In 1863, Francis Lieber, the Prussian-American jurist commissioned by Abraham Lincoln to codify the laws of land warfare, wrote that no soldier may kill an enemy “who has laid down his arms.” War, however brutal, must remain an act performed by a morally responsible agent. That agent must be able to account for what he has done and to whom it has been done. The Lieber Code was imperfect. Its application was racially selective and its humanitarian ambitions frequently betrayed in practice. But its foundational premise survived two world wars, the drafting of the Geneva Conventions, and the development of every weapons system from the machine gun to the precision-guided munition. That premise is that lethal force requires a human being who can be identified and interrogated. That human being must also be someone who can be held to account.
That premise has now been broken both structurally and by design. This break is built directly into the architecture of AI targeting systems that are currently being used in active conflict zones. In these systems, the link between lethal force and a single identifiable human being who can be held accountable has been deliberately severed. For the first time in the history of codified warfare, the entity that determines who dies is one that cannot be summoned before a court. It cannot articulate its reasoning and cannot be said to have exercised judgment at all. What Lieber assumed to be the permanent condition of armed conflict — a moral agent at the end of the kill chain — has been quietly and deliberately engineered out of existence.
The U.S. Central Command (CENTCOM) claimed Operation Epic Fury had struck more than a thousand targets within a single 24-hour window. CENTCOM credited AI-assisted systems for the operational tempo. This supposed tempo followed a familiar script: precision, efficiency, technological superiority. What it actually demonstrated was something more consequential and far less examined. This new kind of warfare consolidates a dangerous shift in how decisions are made. The most critical choices, about who dies, why they die, and what evidence justifies their death, are now delegated to AI systems. These systems reason in ways that are structurally opaque, meaning the humans who are supposedly in charge cannot truly understand or explain those decisions.
The existing critique of AI-driven warfare has largely concentrated on accountability gaps and civilian harm ratios. These critiques are precise and necessary. But they remain devoid of a more foundational problem: algorithmic targeting systems do not merely create new risks of error. They produce a new epistemological condition. A battlefield in which the basis for any targeting decision is, by design and by architecture, unknowable to the commanders who authorize it, the lawyers who assess it, and the courts that might eventually adjudicate it. The algorithm becomes a generator of epistemic darkness that cannot be cross-examined.
The laws of armed conflict rest on a foundational assumption: that a human decision-maker, in attacking a target, can articulate the factual basis for their belief that it was a legitimate military objective. This is the epistemic spine of proportionality analysis and individual criminal responsibility. Remove the articulable basis, and what remains is a structure of legal norms with no enforcement mechanism. Modern AI targeting systems fracture this foundation in a specific way. Deep learning architectures do not produce decisions accompanied by legible chains of inference. They produce outputs — probability scores, threat classifications — derived from the weighted interaction of hundreds of millions of parameters across training datasets that are classified, proprietary, or both. A 2023 study in Nature Machine Intelligence found that even model developers, given full access to architecture and weights, cannot reliably reconstruct the specific feature combinations that drove any individual classification decision. The officer who approved a Lavender-flagged target in an average of twenty seconds was not verifying anything. They were ratifying a recommendation whose premises they could not inspect.
This is what renders the procurement-to-deployment ethics gap so consequential. The AI Ethics Principles of the U.S. Department of War, which were implemented in 2020 and contain a promise of traceability and human judgment, are nominally applicable to AI capabilities in development, deployment, and use. What they fail to state is what occurs when these requirements come into conflict with operational tempo. A thousand strikes per day is a phenomenon architecturally incompatible with any meaningful human consideration of individual targeting decisions. The ethical systems merely stop being functional at that pace. The Israeli case provides the best forensically documented case. Lavender was not a rogue program. It was officially approved, and officers were given the right to kill up to twenty civilians per junior Hamas operative the system flagged and the approval processes were cut down to a few seconds of rubber-stamping. The moral plumbing, which is always intended to be used by human decision-making at an individual level, failed at an algorithmic level. The only thing left was compliance in the procedure: humans in the loop who were, practically, laundering algorithmic decisions with a veneer of authorization.
There is a second underexamined dimension here: the diffusion of this paradigm to client states. The literature on AI warfare is disproportionately strategic in its emphasis on the competition between the U.S. and China. What it conceals is the way U.S. and NATO AI doctrine, and its underlying assumptions regarding acceptable civilian casualties, is exported to allied militaries under Foreign Military Sales agreements without the ethical supervision framework that purportedly limits it in the home country. A recent example is the civil war in Sudan. The UN Panel of Experts has reported AI assisted patterns of targeting that are consistent with signature strike logic, meaning attacks correlated with behavioural and locational patterns rather than confirmed individual identification. These patterns have been observed in attacks on civilians in Khartoum and Darfur.
All this is aggravated by the training data problem. Precision claims of AI targeting are based on an assumption that training data is a true reflection of the categories it claims to characterize. Practically, these systems are conditioned with previous experience of operation which codifies the mistakes and strategic assumptions of previous conflicts. A machine that has been trained on the results of post-9/11 signature strike campaigns in Pakistan and Yemen will recreate that reasoning in machine time. In those campaigns, the presence of adult men in some places was considered adequate justification to kill them.
In a review of U.S. drone policy in 2015, the Stimson Center concluded that “signature strikes” regularly confused civilian conduct with combatant conduct in certain cultural settings. That conflation has been encoded as signal by a targeting AI trained on those strikes. Professor Laurie Blank of Emory University Law has defined what she terms as temporal accountability collapse. This occurs because the classification errors are made during the model training stage, which may be years prior to the actual strike. As a result, the causal pathway between the initial human error and the eventual civilian death is obscured to any ex-post inquiry. The mistake has been washed down the model and the deployment cycle before anyone is killed.
The reaction of the international community has been the CCW Group of Governmental Experts on Lethal Autonomous Weapons Systems meeting since 2014. After twelve years, it has yielded no binding instrument, no agreed definition, and no compliance mechanism. Reaching Critical Will analysis records a steady trend. As the Global South insists on legally binding restrictions, Western delegations shift to voluntary principles, terminological discussions, and procedural delays. The CCW process has been useful to the interests of deploying states in the sense that it offers a platform that consumes the energy of civil society and no governance is realized. The AI targeting will be too ingrained in military doctrine to be limited by the time any binding instrument can be produced.
What meaningful accountability would actually require is specific and currently absent. It requires mandatory algorithmic disclosure obligations for post strike review. It also requires independent incident investigation with binding access rights modeled on ICAO’s aircraft accident investigation framework, as well as treaty level liability rules for AI caused civilian harm in non international armed conflicts. Finally, it requires export controls on AI targeting capabilities with genuine end use monitoring. If these systems are as precise as their proponents claim, deploying states should welcome rather than resist such monitoring. Their resistance is itself the most reliable evidence of the systems’ true costs.
The deepest problem with algorithmic warfare is not that it makes killing more efficient. It is that it makes war epistemically inaccessible. It makes war visible in its effects, opaque in its reasoning, devastating in its outcomes, and structurally unchallengeable in its process. The algorithm does not merely become the alibi. It becomes the architecture within which the concept of alibi itself becomes obsolete. There is only the body, and the statistic, and the silence where accountability used to be.
The writer is a Research Assistant at the Centre for Aerospace & Security Studies (CASS), Islamabad. The Article was first published by Quincy Institute for Responsible Statecraft. He can be reached at: [email protected].
