Hanks asks Dixon to elaborate on AI risk categories
Councilmember Kamillah Hanks asks Dixon to expand on his testimony that not all AI threats are cyber attacks. Dixon describes two risk baskets: AI attacked as a computer system, and novel risks inherent in how AI interacts with society regardless of cybersecurity.
We have our majority whip, Council Member Hanks.
Thank you so much, Chair.
I'll be very, very brief.
So you testified with all the technology that's changing rapidly.
Even the best can't, you know, keep up.
So in your testimony, you said the administration is continuing to evolve your strategies to keep our city's infrastructure safe.
But not all threats to AI systems are necessarily cyber attacks.
Can you expand on that?
Yes, so when looking at the way that it is currently described by the National Institute of Science and Technology, as well as some of the universities and academics who've created some of these systems,
there are functionally two baskets of AI risk.
There is risk.
Related to AI when an AI is attacked as a computer system just like any other piece of software.
And then there are risks related to artificial intelligence that are truly novel to this new technology inherent in the way that these artificial intelligence models may interact with society when deployed.
That second category of risk is a function of often a
how much society may trust the artificial intelligence and how reliable that artificial intelligence system may be.
Those two things can run afoul of what we may expect as consumers or as a government entity, completely agnostic of whether or not the system for which those AIs are deployed are actually cyber secure.
So a system can be completely cyber secure, but the AI model itself in interactions with other humans in society writ large may take an action that is unexpected and therefore result in some sort of disruption,
agnostic of a cyber security incident.
That's functionally the two categories, and that's a very broad breakdown of those two categories of risk.
So I'm going to keep my question just to that.
I think that we should talk offline because my legislation requires the 24-hour reporting requirement to Cyber Command, in which your testimony has some issues, and you talk about
how we're going to push this through to federal and state, and what specific role do they play in that, how can we make this better, but I will...
Relinquish that.
Thank you, Chair.
Thank you so much.