# data[].attributes.headline
Microsoft Partners: This Is Your Copilot Speaking

# data[].attributes.subject
Microsoft Partners: This Is Your Copilot Speaking

# data[].attributes.body
Microsoft CEO Satya Nadella has called the spread of generative AI a ‘collective mission’ for the company and its partners, a mission that in part will be fueled by Microsoft 365 Copilot. Here’s how and where a number of partners are placing their bets.

# data[].attributes.attachment_link.readable_text
Microsoft CEO Satya Nadella has called the spread of generative AI a 'collective mission' for the company and its partners, a mission that in part will be fueled by Microsoft 365 Copilot. Here's how and where a number of partners are placing their bets.

Vineet Arora's belief in the promise of Microsoft Copilot and the vendor's other generative artificial intelligence technology runs so deep he's betting his job on it.

The CTO of WinWire Technologies -- a Santa Clara, Calif.-based 2023 Microsoft Partner of the Year finalist and No. 233 on CRN's 2023 Solution Provider 500 -- has transitioned his role to focus on technology from Microsoft and Microsoft-backed OpenAI that can quickly create content, analyses and summaries based on user prompts.

Arora heads a small team of WinWire employees -- data scientists, data architects and data engineers found through an internal hackathon earlier in the year -- focused on partnering with Microsoft to provide AI technology to customers. WinWire has more than 1,000 employees worldwide.

Since April, he's conducted a seven-city road show with Microsoft technologists to demonstrate what generative AI can do in health care and has done more than 24 envisioning sessions with customers around the technology. WinWire is already piloting generative AI solutions for healthcare and life sciences customers -- all of this before some of Microsoft's most impressive generative AI tools become generally available.

And he even publishes two to three articles a day to a Teams group chat called "All Things OpenAI."

"The scale of the investment that we have planned is [incomparable] to anything else that we have done in the last 16 years," Arora told CRN. "My entire time is going into this. ... The opportunity size, the technology, the speed at which it is evolving requires 100 percent -- 110 percent -- dedication from our side. So the scale and the level of focus has been different from anything else that we've done in the past."

Tech vendors and solution providers alike are fueling a generative AI gold rush. And Redmond, Wash.-based Microsoft is certainly considered a leader in generative AI thanks to its reported $13 billion investment in OpenAI -- the startup that on Nov. 30 publicly launched the ChatGPT text-generating software -- and Microsoft's own March introduction of Microsoft 365 Copilot, which will bring generative AI to Teams, Outlook, Word, Excel and other popular productivity applications.

At the vendor's Inspire conference held online last month, Microsoft Chairman and CEO Satya Nadella called next-generation AI a partner ecosystem opportunity that could span $4 trillion to $6.5 trillion. The most forward-looking of its 400,000-member partner ecosystem have now put their best and brightest employees to work developing generative AI solutions.

'Unrivaled' Partner Distribution

Solution providers are key to scaling Microsoft's generative AI for businesses, according to partners themselves as well as industry observers.

Dan Ives, managing director of equity research at Los Angeles-based financial services firm Wedbush Securities, told CRN that "partners hold the key to spreading the gospel and ultimately getting pen on paper to deals" involving generative AI.

"Getting partners bought in on the ChatGPT/AI strategy on cloud is integral to what I view as just a golden opportunity for Nadella and team over the coming years," Ives said. "Microsoft's partner distribution is unrivaled. In other words, I view that as a huge asset for them in this arms race that's going on."

Ives -- who forecasts an upcoming $800 billion AI spending wave over the next decade -- sees generative AI as more than just hype. In research notes for Wedbush, he estimates that AI will comprise up to 10 percent of overall IT budgets in 2024, compared with about 1 percent in 2023.

And he sees generative AI giving Microsoft and its ecosystem greater leadership in cloud computing. By most measures it sits in the No. 2 position behind Amazon Web Services and ahead of Google Cloud.

Ives expects Microsoft's cloud total addressable market to expand by up to 40 percent over the next decade thanks to generative AI.

"I would compare it to Nadella's vision when he took over as CEO and morphed Microsoft through Azure into a cloud behemoth," he said. "I would compare it to that in terms of this transformation."

Microsoft Invests In Partners

At Inspire 2023, multiple Microsoft executives addressed the need for solution providers to implement Copilot and other generative AI tools.

Nadella called the spread of generative AI "a collective mission" for Microsoft and its partners.

"There's no question the opportunity is tremendous," Nadella said during his keynote address. "And our partner ecosystem, the uniqueness of what you all represent, really is what gets me most excited. It's a map of the world. We can reach every community in every country in every sector of the economy, both public and private. That's what's exciting. In the last six months, as I've been

going to different parts of the world, talking to lots of you, what's unbelievable is the rate of diffusion of this technology. Thanks to all your capability, [that] is what's most exciting about this particular revolution and platform shift, and that's what really grounds us in our mission to empower every person and every organization on the planet to achieve more."

Nicole Dezen, Microsoft's chief partner officer and corporate vice president of the Global Partner Solutions group, told CRN after Inspire that she hopes solution providers see Microsoft's commitment to not only AI, but to partner success and enablement. "Microsoft only wins when partners and customers succeed," Dezen said. "It's core to our mission. And so we were very intentional in making so many big investments this year in all things partner -- everything from the program itself, all the way through to specializations and designations to really shore up training capability."

Microsoft investments and incentives "are meaningful dollars to help partners go deliver fast time-to-value for customers because that's where the truth is. That is the measure of success. When customers are realizing value, then we're all successful," she said. More than 9,400 customers use Azure OpenAI Service, making it the fastest-growing Azure service in the technology's history, according to Microsoft. And 9,100 partners transact on Azure AI.

More than 2,300 of those partners transact on Azure OpenAI, according to Microsoft. Partners have also activated thousands of customers on core Azure migration and modernization scenarios. Azure OpenAI Service, GitHub Copilot and Sales Copilot are examples of currently available Microsoft generative AI offerings. Other generative AI offerings such as the more broad Microsoft 365 Copilot do not have launch dates yet. However, Microsoft did announce at Inspire that the M365 Copilot will cost $30 per user, per month, for buyers of Microsoft 365 E3, E5, Business Standard and Business Premium licenses.

Power Automate Process Mining -- an AI-infused Microsoft offering for process improvement through automation and low-code apps -- is scheduled for general availability on Aug. 1. Copilot in SharePoint is expected to roll out in November.

And Microsoft already provides a wide variety of resources for channel partners with AI practices, such as training, education and an assortment of programs and initiatives. These include the Data and AI Industry Partner Activation Kit, which equips partners with reference architectures, application demonstrations and solution accelerators.

The cloud service provider also has Microsoft- Azure specializations to validate partner abilities and an Azure Analytics and AI Accelerate Program to provide support to partners across all sales stages.

More than 200 partners already met the prerequisites for the Build and Modernize AI Apps with Microsoft Azure specialization at launch, according to the vendor.

Some of the biggest partner news out of Inspire included the rechristening of the Microsoft Cloud Partner Program -- unveiled in October -- as the Microsoft AI Cloud Partner Program, in a reflection of how important AI technology is for Microsoft and its partners' futures.

The vendor also tripled its investment in Azure Migrate and Modernize -- a renamed Azure Migration and Modernization Program -- which provides assessments, more partner incentives and support for additional workloads.

Separately, Microsoft said it has invested $100 million in a new Azure Innovate offering that aims to help partners and customers infuse AI into applications, experiences, advanced analytics and custom cloud-native app building,

And Microsoft unveiled new " Era of AI " marketing campaigns in a box and an AI transformation playbook with guidance on skilling, innovating, marketing and selling.

While generative AI is in its earliest days, some Microsoft solution providers are already delivering generative AI solutions. That work ranges from WinWire AI journey maps to EY's payroll chatbot and from PricewaterhouseCoopers saving employees 80 percent of work time to Core BTS launching an AI readiness assessment.

