Fabien Tarissan

Raphaëlle Nollez-Goldbach

Analysing the first case of the International Criminal Court from a network-science perspective

This paper analyses the multi-level network composed of the legal decisions taken by the International Criminal Court since its creation in 2002. As many real-world networks, legal networks lend themselves to the use of graphs in which nodes represent the decisions taken by the Court and links stand for citations between decisions. Although useful, this framework does not account for the inherent complexity and hierarchy commonly observed in real data. In the context of legal networks in particular, interactions between decisions take place at various levels, inducing a two-level structure. We propose here to rely on a hybrid version of bipartite graphs, which allows to represent different types of links in multi-level networks. We assess the relevance of this approach by analysing the hybrid structure of the first case of the Court and by confronting it with standard approaches focusing on direct citation processes. We validate the outcomes by providing juridical interpretations of the results, which shed some light on the procedural aspects of the International Criminal Court and put an emphasis on the key themes addressed by this jurisdiction. Thus, for the first time, this work converges two very different approaches to account for the multi-level complexity in legal networks.

Introduction

Many real-world networks -also referred to as complex networks -lend themselves to the use of graphs for analysing and modelling their structure. Usually, vertices of the graph stand for the nodes of the network and the edges between vertices stand for (possible) interactions between nodes of the network. This approach has proven to be useful to identify non trivial properties of the structure of networks in very different contexts, such as infrastructures of communications [START_REF] Watts | Collective dynamics of small-world networks[END_REF][START_REF] Le Fessant | Clustering in peer-to-peer file sharing workloads[END_REF], social networks [START_REF] Watts | Collective dynamics of small-world networks[END_REF][START_REF] Newman | Random graph models of social networks[END_REF][START_REF] Battiston | Statistical properties of corporate board and director networks[END_REF], biological networks [START_REF] Watts | Collective dynamics of small-world networks[END_REF][START_REF] Vázquez | The topological relationship between the large-scale attributes and local interaction patterns of complex networks[END_REF], collaborative platforms [START_REF] Althoff | Analysis and Forecasting of Trending Topics in Online Media Streams[END_REF][START_REF] Yang | Defining and evaluating network communities based on ground-truth[END_REF], co-occurrences of words [START_REF] Ferrer | The small world of human language[END_REF][START_REF] Vincent A Traag | Structure of an elite cooccurrence network[END_REF], food pairing [START_REF] Richard | Two degrees of separation in complex food webs[END_REF][START_REF] Ahn | Flavor network and the principles of food pairing[END_REF], etc.

Although useful, such a simple representation is not particularly close to the real structure of most of real networks. If one considers for instance actor networks [START_REF] Watts | Collective dynamics of small-world networks[END_REF][START_REF] Newman | Random graphs with arbitrary degree distributions and their applications[END_REF], which link actors performing in the same movies, or authoring networks [START_REF] Newman | Random graphs with arbitrary degree distributions and their applications[END_REF][START_REF] Newman | Random graph models of social networks[END_REF], which link authors publishing together, one would rather relate actors to the movies they performed in and authors to their papers. This observation led the community to use instead bipartite graphs, where nodes can be divided into two disjoint sets, (e.g. movies) and ⊥ (e.g. actors), such that every link connects a node in to a node in ⊥. Bipartite graphs are fundamental objects, which have proven to be very pertinent for both the analysis [START_REF] Latapy | Basic notions for the analysis of large two-mode networks[END_REF][START_REF] Tumminello | Statistically validated networks in bipartite complex systems[END_REF][START_REF] Ahn | Flavor network and the principles of food pairing[END_REF] and modelling [START_REF] Guillaume | Bipartite graphs as models of complex networks[END_REF][START_REF] Tarissan | Towards a bipartite graph modeling of the internet topology[END_REF] of complex networks as they are able to reveal patterns that could not have been detected in simple graphs.

Yet, many networks also exhibit direct interactions between nodes, which are not taken into account by bipartite graphs since links between two ⊥ nodes are not allowed in this framework. In the example of the actor/movie networks, actors are obviously related to each other when performing in the same movies, but they might also develop social and direct relations. Although one could formally represent such a relation by the addition of an artificial node that connects the two ⊥ nodes, this transformation unfortunately hides important properties of the network. This calls for the use of a specific framework able to support the two types of relations.

In the present study, we follow this approach and rely on a hybrid bipartite graph, which is composed of a traditional bipartite structure enriched with direct links between ⊥ nodes. We address the relevance of this approach for manipulating complex networks and investigate in particular how the analysis of networks can benefit from this representation as well as how it impacts the modelling perspectives.

The International Criminal Court. To assess the interest of this hybrid approach, we compare the relevance of different frameworks for analysing the legal network composed of the decisions ruled by the International Criminal Court (ICC). Indeed, as many real-world networks, legal networks may be analysed and modelled by graphs, where nodes represent the entities that compose the networks (here the juridical decisions taken by the ICC) and links stand for relations between the entities (citations between decisions for instance). However, as stated above, this framework does not account for the inherent complexity and hierarchy of the network. In the context of legal networks in particular, interactions between decisions take place at various levels. To motivate their decisions, judges naturally rely on former decisionsfirst level exhibiting direct interactions -but also refer to articles of the Statute of the Courtsecond level pointing out indirect relations. This induces a two-level structure in which direct and indirect relations interplay in the ruling process. This precisely is the object which is under investigation in the present paper.

Contributions. In this paper, we analyse for the first time the legal network composed of the juridical decisions ruled by the International Criminal Court since its creation in 2002. To do so, we rely on a hybrid bipartite framework that enables us to represent both direct and indirect relations among entities of a network.

At the same time, this work provides evidence of the relevance of the hybrid bipartite approach to handle such complex networks, and sheds light on the key issues related to the proceedings of the International Criminal Court and on the interpretation of international criminal laws by the judges. In particular, we investigate which dynamics of the citation process can be highlighted and how the status of victims evolves through the decisions taken by the judges.

Note that this work builds on a previous study presented in [START_REF] Tarissan | The network of the International Criminal Court decisions as a complex system[END_REF] that provided preliminary results on the structure of the graph of citations and the pure bipartite structure of the ICC decisions network. The present work extends the analyses of those two structures, analyses the projections of the bipartite graph, proposes and assesses the relevance of the hybrid bipartite framework and provides juridical validations of the obtained results. Related work. Many papers have proposed to combine law and computer science. To that regard, one of the main contributions of computer science has been to apply artificial intelligence techniques to legal networks, whether it be for highlighting legal reasoning [START_REF] Kowalski | The Use of Logical Models in Legal Problem Solving*[END_REF][START_REF] Arno | DiaLaw: A Dialogical Framework for Modeling Legal Reasoning[END_REF][START_REF] Zeleznikow | Building Intelligent Legal Information Systems: Representation and Reasoning in Law[END_REF][START_REF] Zeleznikow | Building decision support systems in discretionary legal domains[END_REF], resolving conflict [START_REF] Bellucci | Integrating artificial intelligence, argumentation and game theory to develop an online dispute resolution environment[END_REF], or extracting information from legal databases [START_REF] Stranieri | Knowledge Discovery from Legal Databases[END_REF].

Recently, another line of research has emerged, which considers legal decisions as complex networks [START_REF] Thomas | The Web of Law[END_REF]. This originated from studying the decisions taken by the American Supreme Court [START_REF] Chandler | The Network Structure of Supreme Court Jurisprudence[END_REF][START_REF] James | The authority of Supreme Court precedent[END_REF][START_REF] Whalen | Modeling Annual Supreme Court Influence: The Role of Citation Practices and Judicial Tenure in Determining Precedent Network Growth[END_REF][START_REF] Clough | Transitive reduction of citation networks[END_REF]. In such Common Law systems, the necessity for judges to ground their decisions on precedent ones -formally referred to by the stare decicis rule [START_REF] Guillaume | The use of precedents by International Judges and Arbitrators[END_REF] -has led scholars to focus exclusively on citation networks, putting aside the relation between legal decisions and articles of law. This network approach has since then been proposed in various contexts and jurisdictions [START_REF] Neale | Citation Analysis of Canadian Case Law[END_REF][START_REF] Agnoloni | The Case Law of the Italian Constitutional Court between Network Theory and Philosophy of Information[END_REF][START_REF] Winkels | Determining Authority of Dutch Case Law[END_REF][START_REF] Bourcier | Codification, law article and graphs[END_REF][START_REF] Boulet | A network approach to the french system of legal codes -part i: analysis of a dense network[END_REF], but always focusing on citations. To that regard, it is worth citing the recent study analysing the relations between treaties, articles and legal decisions of the European Union [START_REF] Koniaris | Network Analysis in the Legal Domain: A complex model for European Union legal sources[END_REF] as it is an attempt to investigate the intricate and complex structure of a legal network depicting relations at different levels. However, its main contribution is to provide evidence for the "small-worl" aspect of the network and to show that the degree distribution follows a power-law.

The present paper analyses for the first time the legal network of the ICC decisions and relies on various metrics specifically defined for two-level structures. In addition, it provides explanations enabling to relate the values of the proposed metrics to the juridical interpretation of the decision's content. To this sense, and to the best of our knowledge, this stands out from previous studies on the subject.

