Latest / The Chuck ToddCast / Interview Only w/ Miriam Vogel & Anne Neuberger - Can Government Effectively Regulate The AI Arms Race?

Transcript

Interview Only w/ Miriam Vogel & Anne Neuberger - Can Government Effectively Regulate The AI Arms Race? · The Chuck ToddCast

0:00
Speaker 1: This episode of the Chuck Todcast is brought to you
0:02
Speaker 1: by Wild Grain. Wild Grain is the first bake from
0:06
Speaker 1: frozen subscription box for sour dough breads, artisonal pastries, and
0:11
Speaker 1: fresh pastas, plus all the items conveniently baked in twenty
0:14
Speaker 1: five minutes or less. Unlike many store brought options, Wild
0:18
Speaker 1: Grain uses some simple ingredients you can pronounce and a
0:22
Speaker 1: slow fermentation process that can be a lot easier on
0:25
Speaker 1: your belly, little gut health there right, and richer in
0:28
Speaker 1: nutrients antioxidants. There's also no preservatives and no shortcuts. The
0:32
Speaker 1: Wild Grain boxes are fully customizable. In addition to their
0:35
Speaker 1: variety box, they have a gluten free box, a vegan box,
0:39
Speaker 1: and a new protein box. I will tell you I
0:42
Speaker 1: have done the gluten free box. I have done it
0:44
Speaker 1: a second time. I have also used the code, the
0:48
Speaker 1: todcast code. If you use the promo code toodcast at checkout,
0:52
Speaker 1: you get thirty dollars off. I've already used it as
0:55
Speaker 1: a gift to somebody else who loves this bread. It
0:58
Speaker 1: is hard to find good gluten free bread. It is fantastic.
1:02
Speaker 1: They give you step by step instructions.
1:04
Speaker 2: I really dig this.
1:06
Speaker 1: There is nothing like having an artesion bakery in your freezer.
1:10
Speaker 1: Right now, Wildgrain is offering my listeners thirty dollars off
1:12
Speaker 1: your first box plus free cryissants for life. Come on
1:17
Speaker 1: when you go to wildgrain dot com slash podcast to
1:20
Speaker 1: start your subscription today. That's thirty dollars off your first
1:23
Speaker 1: box and free croissants for life when you visit wildgrain
1:26
Speaker 1: dot com slash podcast, or simply use the promo code
1:30
Speaker 1: podcast at checkout. This is a sponsor I absolutely embrace,
1:35
Speaker 1: so use that code. Hello there, I'm Chuck Todd and
1:41
Speaker 1: welcome to another episode of Sunday Night Tonight. It's a
1:44
Speaker 1: one topic deep dive on artificial intelligence, and maybe the
1:49
Speaker 1: simplest way to frame the AI debate right now is this,
1:53
Speaker 1: Americans are being asked to trust a new technological revolution
1:56
Speaker 1: at a moment when they're not entirely convinced the last
2:00
Speaker 1: one worked out so well.
2:01
Speaker 2: Think about it.
2:02
Speaker 1: Search engines once felt empowering, social media once felt connective.
2:08
Speaker 1: Online marketplaces once felt simpler and more useful. But over time,
2:13
Speaker 1: many of those same technologies became harder to trust, distorted
2:16
Speaker 1: by algorithms, advertising, misinformation, polarization, and the constant incentive to
2:22
Speaker 1: monetize our attention. So when Selagon Valley tells the public,
2:26
Speaker 1: don't worry, this next technological leap will change everything for
2:30
Speaker 1: the better, it's understandable that many of us respond with
2:33
Speaker 1: a little skepticism, or maybe a lot of skepticism, because
2:38
Speaker 1: AI isn't some distant concept anymore. It's already shaping classrooms, workplaces,
2:43
Speaker 1: financial systems, warfare, and even the information we consume every day,
2:49
Speaker 1: which raises two very different but deeply connected questions. One,
2:54
Speaker 1: how do we protect consumers from AI? And two how
2:58
Speaker 1: do we protect country from AI? So tonight we're going
3:02
Speaker 1: to explore both sides of this challenge.
3:04
Speaker 2: Miriam Vogel joins me. First.
3:06
Speaker 1: She chairs the National AI Advisory Committee and leads an
3:10
Speaker 1: organization called Equal AI that's focused on governance, fairness, and
3:15
Speaker 1: consumer trust. She's trying to answer the question how do
3:18
Speaker 1: we build guardrails around AI before the technology outruns the
3:22
Speaker 1: public's confidence in it. Then I'll be joined by and
3:26
Speaker 1: Newburger on the issue of global security, because while Miriam
3:30
Speaker 1: Vogel is trying to make sure AI doesn't discriminate against
3:33
Speaker 1: you when you apply for a mortgage, and Newburger is
3:36
Speaker 1: trying to make sure that same technology isn't used by
3:38
Speaker 1: a foreign adversary.
3:40
Speaker 2: To shut down the bank.
3:41
Speaker 1: Altogether, it's the same technology, it's two completely different battlefields,
3:46
Speaker 1: and somewhere between innovation and regulation, between opportunity and fear,
3:52
Speaker 1: is the question governments around the world are now struggling
3:56
Speaker 1: to answer in real time, how do you govern a
3:58
Speaker 1: technology that evolves faster than governments themselves. Tonight's conversation comes
4:05
Speaker 1: to you from the Unconventional Diner. It's one of Washington's
4:09
Speaker 1: great neighborhood spots, known for taking classic American comfort food
4:12
Speaker 1: and giving it an inventive twist, which trankully feels like
4:16
Speaker 1: the perfect backdrop for a conversation about technology trying to
4:20
Speaker 1: reinvent itself in our everyday life.
4:23
Speaker 2: So let's get started. Very in Bogo. It's nice to
4:27
Speaker 2: see you.
4:27
Speaker 1: Let me start with tell me a little something about
4:31
Speaker 1: what equal AI is supposed to be.
4:34
Speaker 3: So we created equal AI seven and a half years
4:37
Speaker 3: ago because we saw the emergence of AI. We saw
4:40
Speaker 3: that there was a deep enthusiasm starting to root across
4:44
Speaker 3: the country and the globe, but without a lot of
4:47
Speaker 3: understanding of the potential risks and the need for guardrails,
4:50
Speaker 3: and so we created it that time more of a
4:53
Speaker 3: temporary place where companies, policymakers, lawyers, other key stakeholders could
4:59
Speaker 3: align on guardrails. How do we make sure that this
5:02
Speaker 3: really serves people? How do we contain risks and make
5:06
Speaker 3: sure that we can optimize use. So flash forward seven
5:09
Speaker 3: and a half years, it turns out we have not
5:11
Speaker 3: gone out of style in terms of meeting the big
5:15
Speaker 3: place to align on guardrails and best practices.
5:18
Speaker 1: The American electorates skepticism and AI seems very rational to me.
5:23
Speaker 1: When you look at Web one point zero search and commerce,
5:26
Speaker 1: the user experience at first was great, then the.
5:29
Speaker 2: User became the product.
5:30
Speaker 1: Social media, the initial launch seemed great, building up communities.
5:37
Speaker 1: Then what happened algorithms, the user becomes.
5:40
Speaker 2: The product, and so we don't like social media.
5:44
Speaker 1: We're more frustrated than ever with how the regular old
5:47
Speaker 1: Internet works, how Amazon or any of the online commerce
5:51
Speaker 1: marketplaces work.
5:53
Speaker 2: And so to me, it's very rational.
5:54
Speaker 1: They look at AI and, oh, great, yet another way
5:57
Speaker 1: that just is going to exploit us.
6:00
Speaker 3: I think you're absolutely right. We bring a lot of
6:03
Speaker 3: tech baggage to this conversation, and I think There's another
6:06
Speaker 3: layer of a problem here, and that's that we're not
6:08
Speaker 3: listening to people we're expecting them to adopt AI. We're
6:12
Speaker 3: talking about you say we.
6:14
Speaker 2: Who do you feel like you're speaking for when you.
6:16
Speaker 3: Say week leadership in general, corporate leadership, policymakers, I think
6:21
Speaker 3: civil society. I think we all need to do a
6:23
Speaker 3: better job of listening to people.
6:26
Speaker 2: Know.
6:26
Speaker 3: We've published a book in October called Governing the Machine
6:29
Speaker 3: where we outline nine categories of risk, and each of
6:32
Speaker 3: those categories is very meaningful, and we need to be
6:36
Speaker 3: taking those into account when we're talking about how people
6:38
Speaker 3: and why people should be using AI. So if your
6:42
Speaker 3: concern is privacy, we can't dismiss that. We need to
6:46
Speaker 3: talk about how we're going to address your privacy concerns
6:49
Speaker 3: before we can expect you to be using it. I
6:51
Speaker 3: think we need to be doing a better job of
6:54
Speaker 3: having a nuanced conversation where first of all, we're telling
6:57
Speaker 3: people how we're using AI. Too many people don't know
7:00
Speaker 3: that they have been using it all day, every day,
7:03
Speaker 3: unlocking their phones, meeting their news feeds, scrolling through social media.
7:07
Speaker 3: When to let people know that they are using it,
7:10
Speaker 3: then we need to let people know what safe use
7:13
Speaker 3: looks like. We need to be establishing what the frameworks
7:17
Speaker 3: are that companies and organizations are putting in place so
7:20
Speaker 3: they know who to trust and what trustworthy governance looks like.
7:24
Speaker 1: All of this makes sense, except it doesn't look like
7:26
Speaker 1: anybody in the industry is even remotely thinking about this.
7:30
Speaker 1: Whether it's Open AI, whether it's Plowed, whether it's the
7:36
Speaker 1: other Gemini, whether it's Rock everybody. I mean, when you
7:39
Speaker 1: look at the amount of money being invested in infrastructure
7:43
Speaker 1: to build out even more AI, that means there's a
7:46
Speaker 1: whole bunch of investors looking to get their money extract
7:48
Speaker 1: profits out of this. Nobody seems to be worried about guardrails.
7:52
Speaker 1: In fact, I look at the whenever a new update concept,
7:58
Speaker 1: it feels like, you know, there's how we so powerful.
8:02
Speaker 1: We're not sure we can you know, we're not sure
8:05
Speaker 1: that the new cybersecurity can handle it. It's like a
8:08
Speaker 1: marketing ploy, not actually a serious attempt to add actually
8:15
Speaker 1: doing baby steps.