WinWire's Journey Maps

At WinWire, Arora works with customers -- health care, manufacturing and retail are some of its biggest verticals -- on AI journey maps, maps that Arora considers to be WinWire's intellectual property.

"You're not going to jump into building full-fledged production-ready solutions off the bat," he said. "There is a step-by-step approach that you need to take."

He asks customer CIOs and CTOs what their vision is and their familiarity with generative AI. He'll take about 30 minutes to "demystify" generative AI and then identifies one to three use cases for a proof of concept or pilot. WinWire then works with customers on budgeting for the work.

"We are able to supercharge the adoption of that technology into their areas," he said. "They are Microsoft's biggest customers, some of them. And as Microsoft starts bringing those technologies [to market], we are there to help them adopt them in the right manner. And that's a promise that I provide to them."

Tony Guidi, WinWire's senior vice president of alliances, told CRN that the solution provider's years of experience in modernizing customer data estates "allowed us to leapfrog a lot of other Microsoft partners."

"For years, we've been doing modern data, app innovation, all the things that this technology is going to help even further accelerate," Guidi said. "So we were in a unique position where we could take our 16 years of experience and very quickly pivot to focus in this space and ... build out the significant team with some of our best people to just begin to develop use cases by industry, [custom] Copilots, proofs of concept, accelerator approaches in order for customers to make this technology real."

Core BTS' Readiness Assessments

Indianapolis-based Core BTS, a Microsoft partner and No. 168 on CRN's 2023 Solution Provider 500, has a responsible AI readiness assessment available through the Azure Marketplace for customers to identify high-value, low-risk opportunities to use generative AI on business functions within the organization.

Finding a document within a business group, generating relevant data content from the document and using generative AI to model the data for company stakeholders to access is one example, Perry Thompson, managing director of technology strategy at Core BTS, told CRN.

The solution provider's 400-plus Microsoft certified professionals are also working on AI at the networking layer to help find anomalies and behavior patterns that run afoul of policies.

Core BTS employees have looked at customers' internal data, the value that data provides business functions and the data's classification and taxonomy. The solution provider is also working on guardrails to protect sensitive information -- keeping healthcare customers compliant with federal privacy laws, for example, Thompson said.

"We're starting right off the bat because we recognize that this is something that is really exploding in the market," he said. "But when you start to get into the actual processing of information and trying to give controls and automation, that's the piece that you have to be very sensitive about. And you have to work with your leaders in your organization to set that vision first and then be able to define strategic goals that actually align to their business and their values."

Customers seeking generative AI are really seeking more connections across business units to share data quickly, make decisions faster and get closer to end customers, he said.

"This is why we have to take a step back and be able to try to set that strategy, identify those key areas, to define some mitigation aspects of the actual highlighted area -- if it exists -- go into the pilot mode for them to be able to look at it at a small scale. And then we turn back around and plan for the scaling up of the entire solution and make sure that we have a continuous feedback process that actually continuously improves," he said.

EY's Payroll Chatbot

Global systems integrator and Microsoft solution provider EY -- whose accolades include winning multiple 2023 Partner of the Year awards -- is in the piloting phase for an Intelligent Payroll Chatbot for a handful of customers, not to mention conducting proofs of concept in other areas of generative AI for EY and with clients.

Jim Little, a partner principal and global Microsoft alliance lead and Americas technology strategy lead at EY, told CRN that the company is piloting the chatbot with several customers before going industrial scale with the chatbot.

For now, the chatbot knows 27 languages and takes about 15 seconds to answer payroll questions compared with the baseline of 2.2 days for client contact centers.

The accuracy rate for proofs of concept and client pilots has increased to 94 percent from a baseline of 67 percent for human agents. The chatbot also nearly doubled first-resolution percentages for questions from human agents -- from 47 percent to 80 percent.

EY will continue to train the chatbot through prompt engineering and cleansing the data that powers it to improve accuracy.

"It's been a tremendous success," Little said. "We saw a real opportunity to disrupt. And we've done it. ... It's going to give us a great market advantage and learning that we can continue to leverage."

PwC's Proofs Of Concept

Like WinWire, PwC -- a global systems integrator, Microsoft solution provider and 2023 Microsoft Partner of The Year -- has joined Microsoft on the event trail, educating hundreds of financial services, health-care, energy and utilities customers on generative AI.

"We're involved in client delivery work across almost every sector, and certainly proposals in every single sector," Bret Greenstein, PwC U.S. data and analytics partner, told CRN. "[There is] just a huge volume of discussions to help people think this through. It's one of the fastest sales cycles I've ever seen, but at the same time it's highly transformative. So the work is actually really hard. But [customers get interested very quickly] because it's not as if anyone has to be convinced that generative AI matters or is going to be disruptive to business."

Some of the early generative AI use cases include offloading work from contact center agents, having AI collect the customer's problem, answer the customer if the problem is lower level and automate service ticket processing. PwC has seen reductions of work for employees of up to 80 percent.

"These are often workflows where there are inbound communications coming in," he said. "And previously, there was not a good way to vet inbound service tickets, service requests, insurance claims, requests -- whatever comes in always comes in as email, text or some workflow. And it was so hard to automate that because you can't do that with just a bunch of clicks or code. But generative AI does a nice job of reading, so to speak, incoming unstructured text and then characterizing high, middle, low risk and then even resolving some of the issues automatically.

"So we had some processes where we're just seeing an 80 percent drop in what goes to the actual person, which allows the person to focus on the harder cases and the easy ones or the incomplete requests get handled automatically. ... Even the communication back to people with natural language is a really cool process that speeds up the experience, reduces the labor, allows people to scale."

In mergers and acquisitions, generative AI has helped leverage and analyze unstructured data used in complex due diligence, Greenstein said. In sales, it has helped internal sellers support customer needs and questions. In software development, generative AI has helped with creation, testing, evaluation, documentation and code optimization -- improving efficiency by as much as 50 percent. In human resources, generative AI has helped with job postings, performance management and other tasks. And in IT, it has saved workers from answering low-level questions.

"It also helps end users who actually just don't know what they want, but they know how to say it," he said. "And so they don't know how to run SQL, but they do know how to ask for things."

When introducing generative AI to a customer, PwC looks for areas of constraint, he said.

"There's a financial services company I've been talking to, and they're just excited because there are certain parts of their business that they're about to grow drastically as interest rates change," he said. "And they want to scale up and go faster without hiring a million people. And they couldn't find them if they wanted to. So this ability for a midsize company to amplify their business or to scale their workforce is pretty powerful."

The key for customers is that generative AI won't solve everything, he said. "If you just let everyone build a chatbot, you're just going to get a lot of noise and not a lot of high quality," he said. "But if you create a solution that trains people how to build high-quality customer service, you can adapt it to HR or to other things."

A generative AI solution brings in just about every technology discipline at PwC, he said. These include the cloud, infrastructure, security, applications, data, business functional operations such as finance and IT, and then sector-based use cases as well.

"This is the greatest unifier for us because we all have to come together for clients to help them," he said.

Copilot Conversations Open New Doors

Mike Wilson, CTO and partner at Mason, Ohio-based Microsoft partner Interlink Cloud Advisors -- a member of CRN's 2023 Managed Service Provider 500 -- told CRN that his company has used the hype around Microsoft 365 Copilot to educate customers on Microsoft's other generative AI wares.

Azure OpenAI, Azure Cognitive Services, Syntex and Power Platform's form recognition capabilities are some of those wares. Wilson and his customers have even talked about how individual job roles may change with generative AI.

"There are a lot of other AI technologies that exist," he said. "So there's a possibility here when we're looking at readiness around things like Copilot to also start looking across their business. ... We can go through and do that business consulting, look role by role in your organization, identify AI use cases."

An eventual conversation with customers is how MSPs that adopt generative AI may even need to change billing because of the increase to productivity, he said.