In regards to the framework used in this study, the proposed hybrid bipartite structure can be related to other general frameworks proposed by social network scientists for multilevel networks, which have been applied on various contexts and have led to the proposition of dedicated models [START_REF] Wasserman | Statistical modelling of one-mode and twomode networks: Simultaneous analysis of graphs and bipartite graphs[END_REF][START_REF] Lazega | Catching up with big fish in the big pond? Multi-level network analysis through linked design[END_REF][START_REF] Bellotti | Getting funded. Multi-level network of physicists in Italy[END_REF][START_REF] Tom | A model for the multiplex dynamics of two-mode and one-mode networks, with an application to employment preference, friendship, and advice[END_REF][START_REF] Wang | Exponential random graph model specifications for bipartite networks -A dependence hierarchy[END_REF]. Taking inspiration from these approaches, we rely in this paper on a particular instance of multi-level networks as we identify only two distinct levels (sets of nodes) and allow direct links only in one of the levels. The motivation, detailed in Section 2, is driven by the structure of the information contained in the present case study.

Outline of the paper. The remainder of this paper is organised as follows. Section 2 discusses the background required throughout this paper. Section 3 presents the results of the classical approach by focusing on the graph of citations, while Section 4 presents the analysis performed on the hybrid bipartite structure and highlights its relevance. Finally, Section 5 compares the results to the ones obtained on a random network and Section 6 concludes the paper and lays some foundations for future works.

A framework for the ICC decisions network

We start by presenting the context of the study and the content of the dataset (Section 2.1) before defining the formal frameworks used in the paper to represent and analyse the data (Section 2.2).

Legal Networks

The contemporary evolution of international law points out the emergence of international criminal justice, whose role is to repress and redress international crimes (genocide, crimes against humanity and war crimes). Born with the Nuremberg trial after World War II, created to judge the Nazi crimes, the international criminal justice only grew recently. The first international tribunals have been created by the Security Council of the United Nations after genocide and crimes against humanity were perpetrated in ex-Yugoslavia and Rwanda during the 1990's (the International Criminal Tribunal for the former Yugoslavia in 1993 and the International Criminal Tribunal for Rwanda in 1994).

It is mostly the appearance of the International Criminal Court, that started to function in 2002, that was the landmark of the field. The ICC is indeed the first permanent international criminal court, established to help end impunity for the perpetrators of the most serious crimes of concern to the international community. 22 cases regarding 9 situations in different countries have been brought before the ICC, referred by the states themselves, the United Nations security council or the ICC prosecutor. The Court and its competences are governed by an international treaty, the Rome Statute.

The ICC's first trial started on January 2009, regarding the situation in the Democratic Republic of the Congo. Thomas Lubanga Dyilo, a former political leader and warlord, was convicted on March 14 th 2012 of committing war crimes (enlisting and conscripting of children under the age of 15 years and using them to participate actively in hostilities in the context of an armed conflict). He was sentenced to 14 years of imprisonment. Both decisions were recently confirmed on appeal, on December 1 st 2014. In this paper, we only focus on the Lubanga case to concentrate on the first closed case. It is indeed the first trial in which the trial chamber of the ICC reached a verdict on the culpability of the accused1 .

To rule on the Lubanga case, the ICC judges issued 2276 documents. Those decisions, main production of the ICC, are legal statements ruling on juridical issues and stand for the solutions adopted by the Court deciding on juridical issues in a case. In order to motivate their decisions, the judges may either rely on former decisions of the Court or on articles of the ICC In this example, one can notice the two types of arguments used by the judges. The text clearly refers to former decisions (highlighted in red), but also refers to article of the ICC Statute (in blue).

Frameworks

In this section, we provide an overview of the formalisms suited to represent such a complex network. We first recall standard definitions for directed graphs (Section 2.2.1) and bipartite graphs (Section 2.2.2) before defining a hybrid version of bipartite graphs (Section 2.2.3) to overcome their limitations.

Directed graphs

As outlined in the introduction, it is quite usual to represent a network as a directed graph G = (V, E), with n = |V | and m = |E|, where a node represents a decision, identified by its ICC number, and a link between two nodes u and v exists if decision u cites decision v. Note that technically, the graph is a Directed Acyclic Graph (DAG) since, for obvious reasons, the decisions can only refer to existing ones. Thus, there is no cycle in the network 2 .

This defines the graph of citations among decisions, which will be referred to simply as the graph of citations. This allows to compute standard metrics and compare the results to what is obtained on usual complex networks. According to standard studies, one can usually observe, for instance, that graphs are sparse, i.e. the density δ = 2.m n.(n-1) is very small, and their degree distribution is heterogeneous (often close to a power-law).

Another key property concerns the local density, which is meant to study how dense a neighbourhood of a node is in the graph. This concept is generally captured by the clustering coefficient cc(G) or the transitivity ratio tr(G) [START_REF] Watts | Collective dynamics of small-world networks[END_REF][START_REF] Schank | Finding, counting and listing all triangles in large graphs, an experimental study[END_REF][START_REF] Schank | Approximating clustering coefficient and transitivity[END_REF], defined formally by:

cc(G) = v ∆(v) ∨(v) n tr(G) = ∆(G) ∨(G) ,
where for each v ∈ V , ∆(v) denotes the number of directed triangles (sets of three nodes u, v, w, such that (u, v), (u, w),

(v, w) ∈ E) that originate at v; ∨(v) = d(v).(d(v)-1)
2 denotes the number of pairs of neighbours of v, which computes the number of possible directed triangle;

∆(G) = v ∆(v); and ∨(G) = v ∨(v).
Note that the clustering coefficient of a node can be defined for the in-degree and the out-degree, that is when the node is at the origin of the directed triangles (case of u in the example above) and when it is at the end (case of w). Both variants make sense. They will be investigated in Section 3.3 and will be referred to as the inand out-clustering coefficients.

A classical observation in complex network studies is that all these quantities are high, at least compared to the density δ of the graph. Note however, that the meaning of the existence of such a pattern depends on the context of the network. It has been shown that it could be related to robustness properties of the network, or properties related to dynamical aspects of the networks [START_REF] Mangan | Structure and function of the feed-forward loop network motif[END_REF][START_REF] Krackhardt | Heider vs simmel: Emergent features in dynamic structures[END_REF].

Bipartite graphs

As stated in the introduction, the previous formalism does not account for higher level of relations between the decisions. In particular, one does not exploit the references made to the Compared to standard graphs, nodes in a bipartite graph are in two disjoint sets and the links are always between a node in one set and a node in the other set. An example of a bipartite graph is given in Fig. 1(a), where nodes are depicted by squares and ⊥ nodes by circles.

The ⊥-projection of G b is the graph G ⊥ = (⊥, E ⊥ ), where two nodes (of ⊥) are linked together if they have at least one neighbour in common (in ) in

G v : E ⊥ = {(u, v), ∃x ∈ : (u, x) ∈ E b and (v, x) ∈ E b }.
The -projection is defined dually. Both projections are illustrated in Fig. 1(b) and 1(c). Thus, in our case, the ⊥-projection corresponds to a graph of decisions, such as G, but a link between two decisions exists if and only if there is at least one common article to which they both refer.

Note that by projecting a bipartite graph into a simple graph, one theoretically loses information (although a recent study indicates that it is not necessarily the case when using a dual-projection approach [START_REF] Everett | The dual-projection approach for two-mode networks[END_REF]), yet such an operation allows to reuse all the metrics defined above for a standard graph. However, one can also compute specific metrics for bipartite graphs, such as the average degree of top and bottom nodes, denoted k and k ⊥ respectively, and the density of the bipartite graph, denoted δ b = mb n .n ⊥ . Those statistics are natural extensions of graph metrics. However, for the local density, there is no standard variant since by definition there is no triangle in a bipartite graph. This has led the community to propose specific metrics for the bipartite version of the clustering coefficient [START_REF] Latapy | Basic notions for the analysis of large two-mode networks[END_REF][START_REF] Opsahl | Triadic closure in two-mode networks: Redefining the global and local clustering coefficients[END_REF]. One can, for instance, rely on the following coefficient that tends to capture the overlapping between the neighbourhood of two nodes of :

cc (u, v) = |N (u) ∩ N (v)| |N (u) ∪ N (v)| . ( 1
)
This coefficient is interesting as it captures the relative overlap between neighbourhoods of top nodes, i.e. cc (u, v) is equal to 1 if the neighbourhood of u and v intersects exactly, to 0 if they do not share any neighbour. From this coefficient, it becomes natural to define the clustering coefficient related to a specific node v. This is given by:

cc (v) = u∈N ⊥ N (v) cc (u, v) |N ⊥ N (v)| . (2)
This coefficient enables us to study the distribution of this property over the top nodes as well as its correlation with the degree or other properties. Then one can naturally compute the bipartite top clustering coefficient cc bip of G b as the average value of cc (v) over all the nodes v of . More formally:

cc bip (G b ) = 1 | | v∈ cc (v). ( 3
) Art. 1 Art. 2 Art. 3 Art. 4 ICC-3 ICC-2 ICC-1 ICC-4 ICC-5 ICC-6
Figure 2: Example of a hybrid bipartite graph However, it has been shown in [START_REF] Latapy | Basic notions for the analysis of large two-mode networks[END_REF] that this coefficient might miss some important properties of the overlapping between nodes in the bipartite structures. This is why the authors suggested to use the redundancy coefficient rd (v) of a node v, which focuses on the impact of removing v in regards to the ⊥-projection. Intuitively, a high value of the coefficient indicates that two ⊥ nodes that v relates are likely to be related by another node. Formally, the coefficient is given by:

rd (v) = |{{u, w} ∈ N (v) 2 s.t. ∃v = v, (v , u) ∈ E b and (v , w) ∈ E b }| |N (v)|(|N (v)|-1) 2 . (4)
Following this definition, we can naturally derive the redundancy coefficient rd bip of the bipartite graph G b , defined as the average value of the former coefficient over all nodes. More formally:

rd bip (G b ) = 1 | | v∈ rd (v).
(5)

Hybrid bipartite graphs

In order to overcome the limitations imposed by bipartite graphs (which does not allow to define links between ⊥ nodes), we propose in this section a framework that enables to deal with different type of links.