8:16
Speaker 3: Well, you're not wrong. A report last year from McKenzie
8:18
Speaker 3: said that over eighty eight percent of companies are using
8:21
Speaker 3: AI in at least one pivotal function that was a
8:24
Speaker 3: year ago. It's probably a much higher number now, but
8:27
Speaker 3: at that point only a third had any AI governance
8:30
Speaker 3: in place. The World Economic Forum had a report earlier
8:33
Speaker 3: this year that said only less than one percent of
8:37
Speaker 3: companies have strong AI governance frameworks in place. So you
8:41
Speaker 3: are correct that it is not something we're seeing a
8:44
Speaker 3: lot of our hearing a lot about. Although I have
8:47
Speaker 3: the privilege of working with companies that really do prioritize
8:50
Speaker 3: AI governance, so I can tell you the good news
8:53
Speaker 3: is there is alignment across industry for companies, for leaders
8:58
Speaker 3: that care about AI governance. You'll not see a lot
9:00
Speaker 3: of distinction between what those best practices are across the
9:05
Speaker 3: companies and organizations that have strong AI governance frameworks. You'll
9:09
Speaker 3: see visibility into how they're using AI. You'll see accountability
9:13
Speaker 3: from the top. It has to start at the top,
9:16
Speaker 3: but then across divisions so people understand who's the point person,
9:20
Speaker 3: what they should be looking for. You'll see not just
9:23
Speaker 3: AI principles, but operationalization.
9:25
Speaker 1: I feel like you're describing what a company that might
9:29
Speaker 1: adopt an AI platform into their business and integrate it,
9:33
Speaker 1: that they may be taking care in trying to do
9:37
Speaker 1: these things.
9:38
Speaker 2: That's not who I'm talking about. I'm talking about.
9:40
Speaker 1: The purveyors themselves, whether it's Open AI, Anthropic Google, with
9:45
Speaker 1: Gemini or ix whatever we're calling the elon of musk
9:51
Speaker 1: operation these days. What evidence that there is any interest
9:57
Speaker 1: in good governance in those far entities.
9:59
Speaker 3: I can tell you the ones that I work with
10:01
Speaker 3: so in our Badge program for senior executives, in our
10:04
Speaker 3: agentic AI summit we had this week, we have some
10:07
Speaker 3: of the best minds at Google, Deep Mind, at AWS
10:10
Speaker 3: and Amazon Microsoft who are being very intentional about their
10:14
Speaker 3: governance frameworks. You can look online to see what they've implemented.
10:18
Speaker 3: You can talk to their senior executives who will be
10:20
Speaker 3: very well versed in what they are doing intentionally and
10:24
Speaker 3: across their companies to make sure they have strong governance
10:26
Speaker 3: in place. But I don't want to dismiss the deployer
10:29
Speaker 3: role because most of their applications that will have access
10:32
Speaker 3: to and that we're currently using, are from those large
10:36
Speaker 3: companies small companies that are using AI who also have
10:39
Speaker 3: a key role in making sure that it's safe.
10:43
Speaker 1: If the industry is so concerned about governance, why are
10:47
Speaker 1: they fighting Why are they fighting state based regulation? Why
10:50
Speaker 1: is it so important to them to convince the Trump
10:52
Speaker 1: administration to do whatever it takes to prevent.
10:57
Speaker 2: What many of us refer to as the laboratories of democracy.
10:59
Speaker 1: In state government's figuring out a way to protect consumers.
11:02
Speaker 2: From a state level.
11:04
Speaker 3: Yeah, and it's a fair question. I think, first of all,
11:07
Speaker 3: there's nuance in what different companies are and are not
11:09
Speaker 3: pushing for. But to your question about state versus federal
11:14
Speaker 3: I'm a former general counsel, so I have sympathy into
11:16
Speaker 3: how hard it is to respond to a patchwork of laws.
11:19
Speaker 3: I think it's in everyone's best interest that there're certainty
11:22
Speaker 3: and clarity, not just across the country, but across the globe.
11:25
Speaker 3: I mean, we're talking about AI. It doesn't have boundaries,
11:28
Speaker 3: and users across the globe are going to need that
11:31
Speaker 3: it's safe and lawful. So the war we have clarity
11:34
Speaker 3: and certainty and uniformity, the easier it is to be compliant.
11:39
Speaker 1: I understand that. But if you have a dysfunctional Congress,
11:44
Speaker 1: it is not a functioning body of government. They're at
11:48
Speaker 1: war with each other. You have a we don't have
11:52
Speaker 1: a federal government interested in these safeguards, So why step
11:55
Speaker 1: on the state governments from Trump.
11:58
Speaker 3: I can't speak to that. What I can say is
12:00
Speaker 3: I do personally have some great experience of good things happening,
12:05
Speaker 3: the very thoughtful, proactive things happening in the government space.
12:09
Speaker 3: So for instance, at our agentic AI summit this week,
12:12
Speaker 3: we got to talk with the Acting Secretary of Labor
12:16
Speaker 3: who's being very forward thinking and proactive about preparing the
12:19
Speaker 3: workforce and employers for an AI economy. They have an
12:23
Speaker 3: AI literacy framework. Most people don't know what AI literacy is,
12:27
Speaker 3: and so they've broken it down for employers so they
12:29
Speaker 3: can adopt and learn from this framework. They have text
12:33
Speaker 3: based AI literacy tools, and that's really important because when
12:36
Speaker 3: we're thinking about AI literacy, not every American has access
12:41
Speaker 3: to Wi Fi, and so if you have an application online,
12:46
Speaker 3: many people will not have access to it. So they've
12:48
Speaker 3: created a digestible text based program where people can get
12:52
Speaker 3: a ten minute overview and introduction to AI. That will
12:55
Speaker 3: not make everybody AI ready workforce in terms of being
12:59
Speaker 3: an end and neuro computer scientists, but at least gets
13:02
Speaker 3: people over the hump of knowing what AI is and
13:04
Speaker 3: how they're using it.
13:05
Speaker 2: I feel like we're trying to do multiple things here.
13:08
Speaker 1: That sounds like we're on the education side, how to
13:11
Speaker 1: get people up to speed, how to get people comfortable
13:13
Speaker 1: with using if it was like trying to teach me
13:15
Speaker 1: a body, he's a personal computer. Well, what about the
13:19
Speaker 1: consumer protection side? And that's where it seems as if
13:24
Speaker 1: the industry is petrified of any attempt at a regulation
13:29
Speaker 1: that's consumer protection because they say, well, that's stepping on
13:32
Speaker 1: our ability to be able to either beat China in
13:38
Speaker 1: the AI race or keep up with China.
13:41
Speaker 3: You're right, we need to have our eye on the
13:43
Speaker 3: state houses and the congresses across the globe to understand
13:47
Speaker 3: what new laws are coming down. But we also should
13:50
Speaker 3: not lose sight where I think most of this plays out,
13:53
Speaker 3: and that's in the courthouses. I think most of how
13:56
Speaker 3: AI is regulated will come down to how courts are citing,
14:00
Speaker 3: how current laws on the books will be applied to
14:03
Speaker 3: AI use. We have three chapters in the book on
14:06
Speaker 3: how different countries across the globe have laws currently in
14:12
Speaker 3: place that will be impactful. We've seen it play out
14:15
Speaker 3: in IP and copyright that will only increase in the
14:17
Speaker 3: years to come. We've seen it in several other privacy
14:22
Speaker 3: areas and so forth. I think we can expect.
14:24
Speaker 2: All eminating out of Europe.
14:26
Speaker 3: Right we have no way of case law here in
14:27
Speaker 3: the US as well. For sure, I think will increasingly
14:31
Speaker 3: see towards law consumer protection laws, contract laws where we'll
14:37
Speaker 3: be deciding who has liability because the lawyers are catching
14:40
Speaker 3: on to this and they will make sure that there
14:44
Speaker 3: is liability for those that are taking their eye off
14:46
Speaker 3: the ball in terms of safety and what the negative
14:51
Speaker 3: risks and impacts could result in.
14:52
Speaker 1: Let's assume we had a functioning, feral legislative branch that
14:58
Speaker 1: was going to look at this not as seeing which
15:00
Speaker 1: side is going to contribute the most amount of money
15:02
Speaker 1: to their mentor, because that's the other part of this.
15:04
Speaker 1: All of the AI associated super PACs I think are
15:09
Speaker 1: sort of warping the conversation on regulation. Let's assume we
15:12
Speaker 1: didn't have this political cloud hanging over what would what
15:20
Speaker 1: is a recommendation of what first step regulation.
15:24
Speaker 2: Would look like with AI bodels and what.
15:29
Speaker 1: Entity in the government is best equipped to regulate these ais.
15:34
Speaker 3: It's a great question. I think there's more. We need
15:39
Speaker 3: more certainty on what the expectations are out of companies.
15:43
Speaker 3: We need to understand The basic question with AI use
15:48
Speaker 3: that we always need to be able to answer, which
15:50
Speaker 3: is for who could this fail? We need to make
15:52
Speaker 3: sure that AI deployment are designed around thinking about what
15:56
Speaker 3: the human use cases are and what the actual application are.
16:00
Speaker 3: And I think there's a role for every agency and government.
16:04
Speaker 3: They're all going to be using AI personally if they're
16:06
Speaker 3: not already. We know there's an executive order mandating it's
16:09
Speaker 3: being used across agencies as well as the oversight, but
16:12
Speaker 3: I don't want to lose sight of the other ways
16:15
Speaker 3: that this is where leadership is popping up. So with
16:19
Speaker 3: Equal AI, we've been doing an AI literacy tour across
16:22
Speaker 3: the country to listen to people, to hear what they're seeing,
16:25
Speaker 3: what they're worried about, but also to elevate leadership. What
16:29
Speaker 3: it looks like when AI leadership is what it looks
16:35
Speaker 3: like when we have AI leadership. So for instance, we've
16:37
Speaker 3: been to Tennessee, We've been to Arizona. We're having conversations
16:42
Speaker 3: and cities across the country where we're seeing mayors who
16:45
Speaker 3: are using it for smart traffic management, creating resource hubs
16:49
Speaker 3: so that small businesses are in touch with academics, training,
16:53
Speaker 3: our next gen, but also getting small businesses AI ready.
16:57
Speaker 3: I think there's a lot of tools that we have
17:00
Speaker 3: now at our disposal where we have foundations of leadership,
17:04
Speaker 3: and so we just need to understand what does that
17:06
Speaker 3: look like. You know, at ASU where they are leaning
17:09
Speaker 3: into AI USE, they're giving students the capabilities of generative
17:14
Speaker 3: models and that even how will I am teaching augentic
17:18
Speaker 3: AI used to their students. So I think we actually
17:22
Speaker 3: have a lot of opportunities for leadership that we shouldn't
17:25
Speaker 3: be overlooking.