"Do I bill an hour? Do I bill five? Do I bill one hour at five times the rate? We're going to have to navigate through that stuff -- both for me as a professional services firm and I think for a lot of organizations," he said.

"If all of the sudden your employees are more productive, do they work less? Do they work the same? Do they demand more money? How much does the organization give credit for providing the AI tools versus what the employee gets for being more productive and using them? We're going to have to navigate those conversations because there is going to be a lot of change as people's job roles adapt. I don't see it replacing a lot of jobs, but I do think it ultimately changes many of them."

Phillip Walker, CEO of Manhattan Beach, Calif.-based Microsoft partner Network Solutions Provider -- a member of CRN's 2023 MSP 500 -- said that the generative AI fervor has had a ripple effect on customers seeking Microsoft Power BI AI capabilities.

His company has worked with customers on data lake cleanup to prepare for generative AI.

"The golden nugget is going to be Power BI," Walker said. "It's going to be analyzing data. It's going to be real-time information. It's going to be recommendations. Because before, you had to have SAP HANA installed. You had to have NetSuite installed. You had to have some enterprise Oracle ERP to get that type of insight for your business. And you had to have a team of analysts from Harvard sitting in a room looking at the data to make sense of it. Those days are now going away."

Gordon McKenna, global vice president of alliances at Downers Grove, Ill.-based Microsoft partner Ensono -- No. 103 on CRN's 2023 Solution Provider 500 -- told CRN that an example of his company's early generative AI work has been demonstrating an OpenAI application that takes in a vast number of anonymized Statements of Work to create recommendations.

"You can literally query the tool and say, 'I've got this type of customer, and they've got this type of requirement. What do I need to put in the SoW?'" McKenna said. "And it literally scours through those Statements of Work and comes up with a response."

A member of the Microsoft Partner Advisory Council, McKenna said that Microsoft's investment in AI is for the long haul and that it has prompted AWS, Google Cloud and other rivals to publicly announce how they are tackling this technology.

"I would say the pivot that Microsoft made around AGI [artificial general intelligence] is a sharper pivot than they made going all in on the cloud," McKenna said. "And it's absolutely the right pivot to make. They bet the house on it. ... I applaud Microsoft. It's the right move. It is very exciting."

Microsoft taking generative AI seriously is why the vendor's partners need to as well, he said. Interested partners will probably see opportunities for on-premises work, private offerings with more security, and hybrid cloud.

"Any partners that aren't leaning into this now are going to be dead, same way as cloud," McKenna said. "But I think it's a quicker pivot. ... The time is now. In a year's time, two years' time, the market will be saturated. Not only by partners that have transformed, but new partners coming into the market. There are a lot of startups that are like, 'I want a piece of this,' and are leaning into the market and are going to become very quick contenders for the crown."

What Partners Need From Microsoft

Although some enterprising solution providers have already plunged into generative AI, all the partners who spoke with CRN had suggestions for how Microsoft can make Copilots ready for the channel once they become generally available.

WinWire's Arora said he knows Microsoft understands that even businesses won over by generative AI may not have budgeted for its adoption. AI-specific incentive programs for solution providers go a long way, he said.

When asked about bringing generative AI to capital-conscious customers, Microsoft's Dezen said that solving for particular business problems and communicating that this isn't technology for technology's sake is key.

"This isn't a science project," she said. "This is about how you help customers solve their real business problems, and then you can get to the crux of what do you need to do and what are the resources, investments you need in order to solve this problem."

The productivity benefits -- and employee morale boost from no longer working on mundane automated tasks in favor of more complex problem-solving -- can help offset the price of adopting generative AI, she said.

Productivity "is a pretty obvious place to get a direct cost savings," Dezen said. "This is where you realize savings through time savings. I love the way that we talk about Microsoft 365 Copilot and how you can eliminate those mundane tasks. With the elimination of those mundane tasks is the elimination of hours of work. There's real cost savings there."

WinWire has preview versions of certain technology from the vendor, Arora said. More previews will help WinWire and other solution providers evangelize the technology to customers concerned about content safety and accuracy.

WinWire's Guidi said that Microsoft-funded assessment programs and ways to help customers with building costs will help move the technology forward.

When asked about incentives, more specializations, more training and more resources for partners, Dezen said this is only the beginning.

"There's a lot more in the road map," she said. "We're not slowing down at all."

PwC's Greenstein said he looks forward to more ways to scale vector databases, provide access control and synchronize data -- not to mention integration to prevent employees from having to work with dozens of different AI systems.

"Those are going to be critical as this becomes an enterprise capability," he said.

In a June blog post, Microsoft suggested that people interested in staying updated on Copilot developments use Message center in the Microsoft 365 admin center and the online Microsoft 365 road map.

Interlink's Wilson said Microsoft needs to give partners concrete release dates for when Copilots and other generative AI offerings go generally available. The vendor also needs to release more information on how much generative AI will cost customers and better address "hallucinations" -- the term for when AI models produce false information.

Although the hallucination issue is improving and solution providers have techniques they can use when interacting with models to minimize the concern, "sometimes the model just has to be able to say, 'I don't know,' versus making stuff up," Wilson said.

Providing solution providers with "solid training" on leveraging generative AI and interpreting output will help with user adoption, he said.

EY's Little said solution providers can put guardrails in place for customers and investigate the causes of hallucinations. Sometimes, a hallucination reveals an issue with the customer's data used to power the AI, Little said.

"We were demoing [the payroll chatbot] to a client," he said. "And the client just asked a question, came back, and the client said, 'Well, that's wrong.' We were like, 'OK, well, let's click.'

So we clicked to the data source. And actually, what we found was the data had wrong information. So actually, we found a secondary effect in circumstances where it ends up helping us from a data cleansing perspective and continuously making it better."

Microsoft making governance tools and prompt engineering tool sets more available will help customers, Little said.

Core BTS' Thompson said Microsoft has done a good job of talking about responsible AI broadly, but he wants to hear more about industry-specific responsibility and how to factor for customer interpretations.

"If you know anything about the governance and risk and compliance, it's really how to take those regulatory controls, and each company has their own interpretation of their definition of what it means," he said. "What is that prescriptive guidance that needs to come into play? And how do we actually take those controls that they have in the platform to conform it to meet that?"

He also wants to see all vendors put interoperability forward. "It shouldn't matter whether it is a third-party vendor, whether it's Microsoft, or whoever it is," he said. "We're playing into the ecosystem of what our enterprise needs and also from our consumer perspective. We need to be able to play together in that same pool."

Network Solutions Provider's Walker said details on how generative AI uses customer data will help build trust in the technology.

"They need to give us and the community -- the Microsoft community -- best practices," he said. "It's having an honest, detailed conversation about what AI is doing and how it uses data ... so people can make a decision willingly on giving their data and what they are feeding into it."

Walker said more education around using generative AI to avoid headline-grabbing debacles such as Samsung employees feeding proprietary data to ChatGPT and a New York lawyer filing a legal brief with made-up legal opinions generated by ChatGPT.

He related this to when early internet users needed education on when not to put in credit card information and Social Security numbers when asked online.

"There just needs to be rules or ideas of, 'Hey, this is what we should or should not do with AI,'" he said.

Aligning With Microsoft

When Arora and WinWire CEO Ashu Goel both left Microsoft in 2007 -- Arora worked at the vendor for about seven years and Goel about six -- to start their solution provider business, they decided that one of their competitive advantages would be always aligning closely with Microsoft's direction.

"From the very early days of Azure and everything else, we have made sure that we are always part of the best and the latest and greatest that Microsoft is investing their time on," Arora said. "When mobility came into the picture. When IoT came into the picture. When cloud, of course. ... as data and AI itself came into the picture."

For Arora, investing time and money this early into generative AI means WinWire stays ahead of the competition to win new customers and deliver innovative solutions to existing customers.

"We are the AI expert for you for a long time -- data and AI," he said. "And we are also generative AI experts. ... Our commitment to Microsoft as a platform, Microsoft as a partnership and to our existing customers, it is creating a lot of buzz out there for us as a company."

Although WinWire is strictly a Microsoft partner, Arora is still watching how competing services from Google Cloud and AWS compare. For now, he feels secure with his bet on Microsoft.

"Microsoft, the way it has increased its presence in everything in the last five, 10 years, and in the last five or six months on this technology, I think our bet has been paying off," he said. "They need partners like us, the team that I'm bringing in, to go deeper into technology to scale and to speak to the customers. And we are able to provide that."

# data[].attributes.attachment_link.title
Microsoft Partners: This Is Your Copilot Speaking | CRN

# data[].attributes.attachment_link.description
Microsoft CEO Satya Nadella has called the spread of generative AI a 'collective mission' for the company and its partners, a mission that in part will be fueled by Microsoft 365 Copilot. Here's where Microsoft partners are placing their bets.

# data[].attributes.headline
Schweizer Firmen mangelt es an Cybersecurity-Grundlagen

# data[].attributes.subject
Schweizer Firmen mangelt es an Cybersecurity-Grundlagen

# data[].attributes.body
Ein neuer Bericht von Kaspersky zeigt, dass viele Schweizer Unternehmen nicht einmal über einen Basisschutz für die Cybersicherheit verfügen. Viele führen keine Schulungen zu Phishing durch oder haben keine Passwort-Richtlinien.

# data[].attributes.headline
CONNECTED : La plus grande exposition de l'armée de ces dernières années

# data[].attributes.subject
CONNECTED : La plus grande exposition de l'armée de ces dernières années

# data[].attributes.body
Du 16 au 20 août 2023, l’Armée suisse organisera la manifestation phare CONNECTED sur la place d’armes de Kloten-Bülach. CONNECTED fera la part belle aux thématiques cyber et à la digitalisation en permettant de découvrir ces sujets de manière concrète. Alors que des événements fermés auront lieu les 16 et 17 août, l’exposition sera ouverte au public du 18 au 20 août. CONNECTED proposera un programme varié et passionnant. Il y en aura pour tous les goûts.

# data[].attributes.headline
Schweizer Lehrerverband will kein KI-Verbot an Schulen

# data[].attributes.subject
Schweizer Lehrerverband will kein KI-Verbot an Schulen

# data[].attributes.body
Der Dachverband Lehrerinnen und Lehrer Schweiz (LCH) und sein Westschweizer Pendant SER haben in Bern einen Aktionsplan zum Schulstart vorgestellt.

Ein Schwerpunkt an der Medienkonferenz in Bern war Künstliche Intelligenz. Texte von ChatGPT oder Bilder von Dall-E hätten auch in den Klassenzimmern Einzug gehalten – als Werkzeug wie als Unterrichtsthema. "LCH und SER sehen sowohl Potenziale als auch Herausforderungen bei der Nutzung von KI an Schulen und plädieren für einen sorgfältigen und systematischen Ansatz bei deren Implementierung." Man habe die Verantwortung, Schülerinnen und Schüler auf einen kompetenten und verantwortungsbewussten Umgang mit digitalen Technologien vorzubereiten.

# data[].attributes.attachment_link.title
Schweizer Lehrerverband will kein KI-Verbot an Schulen

# data[].attributes.attachment_link.description
Der Dachverband LCH hat einen Aktionsplan lanciert, um die Bildungsqualität zu sichern. Dabei geht es auch um Künstliche Intelligenz.

# data[].attributes.headline
War in Ukraine: Twelve disruptions changing the world-update

# data[].attributes.subject
War in Ukraine: Twelve disruptions changing the world-update

# data[].attributes.body
Russia’s war in Ukraine is an ongoing tragedy, destroying lives and livelihoods in Ukraine and altering economic patterns worldwide. In May 2022, we set out an initial analysis of 12 disruptions that the war could unleash. With the passage of time, it seems increasingly likely that the war, coming so soon after a global pandemic, could presage a new economic era. We have been here before: today’s shocks are reminiscent of the immediate aftermath of World War II (1944–46), the oil crisis (1971–73), and the breakup of the Soviet Union (1989–92). Each of those events changed the global landscape with the sudden release of powerful underlying forces that had been building up around a fault line over time. Each ushered in a new era.

# data[].attributes.attachment_link.readable_text
Russia's war in Ukraine is an ongoing tragedy, destroying lives and livelihoods in Ukraine and altering economic patterns worldwide. In May 2022, we set out an initial analysis of 12 disruptions that the war could unleash. With the passage of time, it seems increasingly likely that the war, coming so soon after a global pandemic, could presage a new economic era. We have been here before: today's shocks are reminiscent of the immediate aftermath of World War II (1944-46), the oil crisis (1971-73), and the breakup of the Soviet Union (1989-92). Each of those events changed the global landscape with the sudden release of powerful underlying forces that had been building up around a fault line over time. Each ushered in a new era.

To understand the shape of the era now unfolding, we have tracked the evolution of the war's disruptions since May 2022. At that time, some disruptions were already well under way-notably the humanitarian crisis that followed immediately from the invasion. As we highlighted, others were less predictable but worth watching-for example, we noted that the direct impact of the war on financial systems had so far been limited, but that risks from wider ripple effects might materialize.

In this update, we look at what's happened in the 16 months since the invasion. As recent events in Ukraine highlight, the ultimate outcome remains profoundly uncertain. However, we find five disruptions with clear effects that may endure: the humanitarian crisis, energy source diversification, defense spending increases, cyber as a stage for conflict, and corporations' pull-back from Russia.

Three other disruptions have eased, as connections in our global system, together with cooling of demand, buffered their effects. These include spikes in prices and supply disruptions for food, metals, and minerals, which have now dissipated.

Of course, in the past year, forces beyond the war in Ukraine have also roiled the system in compounding, intertwined ways: the steady rise of interest rates, China's lockdown and reopening, severe weather, and broader geopolitical tensions. All are contributing additional uncertainty. These forces have become the most important drivers of three more disruptions we noted in May 2022-most prominently, the burden carried by the poorest people, a splintering of tech standards, and financial-system instability.

Ongoing and persistent disruption

The war's impact has persisted across several spheres, from the humanitarian crisis to energy market shifts. Although some of the conflict's long-term outcomes remain unclear, these once-emerging dynamics have begun to solidify.

Resilience and recalibration

Some of the initial shocks from the invasion have leveled out. In particular, high prices in select sectors have reverted to prewar levels, while global value chains have filled production gaps.

Compounding complexities

In May 2022, we thought that the war in Ukraine might directly and unambiguously influence these areas. It hasn't. Instead, the ongoing conflict is one of several forces that are complicating important aspects of global affairs.

Volatility, volatility, volatility

The Greek philosopher Heraclitus taught that all things are in continual flux, and change is the only constant. That certainly seems true today.

As we noted in May 2022, these disruptions are already affecting people's lives and livelihoods with potent force and should be part of every company's scenario planning. The past 16 months have shown that the trends set in motion by the war are far from dispositive regarding the global economy. Each will bear watching over coming months.

Related Articles

# data[].attributes.attachment_link.title
War in Ukraine: Twelve disruptions changing the world-update

# data[].attributes.attachment_link.description
Russia's war in Ukraine grinds on. In this update, we look at what's happened since the invasion began and explore the latest social and economic consequences.

# data[].attributes.headline
Russia Takes Its Ukraine Information War Into Video Games

# data[].attributes.subject
Russia Takes Its Ukraine Information War Into Video Games

# data[].attributes.body
Russian propaganda is spreading into the world’s video games. In Minecraft, the immersive game owned by Microsoft, Russian players re-enacted the battle for Soledar, a city in Ukraine that Russian forces captured in January, posting a video of the game on their country’s most popular social media network, VKontakte.

