I.  Introduction

In public international law, sovereignty derives from the independence and autonomy of States. The parallel aspect of enjoying the monopoly of legitimate authority over a territory is the exclusion of other States’ authority.¹ At the core of the autonomy of States’ sovereignty lies their criminal sovereignty: defining offences, sanctions, powers of investigation, policies, priorities, etc.² Yet, sovereignty was mainly conceptualised in the 16th century,³ and such idealization of States’ autonomy strikes us a utopia in our globalised⁴ and digitalised⁵ world. Consequently, the concept of digital sovereignty was developed to adapt to new realities. Originally meant as informational sovereignty (control over information⁶), today digital sovereignty covers different concepts, such as technological sovereignty and data sovereignty,⁷ due to the lack of a uniform use. In this article, the modern-day theory of (digital) sovereignty will allow us to highlight the contradiction between the supposed autonomy of States and the “de facto disparities of power among States, which, in turn, might limit their capacity to act, to regulate and to freely adopt decisions.”⁸ These disparities of power are particularly threatening to independent sovereignty when they impact criminal law, which is seen as being at the heart of the State’s monopoly of legitimate violence.⁹

One of these disparities of power lies in the ability to develop, to use, and to regulate artificial intelligence (AI) systems when applied to repress criminal offences. Since AI relies on humans and institutions for its creation and functioning, “it depends entirely on a […] set of political and social structures.”¹⁰ While no unique definition exists regarding AI,¹¹ computer systems have been assisting States’ decision-making processes since the 1970s.¹²

There are many examples of AI systems in use to support the prevention and prosecution of offences. Human trafficking (in particular for the purpose of sexual exploitation) is taken as an example in this article to draw conclusion on the use of AI systems for law enforcement purposes, as they have received little attention from legal scholars (in this area) until now. Human trafficking is an internationally criminalised offence defined in the 2000 Protocol to Prevent, Suppress and Punish Trafficking in Persons, Especially Women and Children, supplementing the United Nations Convention against Transnational Organized Crime (Art. 3.a). It is defined as follows:

[t]he recruitment, transportation, transfer, harbouring or receipt of persons [element 1: actions], by means of the threat or use of force or other forms of coercion, of abduction, of fraud, of deception, of the abuse of power or of a position of vulnerability or of the giving or receiving of payments or benefits to achieve the consent of a person having control over another person [element 2: coercive means], for the purpose of exploitation [element 3: purpose].

Therefore, trafficking represents a security threat violating the human rights of victims. Protecting victims and prosecuting perpetrators is a manifestation of States’ criminal sovereignty. Nowadays, the fight against human trafficking is also at the crossroads of States’ digital sovereignty. Indeed, technologies, in particular the internet, can exacerbate the trafficking schemes. Consequently, the term e-trafficking was “coined to describe human trafficking facilitated/enabled or regulated through the use of the internet and other communication platforms.”¹³ To recruit victims, traffickers actively impersonate an employer, rely on cyber seduction,¹⁴ or use different types of bait online, usually a false job offer.¹⁵ The internet is used to book transportation and accommodation for the potential victim.¹⁶ During the exploitation stage, when the victims are trafficked for the specific purpose of sexual exploitation, technology enables their sexual services to be advertised online.¹⁷ Although trafficking encompasses many forms of exploitation (sexual exploitation, labour exploitation, forced begging and criminality, etc.), American AI systems exclusively, as far as we know, focus on the repression of the federal offence of “sex trafficking.” Thus, the intended comprehensive approach of the human trafficking phenomena adopted by this article is limited by the existing technologies. Traffickers might take advantage of technology for the anonymity it provides or to hasten trafficking processes. However, e-trafficking also creates data that might be helpful to investigators and used as evidence. Yet, the sheer volume of data challenges their productive analysis by law enforcement authorities.

The creation of AI systems was intended as a solution, namely to support the fight against human trafficking facilitated by the internet. It can automate the crawling and processing of data, organise information linked to ongoing cases, or improve the detection of patterns and red flags to multiply proactive investigations. This idea was first developed by researchers in the United States in 2012.¹⁸ Later, their elaboration was framed into the Defense Advanced Research Projects Agency.¹⁹ Currently, similar systems are being developed outside of the US (e.g. in Canada²⁰), and US systems are being exported to Europe (e.g. to the United Kingdom and to Ireland²¹). However, the actual or potential use of foreign tools, especially within the European Union, is not neutral with respect to the autonomy of European sovereignties. The following two sections analyse the risks inherent in the use of US AI systems to the criminal national sovereignty and the digital European sovereignty.

II. Risks of Influencing European Criminal Sovereignty

First, the spread of US AI systems developed to support the investigation and prosecution of sex trafficking questions the protection of European national criminal sovereignty. AI systems might be seen as neutral, as they are based on objective data and criteria to combat well-defined criminal phenomena. However, such a perspective reflects mere technological solutionism;²² it “would postulate the existence of a technical solution to any problem.”²³ However, these systems are actually not neutral, as they might be imbued with political positions and policies. As such, when they are used abroad, the politics of their State of origin might be applied in the States of reception, potentially impacting the latter’s autonomous sovereign powers. This risk genuinely exists regarding AI systems designed to prevent and prosecute human trafficking.