A hybrid bipartite graph is formally defined by a nuplet G h = ( , ⊥, E b , E DI ), where is the set of top nodes (the article in our case), ⊥ the set of bottom nodes (the decisions), E b ⊂ × ⊥ is the set of links between top nodes and bottom nodes (i.e. when decisions cite articles) and E DI ⊂ ⊥ × ⊥ is the set of (directed) links between bottom nodes (i.e. when decisions cite decisions). Intuitively, top nodes indicate the presence of cliques (set of nodes all linked together) at the bottom level, the set E b represents direct links between ⊥ nodes and the set E DI stands for standard bipartite links.

Compared to pure bipartite graphs, hybrid bipartite graphs thus allow for a new kind of links between ⊥ nodes3 . Such a framework enables us to represent all the information contained in legal networks as presented in Section 2.1. An example of a hybrid bipartite graph is given in Fig 2, where nodes stand for articles of law and ⊥ nodes for legal decisions. Links in E DI are depicted by plain black arrows and links in E b by dotted coloured lines.

In order to ease the reading, we will not present formally the natural extensions of the metrics defined above. However, this framework allows to focus on new properties of the structure and in particular on the interplay between the links of E DI and the ones of E b . We can, for instance, define the notion of covering coefficient, for which given a bottom node, it computes the fraction of direct links of E DI covered by two indirect links of E b . More formally, let u ∈ ⊥ be a node of G h , we define:

cov(u) = |{v ∈ ⊥ s.t. (u, v) ∈ E DI and ∃w ∈ , (u, w) ∈ E b and (v, w) ∈ E b }| |{v ∈ ⊥ s.t. (u, v) ∈ E DI }| (6)
Note that such a pattern has already proved to be of interest in former studies (see the pattern ATXAX and ATXBX of [START_REF] Wang | Exponential random graph model specifications for bipartite networks -A dependence hierarchy[END_REF] for instance). In the context of the legal networks considered in this paper, this coefficient indicates the proportion for a given decision to rely on former decisions (E DI ) that deal with similar legal grounds (E b ). Taking the example of the hybrid bipartite graph of Fig. 2, one can then distinguish the case of node ICC-3, whose covering coefficient is 1, from node ICC-6, whose covering coefficient is 0.25.

The ICC decisions network: a focus on the graph of citations

The purpose of this section is to analyse the properties of the ICC decisions network. In particular, we question how the properties of the network are positioned in regards to the properties observed in common complex networks. To do so, we start investigating global statistics of the different structures of the network (Section 3.1) before focusing on more specific properties related to the graph of citations: the degree distribution (Section 3.2) and the local density (Section 3.3).

Comparative analysis of the different structures

The first statistics we focus on concern some basic properties that have been extensively investigated in real-world networks, formally presented in the previous section. Table 1 presents the results both for the simple graphs (left) and the bipartite graph (right). Regarding simple graphs, in the left table we compare the differences induced by the two kinds of relations that can link two decisions, namely the direct-citation process4 (left part) and the article-citation process (right part).

One first can see that the expected global observations made on real-world networks also stand for the graph of citations defined over the ICC decisions network. In particular, it presents a very low density (3.9 • 10 -3 ) with a comparatively high local density (captured by the coefficients cc and tr), which is two orders of magnitude higher. This over-representation of triangles validates the citation process as a relevant notion of a link between decisions. However, one can also notice that the maximum out-degree (as well as the maximum in-degree) observed is about two orders of magnitude higher than the average degree. This points out some heterogeneity among the citation process, which we will analyse further in the next section.

Comparing those properties to the ones computed over the graph of article-related decisions, the same conclusions can be derived, although the graph tends to be more dense than the former one. In particular, the local density is very high, which is not surprising, since this graph is defined as the projection of the bipartite structure that encodes clusters of decisions.

Finally, by focusing on the global statistics of the bipartite graph, the same conclusions can be drawn. The degrees seem to be heterogeneously distributed over the structure, as suggested by the difference between the average degrees and the maximum degrees. Regarding the density, this coefficient is low compared to the local density. Yet, it is worth noticing that the two coefficients differ strongly on the value. The redundancy coefficient (0.69) is 4.6 times higher than the bipartite clustering coefficient (0.15). This raises the question of which coefficient is most relevant to discuss overlapping phenomena in bipartite structures [START_REF] Tarissan | Comparing Overlapping Properties of Real Bipartite Networks[END_REF]. This will be investigated more precisely in Section 4.

In order to refine the global statistics presented above, we move now to the analysis of the value of different metrics computed over the graph of citations. Having in mind that the citation process is fundamental in elaborating a juridical decision, this section investigates which properties of the citation process the standard metrics can highlight and how it can help to focus on particular regions of the graph.

To study this question, we first present the distribution of standard metrics defined for directed graphs before deepening the investigation of the relation between degrees and clustering coefficients in the ICC decisions network.

The degree distribution

Figure 3(a) presents the inverse cumulative distribution of the in-and out-degree in the graph of citations. As expected, the shape of the curve (both axis are in log scale) indicates clearly a heterogeneous distribution of the degrees over several orders of magnitude. This in particular highlights nodes with high degrees in the network. Although the decisions cite and are cited 3.9 times in average (see Table 1), some decisions cite and are cited hundreds of times.

Decisions that create a precedent. From a juridical point of view, identifying the most cited decisions highlights the major substantial ICC decisions based on fundamental issues. Those decisions are called "on the merits" in contrast to the technical and procedural ones, which concern more than half of the decisions and have an in-or out-degree equal to 0 or 1. These decisions "on the merits" set a precedent in the ICC case-law.

The most cited decision of the ICC (quoted 96 times) is the the Decision on the consequences of non-disclosure of exculpatory materials 5 . This decision was a major event during the Lubanga trial. The ICC judges ruled on the rupture of the conditions of a fair trial and imposed a stay on the proceedings. That decision, labelled as "urgent" in its own title, led to the decision on the release of the accused (however, the accused continued to remain detained until the commencement of trial six months later). This was serious step back for the prosecution. The importance of that decision led the judges to comment that although they had no doubt it was necessary, "they nonetheless imposed it with great reluctance, not least because it means the Court will not make a decision on issues which are of significance to the international community, the peoples of the Democratic Republic of the Congo, the victims and the accused himself".

The second most cited decision of the ICC (quoted 86 times) is the Decision on victims participation 6 . The place of victims in front of International courts is a fundamental question that judges have currently to address and one of the major stakes for the legitimacy of the ICC. Moreover, in this innovative field of international justice in general, the ICC has been the first international court alleging victims to participate to its proceedings. As the participation of the victims was included in the ICC status (art. 68 and 75), the Lubanga case-law developed it. Judges assigned to the victims, by their decisions, an active role in the proceedings. This particular decision created thus, a precedent [START_REF] Cassese | International Criminal Law: Cases and Commentary[END_REF]. Moreover, the fourth decision most quoted of the ICC is the appeal against that decision on victims participation, that specified it (confirming the main part, but reversing and amending others). It does point out the importance of the interpretation by the ICC judges on the matter of victims participation.

We also can mention that on the top cited decisions listed are the ones finalising the major procedural steps of trial before the ICC. For instance the Decision on the confirmation of charges 7 is the third most quoted decision of the ICC. It is the decision that formally ends the pre-trial phase. The judges confirm the existence of sufficient evidence to establish the liability of the accused, who is committed to the trial chamber for trial. Likewise, the final verdict reached by judges on the Lubanga case that convicted the accused of committing war crimes, is part of the top quoted decisions of the ICC decisions.

The judgement on culpability. Logically if we focus now on the ICC decisions that quote the most decisions, the final verdict of the Lubanga case (Judgement pursuant to Article 74 of the Statute8 ) appears widely as the main decision. Both its versions -the original in English and its translation in French, the two official languages of the Court -and the annexes the verdict comes with, listing precisely all the procedural background, are ranked as the first decisions referring to the most ICC decisions (quoting as much as 199 other decisions for the annex and 65 for the verdict). It can be easily explained since the verdict is the last decision of the trial. It then has to refer to all the previous decisions regarding the procedural steps of the trial as well as the ones ruling on the juridical fundamental issues of the case.

Clustering coefficient

Another strong property observed in real-networks is related to the over-representation of triangles. Figure 3(b) shows how the in-clustering and out-clustering coefficients are distributed in the network. Except for 0 (which concerns more than 20% of the nodes), this coefficient is quite uniformly distributed, although one can notice that small values seem to be more frequent. Intuitively, this shows that no strong pattern can be identified. However, this simple plot can hide different behaviour depending on the way one aggregates the data. It is also worth noticing that there is a non negligible fraction of nodes (more than 10%) with an out-clustering of 1, which raises the question of what kind of decisions are involved.

In order to deepen this question, Figure 4 shows the correlation between the in-and outdegree of a decision and its average in-and out-clustering coefficient. More precisely, a (x, y) dot on the plot indicates that nodes having an in-degree (resp. out-degree) x have an average in-clustering coefficient (resp. out-clustering) of y. The plot shows a clear tendency: the higher the degree, the lower the value of the coefficient. This is particularly true for small degree nodes, which have the highest clustering coefficient in average, meaning that the decisions they rely on tend to cite each-other. This is explained by the fact that small-degree decisions are by nature very specific to a part of the ICC judicial procedure andusually raise specific and technical questions, while large-degree nodes deal with different juridical issues and thus, refer to a broader scope of procedural and substantial matters.

A juridical perspective. To confirm this last statement, we first looked at the most frequent decisions (in the top ten) involved in triangles. It turns out that all of them indeed deal with substantial matters. Here again, both major decisions are the Decision on the consequences of non-disclosure of exculpatory materials and the Decision on victims participation, for which the juridical relevance has been explained previously.

The importance of the first decision and the juridical issues it ruled on is emphasised by the fact that the other major decisions related to the topic, namely the Decision on the release of Thomas Lubanga Dyilo 9 , that results directly from the former decision, is also part of the most frequent in the triangles. This is also the case for more procedural decisions regarding the release 10,11,12 . Those decisions belong to the same procedural chain, the importance of which is fundamental from a procedural point of view (the question of whether the accused was about to be released has deeply affected the Lubanga trial) as well as from a substantial point of view (the definition of the conditions of a fair trial). This explains the presence of such decisions "on the merits" in triangles. In addition, it is worth noticing that the verdict convicting Lubanga of committing war crimes is naturally one of the most frequent decision involved in a triangle.

In regards to the counterpart of our former claim (low degree nodes with a high clustering deal with procedural aspects), it is more difficult to assess its relevance since low degree nodes are numerous (see Fig. 3(a)). Thus, we selected two extreme cases: we identified the decision with the highest in-degree (resp. out-degree) among the nodes having highest in-clustering (resp. out-clustering) coefficient. This resulted respectively in Decision on the Prosecution's Application for Leave to Appeal the "Decision on the Prosecution's Application to Lift the Stay of the Proceedings" 13 and Request for Review of Detention 14 . The first one is a procedural decision on an application from the Prosecutor for leave to appeal against a precedent decision, the latter, regarding itself a precedent application. This structure thus, reveals the existence of a procedural chain. The second is also a procedural decision regarding the conduct of proceedings between the Pre-trial and Trial chambers. Thus, both decisions confirm the expected procedural aspect of low-degree nodes with high clusterings.

The impact of the hybrid bipartite structure

We turn now to the analysis of the hybrid bipartite structure revealed by the ICC decisions network. The interest of studying the network from this point of view is that it allows to focus on another process used by the judges to elaborate on the ruling procedures. It highlights the role of the articles of the Statute of the Court to support the decisions and how both decisions and articles interplay. Formally, this is done by studying at the same time metrics on the bipartite graph, on its projections (Section 4.1) and on the relation between the different types of links (Section 4.2). This is what this section is devoted to.

Interplay between the nodes

We start by studying the distribution of different metrics defined for bipartite graphs before showing some non trivial relations between this structure and the graphs derived by its projections.

Degree distribution. We present in Figure 5(a) the inverse cumulative distribution of the degrees of both the articles and decisions in the bipartite graph. Similar to the degree distribution in the graph of citation (see Figure 3(a)), the shape of the plots (in log-log scale) indicates that the degrees are heterogeneously distributed in the bipartite network. Again, this puts an emphasis on high-degree articles and decisions that intuitively tend to address juridical issues shared by many different decisions in the Lubanga case-law. Note that the degree of a given decision in the bipartite structure has a priori no relation with its degree in the graph of citations, since citing former decisions has no relation with relying on articles of the Statute.

As expected, the ICC decisions that cite the most articles of the Statute is the verdict reached by the judges convicting the accused (both its versions in French and English). It relies on 81 articles of the Statute. Likewise, the Decision on the confirmation of charges, by which judges confirm the existence of sufficient evidence and commit the accused for trial, quotes 63 articles. Those decisions based on the highest number of articles of the Statute are both decisions that end one phase of the Lubanga case, the pre-trial and the trial. Juridical logic implies then that they respect the principle of legality and the applicable law. The motivations of the decisions have to be based on the articles of Statute, that the judges may interpret.

A more interesting question, is to address the content of the articles supporting most decisions. Focusing on the ten most cited articles of the Statute, it turns out that three main domains are emerging. Firstly, it concerns the fields in which the ICC is innovating, such as the participation of victims (art. 68, cited 250 times) and the rights of the accused (art. 67, cited 201 times, its paragraph 2 being cited 195 times more). A second group of articles refer to the powers of the ICC, the functions and powers of the trial chamber (art. 64, cited 175 times), the duties and powers of the prosecutor (art. 54 cited 128 times, its paragraph 3-e being cited 156 times more). Finally, the other top cited articles are related to procedural issues, the appeal (art. 82, cited 132 times, its paragraph 1-d being cited 87 times more), the confirmation of charges (art. 61 cited 116 times) and the warrant of arrest (art. 58 cited 110 times).

Overlapping between articles. As discussed in Section 2.2, there is no consensus in the scientific community on the most relevant notion of clustering when analysing bipartite graphs. Two coefficients emerged, namely the bipartite clustering coefficient (Definition 2) and the redundancy coefficient (Definition 4), in the attempt to capture this notion. The first one intends to adapt the notion of clustering coefficient defined for simple graphs by looking at a variation of the triangle motif for bipartite graphs, while the latter intends to see how two nodes are related to the same set of ⊥ nodes.

Figure 5(b) shows the inverse cumulative distribution of the two quantities on the bipartite structure of the ICC network. One can see immediately that the two notions behave very differently for this network. While the proportion of nodes with a small clustering coefficient is very large (more than 90% of the articles have a clustering coefficient lower than 0.3), it is the converse for the redundancy. In particular, 35% of the articles have a redundancy close to 1. For those articles, it means that if they were not cited by the decisions, the projection of the bipartite structure would remain unchanged. This is a strong property highlighting the fact that when two decisions cite a common article they actually cite the same set of articles, a property which is not captured by the clustering coefficient.

Degree correlations. In order to emphasise the last remark, Figure 6(a) presents some non trivial relations between the degree of the nodes in the bipartite graph and their related degree in the projections (both over articles and over decisions). The two plots show a similar tendency: the more the degree of a node in the bipartite graph, the more its degree (in average) in the projection. As such, this behaviour is not surprising, especially as the progression seems linear 15 . However, looking at the order of magnitude of the axes, the reader might notice that the range of value for the horizontal and vertical axes are very different and thus, pointing out again some overlapping in the bipartite graph. This is particularly obvious for the projection over the decisions. While decisions citing only one article are in average connected to almost 90 other decisions in the projection, this value rises only up to 540 (that is only six times higher) when decisions cite 80 articles. This is clearly due to the fact, as stated earlier, that related decisions tend to rely on the same set of articles.

Figure 6(b) shows the relation between the degree of the decisions in the bipartite graph and the average degree of the related articles. More precisely, a (x, y) dot indicates that if a decision cites x articles, the average degree of those x articles is y. The relation between those two quantities is surprising. The plot shows that the more the degree of the citation, the lower the average degree of the related articles. Somehow, when a decision cites only few articles, those articles tend to deal with issues that are shared by a lot of other decisions. The case of the 1-degree decision is particularly meaningful. It shows that if a decision relies on a unique article, this article tends to be cited by approximately 90 decisions. On the contrary, if a decision relies on many articles, those tend to be more specific and then less invoked by other decisions.

Interplay between the links

We turn now to the analysis of the hybrid bipartite structure, which enables us to focus on the interplay between the citation of decisions and of articles. We start by the study of the covering coefficient, before investigating more in depth the relation between citing decisions and citing articles in the network.

Covering coefficient. The covering coefficient intends to capture by how much two ⊥ nodes of hybrid bipartite graph related by a direct citation are also related by a common article they refer to. In other words, this metrics focuses on the fraction of direct links covered by indirect links.

