President Donald Trump’s recently announced plan on
Truth Social to create an “AI Force” that would be led by an “AI Czar” has security pros wondering what will come next, but mainly hoping reason prevails and the government looks at the serious implications around AI.
While it’s unclear what an AI Force would look like and where it would sit within the government, especially considering Trump's opposition to regulating AI, it should be noted that the Space Force was created by an act of Congress that Trump signed into law in 2019 — and not a presidential executive order.
Because of the 24/7 news blitz around AI in which nothing short of the future of humanity has been discussed over the
past several days, SC Media asked security pros what’s the most appropriate role for government when it comes to regulating AI.
“What we really need is stronger and clearer regulation in the areas where unrestrained AI could potentially have a destructive impact: critical infrastructure, weapons system, biological research, healthcare systems, and so on — the systems that make up and support the backbone of our society,” said Dana Simberkoff, chief risk, privacy, and information security officer at AvePoint.
Simberkoff added that there's a lot that we don't know, but a lack of clarity and guidance from regulators deepens the risk of something catastrophic.
“Regulation is not an answer, but at least allows us to stop, think and then act with a clear and common objective of doing no harm, and consequences for those that do otherwise,” said Simberkoff.
Security pros prefer AI guardrails over regulation
Mark Odom, senior solutions engineer at Black Duck, pointed out that we can’t simply “stop” AI development.
“Much like nuclear weapons, we cannot uninvent AI,” said Odom. “If one country slows development, others may continue to advance, creating significant economic, industrial, and military advantages. In many ways, AI has become a modern technological arms race."
Odom said rather than attempting to reverse progress, we should focus on responsible development, robust guardrails, and taking security testing results seriously. Odom said effective AI safety requires more than a list of prohibited actions: models must be trained to recognize dangerous requests, understand when to refuse them, and identify sophisticated attempts to circumvent safeguards.
Lorri Janssen, vice president, global risk operations at BlueVoyant, said we simply can't regulate AI technology at the speed at which the technology is advancing. Janssen said the best we can do at this time is to focus on regulating the accountability of the AI companies and data, the outcomes of the models, and ensure there is transparency relating to the risk.
“Organizations that deploy AI should be able to demonstrate they understand where their models are being used, the data they have access to, what decisions are being influenced by the data and usage, and who is responsible and accountable if something goes wrong,” said Janssen.
Janssen said many of the security frameworks already in place address the different aspects of AI, so we don't need an entirely new framework for everything. Janssen said new legislation relating to AI should focus on where current laws are too ambiguous particularly about who’s responsible.
“This is particularly important when it comes to autonomous or semi-autonomous systems and if they cause harm, I think more needs to be fleshed out on the liability and who owns it, the developer, the AI company, the organization deploying it, or the individuals actually using it,” said Janssen.
John Strand, owner at Black Hills Information Security, added that we need to have specific rules and objectives around what AI agents are allowed to do — and the monitoring needs to happen in real-time.
Strand said we need to know what an agent is doing, what systems it’s communicating with, what commands it’s executing, and whether those actions are consistent with the goals and scope it was given.
“The industry cannot police AI by itself,” said Strand. “At a minimum, we need an accountability framework. If an AI agent illegally hacks something, there needs to be a human or organization that’s ultimately accountable for those actions. We can’t get into a situation where everybody simply points at the AI and says: ‘The agent did it.’”
Strand said while legislation takes time, one workable approach is establishing clear accountability:
“If an AI agent violates the law, the organization operating that agent may have legal or financial responsibility for what it does,” said Strand. “That’s the type of framework we need to seriously discuss as these systems become more autonomous. Right now, responsibility for the actions of AI agents is still an area where the legal and regulatory framework is developing.”
Denis Calderone, chief technology officer at Suzu Labs, said given that we have an administration that doesn’t really want to regulate AI, we’re talking about two potential steps: mandatory incident disclosure and clear liability for real-world harm.
“Everything else on the wish list needs legislation that isn't coming, so it's aspirational at best,” said Calderone. “Disclosure and liability work through courts and insurers rather than political will, which is why they'd actually stick.”