17:25
Speaker 1: I hear you, but this I mean talk about scattershot
17:28
Speaker 1: like we just described, seems the scatter shot and frankly,
17:35
Speaker 1: and again I'm liking you'd like defend all of these
17:37
Speaker 1: and and I don't. I don't mean to try to
17:40
Speaker 1: put you on the defensive, but it does appear to
17:43
Speaker 1: be that it's all scattershot, and it's really those that
17:46
Speaker 1: have the ability to to maybe even curiosity to be
17:52
Speaker 1: first movers and to learn this stuff. We'll do it,
17:56
Speaker 1: but we I mean, it does feel as if this
17:59
Speaker 1: is way ahead of anny guardrails that are even remotely
18:02
Speaker 1: ready to be used.
18:04
Speaker 3: You know, I think you're getting at something check that
18:06
Speaker 3: we need to be prepared for AI is a disruptor,
18:10
Speaker 3: and I think we need to look at this as
18:12
Speaker 3: a disruption for good. We can't operate in silos anymore.
18:15
Speaker 3: AI connects us all and makes us all dependent on
18:19
Speaker 3: one another to ensure that we know how each other
18:22
Speaker 3: fit into the use cases. We can't imagine that only
18:26
Speaker 3: within our company are we going to be impacted by
18:28
Speaker 3: our AI use We can't imagine only within our state.
18:31
Speaker 3: There's overlap across boundaries when we're talking about AI, and
18:34
Speaker 3: so we're going to have to break silos. We're going
18:36
Speaker 3: to have to rethink culture in organizations where you can't
18:40
Speaker 3: just you know, pinpoint which agency or which department is
18:45
Speaker 3: in charge of AI. It is across organizations, it is
18:49
Speaker 3: across states, and you're right, it's dissipated. It's not the
18:52
Speaker 3: way we're constructed. But we're going to have to rethink that's.
18:55
Speaker 2: Talking about it.
18:57
Speaker 1: I guess, agentic AI, do you really think we're ready
19:02
Speaker 1: for AI to make decisions without a human interface.
19:06
Speaker 3: I think there are a lot of concerns about the
19:10
Speaker 3: state of readiness with agentic AI because of the statistics
19:14
Speaker 3: we talked about that if less than one percent of
19:17
Speaker 3: companies have strong AI governance in place, they are not
19:20
Speaker 3: prepared for AI deployment, let alone agentic AI deployment. I
19:25
Speaker 3: mentioned we had an agentic AI summit this week where
19:28
Speaker 3: we were looking at what is the optimal use cases
19:31
Speaker 3: of a dentic AI. What does it look like if
19:33
Speaker 3: we get this right. We looked at challenges, We looked
19:37
Speaker 3: at the map between where we are today and how
19:40
Speaker 3: we will need to prioritize the steps to get to
19:43
Speaker 3: the optimal end state. And you could only do this
19:46
Speaker 3: if you have strong governance in place. And again, I
19:49
Speaker 3: think we need to break down what we mean by governance.
19:52
Speaker 3: You know, too many people think it's a government responsibility
19:55
Speaker 3: or a stop gapped innovation. We really need to understand
20:00
Speaker 3: that governance is something that leadership needs to be held
20:04
Speaker 3: accountable for and take ownership of whatever your organization is
20:08
Speaker 3: because you're going to be using AI, and we need
20:11
Speaker 3: to be realizing that it is the norms, the culture,
20:14
Speaker 3: the practices that build trust and really unlock the benefits
20:19
Speaker 3: of this innovation.
20:20
Speaker 1: Is you know, and this could happen because of the
20:25
Speaker 1: populist backlash that I think is coming right now with AI.
20:27
Speaker 2: Right some of it has to do with what I
20:29
Speaker 2: talked about with social.
20:30
Speaker 1: Media, Others will be fear of AI job displacement, and
20:33
Speaker 1: you can just feel that there is certainly exploitable anger
20:36
Speaker 1: out there in our politics that you could see if
20:39
Speaker 1: Congress passed the law next that said no AIP, you
20:46
Speaker 1: cannot use agentic AI.
20:51
Speaker 2: Period.
20:51
Speaker 1: There has to be a human interface at the very
20:54
Speaker 1: very end, whether it's confirming a purchase, confirming a decision,
21:01
Speaker 1: that it cannot be.
21:02
Speaker 2: Left only to.
21:05
Speaker 1: The AI platform.
21:08
Speaker 2: What would the industry say to something.
21:11
Speaker 3: I think it would say that you're a little late
21:12
Speaker 3: because it is being deployed. So we cannot slow down innovation.
21:17
Speaker 3: We can speed up governance. That's our only option. Governance
21:22
Speaker 3: is the seatbelts in a car. It's the speed limits.
21:26
Speaker 3: It's knowing there's a doometer. We wouldn't get in a
21:28
Speaker 3: car if we wouldn't if we weren't sure that we
21:32
Speaker 3: had these.
21:32
Speaker 1: The industry bought seatbelts literally until the debts piled up.
21:37
Speaker 1: I mean, are we going to have the industry fight
21:40
Speaker 1: regulation literally until there are what we have right now
21:45
Speaker 1: with social media, a pile up of lawsuits that hey,
21:48
Speaker 1: they made a defective product.
21:51
Speaker 3: Well that's why we need to have more of alignment
21:54
Speaker 3: on what these best practices are, What are the safeguards
21:57
Speaker 3: that everyone should be adopting when they're you using AI,
22:00
Speaker 3: because then we know what it looks like to be
22:03
Speaker 3: doing this well. I think at the end of the day,
22:06
Speaker 3: we've seen time and again that people will not adopt innovation.
22:11
Speaker 3: I mean, look at the ROI on investment. You see
22:13
Speaker 3: tremendous investment in AI. We're not seeing the ROI for
22:17
Speaker 3: many companies, and I'm very convinced, and the data show
22:21
Speaker 3: it's because they don't have governance in place and because
22:24
Speaker 3: they haven't taken the time to deploy AI literacy.
22:28
Speaker 1: Is there anything to be learned as as we try
22:31
Speaker 1: to catch up on governments governance with AI, about.
22:34
Speaker 2: What we didn't do with social media?
22:37
Speaker 3: Yeah, there's a lot of lessons to be learned. Where
22:39
Speaker 3: to begin, We need to first of all understand the
22:44
Speaker 3: pace we are. We moved quickly with social media. I
22:50
Speaker 3: think that innovation was adopted with record speed. For our
22:55
Speaker 3: past innovations, usually it takes decades for adoption. That happened
22:58
Speaker 3: in a pretty integrated way within a decade. Within less
23:01
Speaker 3: than that, AI will continue to scale at a pace
23:05
Speaker 3: that is exponentially higher than that, So I think any
23:08
Speaker 3: comfort people can take in waiting should be disabuse. There's
23:14
Speaker 3: no opportunity to wait. AI is being used in our
23:19
Speaker 3: daily life every day. It is being used in our workplaces,
23:22
Speaker 3: and so there needs to be a clear path towards
23:26
Speaker 3: ensuring its safety and ensuring there's more agency, more people
23:30
Speaker 3: understand why and how to use AI. I mean, we're
23:33
Speaker 3: seeing these very problematic adoption gaps, not just across the
23:36
Speaker 3: fifty percent of the US that is not interested in
23:40
Speaker 3: adopting AI, but we see a gender gap in age gap,
23:44
Speaker 3: education and wealth, and even a regional gap where in
23:48
Speaker 3: the middle of the country there's more anxiety towards AI
23:52
Speaker 3: than on the coasts. These are all understandable. It's communities
23:55
Speaker 3: that have deep concerns that need to be heard and
23:58
Speaker 3: addressed before they're going to be willing to use AIA.
24:02
Speaker 2: Have you had any luck with the AI.
24:05
Speaker 1: Platform companies in understanding what they have or do you
24:09
Speaker 1: feel like they're just in a hurried anyday.
24:12
Speaker 3: I think there's several conversations going on right now. There's
24:15
Speaker 3: certainly that competition once amongst one another, with amongst.
24:21
Speaker 1: Us open AYE trial, it's not reassuring to watch all
24:28
Speaker 1: of this sort of dirt get circulated out, but you're
24:31
Speaker 1: just sitting there going it's just a bunch.
24:34
Speaker 2: Of people trying to make more money off of us.
24:35
Speaker 1: Again, this doesn't feel like anybody's actually been concerned about
24:38
Speaker 1: what the technology.
24:39
Speaker 2: Is going to do to the public.
24:41
Speaker 3: Well, I think the more we can do to empower
24:43
Speaker 3: the public, policymakers, lawyers to understand what good outcomes look like,
24:49
Speaker 3: the better off we are. I think you know it's in.
24:53
Speaker 2: You're right.
24:53
Speaker 3: It's an interesting look into what's happening under the hood.
24:56
Speaker 3: But again, people have agency here and there's many yders
25:00
Speaker 3: across the spectrum. Journalists have brought it to account many
25:04
Speaker 3: of the AI use cases that have been problematic, and
25:07
Speaker 3: that's where you see changes. So the more there's clarity
25:10
Speaker 3: in what good looks like and the more we're able
25:12
Speaker 3: to pressure test what some of these problematic outcomes look like,
25:17
Speaker 3: the more we can have our expectations in place. But again,
25:20
Speaker 3: I wouldn't lose sight of some of the forces, the
25:24
Speaker 3: market forces we have in place, whether it's ROI or
25:27
Speaker 3: the litigation we're seeing increasingly in the courts. Last year
25:30
Speaker 3: there was a the AI Index report. They said there
25:34
Speaker 3: was a six times increase in litigation over sixty years.
25:37
Speaker 3: I'm curious to see how much exponentially higher that is.
25:40
Speaker 1: Now, all right, let's try to let's try to end on.
25:44
Speaker 1: Give me some best practices of entities out there that
25:49
Speaker 1: do seem to be prioritizing governments.
25:51
Speaker 3: When you're seeing governance, there's at least five overlapping indicators.
25:57
Speaker 3: There's visibility. Most companies have not done a survey to
26:01
Speaker 3: understand where they are using AI across enterprise.
26:06
Speaker 1: You think there's some companies their CEO doesn't even know where, yeah,
26:09
Speaker 1: AI is being deployed.
26:11
Speaker 3: It was a very problematic study out a year ago
26:14
Speaker 3: where they looked for at HR uses of AI, which
26:18
Speaker 3: is one of the most predominant use cases of AI.
26:21
Speaker 3: They surveyed the global companies and about eighty eight percent
26:24
Speaker 3: of the chief HR officers confirm their using AI in
26:27
Speaker 3: HR functions. At those same companies, about sixty two sixty
26:31
Speaker 3: four percent of CEOs indicated they were using AI and
26:34
Speaker 3: their HAAR functions. Forty eight percent of general counsels indicated
26:39
Speaker 3: the same. So, yes, I think there is a huge
26:43
Speaker 3: problem of people not knowing, not having visibility into how.
26:46
Speaker 2: AIS is inside their own.
26:49
Speaker 3: Inside their own companies. We can do this in our
26:51
Speaker 3: own homes too. Second of all, you have to have accountability.
26:56
Speaker 3: You have to have someone in your C suite who
26:58
Speaker 3: cares about this, who takes ownership of this, who make
27:00
Speaker 3: sure that there's the budget. But even equally important is
27:04
Speaker 3: that there's alignment across dvice. Too many people think that
27:07
Speaker 3: this is the innovations of the past where you can
27:10
Speaker 3: assign it to one department, and AI doesn't work that way.
27:13
Speaker 3: AI is in every news media.
27:15
Speaker 1: Will have a digital team. It's like all media is
27:17
Speaker 1: on digital. I remember thinking that back then. So, yeah,
27:21
Speaker 1: there's such an AI team. It's like saying you're going
27:25
Speaker 1: to have a deskot you.
27:26
Speaker 3: Got it, you got it. You have to have that
27:30
Speaker 3: C suite level buy in and interest. But then you
27:34
Speaker 3: also need that because a lot of this is going
27:36
Speaker 3: to play out in the front lines. Your employees, your
27:39
Speaker 3: consumers are going to find some of the errors play out,
27:43
Speaker 3: and you need them to know who to report them
27:45
Speaker 3: to and that it's safe to be reported up.
27:47
Speaker 1: The play is the realistic first regulation, then just simply transparency.
27:53
Speaker 3: Transparency. I think that's a complicated issue because it has
27:56
Speaker 3: to be stated in such a way that could be
27:58
Speaker 3: understood meaningfully.
28:00
Speaker 2: Take surveillance pricing.
28:02
Speaker 1: I know New York State passed the law about surveillance
28:04
Speaker 1: pricing that if it was done with AI, it had
28:07
Speaker 1: to be set how to say, so New York does
28:10
Speaker 1: this regulation. But even if you got to know it
28:13
Speaker 1: was a good example to wash the post, it had
28:16
Speaker 1: to put a little disclaimer that they were using surveillance
28:20
Speaker 1: pricing on their subscription services. And somebody who lived in
28:23
Speaker 1: Oklahoma got that warning even though Oklahoma didn't have that law.
28:27
Speaker 2: New York State has that law.
28:29
Speaker 1: But it felt like, well, all right, that's a case
28:31
Speaker 1: where transparency at least is a way to at least
28:34
Speaker 1: give the consumers something.
28:36
Speaker 3: Transparency is a start, but we don't want the human
28:39
Speaker 3: fatigue of checking I'll accept the cookies so I can
28:42
Speaker 3: get quickly to the website of where I want to go,
28:45
Speaker 3: And we don't want it to be written in a
28:48
Speaker 3: way that they can't understand. So I think absolutely transparency
28:52
Speaker 3: is key. Where are you using AI? What have you
28:55
Speaker 3: tested for? I mean, let's talk about in the medical
28:57
Speaker 3: use cases, which are some of the most exciting use
28:59
Speaker 3: cases of it. If you're going to tell me that
29:01
Speaker 3: your cancer detection is eighty eight percent successful. I need
29:05
Speaker 3: to know for whom I need to know if that
29:07
Speaker 3: is true for the patients that you're talking to. Was
29:10
Speaker 3: were they appropriately represented in the satisfaction rate and the
29:14
Speaker 3: success rate of that product? For whom could this fail?
29:19
Speaker 1: How are we going to get most regulation due to
29:21
Speaker 1: court fights rather than due to legislation?
29:23
Speaker 2: Is that true? Is that real mean? And what that
29:26
Speaker 2: means is civil litigation.
29:27
Speaker 3: I think in the short term there's a lot happening
29:30
Speaker 3: in the courts that people should not overlook, a lot
29:32
Speaker 3: that will impact their use, their rights, their company. That
29:36
Speaker 3: if they are not keeping their eye on what's happening
29:38
Speaker 3: across the country and frankly across the globe in the courthouses,
29:42
Speaker 3: they're missing a lot of the liabilities they will be
29:44
Speaker 3: walking into if they do not have good governance in place.
29:47
Speaker 1: Well, I'll say this, if you're a legislator and you're
29:49
Speaker 1: watching this, get our booked, because it does sort of
29:55
Speaker 1: in a very thought in a good way, layout sort
29:58
Speaker 1: of how garden You're trying to figure out what grdros
30:02
Speaker 1: to build and I feel like your book does sort
30:05
Speaker 1: of layout.
30:06
Speaker 2: Okay, if you want to do this, Cardrail, this is
30:07
Speaker 2: the way to do it. Thank you, check Ary, appreciate.
30:10
Speaker 3: You saying that, thank you so much for having me.
30:15
Speaker 2: Well.
30:15
Speaker 1: This episode of the Chuck Podcast is brought to you
30:17
Speaker 1: by ship Station. When your company is growing fast, order
30:21
Speaker 1: fulfillment can make or break your success. Ship Station's intelligence
30:25
Speaker 1: driven platform brings order management, rate shopping, inventory and returns,
30:31
Speaker 1: warehouse systems, and comprehensive analytics all in one place, saving
30:35
Speaker 1: customers fifteen hours per week on fulfillment and guess what
30:39
Speaker 1: time is money? So with shipstation, everything you need to
30:42
Speaker 1: manage getting orders to customers is in one place. You
30:45
Speaker 1: connect to over two hundred sales channels instead of five
30:49
Speaker 1: to seven disconnected tools, you've got one. Shipstation compares rates
30:53
Speaker 1: across all major global carriers, United States, Postal Service UPS
30:57
Speaker 1: and fed X, including your own discount rates. That's pretty
31:01
Speaker 1: good if you have them to find you the best
31:03
Speaker 1: shipping option on every order and discounts up to ninety
31:07
Speaker 1: percent off set up time saving automation. Ship Station picks
31:11
Speaker 1: the best carrier, finds you the best rate, prints labels
31:14
Speaker 1: in bulk, sends tracking updates, and you're done. One million
31:18
Speaker 1: businesses have trusted ship station trust me. I have a
31:21
Speaker 1: little side hustle on sports cards.
31:23
Speaker 2: I think I've mentioned it a few times.
31:25
Speaker 1: The most annoying part is the shipping and if stuff's convoluted,
31:31
Speaker 1: you can't get it done. And that's the beauty of
31:33
Speaker 1: shipstation is it essentially streamlines that shipping process. So try
31:39
Speaker 1: shipstation free for sixty days with full access to every
31:43
Speaker 1: feature I just talked about. No credit card is needed.
31:45
Speaker 1: You go to shipstation dot com and you use the
31:48
Speaker 1: code podcast to get those sixty days for free. Sixty
31:52
Speaker 1: days gives you plenty of time to see exactly how
31:54
Speaker 1: much time and money you're going to be saving on
31:56
Speaker 1: every shipment. So that's shipstation dot com.
32:00
Speaker 2: Toodcast.
32:01
Speaker 1: Shipstation dot com use the code toodcast. All right, you
32:09
Speaker 1: have transitioned from governments into the private sector. Still in
32:13
Speaker 1: the AI space, let's talk about AI security, especially we've
32:17
Speaker 1: got this China summit coming up between She and Trump
32:20
Speaker 1: and apparently AI governance is now going to be on
32:24
Speaker 1: the agenda. So let's start there. What should global AI
32:29
Speaker 1: governance look like between superpowers and how? And is nuclear
32:33
Speaker 1: proliferation or non proliferation the model?
32:39
Speaker 4: So, first of when we think about AI security, there's
32:41
Speaker 4: really two lenses to think about it through. One is
32:45
Speaker 4: the risk that AI brings, for example, in accelerating the
32:50
Speaker 4: depth and speed of cyber attacks.
32:53
Speaker 5: And the second is the risk of AI.
32:55
Speaker 4: If models are not secure, if models can be poisoned
33:00
Speaker 4: and of themselves. And then if they're embedded into whether
33:02
Speaker 4: it's a decision about whether to loan somebody money or a.
33:05
Speaker 5: Decision about we're in the electricity.
33:07
Speaker 4: Grid, thank you so much. One optimizes, then they bring
33:13
Speaker 4: additional risks. So we think about it in.
33:14
Speaker 5: Both of those lenses.
33:16
Speaker 4: And to your point about global governance, it's the question
33:19
Speaker 4: we used to have often about cyber governance.
33:23
Speaker 5: What are the rules in the room? How can countries
33:26
Speaker 5: use these dual use technologies.
33:27
Speaker 4: They're both defensive they help us secure infrastructure, for example,
33:31
Speaker 4: and they're offensive they help between countries. They may be
33:35
Speaker 4: used offensively in the context of a crisis or conflict
33:37
Speaker 4: to destabilize infrastructure. So what should the rules that they
33:40
Speaker 4: will be when fundamentally there are no borders of the rules.
33:43
Speaker 1: Well, it's similar to nukes, right, we had nuclear energy
33:46
Speaker 1: and one set of rules versus nuclear weapons, right, positive
33:49
Speaker 1: and negative.
33:52
Speaker 4: It's very different in that it is a private sector
33:55
Speaker 4: developed technology that's broadly available, versus nukes that are primarily
34:00
Speaker 4: developed by governments with very strict rules around.
34:03
Speaker 1: For the funny you say that, I've talked to I
34:05
Speaker 1: have a retired general friend of mine who is obsessed
34:11
Speaker 1: with the fact that he thinks AI never should have
34:14
Speaker 1: been allowed to be developed with the private sector first,
34:18
Speaker 1: that there always should have been like with nuclear technology,
34:22
Speaker 1: where it was essentially government driven with academic research and
34:26
Speaker 1: sort of bringing the private sector into the government sphere
34:29
Speaker 1: and the internet itself private sector into the government sphere.
34:34
Speaker 2: It's too late to go there now with AI. But
34:36
Speaker 2: was that a mistake?
34:38
Speaker 5: You know?
34:38
Speaker 4: The power of the American innovation system is that we
34:42
Speaker 4: have the laws, the financial markets, and the investment in
34:48
Speaker 4: R and D that happens in the private sector. That
34:49
Speaker 4: means technology, drug R and D, drugs is primarily coming
34:53
Speaker 4: out of the private sector. Yes, there's some investment from government,
34:57
Speaker 4: but it's mostly there. So I think the strength of
34:59
Speaker 4: our system is that innovation comes out of the private sector.
35:03
Speaker 5: So should have could a? I think it's just it's it.
35:08
Speaker 2: Doesn't matter what the philosophy is.
35:11
Speaker 6: We are where we are, so so let's talk about
35:15
Speaker 6: you talk about cyber and a global and you try
35:20
Speaker 6: you develop something in the Biden.
35:22
Speaker 2: Administration having to do with at least coming to a
35:26
Speaker 2: collective agreement on rants.
35:28
Speaker 1: Explained absolutely, because it is gold apply for AI, right, it's.