Figure 7(a) shows the inverse cumulative distribution of the in-and -out covering coefficient of the decisions. First, one can see that most of the nodes have their coefficient equal to 0. Indeed, it is remarkable that only 38.25% of the direct links are covered by articles. This is a very strong characteristic of the ICC network, which shows that the decisions tend to be procedural and involve chains of cited decisions that deal with technical issues. Yet, investigations showed that this proportion rises to 68.85% when focusing on decisions which cite at least one article. This shows that, as soon as the decision requires to rely on the articles of the Statute of the Court, those articles tend to indeed cover the direct citations. This observation is strengthened by the fact that, in the opposite case, more than 15% of the decisions have a coefficient equal to 1, meaning that all their direct citations are covered by articles.

Relation between citations. In order to better understand the interplay between the two kinds of citations, we present in Figure 7(b) the correlation between the number of articles cited by a decision and the average in-or -out degree of the decision. More precisely, a (x, y) dot means that a decision citing x articles, cites (or is cited by) y decisions in average. While no particular conclusion can be drawn for the in-degrees, the plot highlights a tendency for the out-degrees: the more the number of cited articles, the more the number of cited decisions in average. Going back to the observations made in Section 4.1, this strengthens the conclusion we drew: decisions citing many articles tend to be very specific. As such, the decisions they directly rely on are likely to focus on the same juridical issues and thus, mechanically leading to a high covering coefficient.

Comparison to a random model

The analysis conducted in the two previous sections revealed some strong tendencies in the network's structure in the first case of the ICC. While we provided explanation that explains how such findings are related to real juridical issues, it is not yet clear which part of the detected correlations is due to the specific nature this legal network, and which part is induced by the network's point of view adopted in the study.

In order to deepen this question, in this section we compare the previous results to the ones obtained on a structure generated by a simple random model. To that purpose, we apply a natural extension of the standard Configuration Model [START_REF] Aiello | A random graph model for massive graphs[END_REF][START_REF] Bollobás | Random graphs[END_REF][START_REF] Newman | Random graphs with arbitrary degree distributions and their applications[END_REF], which basically shuffles all the edges, both in the directed graph and in the bipartite graph. More precisely, the model generates a hybrid bipartite graph with a similar size (same number of nodes and edges) and similar degree distributions. It means that the only structure kept intact by the model is the number of citations a decision has and the number of times an article is cited. By contrast, the end-points of those links are chosen arbitrary. Thus, by analysing the structure of the generated hybrid bipartite graph as we did in Sections 3 and 4, we can investigate how such a random shuffling of the structure impacts the obtained results.

Figure 8 compares the properties of the real and random networks. Figure 8(a) shows in particular the relation between the in-degree of a citation and its in-clustering coefficient. It is then similar to the blue plot of Figure 4. Regarding those coefficients, the impact of the model is clear. The shuffling has completely deleted the correlation between the two coefficients. Whatever the in-degree of a decision is, its clustering is always around 0.025, which is in contrast with the conclusions drawn in Section 3.3. This shows that the strong relation observed previously is not trivial and it sustains the juridical perspective we provided to explain the observed correlation.

Although less obvious, Figure 8(b) leads to a similar conclusion. The figure focuses on the covering coefficient and shows the inverse cumulative distribution of this property. It is then similar to the blue plot of Figure 7(a). The plot reveals a similar tendency on the model than the one previously observed on the real network. In particular, most of the nodes have their coefficient equal to 0. However, one can observe that the gap between the two distributions is important. In the extreme case, while more than 15% of the decisions have a covering coefficient equal to 1 in the real network, only 2% have such a strong characteristics in the random network. This shows again that such a property is obviously not trivial and it strengthens our conclusions drawn throughout the paper regarding the processes used by the judges to ground their decisions.

Conclusion and perspectives

The multiplication of international criminal jurisdictions led the lawyers to recently question the evolution of the interpretation by the judges of international criminal law and of trial proceedings in the international context. Those jurisdictions started providing a rich case-law of juridical decisions which offer the opportunity to use graph theory to analyse and model such datasets. In this paper, we focused on the legal network composed of the decisions taken by the International Criminal Court (ICC), since its creation in 2002. In order to delimit the object under investigation, we focused more particularly on the Lubanga case, which has reached a final verdict.

Legal networks are characterised by the fact that different types of relations relate the decisions. Since judges motivate their decisions by relying either on former decisions, or on articles of the ICC Statute, this induces a two-level network with a rich and intricate notion of relations between the juridical decisions. We proposed in this paper to analyse this network by means of hybrid bipartite graphs that allow to represent the whole information contained in this network. We then assessed the relevance of this approach by analysing different properties of the structure and we validated the outcomes with juridical interpretations of the results.

As a side effect, this approach highlighted the procedural aspect of this jurisdiction and emphasised the key thematic pointed out by the major decisions. Thus, this work converges for the first time two very different approaches to account for the multi-level complexity in legal networks, and presents a unique and appealing opportunity to relate juridical and network sciences.

This work opens the way to many future directions. From a modelling point of view for instance, it leads naturally to the study of a hybrid bipartite model, that would allow to understand which part of the properties highlighted by the present work stem from this specific dataset, and which part would have emerged within a randomised version of the same two-level structure. Several variations can be envisioned with an increasing constraint on the degree correlations. One could, for instance, force the correlation between direct and indirect links to remain stable in the randomising process, or on the contrary, release this constraint. This would provide a rich information on the emergence of the observed properties in hybrid bipartite graphs. This line of research would benefit from previous studies on general models proposed for multi-level networks [START_REF] Tom | A model for the multiplex dynamics of two-mode and one-mode networks, with an application to employment preference, friendship, and advice[END_REF][START_REF] Wang | Exponential random graph model specifications for bipartite networks -A dependence hierarchy[END_REF].

Finally, on a broader perspective, one key question that the community needs to address in the future lies in the gathering of data exhibiting similar complex structures. It is indeed often difficult to have at the same time information on bipartite and direct links. For instance, if it is trivial to know which actor plays in which movie (bipartite links), on the contrary it is very difficult to know the exact social ties between the actors (direct links). However, several data involving social networks allowed recently to infer this complex structure. We can cite for instance the Flickr network, where users are related to the photos they comment on (bipartite links), but also to their personal contacts (direct links); or Wikipedia webpages, where articles relate to other articles (direct links), but also label their entry with categories (bipartite links). In the same way, most of legal networks put emphasis on juridical decisions that cite each other, but also rely on law articles, which gather several decisions. All in all, we can expect such intricate structures to be more and more available for formal analyses, such as the one presented in this paper.

  Statute they usually have to interpret. Here below is an example of such a motivation found on a footnote of decision ICC-01/04-01/06-2126-Anx (Trial chamber 1, 9 July 2009): Appeals Chamber, Judgement on the appeals of The Prosecutor and The Defence against Trial Chamber I's Decision on Victims' Participation of 18 January 2008, 11 July 2008, ICC-01/04-01/06-1432, para. 95. See also Trial Chamber II, Decision on the Modalities of Victim Participation at Trial, 22 January 2010, ICC-01/04-1/07-1788, para. 30. See also Defence for Germain Katanga's Additional Observations on Victims' Participation and scope thereof", 10 November 2009, ICC-01/04-01/07-1618: "It has been held that article 69(3) gives the Court a general ...

Figure 1 :

 1 Figure 1: Example of a bipartite graph and its { , ⊥}-projections

Figure 3 :

 3 Figure 3: Inverse cumulative distributions of the degree (left) and the clustering coefficient (right) in the graph of citations.

Figure 4 :

 4 Figure 4: Correlation between degrees and clustering coefficients in the graph of citations.

Figure 5 :

 5 Figure 5: Inverse cumulative distributions of degrees, clustering coefficient and redundancy coefficient in the bipartite graph.

  (a) Bipartite vs. Projections (b) Decisions vs. Articles

Figure 6 :

 6 Figure 6: Correlation between degrees in the bipartite graph and its projections.

  Bipartite vs. direct links

Figure 7 :

 7 Figure 7: Properties of the hybrid bipartite structure.

  (a) In-degree vs. In-clustering (b) Covering coefficient

Figure 8 :

 8 Figure 8: Impact of the random model on the structural properties of the network.

Table 1 :

 1 Global statistics for simple graphs (left) and decision/article bipartite graph (right).

		Simple graph		Bipartite graph
		Citations	Projection
	n	2 276	2 276	n ( /⊥)	713 / 2 276
	m	8 640	101 378	m b	6 670
	δ	3.4 (10 -3 ) 3.9 (10 -2 )	δ b	4.1 (10 -3 )
	k	3.8	44.5	k ( /⊥)	9.3 / 2.9
	d +	199 / 96	719	d + ( /⊥)	250 / 81
	cc	0.11 / 0.15	0.44	cc bip	0.15
	tr	0.32 / 0.25	0.58	rd bip	0.69

Only two other cases are now terminated: the Ngujolo case (Appeal Judgement on February

th 2015) and the Katanga case (Judgement on March 7 th 2014 and Sentence on May 23 rd 2014).

All the metrics defined for directed graphs take into account this property.

Note that ( , ⊥, Eb) is a standard bipartite graph.

When two numbers x / y are presented in this column, they respectively refer to the OUT links and the IN links of the graph of citations.

Trial chamber 1, 13 June 2008, ICC-01/04-01/06-1401

Trial chamber 1, 18 January 2008, ICC-01/04-01/06-1119

Pre-trial chamber 3, 29 January 2007, ICC-01/04-01/06-803

Trial chamber 1, 14 mars 2012, ICC-01/04-01/06-2842

Note that the scale of the axes are logarithmic.

