Criminal law imputation path for biometric information

The criminal principle of classifying and identifying biometric information through the MUNN model has been pointed out previously. What needs to be discussed next is what criminal law needs to use the MUNN model to identify biometric information. Such subjects should be held accountable, and what kind of entry point should be used to impute relevant subjects should be found.

In the discussion on infringing the criminal subject status of citizens’ biometric information, many views theoretically believe that the criminal subject qualification of units in criminal law of China is the result of the fiction of the criminal law. There are obstacles. However, the unit is essentially a collection of natural persons’ rights and obligations, and the discussion of the unit’s criminal responsibility is also carried out through the will and behaviour of specific natural persons in the unit [21]. Similarly, imposing a penalty on a unit actually deprives the specific natural person in the unit of the rights, thus having the effect of punishment to prevent crimes. Therefore, the fiction of the unit subject in the criminal law cannot be used to support the independent criminal subject status of citizens’ biometric information. Based on the tool attributes of the current biometric information, the damage caused by the infringement of citizens’ biometric information is in the final analysis the damage caused by the behaviour of the relevant subject. In order to realise the prevention of crimes through punishment, the technical tool of biometric information needs to be used to find the attributable subject behind it.

In the process of the use and development of modern technology, there is often a long causal chain, especially in biometric information technology. The complex software systems used by biometric information often have many developers involved in the development of various parts of the software at different stages. Even in the case of biometric information based on a self-learning algorithm, there is a process of data production, selection and processing. The process also requires the participation of multiple subjects and multiple stages [22]. Whether it is the person who provides the data, the person who collects and processes the data, the person who sells the data, the person who analyses the data, etc., it is possible to affect the process of self-learning of biometric information. At the same time, each participating subject only has knowledge of the specific stage in which the subject participates and cannot predict or control the influence of other subjects on the operation of biometric information in the previous stage or the next stage. The causal chain can also continue to extend to the application stage of the algorithm, and when the algorithm is dominated by the user, it can also produce corresponding damage results. In this causal chain, the damage caused by the violation of citizens’ biometric information may be caused by the superposition of causal relationships in multiple stages, or it may be caused by a certain stage independently, so theoretically, the violation of citizens’ biometric information will be. The characteristics of identification information responsibility judgement are summarised as a kind of ‘the problem of many hands’. How to accurately locate the causal behaviour in the causal chain is of critical significance to the determination of the responsibility of the relevant subjects of biometric information. Article 2 of the ‘Code of Ethics’ stipulates that the applicable subjects of the code include ‘natural persons, legal persons and other relevant institutions engaged in biometric information management, research and development, supply, use and other related activities’, and in Article 2, paragraph 1 to the definition of the relevant subject is clarified in paragraph 4 [23]. This regulation defines a specific scope for the relevant subjects of biometric information and conforms to the characteristics of ‘multi-subject responsibility’ of biometric information. It regulates the behaviour of subjects in ‘management, research and development, supply and use’, which can cover biometric information. Every link from design and development to final use: As far as criminal law is concerned, it is necessary to pay attention to the definition of the scope of relevant subjects of biometric information in the Code of Ethics because in the past, the discussion of biometric information product liability in criminal law theory circles often only focussed on the relationship between producers and users. Division of responsibilities: This division of responsibilities is in line with the requirements of the ‘Development Plan’ in 2017 to ‘implement a two-tier regulatory structure with equal emphasis on design accountability and application supervision’ for biometric information, thereby focussing on both design and application and effectively handling most cases of damage to biometric information products. However, the definition of the scope of relevant subjects in the ‘Code of Ethics’ brings inspiration to criminal law theory: sometimes the cause of biometric information damage does not originate from the producer or user, as well as problems in biometric information management or research and development. It is entirely possible to lead to the occurrence of damage results and then to the issue of criminal liability. If it is required to establish a corresponding artificial intelligence supervision mechanism, the staff of state organs who are legally obliged to supervise activities related to biometric information may constitute a crime of dereliction of duty or abuse of power due to dereliction of duty. This is the principle of negligence in supervision. Conclusion [24]: Another example is that the production activities of biometric information products belong to the supply chain of biometric information according to the definition in Article 2 of the ‘Code of Ethics’, and in the development process of biometric information technology, the producers and developers of biometric information may not the same subject. For example, in the case of superimposed use of disclosed algorithm technology in the production process, the producer cannot control the process of upstream algorithm development, and deviations in the upstream algorithm development process are often the root cause of defects in biometric information. The main body of biometric information ‘management, research and development, supply and use’ can control or intervene in biometric information at different stages, so they need to bear corresponding obligations. This is the conclusion that the principle of business negligence can produce.

