De La Rosa asks Dixon about autonomous attacks and kill switches

And of course, we will continue that conversation.

I did want to ask you, how prepared would you say we are

for enterprise security system for autonomous AI-driven attacks, not just attacks by human, but AI autonomous attacks.

How prepared do you all feel we are as a city?

Yeah, thank you for the question.

I'll let CJ Dixon answer that.

And that is a great question, and I will acknowledge that this is a very dynamic environment.

It is always changing.

That's just the nature of technology.

New York City Cyber Command, however, provides 24 by 7 detection and response capabilities through our 24 by 7 security operations center.

We have provided that service to the city since the establishment of New York State Cyber Command.

We provide that service whether or not the attacker is human or an artificial intelligence-based attacker.

That attacker would still attack the exact same vulnerabilities in the system, and therefore we would still respond functionally in the same manner.

We would just have to do it faster.

We continue to evolve with the technology, and we will continue to do so with the best of our ability as the technology continues to evolve.

The speaker, rightfully so, in my opinion, asked the companies about the possibility of a kill switch and where that kill switch should live.

Do you have any opinions if the kill switch should live in Cyber Command?

I agree in principle.

with the idea of a kill switch.

I will say there are some technical barriers that would prevent a

kill switch as conceptualized living in any agency within New York City, whether that is New York City Cyber Command, OTI, or anywhere else.

The reason being is the technical reality for these models is they are deployed on distributed systems, on distributed architecture.

In order to truly

With a singular button or with a kill switch or anything of that concept for that to actually work functionally, we would need to be able to coordinate across multiple stakeholders that are not actually regionally co-located to be able to turn off everything at the exact same time.

New York City Cyber Command nor OTI does not have the authorities or the technical capability to do that.

And this runs us up against a similar challenge that we've had with other kill switch bills as it relates to computer technology in general.

As this technology gets more distributed, it gets harder and harder for any singular solitary entity to turn it off specifically.

That is not to say that there is not technical means by which a group of entities with the legal authority to do so

could not disconnect a given model from a given function, but in this particular case, we agree on principle, but it would not be able to be implemented at New York State Cyber Command in practice, not with the technical barriers that are in place.

Okay, I'm sure there'll be more on that.

In your opinion, should AI control be recognized, a recognized cybersecurity specialty?

If so, what should be the training and curriculum included in that?

I do not believe every function related to artificial intelligence is necessarily going to be a cybersecurity specific challenge.

There are some intersections between artificial intelligence and cybersecurity as a particular domain.

And when those

two domains interact, that is where certain things should fall within cyber command and a cybersecurity professional's purview.

And that is any instance of a cyber attack or cybersecurity, regardless of if the perpetrator is a human or an artificial intelligence.

I just want to ask one follow-up.

How many people are working in cyber command right now?

121.

And how many vacant positions do you have?

I will need to go back and find that exact number for you, Speaker.

Okay, thank you.

Please provide, if you could please provide that.

We'll do.