Monday, May 29, 2023

How To Hack The Law

Do you ever idly puzzle through various ideas for a "perfect crime"? It's awkward to talk about -- you don't actually want to do them, you don't actually want to give anyone a bright idea, but they're still so interesting to think through.

The legal community is abuzz with the story of a lawyer who relied on ChatGPT to do his research and submitted a brief filled with entirely invented cases. ChatGPT just made them up out of air -- complete with names, citations and quotes -- and the lawyer dutifully added them to the brief. When opposing counsel tried to read the cases for themselves, they were baffled because they couldn't find any trace of them. The presiding judge went so far as to contact the clerk of the courts where the cases were allegedly filed, confirming their non-existence. Now the lawyer is facing sanctions; he is begging for mercy on the grounds that he had no idea ChatGPT would lie to him like that.

I know of very few lawyers who have sympathy for this lawyer. But imagine a slightly different case. Let's say that LexisNexis developed a glitch where it invented a case. If you typed in the (invented) citation to the case, it would pop up on Lexis the same as any other case -- name, judge panel, court, reasoning, everything. But the case isn't real; it was a complete invention. If a lawyer came across such a "hallucinated" decision on Lexis, I think we'd be very forgiving if she ended up being deceived and relied on the case in her briefs. Indeed, I actually wonder, in a situation, like this, how long it would take the legal community to figure out that the case wasn't real.

For example: the last case contained in volume 500 of the Federal Reporter (3d) is Jacobsen v. DOJ, 500 F.3d 1376 (Fed. Cir. 2007). That case ends on page 1381. Suppose an enterprising criminal hacks the Westlaw and Lexis database* and adds another case, call it Smith v. Jones, cited to 500 F.3d 1382. To further cover her tracks, the criminal "assigns" the case to a panel of judges who are no longer active on the court, to make it less likely one of them will see it and be like "I don't remember that decision." Smith v. Jones, of course, can be about and say whatever the criminal (or the unscrupulous lawyer who hired her) wants it to. Need a precedent that appears to decisively resolve a contested point of law in your favor? Voila -- the new case of Smith v. Jones is there to meet your needs. Indeed, the diligent criminal could add one or two new precedents per volume on a range of topics, providing bespoke "new" precedent to shift the legal terrain on an array of different issues.

If this happened, again I ask: how long would it take for the legal community to figure it out? If the initial hack was undetected, could one get away with doing this? Certainly, there would still be ways to confirm the cases are not real. If one back-checked the cases back to the clerk's office, one would discover they're vapor -- but realistically, that almost never happens. We take Lexis and Westlaw as proof enough; I'm not sure I can imagine a circumstance where I would try to confirm the veracity of a case I saw on Westlaw or Lexis by contacting the clerk's office. There probably would be some other hints that the cases were suspect -- the lack of citations from other cases would be a significant hint that something is shady -- but I can imagine a crime like this slipping by us for some time. And the longer it goes unnoticed, the more these cases have the opportunity to subtly adjust the overall trajectory of law in a new direction.

It's a scary thought, no? We're very reliant on the robustness and reliability of online databases. If they start to falter, we run into seriously trouble very quickly.

* Note: I assume -- and desperately hope -- that this is difficult-to-impossible to do.

No comments: