Osse questions administration on preparedness for Australian-style hack

Council Member Osei, followed by Deputy Speaker Williams.

Thank you so much.

I just wanted to refer to the recent hacking situation in Australia.

That was proof that AI agents do have that ability to hack into our government systems.

As I'm sure you know, in June, a rogue OpenAI agent hacked into an Australian government statistics portal containing private data from Australia's universal healthcare system.

At this current moment, if a similar hack that happened to Australia

happened here in New York, do you feel that the city and the admin has a sufficient plan to defend against the hacks and protect any sensitive data?

And two, does the city currently have a responsive liaison from each of these companies to speak to in case of a hack?

To the first question, yes, we do have the people, process, technology, and some of the policies in place to deal with an incident similar to what happened in Australia.

The reason being is even though an AI was involved, the hacking process, the attack chain, if you will, happened in the same way that if a human being were to execute that attack, at the end of the day, the underlying infrastructure,

and we'll use air quotes here, doesn't actually care if the person at the other end of the keyboard is a human or a silicon-based entity.

The attack chain still remained functionally the same.

Therefore, our team is equipped and trained very specifically to identify these indicators of compromise, identify the attack patterns, and then be able to respond accordingly at multiple points.

So we are prepared to address those types of issues, and we do have points of contacts when we are working as city agencies with vendors who are under our contract

to engage with third parties as they get breached or if their product is the result of a breach.

So if they are under contract with the city by their service level agreements are required to keep us informed of when they have.

downtimes or when their products are involved in a breach.

Thank you for that response.

And in regards to my legislation on an emergency plan, and I know that you indicated that there is already a plan in case, you know, an emergency takes place.

Am I correct with that assumption?

Yes, so there are cyber incident response plans as well as my colleagues from NYSOM.

There is also ongoing work for risk response plans in general across the board, and that is for every category of risk that the city may deal with that might disrupt city infrastructure or city services.

Is that publicly available or is that?

Shared with the council?

No, that is by design.

We do not want to share that publicly because if that is the more public aware that someone is of an incident response plan, the more likely they can circumvent it.

That is something that you do want to keep close hold and classified.

Okay.

Thank you very much.

Thank you so much.

Councilmember Honey, followed by Deputy Speaker Williams.

I thought the deputy speaker was going before me, but anyways.

I'm sorry, I messed up.