Acknowledgements

This work is partly funded by the National Center for Scientific Research (CNRS) through the PEPS Project "DoRé". The authors are also grateful to Louisa Harutyunyan for her feedback on the paper.


Quyet H Cao
email: quyet.caohuu@orange.com

Giyyarpuram Madhusudan
email: giyyarpuram.madhusudan@orange.com

Reza Farahbakhsh
email: reza.farahbakhsh@it-sudparis.eu

Noel Crespi
email: noel.crespi@it-sudparis.eu

Usage Control for Data Handling in Smart Cities

Keywords: Defeasible Logic, Usage Control, Data Handling, Smart Cities, and Information Accountability

Data in smart cities is commonly generated by a large variety of participants including institutional actors, equipment manufacturers, network operators, infrastructure providers, service providers, and end users. This data potentially undergoes several transformations such as aggregation and/or composition before finally being consumed. In this context of sharing data between diverse consumers, it is essential to provide the data producers the means by which they can exercise control over how and by whom the data is used. To date, usage control has received attention in the domains of the web and social networks, in terms of confidentiality, privacy and access control aspects. However, it has not yet been fully applied in a rigorous manner in the context of smart cites. In this paper we study usage control with the goal to address the problem of providing stakeholders more control over their data and enforcing accountable management of such data. We first propose a new data usage policy, called DUPO, which captures the diversity of obligations and constraints resulting from the usage control requirements for smart cities. Next, we apply a defeasible logic based approach on DUPO to formally define rule language, solve rule conflicts, and elaborate reasoning. We then introduce the data handling mechanism, which provides useful functionality to process consumer's request, ensuring the accountability of the policy enforcement, and traceability of the data usage. To this end we benefit from SPINdle reasoner to implement the proposed usage control module covered main functionalities of the mechanism.

I. INTRODUCTION

We are witnessing a new communication paradigm which goes beyond traditional people interactions, the one that is between devices under the umbrella of the Internet of Things (IoT) and the underlying technologies. In the very near future, most of the defined plans and ideas for smart cities will become a reality. In this era, deployment of the shared platforms for IoT enables the participation of citizens and groups of users in both the data collection and the emergence of new smart city services. Data can be collected from billions of interactions across a huge number of devices, forever altering the socioeconomic landscape [START_REF]Global Agenda Council on Data-Driven Development, World Economic Forum[END_REF]. In effect, it is the emergence of a marketplace for smart cities.

Currently, applications for smart cities are mostly developed in a vertical manner with no sharing of resources between different applications. Many of these vertical applications may benefit from using information sources from different origins to enhance their own services. These resources include the devices and the networks that are deployed but also the data generated by these devices. The landscape involves a diversity of actors, both public and private, who participate to provide a large variety of services. These applications include energy management for public buildings, waste management, public lighting, mobility management including intelligent parking solutions and a range of new services that are being conceived for smart cities [START_REF]Smart Cities -Le numrique au coeur de la ville intelligente[END_REF]. The actors involved in these applications tend to vary with the specific domain as each comes with its ecosystem. However we can identify several broad categories of actors: institutional actors (such as districts, municipalities), equipment manufacturers, network operators, infrastructure providers and service providers. With the development of IoT, the range of actors involved will be enlarged to include micro companies, value added service providers (such as aggregations, compositions and mashups) and end users. The need for a horizontal platform to federate information from these disparate sources is particularly important [4]. The shared platform, which can be provided by the operator, for actors with differing and sometimes contradictory requirements brings its own set of challenges. For this horizontal approach to succeed, the platform needs to ensure that the business interests of the different participants are fully honored.

In the context of IoT current studies provide mechanisms such as access control or address privacy issues. However the issue of usage control has not been treated in a formal manner. In this paper we focus on the following challenges (i) A language for IoT data producers to express the constraints and obligations on the use of IoT data, (ii) The mechanisms to enforce the policies that have been put in place in the context of a shared data platform, and (iii) Accounting mechanisms to prove to the data producers that their policies have been respected. More specifically, we need a machine-interpretable model and a language for the constraints and conditions that can be used and understood by all actors who are involved in, covering (i) Spatio-temporal granularity, (ii) Abstraction/masking of certain information, and (iii) Conditions by class of actor/purpose.

The main contributions of this paper are two-fold: Firstly, we propose a new data usage policy, called DUPO, and define its conceptual model, as well as a formal language based on defeasible logic, and a practical expression of DUPO. Secondly, a data handling mechanism is provided, in which we indicate an overview of the mechanism in perspectives of data owners, data consumers, and IoT shared platform. Next, we initial implement the Usage Control Module that covers the main functionalities of the mechanism.

The rest of this paper is organized as follows: Section II describes use case scenarios and section III discusses DUPO. Section IV presents the data handling mechanism, section V indicates related works and we conclude in Section VI.

II. USE CASE SCENARIOS

To illustrate our contributions, we introduce the architecture of a general scenario with a use case for fine-granular sensor data collection in the context of smart cities. Fig. 1 shows the overall architecture, including the main components for our use case scenarios. A variety of smart city services communicate to a shared platform called Smart City Management platform. Examples of such services include intelligent parking solutions, waste management, public lighting, air quality monitoring, and participatory sensing applications, etc. The goal of the shared platform is to allow diverse applications to access data collected from a variety of sensors deployed over a large area. A critical element to enable such sharing is the possibility for data providers to exercise some control the usage of the data generated by their sensors. The Usage Control Module ensures that policies put in place by the data producers are respected by data consumers.

We could have different applications, aP arking for actors to be used for tracking the parking spaces in a city during a specific time in the intelligent parking solution, aW aste for waste management, aLighting for a public lighting system, aAir for air quality monitoring, and aP S for participatory sensing, etc. sharing a common platform and some of their data between different them.

In the sections that follow we have chosen to illustrate Usage Control using an intelligent parking solution. Intelligent parking is a hot topic and several studies have proposed solutions in this domain [START_REF] Yin | Research and Application on Intelligent Parking Solution Based on Internet of Things[END_REF]. This sort of solution is also available on the market and their integration is quite simple [START_REF] Zanella | Internet of Things for Smart Cities[END_REF]. The data provider for this solution decides to share the data generated by parking sensors and apply a policy to control the usage of this parking data. Different participants such as municipal authorities, application developers and commercial operators could then request data from the parking solution and will be able to access data at the granularity and scope that the data producer has specified. In the following, we use examples to illustrate the usage control policy:

1) The data owner (the company that deploys and is owner of the parking sensors) will have full access to all the details generated by all the individual parking sensors.

2) For municipal authorities, the data owner is willing to make available average occupancy of parking places per street on an hourly basis.

3) However to commercial operators only statistical data will be made available over a zone and on a weekly basis.

We finally need the Usage Control Module in this scenario to deal with several questions as follows: (i) How do we define the required policies? (ii) What are the main criteria to define the policies? (iii) How do we ensure that these policies enforced correctly? (iv) How do we deal with potential incompatibilities between dependent policies? (v) How do we process the consumers' request and offer an explanation when the request is refused? and (vi) How do we trace data usage history?

III. DUPO: DATA USAGE POLICY

This section introduces the new data usage policy, called DUPO, which includes the conceptual model, formal language, and practical expressions.

A. Conceptual Model

In Fig. 2, we propose a conceptual data usage model that allows a usage policy to be attached to a data set, a collection of data items. The policy is created by defining modal operators (Obligation, Forbidden, and Permission) on usage constraints and conditions: (i) class of actors, (ii) constraints (Spatiality, Temporality, and Abstraction), and (iii) class of purposes. We aim to explain by examples how this model works. Let's consider that a commercial operator requests all the details of parking data over a street on an hourly basis. However, we have already the usage policy in the scenario that commercial operators are permitted only statistical data over a zone on a weekly basis. Thus, the consumer's request is refused. Otherwise, the related data items will be returned. This example basically covers the usage control requirements and related concepts in our model: Next we present each component of the model in detail.

1) Data Items: A Data Item is an individual of the Context Element proposed in the NGSI 9/10 Information Model 1 . The Context Element is a container used to exchange information about an entity. It contains the following information: (i) an entity ID including the name and the type, (ii) a list of the context attributes, (iii) (optionally) the name of an attribute domain that logically groups together a set of context attributes, and (iv) (optionally) a list of metadata that apply to all the attribute values of the given domain. We formally define it by using XML DTD, as mentioned in Listing 1.