35:32
Speaker 5: An interesting approach. You're right to apply to AI. You know.
35:35
Speaker 4: So in the past we would often think about the
35:37
Speaker 4: big risk of cyber as espionage. We talked for years
35:40
Speaker 4: about how China was growing at strategic technology sector by
35:44
Speaker 4: stealing intellectual property from America. And you know, governments have
35:48
Speaker 4: been trying to steal each other's secrets.
35:51
Speaker 5: Whether as human assets is five. But if we say
35:54
Speaker 5: that moved to digital because it's so much easier. You
35:56
Speaker 5: don't have to get a guy into a as old
35:58
Speaker 5: as a country.
35:59
Speaker 2: Bad borders on countries, it exactly.
36:01
Speaker 1: I'm sure the feudal lords were also spying on each other,
36:04
Speaker 1: and it's.
36:05
Speaker 5: So much easier in cyberspace.
36:06
Speaker 4: You don't have to get a human past a fingerprint
36:09
Speaker 4: check into a country. So that was the way we
36:12
Speaker 4: looked at it. It changed with the advent of two things.
36:16
Speaker 4: One is cryptocurrency and the second a criminal ecosystem that
36:21
Speaker 4: essentially built out cyber tools and that enable them to
36:28
Speaker 4: use those tools to disrupt companies, infrastructure, hospitals around the
36:33
Speaker 4: world and get.
36:33
Speaker 5: Paid for it easily.
36:34
Speaker 2: It's the so called dark web, the dark.
36:37
Speaker 4: Web plus the financing right, because the dark web is
36:41
Speaker 4: a way that people can just communicate outside the formal
36:45
Speaker 4: Internet ecosystem. Essentially, as you know, every IP address has
36:49
Speaker 4: a matching mean that makes it easier for us to
36:52
Speaker 4: find Amazon dot Com without necessarily knowing its Internet.
36:54
Speaker 2: For right, everybody's address exactly right.
36:57
Speaker 4: On the Internet dark web, there's just the addresses without
36:59
Speaker 4: the to who it is, so people have to know
37:01
Speaker 4: where they're going. What changed in ransomware, to your point,
37:05
Speaker 4: was that you had a criminal ecosystem that now had
37:08
Speaker 4: a way to move money outside traditional banking systems. And
37:11
Speaker 4: in many ways, while there are rules around cryptocurrency anti
37:14
Speaker 4: money laundering done by the Financial Action Task Force, they
37:18
Speaker 4: are not implemented around the world for various reasons. So
37:21
Speaker 4: as a result, you would have these safe and some
37:24
Speaker 4: countries provided safe haven. So Russia, for example, looked away
37:28
Speaker 4: or quietly enabled criminals with some ties to their.
37:35
Speaker 2: Korea.
37:35
Speaker 1: There was a whole sort of access of maybe unfriendly
37:39
Speaker 1: countries to.
37:40
Speaker 4: The West that were doing this right exactly, and those
37:43
Speaker 4: actors ended up disrupting infrastructure to get paid a ransom,
37:47
Speaker 4: and in many cases, like when you think about Britain's
37:49
Speaker 4: National Health system, disrupted the operations of hospitals.
37:52
Speaker 5: So to them, they're ready to pay.
37:54
Speaker 4: So the debate became while for one entity paying a
37:58
Speaker 4: ransom could be the fastest way to get back online,
38:00
Speaker 4: every payment fuels the ecosystem, right, So overall we're enabling
38:05
Speaker 4: these attackers to do more and more of these attacks.
38:08
Speaker 4: It's essentially incentivizing them. So in the last administration, we
38:12
Speaker 4: formed something called the Counter Ransom Initiative. We said, we
38:15
Speaker 4: need a way to coordinate among countries to put it
38:18
Speaker 4: in place the practices, getting countries to implement anti monitor
38:21
Speaker 4: laundering rules for cryptocurrency, disrupting the operations of these ransomware attackers,
38:27
Speaker 4: and fundamentally in each of our countries, trying to put
38:30
Speaker 4: in place policies to not allow ransoms.
38:34
Speaker 1: How hard is it though, to get I mean, does
38:36
Speaker 1: that need to be like a again? Does that look
38:39
Speaker 1: like a treaty like we have with nuclear weapons and
38:43
Speaker 1: what we have with biological weapons?
38:45
Speaker 2: Is that what this would eventually look like?
38:48
Speaker 5: So it's a really good question.
38:50
Speaker 4: On the positive side, we formed the Counter Ransom Innership
38:54
Speaker 4: that grew to eighty countries, and we had working groups
38:56
Speaker 4: that did things like countries sharing with each other threat
38:59
Speaker 4: and so if a particular technique was used against the
39:02
Speaker 4: hospital in the UK, that was shared across the governments
39:05
Speaker 4: so that another country would then inform their hospitals keep
39:08
Speaker 4: an eye out for that, protect against this. In that way,
39:11
Speaker 4: that was successful because it was sensitive sharing and it
39:14
Speaker 4: expanded it to more countries than had ever been shared
39:16
Speaker 4: together before. A second success was in training countries and
39:22
Speaker 4: how to look for cryptocurrency money laundering. Cryptocurrency enables cheaper
39:27
Speaker 4: and faster transactions for all kinds of people, people sending
39:29
Speaker 4: remittances back home, for example, but it also enables payment
39:34
Speaker 4: of ransoms quickly. So we among different countries who had
39:37
Speaker 4: more sophisticated systems, we trained other countries, and we could
39:41
Speaker 4: also use more offensive capabilities to say if a given
39:44
Speaker 4: country is not acting, it can be put on a
39:46
Speaker 4: gray list, to say other countries say we're not going
39:49
Speaker 4: to do business with you, because you really need to.
39:53
Speaker 4: The stick is essentially doing routine business transactions, not in cryptocurrency.
40:00
Speaker 4: Nobody wants to be on a grade list which says
40:02
Speaker 4: they're not following the rules of anti money laundering because
40:05
Speaker 4: it puts their entire financial system under question. As well
40:09
Speaker 4: as another stick, which is sanctioning some of these exchanges
40:12
Speaker 4: that were moving a preponderance of illicit money. One was
40:15
Speaker 4: called Tornado dot Cash, and we did the first ever
40:18
Speaker 4: sanctioning of that entity to say.
40:21
Speaker 5: We're going to bring the traditional rules.
40:23
Speaker 4: Of enforcing the rules for banks to cryptocurrency virtual asset
40:27
Speaker 4: service providers. So we extended the traditional rules for fiat
40:30
Speaker 4: currency to cryptocurrency. So that's where it worked.
40:34
Speaker 2: Where didn't it work yet.
40:35
Speaker 4: And I guess actually a third one where it worked
40:37
Speaker 4: is the governments agreed that no governments would pay ransoms.
40:40
Speaker 5: That was the third way.
40:40
Speaker 4: We got agreement and a public statement saying we all agree,
40:43
Speaker 4: And the public statement was important because then we called
40:45
Speaker 4: ourselves accountable. Where we had more trouble was a fierce
40:50
Speaker 4: debate about what countries do to actually disincentivize ransom payments
40:57
Speaker 4: by private sector actors. In the US, it was a
41:00
Speaker 4: fierce policy debate. What we wanted to do was say
41:04
Speaker 4: we would announce in six months that ransom payments were
41:07
Speaker 4: not permitted unless a permission was requested from the Department
41:11
Speaker 4: of Justice for a national security emergency.
41:13
Speaker 2: Could be illegal.
41:15
Speaker 5: It would be yes, essentially, so I paid.
41:18
Speaker 1: A ransom, charges would be brought against the person that
41:21
Speaker 1: paid the ransom.
41:21
Speaker 4: Or if you wanted to pay a ransom, you'd have
41:23
Speaker 4: to come to the Department of Justice and they might
41:25
Speaker 4: see that. For example, if a hospital wanted to pay
41:28
Speaker 4: a ransom. What we wanted to do the goal of
41:30
Speaker 4: this was not only to disincentivize paying ransoms, but to
41:34
Speaker 4: incentivize putting in place the cybersecurity practices that enabled entities
41:39
Speaker 4: to recover without paying a ransom. What do I mean
41:41
Speaker 4: if you have a good backup, if you've encrypted your
41:44
Speaker 4: data so even if the attackers get it, they can't
41:46
Speaker 4: use it to blackmail you, that they have a bunch
41:48
Speaker 4: of sensitive medical information or your client's wire.
41:51
Speaker 5: Instructions that's sensitive.
41:53
Speaker 4: So a few practices like that help a company recover
41:58
Speaker 4: without having to pay a ransom.
41:59
Speaker 5: And what we want to.
42:00
Speaker 4: Do was essentially say, Okay, in six months, the easy
42:04
Speaker 4: out of a ransom payment is going away.
42:05
Speaker 5: Come on, folks, do what you need to do so
42:08
Speaker 5: you can recover without.
42:09
Speaker 2: It, So.
42:11
Speaker 1: That puts the burden on the company to have as
42:14
Speaker 1: most the most up to date security possible.
42:19
Speaker 2: In theory, I get it. On the other hand, you know.
42:25
Speaker 1: Is it should should that fall on the company or
42:29
Speaker 1: should that fall on the governments?
42:33
Speaker 4: That is one of the core policy debates in cybersecurity.
42:38
Speaker 4: Now to that point, there was responsibility for each and
42:41
Speaker 4: I think when you think about the physical world, to
42:43
Speaker 4: your point, when you walk into a large corporate building,
42:46
Speaker 4: there are guards there that are paid for, you know,
42:49
Speaker 4: by the owners of the building, but you then have
42:52
Speaker 4: a police department if they're right, so you have both
42:54
Speaker 4: with rules, and I think that's very similar in cyber space.
42:58
Speaker 4: So in the case of governments, you know, we were
43:00
Speaker 4: conducting at that point offensive cyber operations to disrupt the
43:05
Speaker 4: infrastructure of these criminals around the world. We were working
43:08
Speaker 4: with governments around there were a number of coordinated attempts
43:11
Speaker 4: to arrest people. So we'd share quietly, you know, the
43:14
Speaker 4: names of people and if they got on a plane,
43:16
Speaker 4: they went on vacation, or they tried to you know,
43:18
Speaker 4: enjoy their illicit gains.
43:20
Speaker 5: In Duvine, you know, they'd be arrested.
43:22
Speaker 4: Among the members of the counter ransomware initiative were law
43:25
Speaker 4: enforcement cooperation and finally, government, like I said, created forums
43:29
Speaker 4: like that for information sharing, released advisories, and took those steps.
43:34
Speaker 4: But on the private sector side, there is the pretty
43:37
Speaker 4: in this case, basic steps like have backups, encrypt your data,
43:41
Speaker 4: make yourselves a harder target that when we think about
43:44
Speaker 4: the physical world, is very.
