Negligence is absolutely a part of US criminal law, though - the canonical example being "firing a shotgun into a tent even if you don't know someone is inside it". See "negligent homicide" etc.

Negligence and “negligent homicide” are entirely different beasts.

Civil negligence would apply here but that would be limited to recovering damages.

The hacked website could sue to recover costs incurred, but what costs were incurred here? Maybe some wasted network bandwidth but that’s minimal.

You have to point to monetary losses caused by the hack. Only that would be covered.

Negligent homicide doesn’t apply because no one was killed.

Yes, obviously (and thankfully) no one was injured. I'm just using that as an example to show that Negligence is definitely considered in US criminal law ( https://en.wikipedia.org/wiki/Criminal_negligence )

Ok but what aspect of the CFAA applies a negligence standard?

Better question: why should CFAA be the entirety of law to be considered?

Do you have another charge that you think is applicable?

The FTC can fine for deceptive practices. There are a slew of vicarious criminal recklessness and liability approaches that charge an operator. Damage to infrastructure falls under public welfare and strict liability. There are state-level AI statutes (like Wyoming law that doesn't really allow "autonomous" defense) For civil damages, the CLAIM Act can be used to sue devs for negligince.

The law is much more broad than CFAA!

You listed a couple civil claims, but the rest is pretty vague.

Outside of the CFAA, what criminal charge do you feel is applicable here?

I also listed several criminal options!

You listed some broad areas of criminal law. If you’re saying that some statute inside those areas would apply here, can you say what it is so that we can actually look at the elements?

It is. But different statutes set their own intent standards, and the intent standards for CFAA are high.

Eh. There is enough flexibility in the law for unintended damages to be prosecutable.

Not under CFAA.

Yes, the legal code is actually larger than CFAA.

The entire reason we have CFAA is that prior to CFAA these kinds of offenses --- computer intrusion not directly connected to remunerative fraud against the victim of the offense --- were impossible to charge.

That's not why the CFAA came about. It was just hard, not impossible.

But, let's go down the rabbit hole, eh? There are several legal theories under which an AI agent's operator can be charged:

- Direct perpetration, with the AI as the instrument. 18 USC section 2 (principals), and possibly wire fraud (18 USC Setion 1343). Under this, the law treats the defendent with using the AI as a tool (which the big AI firms argue anyway) which punishes the operator

- Criminal recklessness or even negligence - 18 USC Secion 1112 (Involuntary Manslaughter) - if someone died, the agent operator could be pursued this way

- Strict liability - 15 USC Section 1, states strict liability statutes. Certain regulatory offenses don't require intent. These specific statutes could apply to algorithmic price fixing or self-driving cars being reckless. The operator using the agents are liable for the interaction

- Probably the strongest is willful blindness (ostrich doctrine). Great common law precedence. This would be used to satisfy any intent/knowledge requirements like CFAA. You as an operator can't dismiss liability by just ignoring an AI is committing a crime.

- Vicarious liability - good commmon law precedence for corporate criminal liability. Agents acting in scope for an operator means the operator has liability - doesn't matter if that agent is human or AI-driven.

Wire fraud requires specific intent to defraud. You can't charge it for recklessness or negligence.

Nobody died in this case. If someone actually does die because of something like the HuggingFace incident, we'll be having a different conversation.

"Strict liability" is indeed a thing! The classic example (in state criminal law) is statutory rape. But you haven't identified an applicable strict liability offense.

"Willfull blindness" isn't an offense, it's part of an intent standard. The whole issue here is that computer crime laws have rigorous intent standards.

Vicarious liability requires an actor that had provable intent. The liabilities a corporation will have under CFAA and wire fraud statutes will be civil, not criminal. There's no question that frontier labs can be civilly liable for this stuff.

See how hard this is to charge, now?