A channel on the Russian version of World of Tanks, a multiplayer warfare game, commemorated the 78th anniversary of the defeat of Nazi Germany in May with a recreation of the Soviet Union’s parade of tanks in Moscow in 1945. On Roblox, the popular gaming platform, a user created an array of Interior Ministry forces in June to celebrate the national holiday, Russia Day.

These games and adjacent discussion sites like Discord and Steam are becoming online platforms for Russian agitprop, circulating to new, mostly younger audiences a torrent of propaganda that the Kremlin has used to try to justify the war in Ukraine.

# data[].attributes.headline
Elite North Korean Hackers Breach Russian Missile Developer

# data[].attributes.subject
Elite North Korean Hackers Breach Russian Missile Developer

# data[].attributes.body
It has been uncovered that an elite group of North Korean hackers successfully breached the computer networks of a major Russian missile developer for an extended period last year. The evidence, reviewed by Reuters and analyzed by security researchers, points to cyber-espionage teams associated with the North Korean government, namely ScarCruft (aka APT37, InkySquid, Reaper, and Ricochet Chollima). The same group was also reported to have used the Dolphin Backdoor against South Korea in December 2022.

The researchers also noted tracks of the infamous North Korean state-backed group, Lazarus, in these attacks. This was identified after researchers noted the presence of OpenCarrot Windows OS backdoor. The backdoor is known to be used by the Lazarus group. These hackers discreetly installed stealthy backdoors into systems at NPO Mashinostroyeniya, commonly referred to as NPO Mash, a prominent rocket design bureau located in Reutov, on the outskirts of Moscow.

# data[].attributes.attachment_link.provider_name
HackRead | Latest Cybersecurity and Hacking News Site

# data[].attributes.attachment_link.title
Elite North Korean Hackers Breach Russian Missile Developer

# data[].attributes.attachment_link.description
North Korean hackers from OpenCarrot and Lazarus breached NPO Mashinostroyeniya, a major Russian missile developer, for at least five months.

# data[].attributes.headline
Innovation Wars: How China Is Gaining on the United States in Corporate R&D

# data[].attributes.subject
Innovation Wars: How China Is Gaining on the United States in Corporate R&D

# data[].attributes.body
China wants to displace the United States as the world’s leading innovation economy. Business R&D in advanced, traded-sector industries is a key indicator of its progress—and it is catching up rapidly. Congress and U.S. state governments should respond by boosting R&D tax incentives.

# data[].attributes.attachment_link.readable_text
Contents
Key Differences Between EU R&D 2,500 Scoreboard and Business Enterprise R&D Expenditure Estimates 37
This report uses the EU R&D 2,500 Scoreboard, which covers 90 percent of the world's private-sector R&D spending, to compare U.S.- and Chinese-headquartered firms' R&D spending in three groups of economic sectors. First, we examine nine strategically important advanced, traded-sector industries. Second, we compare U.S. and Chinese firms across all non-advanced traded sectors. Finally, we examine non-traded sectors. There are, however, some caveats about this dataset: the companies' locations are categorized by their headquarters rather than where R&D investments occurred; the R&D spending is in nominal dollars, company sectors are classified by main business activities, and most of the data presented here does not attempt to adjust for purchasing power parity to reflect lower R&D salaries in China. (See appendix 2 for details.)

Each section of the report examines U.S. and Chinese private-sector R&D in those sectors on a size-adjusted basis-first relative to the size of their respective economies; then as proportions of global R&D in each sector or group of sectors; and finally using an industrial concentration ratio known as a location quotient (LQ), which is R&D as a share of a country's national economy versus the global average. We also compare the extent to which private R&D is concentrated among each country's top four firms on the EU R&D 2,500 Scorecard.

In response, Washington needs to do a better job of incentivizing the private sector to continue investing in R&D. This should include expanding programs that fund joint industry-university research, boosting the Alternative Simplified R&D Credit rate from 14 percent to at least 28 percent, and restoring R&D expensing. It's much easier to keep U.S. industries' global market shares through such policies than to lose them and later have to work much harder to win them back, often in vain.

The following subsections compare the United States' and China's private business R&D spending from firms in nine advanced sectors: aerospace and defense, electronic and electrical equipment, general industrials, industrial engineering, pharmaceutical and biotechnology, software and computer services, technology and hardware equipment, alternative energy, and automobiles and parts. It is important to note that the sample of firms only includes the top 2,500 R&D spenders globally.

Chinese firms in advanced sectors are heavily investing in R&D and catching up to U.S. firms to compete in the global economy.

The United States relies more on firms in the software and services sector to maintain its growth in size-adjusted R&D spending for advanced sectors. According to Statista, the United States is the largest R&D spender in software. From 2013 to 2021, U.S. firms' R&D spending grew from 80 percent (1.8x) to 100 percent (2.0x) above the global average. Without the software and services sector, U.S. firms' R&D spending remained stagnant at 60 percent above the global average. In comparison, Chinese firms' R&D spending grew about the same even without the software the sector (0.26x to 0.76x). As a result, without the software sector, Chinese firms are projected to catch up to U.S. firms' R&D spending by 2034. (See figure 4.)

Chinese firms in the electronic and electrical equipment sector not only caught up but now exceed the United States in promoting R&D and competitiveness.

The industrial engineering sector includes "companies that design, develop, manufacture, sell, and support general industrial machines and parts;" manufacture farming equipment; manufacture large construction and port industrial equipment; manufacture and distribute energy output devices (such as diesel engines); manufacture equipment for heavy industries; and manufacture and market specific types or groups of industrial machines and parts.

Chinese firms in the pharmaceutical and biotechnology sector are not investing as much in R&D in relation to the size of their country's GDP.

The technology and hardware equipment sector includes semiconductor and other chip producers and distributors; "companies involved in the application of high technology parts to finished products" (e.g., printed circuit boards); semiconductors, photonics, and wafers creation equipment manufacturers; computer, servers, and other computer hardware manufacturers and distributors; and electronic office equipment manufacturers and distributors.

The rapid increase in R&D investment from Chinese firms in the tech and hardware sector means they will likely become increasingly more competitive, taking market shares from the United States.

The following sections compare the R&D spending of U.S. and Chinese firms in all nonadvanced traded sectors and nontraded sectors.

Nonadvanced traded sectors include all traded sectors that are not one of the above advanced sectors (see appendix 1 for a list of sectors). These sectors include producers of leisure goods, chemicals, and food, along with oil and gas producers.

In 2021, 65 U.S. firms and 143 Chinese firms made the EU R&D 2,500 list. The average U.S. firm spent $294 million on R&D, 0.02 standard deviations below the average firm in the sectors globally. In comparison, the average Chinese firm spent $240 million, a 0.12 standard deviation below the average firm. This is compared with the average firm's spending of $304 million. Both the average U.S. and Chinese firm did not invest as much as the average firm globally.

Collectively, Chinese firms invest more in R&D than U.S. firms because of the higher number of Chinese firms. In 2021, Chinese firms invested $34 billion, while U.S. firms invested $19 billion. As a result, Chinese firms' share of the global sectors was 28.7 percent, while U.S. firms' share was 16 percent. Chinese firms still spent more when controlling for GDP. For every $1,000 of GDP, U.S. firms spent $0.82, while Chinese firms spent $1.94. This is compared with the rest of the world's R&D share of 55.3 percent and spending of $1.19 for every $1,000. (See figure 32.) When adjusting for wages, Chinese firms spent 3.4 times more than U.S. firms-$66 billion compared to U.S. firms' $19.1 billion.

Nontraded sectors include general merchandise stores, life insurance providers, and financial services (see appendix 1 for a list of sectors).

Scientific and engineering research is key to innovation success for firms and economies. This generated knowledge is translated into innovation, including novel products and processes. More importantly, business research resulting in knowledge is a crucial driver of global competitiveness for a nation because manufacturing industries and many service industries rely on R&D for competitive success.

