Unported license.)

          [1] Ukraine Nuclear Power Company Says Russia Attacked Website,Al Jazeera (Aug. 16, 2022), https://www.aljazeera.com/news/2022/8/16/ukraine-nuclear-power-company-says-russia-attacked-website.

          [2] Id. See infra note 41.

          [3] Id.

          [4] Al Jazeera, supra note 1; Joel Middleton & Samantha Lock, Russia-Ukraine War Latest: What We Know on Day 175 of the Invasion, The Guardian (Aug. 17, 2022), https://www.theguardian.com/world/2022/aug/17/russia-ukraine-war-latest-what-we-know-on-day-175-of-the-invasion.

          [5] James Andrew Lewis, Cyber War and Ukraine, Center for Strategic and International Studies (Aug. 24, 2022), https://www.csis.org/analysis/cyber-war-and-ukraine.

          [6] Id.

          [7] Slate Herman, Cybersecurity and the U.N Charter: A Square Peg in a Round Hole, 19 Colo. Tech. L. J 217, 231 (2021).

          [8] See Josiah Dykstra et al., Differentiating Kinetic and Cyber Weapons to Improve Integrated Combat, 99 Joint Force Q., 116, 116–17 (2020).

          [9] Id.

          [10] See Lewis, supra note 5.

          [11] Microsoft Digital Security Unit, Special Report: Ukraine 8 (2022).

          [12] Id.

          [13] Ewan Lawson & Kubo Mačák, Int’l Comm. of the Red Cross, Avoiding Civilian Harm From Military Cyber Operations During Armed Conflicts 37 (2020), https://www.icrc.org/en/document/avoiding-civilian-harm-from-military-cyber-operations.

          [14] Tilman Rodenhäuser & Veronique Christory, Capacity-Building Tools on “How and When” IHL Applies to Cyber Operations During Armed Conflict, 2 Cyber Peace & Security Monitor 13, 13 (2022).

          [15] Lauren Gisel et al., Twenty Years On: International Humanitarian Law and the Protection of Civilians Against the Effects of Cyber Operations During Armed Conflict, 913 Int’l Rev. Red Cross 287, 299 (2021).

          [16] Kubo Mačák, Unblurring the Lines: Military Cyber Operations and International Law, 6 J. Cyber Pol’y 411, 412–13 (2021).

          [17] See Rodenhäuser & Christory, supra note 13, at 14.

          [18] See Herman, supra note 7, at 230;Gisel, supra note 14, at 314; Mačák, supra note 15, at 416.

          [19] See Gisel, supra note 14, at 304; Mačák, supra note 15, at 414.

          [20] Rodenhäuser & Christory, supra note 13, at 14.

          [21] See Gisel, supra note 14, at 312; Jean-Marie Henckaerts & Louise Doswald-Beck, Customary Int’l Humanitarian L.: Rules 3, 46 (2005).

          [22] Michael N. Schmitt, Wired Warfare 3.0: Protecting the Civilian Population During Cyber Operations, 101 Int’l Rev. Red Cross 333, 339 (2019); Dykstra et al., supra note 8, at 118 (noting that, unlike most kinetic ops, the effects of cyberattacks on the physical world are often reversible, like the use of a decryption key to reverse the encryption used in ransomware).

          [23] See Dykstra, supra note 8, at 118.

          [24] Id. Operational access is “the ability to project military force into an operational area with sufficient freedom of action to accomplish the mission.” Id.

          [25] Id.

          [26] Id.; see also Mike McQuade, The Untold Story of NotPetya, the Most Devastating Cyberattack in History, Wired (Aug. 22, 2018), https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/

          [27] See Schmitt, supra note 21, at 341.

          [28] Lewis, supra note 5.

          [29] Lewis, supra note 5; Dykstra et al., supra note 8, at 118.

          [30] Lewis, supra note 5.

          [31] Council on Foreign Relations, Compromise of a Power Grid in Eastern Ukraine, Council on Foreign Relations (Aug. 24, 2022), https://www.cfr.org/cyber-operations/compromise-power-grid-eastern-ukraine.

          [32] See Microsoft Digital Security Unit, supra note 11, at 15; Lorenzo Franceschi-Bicchierai, Ukraine Accuses Russia of Using WhatsApp Bot Farm to Ask Military to Surrender, Vice (Aug. 24, 2022), https://www.vice.com/en/article/5dgemn/ukraine-accuses-russia-of-using-whatsapp-bot-farm-to-ask-military-to-surrender.

          [33] Gisel, supra note 14, at 314.

          [34] Henckaerts & Doswald-Beck, supra note 20, at 3; Lawson & Mačák, supra note 12, at 25.

          [35] Henckaerts & Doswald-Beck, supra note 20, at 530.

          [36] See Gisel, supra note 14, at 296.

          [37] Mačák, supra note 10, at 419.

          [38] Lawson & Mačák, supra note 12, at 13.

          [39] Mark Maunder, Ukraine Universities Hacked As Russian Invasion Started, Wordfence (Aug. 24, 2022), https://www.wordfence.com/blog/2022/03/ukraine-universities-hacked-by-brazilian-via-finland-as-russian-invasion-started/. What makes cyberwarfare even more complex are the varying “domains” it touches–note that the Brazilian hackers attacked Ukrainian Sites via the Sweden-based hosting provider, which routed the malicious traffic involved in this attack. Id.

          [40] Lorenzo Franceschi-Bicchierai, Inside Ukraine’s Decentralized Cyber Army, Vice (Aug. 24, 2022), https://www.vice.com/en/article/y3pvmm/inside-ukraines-decentralized-cyber-army.

          [41] See generally, Sean McFate Mercenaries and War: Understanding Private Armies Today National Defense University Press: News (Dec. 4, 2019), https://ndupress.ndu.edu/Media/News/Article/2031922/mercenaries-and-war-understanding-private-armies-today/.

          [42] Kate Conger & Adam Satariano, Volunteer Hackers Converge on Ukraine Conflict With No One in Charge, New York Times (Mar. 4, 2022), https://www.nytimes.com/2022/03/04/technology/ukraine-russia-hackers.html.

          [43] Al Jazeera, supra note 1; Max Hunder, Zaporizhzhia Nuclear Plant Still Disconnected From Grid, Ukraine’s Energoatom Says, Reuters (Aug. 26, 2022), https://www.reuters.com/world/europe/zaporizhzhia-nuclear-plant-still-disconnected-grid-ukraines-energoatom-says-2022-08-26/. Though the initial cyberattack yielded no results, the affiliated nuclear plant was disconnected from Ukraine’s power grid. It is argued that the disconnection was due to kinetic ops and physical destruction to the electric lines, which perfectly captures the problem of cyber warfare. See discussion supra Section IV. a.

          [44] Al Jazeera, supra note 1.