Safety in a risk society is one of the basic value orientations that criminal law needs to adhere to, and under certain circumstances, the safety value of criminal law takes priority over other values, that is, sometimes only on the premise of realising safety value, criminal law can pursue other values. Therefore, if we only discuss from the perspective of producers and users, we will ignore the biometric information managers and developers who are also in the causal chain of ‘multi-subject responsibility’, and it is difficult to meet the needs of contemporary criminal law to defend against technological risks. Of course, the damage caused by the biometric information may also exist in which the relevant subjects cannot be held liable. For example, when the R&D, supply, management and use links all meet the requirements of the specification, the algorithm applied to the biometric information may also cause algorithm discrimination and algorithm bias. The reason may be that the algorithm has autonomously learned the discriminatory and prejudicial knowledge that is common on the Internet. This phenomenon is the reflection of the algorithm on the objective existence of the society. It can be said that the entire social group is responsible for this. For such phenomena, the criminal law needs to maintain due humility. Even in order to prevent risks, it cannot be held accountable only based on the results. Otherwise, it is easy to expand the scope of the attack, and the criminal responsibility will be transformed into a pure result responsibility, thus forcing the biometric information. Practitioners are trembling and timid, inappropriately inhibiting the progress of algorithms and the normal development of biometric information business.

After determining the scope of the subjects to be held accountable, we can further examine the specific path to confirm the criminal responsibility of the relevant subjects.

Inferring the uncertainty of various types of y_j under a given X, we can further get 1 πj=∏i=1N(1−P(yi|xi))=P(yj)N∏i=1N(1−P(yj|xi)P(yj))

Taking the logarithm of both sides, we get 2 log⁡πj=Nlog⁡P(yj)+∑i=1Nlog⁡(1−P(yj|xi)P(yj))

Its form is similar to the general signal transmission equation of the neural network: sj=βj+∑iϖjioi . Let A be the observed value of X, and x_ii be the observed value of attribute x_i, then the previous equation can be changed as follows: 3 πj=P(yj)N∏xii∈A(1−P(yj|xii)P(yj))

Taking the logarithm of both sides, we get 4 log⁡πj=Nlog⁡P(yi)+∑xii′∈Alog⁡(1−P(yj|xii′)P(yj))=Nlog⁡P(yj)+∑i=1Nlog⁡(1−P(yj|xii′)P(yj))Oii′

When x_ii′ ∈ A, O_ii′ = 1; otherwise, O_ii′ = 0. Comparing with the previous equation, we can get 5 sj=log⁡πj

The equation for obtaining the threshold can be expressed as follows: 6 βj=Nlog⁡P(yj)

The equation for obtaining the weights can be expressed as follows: 7 ωji=log⁡(1−P(yj|xii′)P(yj))

The uncertainty equation can be expressed as follows: 8 πj=oj=f(sj)=exp⁡sj

Or normalising π_j, we get 9 πj=oj=f(sj)=exp⁡sj=exp⁡sj∑iexp⁡si

Based on the previous equation, the neural network structure can be determined, as shown in Figure 1.

Fig. 1

The secondary model is defined as the MUNN model. After obtaining the weight ω_ji and the threshold β_j through the training method, the minimum uncertainty judgement can be used for classification and identification. At this point, the classification and identification of citizens’ biometric information have been completed.

The speech rate usually refers to the pronunciation speed, which is a measure of the speaker’s pronunciation speed. It can be reflected by calculating the number N of syllables spoken in a unit time T, and it can be roughly measured by the total speech duration including pauses. Since different speakers have certain differences in speech speed, the pronunciation of the same sentence also has certain differences in the sentence duration of different people. In addition, the emotional state of the speaker also affects the speech rate. For example, in angry and happy states, the speech rate is generally slightly faster than in the calm state, while in sadness, the speech rate is generally slower.

With an N-dimensional input vector X = {x₁, x₂, ... , x_N}, each attribute x₁, x₂, ... , x_N is independent of each other; let P(k) be the probability of the occurrence of event k, then π = 1 – P(y|X) be the uncertainty of y under given X.

So, the equation can be expressed as follows: 10 π=∏i=1N(1−P(y|xi))

Assuming events A_i = {y occurs when x_i occurs}, i ∈ [1, 2, … , N], obviously N events A₁, A₂, … , A_N are independent in pairs:

Set event A = {y occurs when X occurs}, then there is P(A) = P(A₁ ∪ A₂ ∪ … ∪ A_N) from P(A)=1−P(A)¯=1−P(A1∪A2∪…∪AN)¯=1−P(A1⋅A2⋅⋯⋅AN¯) ; according to A₁, A₂, … , A_N, we can get 11 P(A)=1−P(A1)¯P(A2)¯…P(AN)¯=1−(1−P(A1))(1−P(A2))…(1−P(AN))=1−∏i=1N(1−P(Ai))

If P(A_i) and P(A) are written in the form of conditional probability, then P(A_i) = P(y|x_i) and P(A) = P(y|x), substituting them into the previous equation to get P(y|X)=1−∏i=1N(1−P(y|xi)) , so there is 1−P(y|X)=∏i=1N(1−P(y|xi)) .

