From the President: Generative AI for Criminal Defense Lawyers: Myths, Risks, and Benefits
By Michael P. Heiskell, NACDL President and Dr. Ilia Kolochenko
June 2024 issue of The Champion
I am “old school.” Yet I make every effort to educate myself in this rapidly changing and challenging time on the impact of Generative AI (GenAI). I must confess that when the topic of GenAI using mysterious Large Language Models (LLM)¹ emerged, I was fearful that robots were coming to replace us. The landscape in the legal tech area is ever-changing. Criminal defense practitioners must be aware of its impact from law enforcement’s use of ChatGPT in police report writing to the courts’ use of risk assessment programs in determining bail amounts and conditions of release. Other areas reflecting the use of GenAI include predictive policing, digital analysis, gunshot recognition, and digital facial recognition. I was extremely pleased when Dr. Ilia Kolochenko, a partner and cybersecurity practice lead at Platt Law LLP, reached out to NACDL and offered to create a Cybercrime Committee. Dr. Kolochenko is now chair of our Cybercrime Committee, and we encourage all interested people to join. Our communications culminated in this column he and I have co-authored — primarily Dr. Kolochenko.
— Michael P. Heiskell
Some legal professionals probably remember the golden epoch of the late 1990s and the global rise of the internet. Some people believed that the internet would make legal professionals redundant and obsolete, especially after launch of the first search engines where one could easily find a template of almost any contract or even obtain “legal advice” about a specific problem. The internet, alongside the ubiquitous digitalization, has shaped virtually all dimensions of the legal profession. However, the internet has also made lawyers even more “in demand” than ever, simultaneously improving and accelerating many routine tasks and time-consuming legal processes. The distilled aftermath is that today both lawyers and the internet co-exist in harmony.
GenAI and Cybercrime
It would be an arduous task to find a single legal professional who would disagree that cybercrime is steadily growing, causing massive financial and other losses, and disrupting schools, healthcare institutions, critical infrastructure and governmental agencies. Some cybersecurity and fraud prevention vendors imprudently make unsubstantiated claims about multi-trillion-dollar losses caused by cybercrime; however, those pseudo-sensational reports are only good for scaremongering marketing. According to the FBI’s Internet Crime Complaint Center (IC3) report, U.S. entities and individuals lost over $12.5 billion in 2023 due to cyberattacks, representing a grim 22% year-over-year growth.² It is important to note that the FBI’s somewhat conservative numbers do not include nonreported or concealed cybersecurity incidents and intrusions, and thus they may appear comparatively insignificant.
Remarkably, while both intensity and amplitude of cyberattacks soar, technical complexity of the underlying hacking techniques does not necessarily follow.³ This may appear somewhat counterintuitive, but there is a sound explanation for this trend. Contrasted to many other sectors of the economy, cybercrime has become a mature, well-organized and highly efficient industry with immense potential for an epidemic growth. Cybercriminals are pragmatic and good at math. They always seek the fastest, least expensive, and most riskless way to steal the data they need. Instead of attacking a leading financial corporation, which can afford to invest eight-digit amounts in its cybersecurity program and hire top-skilled cybersecurity talents, astute cybercriminals will go after the corporation’s trusted third parties — having copies or privileged access to the very same data — such as accountants, law firms, IT vendors, and various external consultants. As one would expect, breached law firms make news headlines with an unenviable frequency.⁴ This is the reason prevention of supply-chain attacks and implementation of third-party risk management (TPRM) programs are essential elements of a resilient cybersecurity program, while becoming mandatory compliance requirements of data protection laws and regulations.
GenAI progressively pours gasoline on the flame of cybercrime. Nonetheless, despite the abundance of alarmist reports by some cybersecurity companies warning about the doom-like capabilities of GenAI for cybercrime, most such claims are overdramatized or unnecessarily inflated. Yet a rationale does exist for anxiety about emerging risks of GenAI and its catalyzing effect on cybercrime. GenAI can undeniably provide potent capacities to generate deep-fake content, including photographs as well as audio and video recordings that, inter alia, can be exploited to bypass biometric authentication systems. Likewise, GenAI can assist cybercriminals with writing impeccable phishing emails, creating fake but trustworthy-looking web pages, and otherwise helping to impersonate government and law enforcement agencies, law firms or individuals.⁵ That being said, deceptive capabilities of organized cybercrime have been sufficiently advanced and inventive to successfully manipulate victims during the past decade. Years before the launch of ChatGPT, gangs of cyber mercenaries already had access to professional copywriters, psychologists, and even lawyers to create top-quality content, obviously concealing their real identities and the contemplated use of deliverables from the unwitting professionals. Paradigmatically, apart from creation of deceptive content aimed at perfidiously misleading human beings, GenAI remains comparatively useless for skilled cybercriminals. For example, GenAI cannot deploy proxy infrastructure to conceal real sources of cyberattacks, and it cannot launder and cash out ransomware proceeds received in cryptocurrencies. GenAI cannot verify that new clients are not undercover FBI agents. Finally, GenAI’s malware creation capabilities remain quite primitive and nascent, bringing from little to no value for experienced cybercrime groups.⁶ While cybercrime is booming for a variety of reasons, GenAI is not and is unlikely to become a groundbreaking or revolutionary facilitator of data breaches in 2024.