43:46
Speaker 5: Much the equivalent in the digital world.
43:48
Speaker 1: Let's go back to so one of the one of
43:52
Speaker 1: the reasons that the industry has fought regulation in these
43:57
Speaker 1: early days of AI adoption has been with this idea
44:00
Speaker 1: that we're in a race with China, and yet at
44:04
Speaker 1: the same time that there's no cooperation on how governments
44:09
Speaker 1: use for particularly how they weaponize AI. We could be
44:14
Speaker 1: in a We've already seen some asymmetric warfare successes thanks
44:20
Speaker 1: to AI for you know, essentially a smaller country being
44:24
Speaker 1: able to you know, operate with the with the bigger countries.
44:31
Speaker 1: What do you envision is realistic in trying to have
44:35
Speaker 1: some sort of AI red funk between China and the
44:40
Speaker 1: United States. I mean, is that what we're looking for here?
44:42
Speaker 4: So first, let's unpack the race with China, because I
44:45
Speaker 4: think you're right that term is used a lot, and
44:47
Speaker 4: we should ask what does that really mean. So from
44:50
Speaker 4: an AI perspective, there is AI that's helping in the
44:52
Speaker 4: fields of drug discovery.
44:54
Speaker 5: I mean they're currently drug trials. You can accelerate.
44:57
Speaker 2: The should be a border there should be borderless. One
45:00
Speaker 2: would think might competition.
45:01
Speaker 4: Because today, unfortunately, there are more diseases than there are
45:05
Speaker 4: vaccines for than there are drugs for. So that would
45:08
Speaker 4: be something where if it brings down the cost of
45:10
Speaker 4: drug production enables trialsity faster, that's a win for all
45:13
Speaker 4: of us.
45:14
Speaker 5: So in that case, I think the race is a
45:16
Speaker 5: race that's arm in arm.
45:18
Speaker 4: How do we make the most of this technology for
45:20
Speaker 4: the benefit of mankind. Similarly, there's many kinds of positive
45:26
Speaker 4: uses of AI. Frankly, there's positive use of AI for cybersecurity.
45:30
Speaker 4: It's hard to build secure code. Using AII that's trained
45:35
Speaker 4: on more secure code or on some malicious practices can
45:37
Speaker 4: then help ensure that code is generated securely against known
45:41
Speaker 4: threats and then can be tested as well before deployed.
45:43
Speaker 5: That's again a win win for all of us.
45:48
Speaker 4: There's the discussion of a race is essentially adoption of
45:52
Speaker 4: the most capable AI in national security fields, for example,
45:57
Speaker 4: in intelligence collection in for sample, in China, here's where
46:01
Speaker 4: an authoritarian country has an edge over a democracy. China
46:05
Speaker 4: has millions of cameras deployed around the country.
46:08
Speaker 5: Chinese technology is deployed around the world.
46:10
Speaker 1: They're going to probably surpass us on facial technology simply
46:13
Speaker 1: because of their system of government.
46:15
Speaker 4: Exactly, and I don't think we would trade our system
46:17
Speaker 4: of government. On the other hand, let's recognize that an
46:20
Speaker 4: American human spy traveling around the world is at greater
46:24
Speaker 4: risk as China trains facial recognition models. Then a reverse case,
46:29
Speaker 4: a Chinese spy would be because the US both did not,
46:33
Speaker 4: and we should talk about that. US technologies, let's say,
46:36
Speaker 4: in strategic areas like telecommunications, were overcome by the Chinese playbook.
46:41
Speaker 4: So if you go around the world, it's Wahwick, it's
46:44
Speaker 4: not ericson right, It's certainly not Motorola, which was or
46:49
Speaker 4: put out of business.
46:49
Speaker 1: We attempted the United States to try to hamstring Huawei,
46:56
Speaker 1: just failed.
46:57
Speaker 4: So let's come back to that, because I want to
46:58
Speaker 4: make sure I answer the prime you know. It's so
47:01
Speaker 4: when we talk about the race, that's where we mean
47:04
Speaker 4: in deployment of AI and national security areas like intelligence
47:08
Speaker 4: like by the military, where AI can make a difference crisis.
47:12
Speaker 1: I mean, you know it's funny. It's this is race,
47:14
Speaker 1: but you know it's always funny, and there's sometimes the
47:17
Speaker 1: arrogainst the west right where we assume that the other
47:20
Speaker 1: side is to see the potential advantage or disadvantage.
47:23
Speaker 2: If they if they allow.
47:26
Speaker 1: But with AI, the speed of innovation and frankly the
47:35
Speaker 1: speed with which you could counter the innovation is all
47:38
Speaker 1: happening so fast it feels like an unwinnable race. Meaning
47:42
Speaker 1: even if you think you there's no finish line. You
47:44
Speaker 1: may be here and in other country's here, but they
47:48
Speaker 1: may do this because we've seen these we've seen the
47:52
Speaker 1: AI models.
47:52
Speaker 2: They all leap each other.
47:53
Speaker 1: Who's to say Chinese is a Chinese deepline model isn't
47:57
Speaker 1: going to do the same thing.
47:58
Speaker 4: So that's exactly the way to think about your question
48:02
Speaker 4: about governance, because I think when we think about AI
48:05
Speaker 4: for all the positive use cases, let's arm in arm
48:07
Speaker 4: for the benefit of humanity, when we think about the
48:09
Speaker 4: case of AI deployed in military in weapons, that's where
48:16
Speaker 4: harkening back to your question around nuclear technologies, they had
48:20
Speaker 4: the same back and forth. Right, we were attempting to
48:23
Speaker 4: detect Soviet nuclear submarines, they were attempting to detect ours, and.
48:27
Speaker 5: Generally we would have a flywheel.
48:29
Speaker 4: Whereas our own detection technologies improved and became more sophisticated,
48:34
Speaker 4: we deployed better stealth on our own subs as well
48:37
Speaker 4: to protect against theirs. Now, clearly the pace of tech
48:40
Speaker 4: was far slower in nuclear technologies, so we could have a.
48:44
Speaker 1: Five year advantage a ten year advantage, it seems with
48:46
Speaker 1: this at best you're lucky to have a.
48:47
Speaker 4: Five month ANOW and the degree of depth, potentially of
48:51
Speaker 4: incorporation of AI into military decision making can be significant. Now,
48:56
Speaker 4: I want to be clear and say military culture around
49:00
Speaker 4: the world is generally more conservative. These are people who
49:04
Speaker 4: are trained in the laws of war. These are people
49:06
Speaker 4: who know what it means to lose a life, and
49:08
Speaker 4: they also know that any technology use on offense it's
49:11
Speaker 4: likely to come back to that you have to defend
49:14
Speaker 4: against as well. So it's not as if I think
49:17
Speaker 4: military communities anywhere around the world rush to deploy a
49:20
Speaker 4: new technology that's not fully understood. With that said, that
49:25
Speaker 4: is where as China and the US talk discussions about
49:29
Speaker 4: how will we incorporate AI into our military decision making
49:35
Speaker 4: and most importantly, if there is a misunderstanding, how do
49:39
Speaker 4: we communicate. One of the troubling things about US China
49:42
Speaker 4: relations is that we haven't had a military.
49:44
Speaker 2: To red phone. We don't have the exactly you know,
49:48
Speaker 2: the metaphorical right exactly.
49:49
Speaker 4: And in the past, with our last peer adversary, the
49:52
Speaker 4: Soviet Union, we had both a military red phone and
49:55
Speaker 4: a political line.
50:00
Speaker 1: So to the Check podcast is brought to you by Soul.
50:02
Speaker 1: So if you love that end of the day unwined
50:04
Speaker 1: but hate the hangover, Soul's out of Office is for you.
50:09
Speaker 1: These sparkling THCHC drinks and gummies give you the same
50:12
Speaker 1: relaxed social feeling without the alcohol, without the calories, and
50:16
Speaker 1: without the crash. Soul is a wellness brand that believes
50:19
Speaker 1: feeling good should be fun and easy. Soul specializes in
50:23
Speaker 1: delicious hemp derived THCHC and CBD products designed to boost
50:27
Speaker 1: your mood and help you unwind. Their best selling out
50:30
Speaker 1: of Office gummies were designed to provide a mild, relaxing buzz,
50:34
Speaker 1: boost your mood, and enhance creativity and relaxation with five
50:38
Speaker 1: different strengths.
50:39
Speaker 2: You can tailor the dose to fit your vibe.
50:41
Speaker 1: So also has a variety of products specifically designed to
50:44
Speaker 1: help you get a better night's rest, including their top
50:47
Speaker 1: selling Sleepy Gummies, a fan favorite for deep, restorous sleep. Look,
50:51
Speaker 1: I have made no secret, I am a believer in
50:54
Speaker 1: this stuff, in cannabis and hemp derived. I do not
50:57
Speaker 1: partake in alcohol. For the most part, I think this
51:00
Speaker 1: stuff is a lot safer than alcohol, a lot less
51:02
Speaker 1: addictive than alcohol. And yes, I have to say I
51:05
Speaker 1: love these drinks. It is the glass of wine and
51:08
Speaker 1: you know after work, that's what this is. So no
51:11
Speaker 1: hangover and no excess calories like this. I'm a big fan.
51:16
Speaker 1: So bring on the good vibes and treat yourself to
51:18
Speaker 1: Sold today. Right now, Soul is offering my audience thirty
51:21
Speaker 1: percent off your entire order. Go to getsol dot com
51:24
Speaker 1: and use the word toodcast that's getsold dot com promo
51:28
Speaker 1: code podcast for thirty percent off. And yes, I too,
51:32
Speaker 1: am a customer. Yeah, but we didn't get it until
51:37
Speaker 1: after we had almost a convertation. Like it took a
51:40
Speaker 1: crisis to create those safeguards.
51:44
Speaker 4: And to be clear, the US has attempted to put
51:46
Speaker 4: that in place. The onus is really the Chinese have
51:48
Speaker 4: not wanted to put it in place, and the concern
51:50
Speaker 4: really is that as a result, as each of us
51:53
Speaker 4: start to deploy AI and sensitive areas, there is the
51:57
Speaker 4: opportunity for miscommunication. There isn't necessarily the channel to resolve it.
52:02
Speaker 4: And that's where discussions among leaders are important, as well
52:07
Speaker 4: as putting in place the detection technology so that we
52:11
Speaker 4: and and really the intelligence capability is to try to
52:14
Speaker 4: understand how competitors are using AI in their own ecosystem
52:18
Speaker 4: so we can be aware as well and know and
52:21
Speaker 4: try our best not to misinterpret. But an ideal world,
52:24
Speaker 4: that's where you want the governance simply.