1 <!DOCTYPE DUPO[ 2 <!ELEMENT DataItem(ContextElement)> 3 <!ELEMENT ContextElement(EntityID, AttributeDomainName?, ContextAttributeList, DomainMetadata?)> 4 <!ELEMENT EntityID(Id, Type)> 5 <!ELEMENT ContextAttributeList(ContextAttribute * ) > 6 <!ELEMENT ContextAttribute(Name,

B. Formal Language

Defeasible Logic (DL) is a non-monotonic formalism that deals with incomplete and conflicting information, originally proposed by Nute [START_REF] Nute | Defeasible logic[END_REF]. The Data Usage Policy proposed in this paper (DUPO) is based on the general concept of DL. In particular, we build on earlier works extending DL with modal and deontic operators, as presented in Governatori [START_REF] Governatori | BIO logical agents: Norms, beliefs, intentions in defeasible logic[END_REF] [15] and Antoniou [START_REF] Antoniou | Representation results for defeasible logic[END_REF] [START_REF] Antoniou | A modal and deontic defeasible reasoning system for modelling policies and multi-agent systems[END_REF]. There are some proposed formalisms for dealing with reasoning, handling and solving the normative conflicts that arise between rules and exceptions. However, DL is one of the best solutions which can manage all aspects in an efficient and computationally tractable way [START_REF] Governatori | One License to Compose Them All:A Deontic Logic Approach to Data Licensing on the Web of Data[END_REF]. Moreover, DL offers enhanced representational capabilities and low computational complexity [START_REF] Kontopoulos | A modal defeasible reasoner of deontic logic for the semantic web[END_REF]. According to [START_REF] Governatori | BIO logical agents: Norms, beliefs, intentions in defeasible logic[END_REF], when DL is enriched with modal operators, the complexity also does not increase in most cases. In this section, we define the formal language as follows:

Let P ROP be a set of propositional atom. A set of literals Lit = P ROP ∪ {¬p|p ∈ P ROP }.

Let M OD = {O, P, F } be the set of basic deontic modalities (Obligation, Permission, and Forbidden). A set of modal literals M odLit = {[X]l, ¬[X]l|l ∈ Lit, X ∈ M OD}.

Let Lbl be a set of arbitrary labels. R is a set of base and deontic rules. A base rule is expressed r : A(r) → C(r), while a deontic rule is r : A(r) → X C(r), where (i) A unique label r ∈ Lbl, (ii) The antecedent (or body) A(r) = a 1 , ..., a n , a i ∈ Lit ∪ M odLit, 1 ≤ i ≤ n; (iii) An arrow →∈ {→, ⇒ , ;}, denotes the type of rules: strict rules, defeasible rules and defeaters, respectively, (iv) X ∈ M OD, and (v) The consequent (or head) C(r) = b, b ∈ Lit.

The different rules have the following meaning. The strict rules can never be defeated, while defeasible rules can be defeated by contrary evidence. Defeater rules are only used to prevent certain conclusions.

1) DUPO Theory:

A DUPO theory is a defeasible theory D = (F DU P O , R DU P O , >), where i)F DU P O ⊆ Lit ∪ M odLit are facts, ii)R DU P O ⊆ R is a set of rules from usage policies, and iii) > is a superiority relation for priorities among the non-strict rules in R DU P O .

2) Theory Proof: A conclusion derived from D is a tagged literal and is classified as follows: +∆q means that literal q is definitely provable in D; -∆q means that literal q is definitely rejected in D; +∂q means that literal q is defeasibly provable in D; and -∂q means that literal q is defeasibly rejected in D.

A proof P = (P (1), ..., P (n)) in D is a finite sequence of tagged literals of type +∆q, -∆q, +∂q and -∂q.

We denote the set of all strict rules in R by R s , R sd for the set of strict and defeasible rules, and R[q] for the set of rules whose head is q. P [1..i] denotes the initial part of the sequence of length i. The proof conditions for the conclusions are formally defined as follows [START_REF] Antoniou | Representation results for defeasible logic[END_REF]:

+∆ : If P (i + 1) = +∆q then either (1) q ∈ F or (2) ∃r ∈ R s [q]∀a ∈ A(r) : +∆a ∈ P [1..i].
-∆ : If P (i + 1) = -∆q then (1) q / ∈ F and

(2) ∀r ∈ R s [q]∃a ∈ A(

C. Practical Expression

In this part, we use our formal language to express facts, rules for usage policies, and consumer's request related to the use case examples. We also present an example of data items.

1) Facts:

We have a fact about a commercial operator (CO) that wish to request the data. It is presented as follows:

F DU P O = {CommercialOperator(CO)}
2) Rules: We express all usage policies related to the use case scenarios. For the data owners (DO), they have the permission to full access of all the details. This policy is represented with the use of defeasible rules, as follows: For commercial operators (CO), only statistical data will be made available over a zone and on a weekly basis. This policy is represented with the use of defeasible rules, as follows: In fact, we have a collection of data items in different data sets. Thus, when the consumer's request is defeasible provable. These data items will be filtered or aggregated following the request conditions before returning results to consumers. Every transaction of data usage will be stored as new data items and later reported to the data owners as possible.

R DU P O = {r 1,d : DO ⇒ P T emporalScope(any), r 2
R DU P O =

IV. DATA HANDLING MECHANISM

This section provides an overview of the data handling mechanism and an initial implementation of the usage control module.

A. Overview Fig. 3 shows the sequence of the proposed mechanism for data handling, which is in the following steps: (1) Create Usage Policy, (2) Send Data, (3) Request Data, (4) Process Data Usage Enforcement, (5) Load Usage Policy, (6) Process Data Usage Accountability, (7) Store Data Usage History, (8) Response Data and Justification, and (9) Visualize Data Usage History. Traditional flows are provided by steps ( 2), (3), and a part of step [START_REF] Park | The UCONABC usage control model[END_REF] proposed traditionally (normal lines), but steps (1), (4), ( 5), ( 6), ( 7), [START_REF] Park | The UCONABC usage control model[END_REF], and ( 9) are added to implement usage control and accounting (dotted lines). Next, we present the main defined functionalities of the data owners, data consumers, and IoT trusted third party.

1) Data Owners:

We first allow the data owners to create the usage policy for their data set, and then data from their sensor devices are sent to the shared platform. The data owners also can visualize the data usage history and adjust the usage policy as needed.

2) Data Consumers: The data consumers are able to request data using their applications. They can visualize not only the responsed data but also the justification for trusting the results.

3) IoT Shared Platform: The data collection and distribution will be managed in the Smart City Management Platform. The Usage Control Module is provided in order to incorporate transparency in how the data is used. It has three main functionalities as follows: (i) Usage Policy Management for managing data owner's policies, (ii) Data Usage Enforcement for reasoning consumer's requests, and (iii) Data Usage Accountability for tracing data usage history. We will explain more the module in the next section.

B. Usage Control Module

This part will provide more detail about the technical functionality of the usage control module which provided by the shared platform. We also aim at initial implementing it using SPINdle2 , a logic reasoner that can be used to compute the consequence of DUPO theories in an efficient manner [START_REF] Lam | The making of SPINdle[END_REF]. 1) Usage Policy Management: So far, we have explained how the usage policies are defined in the previous sections, from use case examples (section II) to defeasible logic rules (section III). However, we need a practical way to manage the policies. In this module, we suggest a rule based language which build on Defeasible SPINdle, and later extend to Defeasible RuleML3 as possible. We will go further to provide a visual editor which supports data owners to define the policy for diversity of obligations and constraints mentioned above, and propose a DUPO service to load the related polices. For prototype, we use SPINdle systax to define facts and rules of usage policies in Listing 6. 2) Data Usage Enforcement: This functionality aims to process the consumer's requests. Firstly, the request will be transformed into defeasible rules. We then use the DUPO service to load the related policies. Next, we deal with conflicts between the usage policies and consumer's request by setting superiority relation between the defeasible rules. Finally, we do reasoning to have the conclusions which are able to demonstrate that the related policies are correctly enforced. Listing 7 shows the consumer's request, the defined superiority relation, and reasoning conclusions from SPINdle engine. 3) Data Usage Accountability: This functionality ensures the accountability of policy enforcement and traceability of the data usage history. We firstly define the justification [START_REF] Kontopoulos | Visualizing Semantic Web proofs of defeasible logic in the DR-DEVICE system[END_REF] to the consumers based on extending of the SPINdle Inference Logger (as Listing 8). The data usage history is updated as every consumers' request is defeasible provable and responsed data is processed.

V. RELATED WORK

Usage control is concerned with how data is used after access to it has been granted. It has received attention in the domain of the social networks. In particular authors in [START_REF] Pato | Aintno: Demonstration of Information Accountability on the Web[END_REF] propose a simple accountability model and a platform that allows users to explore the consequences of different usage control choices. In addition, various efforts have been made in the web domain to address accountability and trust [10] [17]. Classic access control models have also been extended to implement obligations and conditions in the context of access to enterprise resources [START_REF] Park | The UCONABC usage control model[END_REF] and usage control mechanisms are well studied by authors cited in [START_REF] Lazouski | Usage control in computer security: A survey[END_REF]. Recently, in the field of IoT, the work done by [START_REF] Speiser | Web Technologies and Privacy Policies for the Smart Grid[END_REF] they propose a privacy policy model that allow users give control over their data in context of smart grid application. However, our work is designed to bring a rigorous approach to usage control in the context of smart cities. We do not focus on the security aspects such as confidentiality, access control, and privacy. In fact, our paper deals with issues arising from applying usage control policies based on spatio-temporal granularity, abstraction/masking of certain information, and conditions by class of actors or purposes. In this work, policies has been built on deontic logic based on obligations, permissions and prohibitions, as in regular defeasible logic rules. Thus, we build on the work done in the area of DL by Governatori et al. [START_REF] Governatori | BIO logical agents: Norms, beliefs, intentions in defeasible logic[END_REF] [15], and then focus on the accountability and traceability of data usage.