π = 1 − P(y|X) is the uncertainty of y given X, we can get π=∏i=1N(1−P(y|xi)) proof.

When the classification set Y = (y₁, y₂, … ,y_m) and j ∈ [1, 2, … ,M], the uncertainty of each type of y_j under the given X is as follows: 12 πj=1−P(yj|X)=∏i=1N(1−P(yj|xi))

Therefore, when classifying, select π_j with the smallest uncertainty as the final decision, which is defined as the minimum uncertainty decision.

In order to verify the validity of the MUNN model for the classification and identification problem, we conduct a classification and identification test on the two-dimensional signals of the citizen biometric information of 10 people (100 samples for each person, a total of 1000 training samples). Before the signal is input, the two-dimensional signal needs to be preprocessed. According to the characteristics of each dimension of the signal, the continuous value of the signal is divided into 11 and 13 discrete regions at equal distances to meet the MUNN discrete value input requirements. For each iteration, it takes about 20 s, with 1G P3 processor PC, 128M memory, Win2000 system, VC++6.0 language.

The Bayesian probability model, the PSO training model and the MUNN model proposed in this article are used to train these 1000 samples, and the results of the three models in terms of the number of misjudgements, recognition rate and iteration times are analysed. The comparison results are shown in Table 1.

Table 1 shows that in terms of the number of misjudgements, the MUNN model proposed in this study has the least number of misjudgements, and only 65 samples are misjudged; in terms of recognition rate, the model proposed in this article has the highest recognition rate, reaching 93.5%. In terms of the number of iterations, the number of iterations in this study is the most, so the classification and recognition process are the most stable, and the accuracy is also high. In order to compare the training results more vividly, it is shown in the form of a graph. The specific recognition rate training change curve is shown in Figure 2.

Fig. 2

In Figure 2, since the number of iterations of the Bayesian probability model is 1, the curve of the model cannot be reflected. The figure can only reflect the PSO model and the MUNN model proposed in this study. The training change curve of the recognition rate: The identification training curve of the PSO model shows that the initial number of misjudgements is 870, but as the number of iterations continues to increase, the number of misjudgements is also decreases. At the 200th iteration, the number of misjudgements became stable and remained at 429; the training curve of the MUNN model proposed in this article shows that the initial number of misjudgements is 290, but as the number of iterations continued to increase, the number of misjudgements increased. It is also decreasing continuously. At the 200th iteration, the number of misjudgements began to stabilise and remained at 65.

Since September 2020, the defendant Guo Yong violated the robots agreement and other means by adopting high-similarity browser camouflage technology on the Internet, and illegally obtained 108 pieces of motor vehicle information, 79 pieces of company registration information, 101 pieces of passport information, 57 pieces of hotel check-in information, 85 pieces of demographic information, 94 pieces of bank personal credit report information, 86 pieces of personal bank information and 106 pieces of mobile phone information. As of the time of the incident, the defendant Guo Yong used the aforementioned illegally obtained information to defraud the victim, and some pieces of the information were sold at a higher price, and now he has made a profit of more than 100,000 yuan.

Using the criminal law imputation path of biometric information in this study, this case is analysed, and the analysis results are compared with the actual criminal law imputation results of the court, as shown in Table 2.

It can be seen from Table 2 that the adopted criminal law imputation path is used to analyse the case, and the analysis results are compared with the actual criminal law imputation results of the court. The subject is the criminal suspect Guo Yong himself, so the consistency in the subject of attribution is 100%; in terms of the main charges, Guo Yong was convicted of illegally obtaining citizens’ personal information and fraud in the first instance, but in the second instance, the prosecutor claimed the crime in this case. For the crime of fraud, the final suspect was convicted of fraud. According to the path of attribution of criminal law in this article, it is believed that the suspect in this case should be punished for the crime of illegally obtaining citizens’ personal information and the crime of fraud, so the consistency of the main crimes is 50%. The main reason for this situation is the insufficient response of the criminal law to biometric information. Violation of citizens’ biometric information includes two types of criminal tools and criminal objects. How should different types of behaviour be convicted and punished? The criminal law does not clearly stipulate the punishment for multiple crimes; there is also a gap in terms of the sentence. The criminal law in this article believes that according to the case of the crime of illegally obtaining citizens’ personal information and the crime of fraud, the sentence should be 8 years. However, the actual court only punished the crime according to the crime of fraud, so the final sentence was 6 years, so the consistency of the sentence was 75%.