Despite benefiting from an international definition, the offence of human trafficking has not been fully harmonised. Firstly, the 2000 Protocol was adapted and broadened by European texts²⁴ (the addition of types of exploitation and suppression of the criterion of a transnational traffic). Secondly, even within Europe, national definitions reveal a wide variety of transpositions of the Directive 2011/36/EU.²⁵ For instance, in Belgium, coercive means are not an element of the offence but an aggravating circumstance.²⁶ In France and in Spain, as in the supranational definitions, these means are part of the elements of the offence, although they are slightly differently defined.²⁷ A comparison between the European definitions and the US code is particularly striking; the latter only recognises trafficking in the context of, on the one hand, peonage, slavery, involuntary servitude, or forced labour, and, on the other hand, sex trafficking.²⁸ Therefore, an AI system to combat human trafficking needs to be adaptable to national definitions, which might not be applicable, as most of them were developed in the United States and for the United States.

The development of such systems is based on the criminal realities and priorities of each country, particularly regarding the types of exploitation. For instance, in Europe, there is a stronger focus on trafficking for labour exploitation.²⁹ Yet, systems of AI financed in the United States exclusively focus on the repression of trafficking for domestic sexual exploitation.³⁰ One of the major means is the analysis of classified advertisements. In particular, these US AI systems emphasise the identification of victims who are minors.³¹ The fact that the existing systems are mainly made in the United States impacts worldwide priorities in the fight against the complex and multifaceted phenomenon of human trafficking. It reinforces the continuous focus on sexual exploitation,³² which has been strongly criticised as a very limited conception of human trafficking.³³

In the latter context, one should consider as well that trafficking for sexual exploitation can, under some national legislations, be conflated with sex work. Certain states’ policies consider commercial sex as exploitative per se, regardless of working conditions and the legitimacy of a sex workers’ agency.³⁴ This is the case in the United States, where sex work is mainly illegal.³⁵ On the contrary, there are various sex work regulations in Europe: legal regulation (the Netherlands, Germany), prohibition (Romania), criminalisation of clients (France, following the Nordic model)³⁶, and decriminalization (Belgium³⁷). To qualify as an act of adult sex trafficking in the United States, the US code only requires a commercial sexual act as the purpose. Yet, it still requires proof of “means of force, threats of force, fraud, [or] coercion”³⁸ (child trafficking does not require this element: to identify an underage trafficked victim, an AI system would only have to detect underage persons advertised for a commercial sexual act). Nevertheless, indicators of potential trafficking in advertisements for sex workers’ services hardly take this element into consideration; they rely only on indirect potential flags of exploitation³⁹ (it is obviously rare to find explicit proof of coercion in the ads). They have been identified on the basis of US prosecutions and by experts and databases, but the indicators remain the basis of the criteria used abroad, although criminal realities might differ.⁴⁰ It must be pointed out that American researchers developing these systems mostly rely on a conflation between trafficking and sex work, and they do not consider nor mention the existing discussions on whether sex trafficking should be, or not, conflated with sex work.⁴¹ Researchers and sex workers have come to criticise the criteria set by the systems as not being able to detect victims of trafficking but instead discriminating sex workers.⁴² Consequently, this conflation is embedded in the functioning of most of the US systems of AI designed to support the investigation of sex trafficking cases. Therefore, their use in Europe, in particular in countries where sex work policies are different, could have a significant impact on the autonomy of their criminal sovereignty.

III. Risks of Influencing European Digital Sovereignty

Apart from the potential threat to European criminal national sovereignty by not taking into account national definitions, law enforcement priorities, and the delimitation of human trafficking, the use of AI systems originating from the United States to prevent and combat human trafficking in Europe might also hinder digital sovereignty.

Firstly, the use of AI systems from the United States challenges data sovereignty, which is understood as “the ability to store and process certain types of data.”⁴³ Classical sovereignty prioritises the possibilities to exercise control and authority over data. Interpreted through the lens of human rights, sovereignty also includes the protection of citizens’ personal data. Data, in particular personal data, is a “genuine power issue between States.”⁴⁴ EU data sovereignty, in particular, lies in its innovative and unique approach to protect it. Processing personal data for the purpose of combating an offence is regulated by Directive 2016/680.⁴⁵ Despite setting out more lenient obligations than the General Data Protection Regulation,⁴⁶ the Directive still lists a number of principles to be implemented by design (Art. 4), which can be summarised as the following:

• Lawful and fair processing, delimited by specific purposes;

• Limitation of collection and conservation of data;

• Data accuracy, integrity, and confidentiality;

• Liability on the part of the data processor.