The United States needs to raise the Alternative Simplified Credit, an R&D tax credit, to 20 percent to restore the United States' R&D competitiveness compared with China and other OECD nations.

The United States is in fierce geopolitical competition with China, requiring leadership in advanced sectors. Success in these sectors stems in part from R&D investments. Yet, size-adjusted R&D spending of U.S. firms in nine advanced sectors is beginning to fall behind that of Chinese firms, despite U.S. firms being ahead of Chinese firms' a decade ago. Yet, U.S. firms in two of nine advanced sectors have size-adjusted R&D spending that is now lower than that of Chinese firms. Moreover, Chinese firms are closing the size-adjusted R&D spending gap with U.S. firms in advanced sectors. In seven of the nine sectors, U.S. firms' size-adjusted R&D spending has either declined or remained stagnant while Chinese spending rose. In other words, Chinese firms will only become more competitive as they increase their R&D investments and develop new products and processes, potentially taking market share from U.S. firms. This will hurt the United States' economy, national security, and global competitiveness.

The EU R&D 2,500 Scoreboard differs from business enterprise R&D expenditures due to different methodologies and data sources. The Scoreboard collects data on company-funded R&D expenditures from audited financial records, regardless of where the R&D occurred. In comparison, the business R&D expenditure estimates consider a sample of all large companies and a representative sample of smaller companies to estimate the total business R&D expenditures of a country. Moreover, the business R&D expenditure estimates refer to R&D financed by a business sector in a given territorial unit, whereas the Scoreboard does not. As a result, the EU R&D 2,500 Scoreboard report notes that "the Scoreboard R&D figures are comparable to BES-R&D [or business R&D expenditures} data at only the global level." Even then, the estimates are not a complete match due to the different sources and methodologies of data collection.

The Scoreboard lists companies based on the location of their headquarters rather than the location of R&D activities or investments. As a result, the aggregate R&D spending of a country reflects the amount that headquartered firms in that country spent globally rather than domestically. For example, the $5 billion Country A spent on the automobile sector reflects the aggregate amount Country A's firms spent on R&D globally, and not just the R&D investment that took place in Country A.

The Scoreboard collects R&D spending data from companies' annual financial records. As a result, companies' R&D spending is in nominal dollars and not adjusted to control for changes in currency values. If the value of the dollar strengthens compared to other nations, then U.S. aggregate R&D spending will appear larger than if the dollar value remained constant.

The EU R&D 2,500 Scoreboard classifies each company using the International Classification Benchmark based on the main sector in which it conducts its business. As a result, the Scoreboard is not a comprehensive estimate of R&D spending invested in a sector, but rather an estimate of firms (whose main business activity is in that sector) investments in R&D. The estimates in some sectors may therefore be lower than expected since R&D investments by companies whose main activity is not in the sector are not included. Moreover, it is not guaranteed that the R&D investment by a company within a sector is going to R&D for that sector. For example, a company in the retail sector could invest in R&D for new products and also for software, in which case the R&D investment for both the product and software would be included only in the retail sector.

Acknowledgments

The authors would like to thank Cliff Waldman for his guidance on this report. Any errors or omissions are the authors' responsibility alone.

About the Authors

Trelysa Long is a research assistant for antitrust policy with ITIF's Schumpeter Project on Competition Policy. She was previously an economic policy intern with the U.S. Chamber of Commerce. She earned her bachelor's degree in economics and political science from the University of California, Irvine.

Dr. Robert D. Atkinson (@RobAtkinsonITIF) is the founder and president of ITIF. His books include Big Is Beautiful: Debunking the Myth of Small Business (MIT, 2018), Innovation Economics: The Race for Global Advantage (Yale, 2012), Supply-Side Follies: Why Conservative Economics Fails, Liberal Economics Falters, and Innovation Economics Is the Answer (Rowman Littlefield, 2007), and The Past and Future of America's Economy: Long Waves of Innovation That Power Cycles of Growth (Edward Elgar, 2005). Atkinson holds a Ph.D. in city and regional planning from the University of North Carolina, Chapel Hill.

About ITIF

The Information Technology and Innovation Foundation (ITIF) is an independent 501(c)(3) nonprofit, nonpartisan research and educational institute that has been recognized repeatedly as the world's leading think tank for science and technology policy. Its mission is to formulate, evaluate, and promote policy solutions that accelerate innovation and boost productivity to spur growth, opportunity, and progress. For more information, visit .

# data[].attributes.attachment_link.title
Innovation Wars: How China Is Gaining on the United States in Corporate R&D

# data[].attributes.attachment_link.description
China wants to displace the United States as the world's leading innovation economy. Business R&D in advanced, traded-sector industries is a key indicator of its progress-and it is catching up rapidly. Congress and U.S. state governments should respond by boosting R&D tax incentives.

# data[].attributes.headline
China’s Global Investment Surges, Finally

# data[].attributes.subject
China’s Global Investment Surges, Finally

# data[].attributes.body
China’s documented global investment rose sharply in the first half of 2023, from a low base. Metals connected to electric vehicles drew the most interest. China’s global construction did not surge, but it takes longer to adjust. It is sensible to see a jump after “zero-COVID” policies were lifted. China’s Ministry of Commerce, though, asserts COVID-19 was good for outbound investment. The evidence says otherwise, and official outbound investment remains exaggerated. Chinese investment in the US is low. In contrast, American investment in China in 2022 and 2023 is largely unknown, including whether US money supported technology. This is a more important issue than China’s current global spending.

# data[].attributes.body
The value of China’s overseas investment and construction combined since 2005 exceeds $2.3 trillion. In the first half of 2023, investment finally began to rebound from Covid and zero-Covid while construction lagged for the moment. Transport eclipsed energy to become the biggest area of activity. The US, EU, and others continue to be hesitant concerning China’s acquisitions, bringing countries such as Indonesia and Saudi Arabia to the fore.

The China Global Investment Tracker is the only comprehensive public data set covering China’s global investment and construction, which are documented both separately and together. It includes over 4100 large transactions across metals, property, agriculture, technology, and other sectors (plus more than 350 troubled transactions). The full set, with the amount, Chinese parent company, host country, and sector, is available for public use with the proper citation. The tracker is published by the American Enterprise Institute.

# data[].attributes.headline
Another player heats up generative AI race as China introduces interim laws

# data[].attributes.subject
Another player heats up generative AI race as China introduces interim laws

# data[].attributes.body
JD.com launches its large language model ChatRhino, which it says hits 100 billion parameters, amid new regulations in China to manage generative AI services.

# data[].attributes.attachment_link.title
Another player heats up generative AI race as China introduces interim laws

# data[].attributes.attachment_link.description
JD.com launches its large language model ChatRhino, which it says hits 100 billion parameters, amid new regulations in China to manage generative AI services.

# data[].attributes.headline
Report to Congress on Advances in Artificial Intelligence

# data[].attributes.subject
Report to Congress on Advances in Artificial Intelligence

# data[].attributes.body
Numerous federal laws on AI have been enacted over the past few Congresses, either as standalone legislation or as AI-focused provisions in broader acts. These include the expansive National Artificial Intelligence Initiative Act of 2020 (Division E of P.L. 116-283), which included the establishment of an American AI Initiative and direction for AI research, development, and evaluation activities at federal science agencies. Additional acts have directed certain agencies to undertake activities to guide AI programs and policies across the federal government (e.g., the AI in Government Act of 2020, P.L. 116-260; and the Advancing American AI Act, Subtitle B of P.L. 117-263). In the 117th Congress, at least 75 bills were introduced that either focused on AI and ML or had AI/ML-focused provisions. Six of those were enacted.