VI. CONCLUSION

In this paper we proposed a new policy model for usage control and its formalization using defeasible logic. We have also illustrated the enforcement of the above policies using SPINdle and the accounting mechanisms needed to ensure confidence to the data providers that the data is being used in a manner complaint to their policies. Two main contributions proposed in this study advance the state of the art in this domain. A new data usage policy, called DUPO, has been presented, including its conceptual model, formal language, and practical expression. We also introduce a novel data handling mechanism, including the definition and initial implementation of data owners', data consumers', and Usage Control Module' functionalities.

As future work, we aim to extend this study, with implementation and validating of the proposed models in the following directions: Firstly, experiment the proposed solution to check the performance related aspects to ensure that the system is efficient and scalable. Secondly, provide a visualization tool to help users customize their policies in a manner that allows them to explore the consequences of certain changes and finally enhancement to the language to allow monetization of data for example different levels of subscription or payment.

Fig. 1 :

 1 Fig. 1: Overall Architecture of the Use Case Scenario.

Fig. 2 :

 2 Fig. 2: Conceptual Data Usage Policy Model.

  Actor = (CommercialOperator), Abstraction = (Detail, StatisticalData), Spatiality = (StreetLevel, ZoneLevel), T emporality = (Hourly, W eekly), Operator = (P ermission, Obligation).

Listing 2 :

 2 XML DTD Definition of Condition.3) Operators: This is a set of model operators (i) Obligation (ii) Forbidden, and (iii) Permission. The formal definition created using XML DTD is presented in Listing 3. 1 <!DOCTYPE DUPO[ 2 <!ELEMENT Operator(Obligation?, Forbidden?, Permission?)> 3 ... 4 ]> Listing 3: XML DTD Definition of Operator. 1 NGSI 9/10 Information Model: https://forge.fiware.org/plugins/mediawiki/ wiki/fiware/index.php/NGSI-9/NGSI-10 information model 4) Usage Policies: A collection of rules which is created by defining Operators on the individual Condition. Listing 4 formally defines the definition of Usage Policies using XML DTD. 1 <!DOCTYPE DUPO[ 2 <!ELEMENT UsagePolicy(Rule * )> 3 <!ELEMENT Rule(Operator?, Condition?)> 4 ... 5 ]> Listing 4: XML DTD Definition of Usage Policy.

  ,d : DO ⇒ P SpatialScope(any), r 3,d : DO ⇒ P AbstractScope(any), r 4,d : DO ⇒ P P urposeScope(any)} For municipal authorities (M A), they have permission to access available average occupancy of parking places (aggregation) per street on an hourly basis. This policy is represented with the use of defeasible rules, as follows: R DU P O = {r 1,m : M A ⇒ P SpatialScope(street), r 2,m : M A ⇒ F ¬SpatialScope(street), r 3,m : M A ⇒ P T emporalScope(hourly), r 4,m : M A ⇒ F ¬T emporalScope(hourly), r 5,m : M A ⇒ P AbstractScope(aggregation), r 6,m : M A ⇒ F ¬AbstractScope(aggregation)}

Listing 5 :

 5 An example of Data Item.

Fig. 3 :

 3 Fig. 3: Simplified Data Handling Mechanism.

  policies 5 r1c: CO =>[P] SpatialScope(zone) 6 r2c: CO =>[F] -SpatialScope(zone) 7 r3c: CO =>[P] TemporalScope(weekly) 8 r4c: CO =>[F] -TemporalScope(weekly) 9 r5c: CO =>[P] AbstractScope(statistic) 10 r6c: CO =>[F] -AbstractScope(statistic) 11 ...

Listing 6 :

 6 Facts and Usage Policies.

1 #

 1 Consumer's request 2 r: CO,[P]SpatialScope(street),[P]TemporalScope( hourly),[P]AbstractionScope(detail) =>[14 =================== 15 -D [O]ConsumerRequest(X) 16 -d [O]ConsumerRequest(X) 17 ...

  Listing 1: XML DTD Definition of Data Item.2) Usage Constraints and Conditions: This is a collection of individual Conditions. The condition list optionally contains the following expressions:(i) Temporal Constraints for temporal granularity, (ii) Spatial Constraints for spatial granularity, (iii) Abstraction Constraints for masking of certain information, (iv) Conditions by Actors, and (v) Conditions by Purposes. We formally define it by using XML DTD, as shown in Listing 2.

	Type,
	ContextValue, ContextMetadata+)>
	7 <!ELEMENT DomainMetadata(ContextMetadata * )>
	8 <!ELEMENT ContextMetadata(Name, Type, Value)>
	9 ...
	10 ]>
	1 <!DOCTYPE DUPO[
	2 <!ELEMENT Condition(Temporality * , Spatiality * ,
	Abstraction * , Actor * , Purpose * )>
	3 <!ELEMENT Spatiality(SpatialScope * )>
	4 <!ELEMENT Temporality(TemporalScope * )>
	5 <!ELEMENT Abstraction(AbstractScope * )>
	6 <!ELEMENT Actor(ActorScope * )>
	7 <!ELEMENT Purpose(PurposeScope * )>
	8 <!ELEMENT TemporalScope(Secondly?, Minutly?,
	Hourly?, Daily?, Weekly?, Monthly?, Yearly?,
	Any?)>
	9 <!ELEMENT SpatialScope(Space?, Slot?, Street?,
	Zone?, Any?)>
	10 <!ELEMENT ActorScope(DataOwner?,
	MulnicipalAuthority?, ComercicalOperator?)>
	11 <!ELEMENT AbstractScope(Aggregation?, Detail?,
	Any?)>
	12 <!ELEMENT PurposeScope(CommercialUse?, Any?)>
	13 ...
	14 ]>

  r) : -∆a ∈ P [1..i].

	+∂ : If P (i + 1) = +∂q then either
	(1)+∆q ∈ P [1..i] or
	(2)(2.1)∃r ∈ R sd [q]∀a ∈ A(r) : +∂a ∈ P [1..i] and
	(2.2)-∆¬q ∈ P [1..i] and
	(2.3)∀s ∈ R[¬q] either
	(2.3.1)∃a ∈ A(s) : -∂a ∈ P [1..i] or
	(2.3.2)∃t ∈ R

sd

[q]

such that ∀a ∈ A(t) : +∂a ∈ P [1..i] and t > s.

-∂ :

If P (i + 1) = -∂q then (1)-∆q ∈ P [1..i] and (2)(2.1)∀r ∈ R sd [q]∃a ∈ A(r) : -∂a ∈ P [1..i] or (2.2)+∆¬q ∈ P [1..i] or (2.3)∃s ∈ R[¬q] such that (2.3.1)∀a ∈ A(s) : +∂a ∈ P [1..i] and (2.3.2)∀t ∈ R sd [q] either ∃a ∈ A(t) : -∂a ∈ P [1.

.i] or t ≯ s.

  {r 1,c : CO ⇒ P SpatialScope(zone), r 2,c : CO ⇒ F ¬SpatialScope(zone), r 3,c : CO ⇒ P T emporalScope(weekly), r 4,c : CO ⇒ F ¬T emporalScope(weekly), r 5,c : CO ⇒ P AbstractScope(statistic), r 6,c : CO ⇒ F ¬AbstractScope(statistic)}3) Consumer's Request: We have a consumer's request that a commercial operator (CO) requests all the detail of the parking data over a street on a hourly basis. This request is represented with the use of defeasible rules, as follows: It means that ConsumerRequest is not defeasible provable in D, so the request is refused. 4) Data Items: In the Listing 5, we describe a data item example using Context Element XML format. It contains the current state (line 9) of the parking sensor (line 3) in location (line 14) at timestamp (line 21).

		r : CO, [P ]SpatialScope(street),
		[P ]T emporalScope(hourly),
		[P ]AbstractionScope(detail)
	⇒ 1 <contextElement>
	2	<entityId type="ParkingSensor" >
	3	<id>ps1</id>
	4	</entityId>
	5	<contextAttributeList>
	6	<contextAttribute>
	7	<name>currentState</name>
	8	<type>integer</type>
	9	<contextValue>1</contextValue>
	10	</contextAttribute>
	11	<contextAttribute>
	12	<name>location</name>
	13	<type>string</type>
	14	<contextValue>parkingspace1</contextValue>
	15	</contextAttribute>
	16	</contextAttributeList>
	17	<domainMetadata>
	18	<contextMetadata>
	19	<name>timestamp</name>
	20	<type>dateTime</type>
	21	<value>2015-03-16T15:23:17.234+0200</value>
	22	</contextMetadata>
	23	</domainMetadata>
	24 </contextElement>

O ConsumerRequest We have the conlusions, -∆[O]ConsumerRequest, -∂[O]ConsumerRequest.

SPINdle: http://spin.nicta.org.au/spindle/index.html

Defeasible RuleML: http://ruleml.org/1.0/defeasible/defeasible.html

ACKNOWLEDGMENT

The research leading to these results was partially funded by the ITEA3 project CAP.