Artificial Intelligence and Criminal Responsibility: Reconstructing Mens Rea and Attribution for AI-Assisted Cybercrime in Pakistan

Abstract

Artificial intelligence is changing the scale, speed, personalization, and technical complexity of cybercrime without eliminating the need to attribute criminal responsibility to human actors. In Pakistan, the principal substantive framework remains the Prevention of Electronic Crimes Act 2016, as amended in 2025, supplemented by the Pakistan Penal Code, the Qanun-e-Shahadat Order 1984, the Electronic Transactions Ordinance 2002, and the National Forensics Agency Act 2024. These laws are largely technology-neutral, yet AI-assisted offending creates evidential and conceptual pressure on traditional categories of intention, knowledge, authorization, causation, participation, and digital attribution. A person may use a generative model to draft phishing messages, automate reconnaissance, generate malicious code, create deepfakes, or optimize fraud while delegating numerous operational choices to software. The central legal problem is therefore not whether an AI system itself possesses criminal mens rea, but how courts should infer the mental state and causal contribution of programmers, operators, deployers, account holders, collaborators, and beneficiaries when machine output intervenes between human instruction and prohibited result. This paper argues against premature recognition of AI as a criminal subject. Current systems lack the normative agency, legal status, and punishment-sensitive interests that make criminal blame meaningful. Pakistani law should instead adopt a human-centred attribution framework built around purposeful use, knowledge of capabilities, control over deployment, foreseeability of system behaviour, acceptance of risk, contribution to the offence, and corroborated digital evidence. The paper proposes a four-layer attribution model covering identity, control, mental state, and causal contribution, together with evidential safeguards for logs, prompts, model outputs, account records, device forensics, and chain of custody. Reform should clarify AI-assisted liability without creating strict criminal responsibility for developers or users merely because an unpredictable model produced harmful output.