In the 118th Congress, as of June 2023, at least 40 bills had been introduced that either focused on AI/ML or contained AI/ML-focused provisions, and none has been enacted. Collectively, bills in the 118th Congress address a range of topics, including federal government oversight of AI; training for federal employees; disclosure of AI use; export controls; use-specific prohibitions; and support for the use of AI in particular sectors, such as cybersecurity, weather modeling, wildfire detection, precision agriculture, and airport safety.

# data[].attributes.attachment_link.readable_text
The following is the Aug. 4, 2023, Congressional Research Service report, Artificial Intelligence: Overview, Recent Advances, and Considerations for the 118th Congress.
From the report

Artificial intelligence (AI)-a term generally thought of as computerized systems that work and react in ways commonly thought to require intelligence-can encompass a range of technologies, methodologies, and application areas, such as natural language processing, facial recognition, and robotics. The concept of AI has existed for decades, with the term first being coined in the 1950s, followed by alternating periods of much development and lulls in activity and progress.

A notable area of recent advancement has been in generative AI (GenAI), which refers to machine learning (ML) models developed through training on large volumes of data in order to generate content. Technological advancements in the underlying models since 2017, combined with the open availability of these tools to the public in late 2022, have led to widespread use. The underlying models for GenAI tools have been described as "general-purpose AI," meaning they can be adapted to a wide range of downstream tasks. Such advancements, and the wide variety of applications for AI technologies, have renewed debates over appropriate uses and guardrails, including in the areas of health care, education, and national security.

AI technologies, including GenAI tools, have many potential benefits, such as accelerating and providing insights into data processing, augmenting human decisionmaking, and optimizing performance for complex systems and tasks. GenAI tools, for example, are increasingly capable of performing a broad range of tasks, such as text analysis, image generation, and speech recognition. However, AI systems may perpetuate or amplify biases in the datasets on which they are trained; may not yet be able to fully explain their decisionmaking; and often depend on such vast amounts of data and other resources that they are not widely accessible for research, development, and commercialization beyond a handful of technology companies.

Numerous federal laws on AI have been enacted over the past few Congresses, either as standalone legislation or as AI-focused provisions in broader acts. These include the expansive National Artificial Intelligence Initiative Act of 2020 (Division E of P.L. 116-283), which included the establishment of an American AI Initiative and direction for AI research, development, and evaluation activities at federal science agencies. Additional acts have directed certain agencies to undertake activities to guide AI programs and policies across the federal government (e.g., the AI in Government Act of 2020, P.L. 116-260; and the Advancing American AI Act, Subtitle B of P.L. 117-263). In the 117th Congress, at least 75 bills were introduced that either focused on AI and ML or had AI/ML-focused provisions. Six of those were enacted.

In the 118th Congress, as of June 2023, at least 40 bills had been introduced that either focused on AI/ML or contained AI/ML-focused provisions, and none has been enacted. Collectively, bills in the 118th Congress address a range of topics, including federal government oversight of AI; training for federal employees; disclosure of AI use; export controls; use-specific prohibitions; and support for the use of AI in particular sectors, such as cybersecurity, weather modeling, wildfire detection, precision agriculture, and airport safety.

A primary consideration under debate in the United States and internationally is whether and how to regulate AI technologies. The European Union's draft Artificial Intelligence Act would broadly take a risk-based approach to regulatory requirements and prohibitions for certain uses. In the United States, previously introduced legislation has sought to require impact assessments and reporting for automated decision systems-including but not limited to AI systems-in critical areas (e.g., health care, employment, and criminal justice). Other perspectives on AI regulation have suggested a sector-specific approach with interagency coordination. A general concern for Congress might be how to approach AI regulatory efforts in a way that balances support for innovation and beneficial uses while minimizing current and future harms.

Additional considerations for the 118th Congress might include whether the current federal government mechanisms are sufficient for AI oversight and policymaking, the role of the federal government in supporting AI research and development, the potential impact of AI technologies on the workforce, disclosure of AI use, testing and validation of AI systems, and potential ways to support the development of trustworthy and responsible AI.

Download the document here.

# data[].attributes.attachment_link.title
Report to Congress on Advances in Artificial Intelligence - USNI News

# data[].attributes.attachment_link.description
The following is the Aug. 4, 2023, Congressional Research Service report, Artificial Intelligence: Overview, Recent Advances, and Considerations for the 118th Congress. From the report Artificial intelligence (AI)-a term generally thought of as computerized systems that work and react in ways commonly thought to require intelligence-can encompass a range of technologies, methodologies, and application areas, ...

# data[].attributes.body
Artificial intelligence (AI)–enabled systems make many invisible decisions affecting our health, safety and wealth. They shape what we see, think, feel and choose, they calculate our access to financial benefits as well as our transgressions, and now they can generate complex text, images and code just as a human can, but much faster. So it’s unsurprising that moves are afoot across democracies to regulate AI’s impact on our individual rights and economic security, notably in the European Union (EU).

# data[].attributes.headline
CIO Signs 2023-2027 DoD Cyber Workforce Strategy Implementation Plan

# data[].attributes.subject
CIO Signs 2023-2027 DoD Cyber Workforce Strategy Implementation Plan

# data[].attributes.body
The Department of Defense (DoD) Chief Information Officer (CIO) Hon. John Sherman released the 2023-2027 Cyber Workforce (CWF) Strategy Implementation Plan.

The CWF Workforce Strategy Implementation Plan will assist the Department in advancing talent management initiatives aimed at fostering an agile, flexible, and responsive cyber workforce. This Implementation Plan sets the foundation for how the Department will successfully execute the 22 objectives and 38 initiatives aligned with the 4 overarching goals in the CWF Strategy.

"Our goal is to ensure we are not only finding and hiring a diverse group of highly skilled cyber professionals but also develop the tools, resources, and partnerships required to continue growing these individuals," said Patrick Johnson, Director, Workforce Innovation Directorate.

# data[].attributes.attachment_link.readable_text
The Department of Defense (DoD) Chief Information Officer (CIO) Hon. John Sherman released the 2023-2027 Cyber Workforce (CWF) Strategy Implementation Plan today.

The CWF Workforce Strategy Implementation Plan will assist the Department in advancing talent management initiatives aimed at fostering an agile, flexible, and responsive cyber workforce. This Implementation Plan sets the foundation for how the Department will successfully execute the 22 objectives and 38 initiatives aligned with the 4 overarching goals in the CWF Strategy.

"Our goal is to ensure we are not only finding and hiring a diverse group of highly skilled cyber professionals but also develop the tools, resources, and partnerships required to continue growing these individuals," said Patrick Johnson, Director, Workforce Innovation Directorate.

To realize the success of these goals and objectives, the activities outlined within must be measurable and monitored with continuous feedback. DoD components will continue to build and improve action planning efforts to achieve the goals and objectives in the CWF Strategy.

"Maintaining a highly skilled cyber workforce is vital to protecting our Nation against global cyber threats," Sherman said. "This Implementation Plan covers how the Department will take progressive measures to cultivate a workforce that is flexible and responsive in an ever-changing cyber domain."

Together, the CWF Strategy and Implementation Plan will enable the Department to recruit, develop, and retain the most capable and dominant cyber workforce in the world.

To read the CWF Strategy Implementation Plan, visit:
https://dodcio.defense.gov/Cyber-Workforce/CWS.aspx

# data[].attributes.attachment_link.title
CIO Signs 2023-2027 DoD Cyber Workforce Strategy Implementation Plan

# data[].attributes.attachment_link.description
The DOD released a plan that will assist in advancing talent management initiatives aimed at fostering an agile, flexible and responsive cyber workforce.