52:28
Speaker 1: We go to a larger issue. You're now in the
52:32
Speaker 1: private sector.
52:35
Speaker 5: There has been hard always stays in the national security.
52:38
Speaker 2: I hear you, I hear you. There is this, There is.
52:43
Speaker 1: There is The industry is petrified of any regulation at
52:46
Speaker 1: the moment. And I am cranky cinical reporter who says
52:53
Speaker 1: tech industry, you you you gave us social media and
52:56
Speaker 1: totally destroy the information ecosystem and we're suppos to trust
53:00
Speaker 1: you with AI. The industry, I feel like is not
53:03
Speaker 1: fully self aware as to how they have brought up.
53:07
Speaker 1: The skepticism that is out there about the technology exists
53:13
Speaker 1: because of essentially their bad behavior and the lack of
53:18
Speaker 1: lack of regulatory for any sort of significant regulation coming
53:23
Speaker 1: from government.
53:24
Speaker 2: And now we're jumping to it I entirely new technology.
53:28
Speaker 2: This feels this feels like.
53:33
Speaker 1: This just feels like government has no chance to sort
53:37
Speaker 1: of get its monitories.
53:40
Speaker 4: It is always a hard area to think about how
53:43
Speaker 4: to regulate a technology that's evolving so quickly. And I
53:47
Speaker 4: think there are some lessons we can learn from cyberspace
53:50
Speaker 4: and some that are very new. What do I mean,
53:54
Speaker 4: As you said, the US government failed to put in
53:56
Speaker 4: place regulations for cyberspace for a decade. The last attempt
54:01
Speaker 4: was a Lieberman Collins bill in twenty fifteen that's failed.
54:05
Speaker 4: After the Colonial pipeline incident, the President turned to me
54:08
Speaker 4: and said.
54:09
Speaker 5: And how is this happening?
54:12
Speaker 4: How can it be that we have one major pipeline,
54:14
Speaker 4: one major oil and gas pipeline supplying the entire East coast,
54:18
Speaker 4: only one, and a group of ransomware attackers sitting in
54:24
Speaker 4: Saint Petersburg can can conduct an attack that leads the
54:28
Speaker 4: company to take it offline, and as you know, that
54:32
Speaker 4: led to you know, americans at gasoline stations.
54:34
Speaker 5: One of the things we learned is never.
54:36
Speaker 4: Tell Americans please don't line up and get your gas
54:38
Speaker 4: all will be well, because then they immediately will go
54:41
Speaker 4: refill their pumps.
54:44
Speaker 5: And at the time we realized we.
54:47
Speaker 4: Were reflected on the President's question and said, you know,
54:50
Speaker 4: let's do a scrub and see are there regulations that
54:53
Speaker 4: already exist that apply. And what we found was that
54:56
Speaker 4: in pretty much every sector of critical infrastructure there were
55:00
Speaker 4: old safety regulations that could be reinterpreted for the digital age.
55:04
Speaker 5: What do I mean?
55:05
Speaker 4: Railroad signaling systems already had regulations to ensure that when
55:10
Speaker 4: they were mechanical, the mechanical box was properly secured. Who
55:13
Speaker 4: could have access to that, who could have the key?
55:16
Speaker 4: So we worked with TSA, who's the regulator for all railroads,
55:20
Speaker 4: took those regulations and updated them for the digital age
55:23
Speaker 4: to say, you know, you need multi factor authentication, not
55:26
Speaker 4: a password because everybody's passwords have been compromised. You need
55:30
Speaker 4: to ensure you have a monitoring system for your signaling system.
55:34
Speaker 5: And initially there was some pushback from the.
55:35
Speaker 4: Sector exactly as you said, and we realized that we
55:38
Speaker 4: had failed to properly engage them. So we invited the
55:41
Speaker 4: fifty seven railroad CEOs in the country to come in
55:44
Speaker 4: and we gave them briefings on the security threat, and
55:48
Speaker 4: we said, here are the security things that we think
55:52
Speaker 4: are needed. Let's have a discussion of that right balance
55:54
Speaker 4: of costs and impact, because if the threat is here
55:58
Speaker 4: and railroad signaling systems here, we can't jump here in
56:01
Speaker 4: one leap, but we can jump here, show the impact,
56:06
Speaker 4: show how we're reducing the cost of an attack, which
56:08
Speaker 4: is significant, and then do that in degrees. We did
56:11
Speaker 4: it for pipelines, we did it for ports, we did
56:14
Speaker 4: it for airports. We did it for water systems using
56:18
Speaker 4: existing regulators and existing regulations. And I think there's a
56:21
Speaker 4: lot we can learn from that because there's no one
56:23
Speaker 4: size fits all. I've visited water systems in San Jose.
56:26
Speaker 4: Securing those water systems so Americans have safe water is
56:29
Speaker 4: very different from securing an oil and gas pipeline. And
56:32
Speaker 4: the regulators know their sectors well and know what's reasonable
56:35
Speaker 4: in terms of the cost burden for impact in terms
56:38
Speaker 4: of driving down the threat. So I just to close
56:40
Speaker 4: on that I think there's some lessons to be learned
56:43
Speaker 4: in the case of AI, right Like, for example, if
56:46
Speaker 4: you think about people are worried that AI is used
56:48
Speaker 4: to determine if you or I should get alone, and
56:51
Speaker 4: they want to make sure that the data that's trained
56:52
Speaker 4: on is not biased and that the recommendation is explainable.
56:56
Speaker 4: So a human looking at it can say, why trust chock,
57:00
Speaker 4: why not trust in? There are existing regulations that do that.
57:04
Speaker 5: They have to be.
57:04
Speaker 4: Updated for the use of AI, many of them or
57:07
Speaker 4: they exist so many are adequate. That needs to be
57:10
Speaker 4: done for every sector. And then going back to the
57:12
Speaker 4: first question you asked me that talks about the risk
57:16
Speaker 4: AI brings separately, there are approaches we need to do
57:19
Speaker 4: to make sure the AI models that are deployed are
57:21
Speaker 4: safe themselves.
57:23
Speaker 1: So this gets back to you, we don't you know,
57:25
Speaker 1: we still don't regulate algorithms.
57:28
Speaker 2: Algorithms.
57:29
Speaker 1: Many companies believe their algorithms are this proprietary thing, and
57:32
Speaker 1: we don't know whether it's being used for predatory practices.
57:37
Speaker 1: For because it's an algorithm that could make that decision
57:40
Speaker 1: about a mortgage or about a loan. Sometimes after the fact,
57:44
Speaker 1: maybe a civil lawsuit is brought and then you can
57:47
Speaker 1: somehow claim that they violated the law. I get that
57:49
Speaker 1: the law is there eventually, but is there a proactive
57:53
Speaker 1: way to essentially, hey, we've got a new algorithm that's
57:57
Speaker 1: it's going.
57:57
Speaker 2: To help us.
58:01
Speaker 1: Get through these mortgage applications faster. Let's make sure it's
58:05
Speaker 1: approved by the government the same way we would approve
58:07
Speaker 1: a new drug before it was circulated on the market,
58:10
Speaker 1: sold as a as a as a pharmaceutical, you know,
58:17
Speaker 1: answer to some disease.
58:19
Speaker 5: It's a good question.
58:20
Speaker 4: And the big difference I think between an AI model
58:23
Speaker 4: or an algorithm, to your point, and a drug is
58:25
Speaker 4: one changes so continuously and one takes time to develop
58:28
Speaker 4: and test.
58:29
Speaker 5: It has IP protection attacked, I.
58:31
Speaker 1: Admit, but I you know, actually the speed of prescription
58:36
Speaker 1: drugs is going faster. I mean, I could make an
58:38
Speaker 1: argument that FDA and drugs AI models.
58:42
Speaker 2: You know, why shouldn't there be an FDA or AM
58:45
Speaker 2: And I think it's.
58:47
Speaker 4: I think to your point, there's a tension between the
58:49
Speaker 4: innovation and regulation, right because regulation often is slow to
58:53
Speaker 4: adapt to adapt to changing technology. And in fact, I think, frankly,
58:57
Speaker 4: if you look at the difference between the European Union
58:59
Speaker 4: and the United the States. European Union is a country
59:01
Speaker 4: that puts regulations first, an innovation second.
59:04
Speaker 1: I get it, and it's what's the line. Yeah, well,
59:07
Speaker 1: right now, there's no line, And I think we're not
59:09
Speaker 1: even attempting any of them because the industry has got
59:13
Speaker 1: aggressive politically and has got essentially made a political bargain
59:17
Speaker 1: with this administry.
59:18
Speaker 4: And I think there's a balance between the how we
59:22
Speaker 4: approach AI models themselves and then how do we approach
59:26
Speaker 4: when they're deployed in sectors where regulations exist, Like, for example,
59:30
Speaker 4: we'll just go use our loan example again.
59:33
Speaker 5: So if somebody is deploying an AI model.
59:35
Speaker 4: To determine who gets a loan, there are regulations around
59:40
Speaker 4: explaining how a decision is made coming out of an
59:44
Speaker 4: algorithm or model, and around what data that's trained on,
59:49
Speaker 4: So that you need transparency on the data it's trained
59:52
Speaker 4: on and explainability of how that decision is made. That
59:55
Speaker 4: exists in that sector. It doesn't exist in every sector,
59:58
Speaker 4: and that's really what we need. We need the transparency
1:00:01
Speaker 4: on the data models trained on to see is it
1:00:03
Speaker 4: trained on data that fundamentally was.
1:00:06
Speaker 2: Do we need new law in the books for this.
1:00:10
Speaker 4: I usually default to say, given that laws trail tech
1:00:14
Speaker 4: by such a long time, are there ways that we
1:00:17
Speaker 4: can achieve what we want, which is protecting the population
1:00:21
Speaker 4: from a new technology's most significant risks in a way
1:00:25
Speaker 4: that's also adaptable and changes quickly. And I think there
1:00:30
Speaker 4: to your point, looking at the AI models and saying,
1:00:34
Speaker 4: what is the delta harm they bring to different areas,
1:00:39
Speaker 4: and then what's the best way to control against that harm?
1:00:43
Speaker 5: What's what's needed?
1:00:44
Speaker 1: Look, a month ago, Anthropic came out and said, our
1:00:48
Speaker 1: new AI model is so powerful, we're.
1:00:50
Speaker 2: Not sure that.
1:00:54
Speaker 1: Current cybersecurity infrastructure is going to be able to defend
1:00:58
Speaker 1: against people deciding to use our model to potentially attack.
1:01:03
Speaker 2: And there's a part of me that says, so why
1:01:05
Speaker 2: release the model? Like should this?
1:01:11
Speaker 1: But again, there's no law in the books that says
1:01:13
Speaker 1: they can't release the model.
