Milstein raises concerns about Intro 2602 third-party validation
Milstein explains Cyber Command's role protecting city infrastructure and raises concerns with Intro 2602, saying neither OTI nor Cyber Command has private-sector regulatory experience and deferring to DCWP on enforcement.
Our core mission is to make New York City the most cyber resilient city in the world, and we take this extremely seriously.
New York City is a target for cyber attacks with a technology landscape that is unparalleled among other cities and states.
This requires a unified, comprehensive defense against constant cyber threats.
Our key duties include setting information security policies and standards for the city, directing the city's citywide cyber defense and incident response,
deploying defensive technical and administrative controls, and providing guidance to City Hall and agencies on cyber defense.
In my fairly new role at OTI, it is a privilege to work with our staff and our agency partners in furtherance of this critical mission.
New York City Cyber Command's alignment within OTI has placed the team in a strong position to monitor and respond to wide-ranging cyber threats.
Cybersecurity is continuous work.
In my role, I'm confident we can continue to adapt to a constantly evolving threat landscape.
Simply put, New York City Cyber Command has a 24-7 apparatus in place to defend the city's systems from malicious attacks, regardless of the threat.
the origin.
With that in mind, pre-considered introduction of 2026-2602 would make it unlawful to market, offer for sale, sell or deploy an artificial model, an artificial intelligence model
in New York City that has not received third-party validation or does not have a technical capability to be shut down by a human operator.
The bill would require the director of the Office of Cyber Command to promulgate rules regarding what the third-party validation, assessments, certifications, and disclosure would entail and the qualifications for third-party validators.
To be clear, Cyber Command's core mission is to defend the City of New York's infrastructure from cyber attacks.
We are not subject matter experts on the qualifications for an entity to be considered a third-party validator.
Further, neither an OTI nor Cyber Command have experience regulating the private sector in the way that this legislation would require, and neither would be the best choice to lead this regulatory regime for consumer products.
We defer to DCWP to speak about the private sector policy and enforcement piece.
To that end, DCWP supports the intent of this legislation.
They recommend including robust record-keeping requirements to better allow the agency to conduct affirmative enforcement.
They also note, based on conversations with advocates and sister agencies, that the administration is not certain about the availability or ability of such businesses.
We look forward to hearing from those stakeholders.