If AI systems have been developed in the United States for an originally American-only use, however, these AI systems do not fall within the scope of the European data protection framework. Therefore, it is doubtful whether the protection of personal data has been incorporated into the systems from the start of their development. Since the transparency principle is absent from the Directive, the necessary safeguards to control the use of these AI systems are particularly important to balance any interference with the right of privacy.

Another important point is the localisation of the processed data. Indeed, it would be particularly sensitive to store European data related to criminal investigations in the United States if the AI systems use a cloud version saved on US servers. The Directive provides for the possibilities of transferring data outside the EU (Arts. 35 to 40). Specifically, the Umbrella agreement was signed between the EU and the United States on this matter in 2016.⁴⁷ A few months earlier, the Privacy Shield⁴⁸ set a supposedly adequate level of data protection for data transfers for commercial and civil purposes. Yet, it was invalidated by the CJEU.⁴⁹ On the contrary, the lawfulness of the Umbrella agreement has not been questioned. As these AI systems process large quantities of data, including, sensitive data, the effectivity of safeguards when data is transferred abroad should be particularly reviewed.

Secondly, European digital sovereignty is not limited to data sovereignty but also covers the regulation of technical aspects, leading to a technical sovereignty. Indeed, Directive 2016/680 hardly considers the specificities of AI systems. For instance, it does not take into account the principle of transparency or the explanation of the algorithms that comprise the AI system,⁵⁰ even though this is at the core of ensuring that data used to train it does not lead to any discrimination.⁵¹ The Directive also does not take into consideration any protection against discriminating results.⁵² This is why the European Commission launched a proposal for an AI Act in 2021.⁵³ This act would apply whenever the AI systems are used by European users, including law enforcement authorities (Art. 2.2). As these systems are to be used for the prosecution of offences (Art. 7.1.a in relation to Annex III.6), they are classified as high-risk and must comply with the highest level of obligations. Yet, transparency obligations have been excluded for these systems (Art. 52).

While this act is still under negotiation, the CJEU provided guidance for the regulation of automated systems. In its Opinion of 2017 on the EU-Canada PNR Agreement, the Court recognised the possibility of carrying out an automated analysis based on predefined models and criteria and a comparison with various databases.⁵⁴ The Court introduced five elements to assess the lawfulness of the use of AI systems to prosecute offences:⁵⁵

• Establishing specific, reliable, and non-discriminatory models and criteria to ensure the targeting of individuals with a level of “reasonable suspicion”;

• Using automated means only for serious transnational crime;

• Ensuring databases are reliable and up-to-date;

• Introducing an individual re-examination by non-automated means to offset the margin of error;

• Concluding a review of the implementation.

Against this background, it should be stressed that the US systems are mainly used to assist in the investigation of domestic trafficking, which calls into question their applicability in Europe. The conclusion on data sovereignty applies to technical sovereignty: US systems did not integrate European standards (existing standards and those under development) when developing their algorithm. Furthermore, when the software code is developed by private entities, the lack of transparency and the protection of the code by intellectual property rights challenge the access to technical elements to ensure their conformity to European frameworks.

IV. Conclusion

As human trafficking schemes are being increasingly supported by online services, one challenge for law enforcement to combat human trafficking lies in the processing and organisation of available data online. It is next to impossible for individual investigators to develop an efficient means of manually processing data. Manual processing is indeed unsuitable for the volume of data and to keep up with the speed of deletion and updates. As a solution, the automatic processing of data and systems relying on AI have been developed to assist law enforcement authorities. These instruments are intended to support the exercise of sovereignty by states by protecting their populations and borders.

Yet, AI systems used to combat offences are not neutral: depending on the context of their development, they embed specific values and policies. As such, due to the digital interconnectedness of the world, if exported abroad, they might hinder the autonomy of other States by limiting their own exercise of sovereign powers.

A first challenge in this regard relates to European criminal national sovereignty In particular as regards human trafficking, systems are based on a specific national definition of an offence that might not be consistent with foreign definitions. Similarly, they are often developed in a particular national criminal context, making them harder to adapt to foreign criminal realities if a consistent reprogramming is not considered. Furthermore, because they were developed primarily in the United States, they underline a continued focus on combating sex trafficking while disregarding other forms of trafficking, such as labour exploitation. Lastly, the American AI systems have usually been programmed according to a prohibitionist policy that equates sex trafficking with sex work, which leads to these values and political decisions being integrated in the systems. All of these elements indicate that the autonomy of European national criminal justice sovereignty could be threatened if American systems are used or if national systems are developed on the basis of American systems without specific adaptation.

The use of US AI systems in Europe to combat human trafficking also challenges European digital sovereignty. The EU has developed regulations and standards to safeguard the protection of personal data and the specific risks linked to the use of AI systems. Yet, these norms are not applicable to systems originally developed for a US-only use. Although transparency requirements of AI systems are to be limited when used by law enforcement authorities, European norms under development still require conformity with human rights standards. This reinforces the potential threats to European autonomy when developing AI systems that are consistent with its own policies and values, both from a criminal law and a human rights perspective.