Criminal Law Impact
Access to the criminal legal system in the United States has been suboptimal, especially for defendants from the most vulnerable social, racial and ethnic groups,⁷ leading to incalculable miscarriages of justice.⁸ Even a well-prepared trial by a top-ranked lawyer is no guarantee of acquittal for an innocent person. Many state and federal courts experience serious and increasing backlogs due to a growing number of cases. Whenever possible, the judicial system — including prosecutors and judges — foreseeably tries to handle and close cases as expeditiously as practical, inevitably hurting the quality of justice that everyone deserves with coercive guilty plea tactics, with the trial penalty leading the way.
However, imagine that a public defender can obtain a two-page, cogent summary of a newly assigned criminal defense case that contains the most important elements of the dossier, compiled by GenAI from hundreds of different documents, warrants, handwritten notes, forensic reports, and photographs. This will, of course, not absolve the lawyer from numerous crucial legal tasks that deserve and require human skills and knowledge, such as cross-examining witnesses or convincing the jury with spellbinding storytelling during the opening and closing statement. However, obtaining a summary generated by AI will save a considerable amount of invaluable human time. As already stated, although AI can immensely help to summarize and prioritize, the lawyer should review the documents and scrutinize any AI-generated products; otherwise, a sudden AI hallucination may put counsel’s client behind bars or even send him to death row.
Court clerks and judges can leverage AI to accelerate and streamline their caseload, putting the most important or urgent motions and cases on top of the pile, and then quickly getting to the most decisive elements of a case precisely spotted and lucidly summarized by AI. Moreover, AI can sometimes be more attentive and accurate than a legal professional on a late Friday evening, possibly making the judicial process even more reliable. The future belongs to a seamless and sustainable co-existence between lawyers and GenAI: the inimitable human intelligence, cognition and reasoning, combined with the speed of AI, can hammer out an unprecedented human-machine synergy for a more efficient legal system. Yet skeptics of algorithmic tools in criminal law have noted that accuracy and bias are still noteworthy concerns.⁹
One additional trend that could develop is the ability of prosecutors to utilize AI to predict chances that an accused will be convicted in a jury trial based on previously available data. That inherent danger potentially removes human consideration of the mitigating, and often exculpatory, evidence and circumstances that weigh against a prosecution from the onset.
In considering this burgeoning field of GenAI and its impact on the criminal legal system, one must be vigilant. Lawyers must keep their defense hats on at all times to help identify the biases this technology may support and to implement creative safeguards to ensure the presumption of innocence is maintained in our courts.
Notes
1. GenAI refers to artificial intelligence models that have the ability to generate new content. These models create text or other forms of media based on patterns and examples they have been trained on. LLMs focus on language modelling. They predict what comes next in a given sequence of words or generate text based on a prompt. TechMobius, Generative AI vs. LLM — What Is the Big Difference?.
2. FBI Internet Crime Complaint Center, FBI Internet Crime Report 2023 (2024).
3. ImmuniWeb, Top 5 Cybersecurity and Cybercrime Predictions for 2024 (2023).
4. Sam Skolnik, Skye Witley & Olivia Cohen, Law Firm Cyberattacks Grow, Putting Operations in Legal Peril, Bloomberg Law, July 7, 2023.
5. Kevin Purdy, Fake AI Law Firms Are Sending Fake DMCA Threats to Generate Fake SEO Gains, Ars Technica, April 4, 2024.
6. Alex Scroxton, AI Will Heighten Global Ransomware Threat, Says NCSC, Computer Weekly, January 24, 2024.
7. Jonathan Rapping, Redefining Success as a Public Defender: A Rallying Cry for Those Most Committed to Gideon’s Promise, The Champion, June 2012, at 30.
8. Richard Oppel & Jugal Patel, One Lawyer, 194 Felony Cases, and No Time, N.Y. Times, Jan. 31, 2019.
9. Jacob Snow, Amazon’s Face Recognition Falsely Matched 28 Members of Congress with Mugshots, American Civil Liberties Union (July 26, 2018).
About the Authors
Michael P. Heiskell is the owner of Johnson, Vaughn & Heiskell in the Fort Worth-Dallas, Texas area. He represents individuals and entities in state and federal courts throughout the country, with an emphasis on white collar investigations and prosecutions. He is a past president of the Texas Criminal Defense Lawyer’s Association.
Michael P. Heiskell
Johnson, Vaughn & Heiskell
Fort Worth, Texas
www.johnson-vaughn-heiskell.com
A member of the D.C. Bar, Dr. Ilia Kolochenko is a Partner at Platt Law LLP. He is a cybersecurity expert with over 15 years of experience in information security auditing and digital forensics. Dr. Kolochenko advises clients on complex questions of data protection, privacy, and cybersecurity law.
Dr. Ilia Kolochenko
Platt Law
Washington, DC
https://platt.law
© 2024, National Association of Criminal Defense Lawyers. All rights reserved. This article originally appeared in The Champion magazine and is reprinted with permission.
