Democratic Accountability for Autonomous Systems: A Legislative Notification Framework and Comparative Institutional Design

Abstract

No domestic legislature has ever reviewed a state's decision to authorise an autonomous cyber weapon before it acted. Closing the international attribution gap is necessary but not sufficient for democratic accountability. We formalise the Tripartite Attribution Framework's three attribution levels and add a fourth, non-legal Democratic Accountability level ($A_{dem}$): a 72-hour legislative notification requirement. Scoring six democratic oversight bodies against five adoptability dimensions yields a counter-intuitive result: the statutes granting these bodies privileged access to classified material are often the same statutes withholding particular ongoing operations from them, so at most one could lawfully receive such a notification today, and the carve-out Level 4 needs is required in nearly every jurisdiction rather than only the least-equipped. Retrospective analysis of Stuxnet, NotPetya, and Volt Typhoon shows one pattern: legal attribution resolvable, domestic democratic review absent.

arXiv comment15 pages, 3 figures. Presented at the 2026 IDeaS Conference (Carnegie Mellon University)