1:01:15
Speaker 4: So yes, And you know that's a fierce debate in
1:01:17
Speaker 4: the cybersecurity community.
1:01:18
Speaker 5: How much of that was Anthropic marketing and all that
1:01:22
Speaker 5: I saw.
1:01:24
Speaker 2: Debate, I think it is enough.
1:01:25
Speaker 1: It's no different than claiming that your prescription drug, if
1:01:30
Speaker 1: it works properly but for longer.
1:01:32
Speaker 2: Than four hours, call a doctor. Was that a side effect.
1:01:35
Speaker 5: Was that a marketing gold Well, you know, so it's
1:01:37
Speaker 5: so interesting.
1:01:37
Speaker 4: I've had the privilege of leading teams conducting offensive operations
1:01:40
Speaker 4: and I also, as you know, led defensive head of
1:01:43
Speaker 4: cybersecurity and essay and then let this work at the
1:01:45
Speaker 4: White House, and I will say that I really believe
1:01:49
Speaker 4: AI models will transform cybersecurity on defense. But it's a
1:01:54
Speaker 4: painful path there, and that's what we need to control
1:01:57
Speaker 4: for what do I mean it is far easier.
1:02:00
Speaker 5: To attack than to defend.
1:02:01
Speaker 4: An attacker has to find one way in a defender
1:02:03
Speaker 4: has to be checking every door, window and ceiling.
1:02:07
Speaker 1: Job in America's homeland security, yeah, because.
1:02:11
Speaker 5: N is not going to happen, and being a SISO
1:02:14
Speaker 5: is a really tough job.
1:02:15
Speaker 4: I mean, there's often discussions in that community around just
1:02:19
Speaker 4: how difficult, how much people know exactly this, et cetera.
1:02:22
Speaker 2: It's terrible.
1:02:23
Speaker 4: Now, what AI allows is attackers to jiggle every doorknob
1:02:27
Speaker 4: continuously and at scale. So it really does enable attackers.
1:02:31
Speaker 4: But what allows defenders to do if they're doing the
1:02:34
Speaker 4: same thing, if they're jiggling every doorknob in their infrastructure
1:02:38
Speaker 4: in advance and at scale, and AI then helps generate
1:02:42
Speaker 4: patches or controls to compensate that can be significant. Today,
1:02:47
Speaker 4: the model's capabilities on generating patches, et cetera need to
1:02:52
Speaker 4: be better.
1:02:53
Speaker 5: They're there, but they need to be better.
1:02:55
Speaker 4: So the approach that said, let's get the core companies
1:02:59
Speaker 4: producing digital infrastructure that everyone uses to use the models
1:03:03
Speaker 4: to find and fix vulnerabilities and deploy them via existing
1:03:08
Speaker 4: patches is a smart one because it starts locking down
1:03:12
Speaker 4: common infrastructure. What's missing today and what we need is
1:03:16
Speaker 4: that in all of our critical sectors. Hospitals are a
1:03:19
Speaker 4: good one, there's also a stack that rides on top
1:03:22
Speaker 4: of the core infrastructure and that is often what's used
1:03:27
Speaker 4: to compromise a hospital to disrupt its operations. That's missing,
1:03:31
Speaker 4: and I think that's what we need to be able
1:03:33
Speaker 4: to say, within each sector, what does the stack look like?
1:03:36
Speaker 4: And in some cases those are stacks that aren't updated
1:03:39
Speaker 4: and secure them quickly.
1:03:41
Speaker 1: Is government behind or industry being obstinate?
1:03:46
Speaker 4: Government needs to be doing convening and I see the
1:03:49
Speaker 4: power of government convening is significant when you bring everybody
1:03:53
Speaker 4: around the table and you say, look, we can regulate
1:03:56
Speaker 4: this or these are the things we.
1:03:58
Speaker 5: Need to see you get done.
1:04:01
Speaker 4: Particularly when companies are out there saying this is such
1:04:04
Speaker 4: a powerful weapon, this is so concerning, Well, then act
1:04:06
Speaker 4: it out.
1:04:07
Speaker 5: Then work with.
1:04:08
Speaker 4: Us in team to ensure that we can equip defenders
1:04:12
Speaker 4: to be ready, because, let's be honest, Chinese open source
1:04:15
Speaker 4: models followed by six months and that's a threat that's significant.
1:04:19
Speaker 4: So we have a window of time for models, for
1:04:23
Speaker 4: frontier model companies to be working, and frankly, for government
1:04:27
Speaker 4: to be helping convene the open source and the open
1:04:30
Speaker 4: source community to be getting access to the models because,
1:04:33
Speaker 4: as you know, open source, unlike a Cisco or Microsoft,
1:04:37
Speaker 4: is developed often by anyone, but broadly deployed in our infrastructure.
1:04:42
Speaker 4: So I think that's starting. You see, the White House
1:04:45
Speaker 4: has been bringing companies together. You see Project Last Wing,
1:04:48
Speaker 4: you see opening eyes approach to say we'll approve people
1:04:51
Speaker 4: because we.
1:04:51
Speaker 5: Wanted to know your customer.
1:04:52
Speaker 4: We want to know are you a SISO, are you
1:04:54
Speaker 4: a head of cyber or AI for a country who's
1:04:57
Speaker 4: setting strategy, and if so, will come up with ways
1:04:59
Speaker 4: to have you use the model in a way that's
1:05:02
Speaker 4: safe and doesn't broadly distribute it. But the race is on,
1:05:05
Speaker 4: and to be clear, even though you know I do
1:05:08
Speaker 4: believe it's going to be a game changer on cybersecurity.
1:05:11
Speaker 4: We've got to ensure that models are in the hands
1:05:13
Speaker 4: of defenders quickly, and we've got to keep the pressure
1:05:18
Speaker 4: on companies that build digital infrastructure to be getting those
1:05:21
Speaker 4: patches out and figuring out for infrastructure that is difficult
1:05:26
Speaker 4: to patch.
1:05:27
Speaker 5: You know, it's not so easy to just push a
1:05:28
Speaker 5: patch on a manufacturing plan.
1:05:30
Speaker 4: You know, it sometimes has side effects that we can
1:05:34
Speaker 4: use AI, for example, to simulate those patches to ensure
1:05:38
Speaker 4: that they're working right, to give users more confidence to
1:05:40
Speaker 4: deploy them. So there's a lot that needs to get done.
1:05:42
Speaker 2: You're outriting a lot that we need to do.
1:05:46
Speaker 1: Color me skeptical that we have the current governmental infrastructure
1:05:50
Speaker 1: to respond in the ways that maybe the public needs
1:05:54
Speaker 1: it to respond.
1:05:56
Speaker 4: You know, the first step is saying here's where we
1:05:57
Speaker 4: need to go. The second step is rally a community.
1:06:01
Speaker 4: The nice part is there are lots of people across
1:06:05
Speaker 4: the tech community are ready to roll up their sleeves
1:06:08
Speaker 4: and can be self organizing on this too.
1:06:10
Speaker 1: But you're right, governments, and yet we're all watching as
1:06:14
Speaker 1: voyeurs this elon musk Open AI trial and it doesn't
1:06:19
Speaker 1: give a lot of confidence in some of these companies.
1:06:22
Speaker 4: You're right that the role of government inconvening, and I
1:06:25
Speaker 4: do believe the White House has been doing convenings, bringing
1:06:27
Speaker 4: companies together and trying to get action out of them.
1:06:31
Speaker 4: And in fact, companies are moving in. I've talked to
1:06:33
Speaker 4: a number of companies participating in glass Wing.
1:06:35
Speaker 5: They're doing the work, they're building.
1:06:37
Speaker 4: The patches, they're planning to get them out to customers,
1:06:40
Speaker 4: pressing them.
1:06:40
Speaker 1: On psychically, initial models are not the trustworthy enterprise. It's
1:06:44
Speaker 1: one thing for Microsoft, JP, Morgan, some of these companies
1:06:48
Speaker 1: to be responsible with how they're using these models, but
1:06:52
Speaker 1: it feels like the companies that are making the models don't.
1:06:56
Speaker 1: Necessarily they seem to be more a bit self absorbed.
1:07:00
Speaker 4: There's a tension between the commercial value and the national
1:07:03
Speaker 4: security risk, and typically, you know, government makes that determination.
1:07:08
Speaker 4: What's so different here is the tech is coming out
1:07:10
Speaker 4: of the private sector, and it is important that government
1:07:14
Speaker 4: come out and clearly say here's where national security risk
1:07:17
Speaker 4: is significant. Here's an approach that insures we still lead
1:07:20
Speaker 4: on innovation, but we drive down the risk to an
1:07:22
Speaker 4: acceptable level.
1:07:23
Speaker 5: Along the way.
1:07:25
Speaker 1: And you've got a big job it's like with trying
1:07:28
Speaker 1: to bridge this divide.
1:07:29
Speaker 4: It's a large community, and you know, I always believe
1:07:33
Speaker 4: with tech, there's nothing wrong with tech that can be fixed.
1:07:35
Speaker 1: With the threat, I will say this, I think there's
1:07:38
Speaker 1: government is skeptical, a tech is skeptical of government, and
1:07:42
Speaker 1: yet they have to work together in world fits.
1:07:45
Speaker 4: I very much agree with that, and I think quite
1:07:47
Speaker 4: frankly those relationships. When I think back to the Snowden period,
1:07:52
Speaker 4: the divide between Washington and Silicon Valley was incredibly sharp,
1:07:57
Speaker 4: and that came from a sense that government surveillance wasn't
1:07:59
Speaker 4: farnollowing laws and policies of the country as a democracy.
1:08:03
Speaker 5: And frankly, you know, at the.
1:08:05
Speaker 4: Time, I after that, I was asked to be NSA's
1:08:07
Speaker 4: first chief risk officer, and I remember flying back and
1:08:10
Speaker 4: forth across the country and seeing how sharp the divide was.
1:08:12
Speaker 4: Folks in the national security community were saying, why don't
1:08:15
Speaker 4: people trust us? We're the good guys here, and folks
1:08:17
Speaker 4: in the private sector were like, Okay, how does this
1:08:20
Speaker 4: intelligence community work and doesn't really respect my values? And
1:08:23
Speaker 4: it took a series of conversations, you know, over the
1:08:26
Speaker 4: last decade to heal that.
1:08:28
Speaker 5: I think we're at the same place.
1:08:29
Speaker 2: Now where you Well, it's funny you bring up values.
1:08:31
Speaker 1: What are the values of these companies? I don't know
1:08:33
Speaker 1: sometimes and are they our values? I think there's some
1:08:37
Speaker 1: concern about that.
1:08:38
Speaker 2: But this is just the beginning, it is indeed, and
1:08:41
Speaker 2: thanks for your time.
1:08:42
Speaker 5: Thank you.
1:08:43
Speaker 2: Thanks