# data[].attributes.headline
AI in Federal Election Campaigns: Legal Background and Constitutional Considerations for Legislation 

# data[].attributes.subject
AI in Federal Election Campaigns: Legal Background and Constitutional Considerations for Legislation 

# data[].attributes.body
In evaluating a prohibition on certain campaign communications, the Supreme Court applied a “strict scrutiny” standard of review. Strict scrutiny requires the government to show that the law is the least restrictive means to achieve a compelling interest, which is a difficult standard to meet. Hence, applying strict scrutiny, the Court invalidated a FECA provision that prohibited corporations and unions from directly funding independent expenditures and electioneering communications. Citizens United v. FEC, 558 U.S. at 372. Accordingly, it appears that a prohibition on AI-generated campaign ads would likely be invalidated under a strict scrutiny standard of review unless the government could show that the law achieves a compelling government interest.

# data[].attributes.body
Am 10. Juli hat die Europäische Kommission ihren Angemessenheitsbeschluss für den Datenschutzrahmen EU-USA angenommen. Darin wird der Schluss gezogen, dass die USA ein angemessenes Schutzniveau – verglichen mit dem der Europäischen Union – für personenbezogene Daten gewährleisten, die aus der EU an die am Datenschutzrahmen EU-USA teilnehmenden US-Unternehmen übermittelt werden.

Der Angemessenheitsbeschluss folgt auf die Unterzeichnung eines einschlägigen Dekrets („Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities“) durch die USA, mit dem neue verbindliche Garantien eingeführt wurden, um den vom Gerichtshof der Europäischen Union in seinem Schrems-II-Urteil vom Juli 2020 aufgezeigten Aspekten Rechnung zu tragen. Die neuen Verpflichtungen sollen insbesondere sicherstellen, dass die US-Nachrichtendienste nur auf Daten zugreifen können, soweit dies notwendig und verhältnismäßig ist. Ferner soll ein unabhängiges und unparteiisches Rechtsbehelfsverfahren geschaffen werden, in dem Beschwerden von europäischen Bürgerinnen und Bürgern über die Erhebung ihrer Daten zu Zwecken der nationalen Sicherheit bearbeitet und beigelegt werden.

# data[].attributes.attachment_link.provider_name
European Commission - European Commission

# data[].attributes.headline
Train de mesures sur les services numériques

# data[].attributes.subject
Train de mesures sur les services numériques

# data[].attributes.body
La législation sur les services numériques et la législation sur les marchés numériques visent à créer un espace numérique plus sûr où les droits fondamentaux des utilisateurs sont protégés et à créer des conditions de concurrence équitables pour les entreprises.

# data[].attributes.headline
Vatican News - Weltfriedenstag 2024 befasst sich mit Künstlicher Intelligenz

# data[].attributes.subject
Vatican News - Weltfriedenstag 2024 befasst sich mit Künstlicher Intelligenz

# data[].attributes.body
Der katholische Weltfriedenstag 2024 nimmt das Thema Künstliche Intelligenz (KI) in den Fokus. Wie der Vatikan am Dienstag mitteilte, wird die entsprechende Papst-Botschaft den Titel „Künstliche Intelligenz und Frieden“ tragen.

# data[].attributes.attachment_link.readable_text
Künstliche Intelligenz und Frieden" ist das Thema der Botschaft des Papstes für den 1. Januar 2024

Der katholische Weltfriedenstag 2024 nimmt das Thema Künstliche Intelligenz (KI) in den Fokus. Wie der Vatikan am Dienstag mitteilte, wird die entsprechende Papst-Botschaft den Titel „Künstliche Intelligenz und Frieden" tragen.

Die Fortschritte im Bereich der Künstlichen Intelligenz (KI) haben „immer tiefgreifendere Auswirkungen auf das menschliche Handeln, das persönliche und soziale Leben, die Politik und die Wirtschaft". Das teilte die vatikanische Entwicklungsbehörde mit. Deshalb laute das Thema der Botschaft von Papst Franziskus für den kommenden Weltfriedenstag am 1. Januar 2024, die vom Dikasterium für den Dienst der ganzheitlichen menschlichen Entwicklung angekündigt wurde: „Künstliche Intelligenz und Frieden".

KI auf verantwortungsvolle Weise steuern

Papst Franziskus, heißt es im Kommuniqué des Dikasteriums weitere, fordere „einen offenen Dialog über die Bedeutung dieser neuen Technologien, die mit einem disruptiven Potenzial und ambivalenten Auswirkungen ausgestattet sind". Auch erinnere der Papst an „die Notwendigkeit, wachsam zu sein und sich dafür einzusetzen, dass bei der Herstellung und Nutzung solcher Geräte nicht eine Logik der Gewalt und Diskriminierung auf Kosten der Schwächsten und Ausgegrenzten entsteht". Ungerechtigkeit und Ungleichheit schürten Konflikte und Antagonismen. Die Dringlichkeit bestehe also darin, „die Konzeption und den Einsatz künstlicher Intelligenzen verantwortungsvoll zu gestalten, damit sie im Dienste der Menschheit und des Schutzes unseres gemeinsamen Hauses stehen", wobei diese ethische Reflexion „auf den Bereich der Bildung und des Rechts" ausgedehnt werden müsse. „Der Schutz der Würde der Person und die Sorge um eine Geschwisterlichkeit, die tatsächlich der gesamten Menschheitsfamilie offensteht", sind nämlich "unabdingbare Voraussetzungen dafür, dass die technologische Entwicklung zur Förderung von Gerechtigkeit und Frieden in der Welt beiträgt".

Das Kirchenoberhaupt wolle verhindern, dass sich bei Entwicklung und Gebrauch von KI-Systemen eine „Logik der Gewalt und Diskriminierung" festsetze. Es müsse verantwortlich mit den neuen Technologien umgegangen werden, um sie zum Wohle der Menschheit einzusetzen.

Das Engagement des Heiligen Stuhls für die „Algorethik"

Der Heilige Stuhl hat schon immer auf die ethischen Implikationen des Einsatzes von künstlicher Intelligenz geachtet, indem er möglichst viele wissenschaftliche und technologische Akteure in seine Überlegungen einbezog und mit anderen Religionen zusammenarbeitete. Am 10. Januar hatte die Päpstliche Akademie für das Leben dafür geworben, das Dokument „Rom Call for AI Ethics", das 2020 von Unternehmen wie Microsoft und IBM unterzeichnet wurde, auf Vertreter des Judentums und des Islams auszuweiten. Ziel ist es, eine „Algorithmik" zu fördern, denn, wie der Präsident der Akademie, Erzbischof Vincenzo Paglia, erinnerte, können diese neuen Technologien „zu einer enormen Entwicklung, aber auch zu einer ebenso enormen Tragödie führen, weil sie das Risiko bergen, das Menschliche in einer Art Diktatur der Technologie zu unterdrücken, die die Menschheit selbst umstößt". Das Engagement des Heiligen Stuhls in dieser Hinsicht ist auch in den großen internationalen Organisationen wie den Vereinten Nationen konstant, wo die Risiken und der Missbrauch des Einsatzes von künstlicher Intelligenz in der Rüstung und in Konflikten oft hervorgehoben wurden. Daraus sollte eine „Algorethik" entstehen.

Hintergrund

Der von Paul VI. 1967 ins Leben gerufene Weltfriedenstag findet 2024 zum 57. Mal statt und wird zum elften Mal von Papst Franziskus begangen. Das Thema des letzten Jahres war „Niemand kann sich allein retten" über die Welt nach der Covid-19-Pandemie. Zu den Themen der vergangenen Jahre gehörten der Dialog zwischen den Generationen, die Kultur der Fürsorge, gute Politik und Gewaltlosigkeit sowie die Aufmerksamkeit für Migranten und Flüchtlinge.

Der Weltfriedenstag der katholischen Kirche wird seit 1968 jährlich am 1. Januar begangen; er geht zurück auf eine Initiative Papst Pauls VI. (1963-1978). Zum Weltfriedenstag veröffentlicht der Papst jeweils vorab eine Weltfriedensbotschaft, in der er ein Thema näher erörtert.

(kna/vatican news - mg)

# data[].attributes.attachment_link.title
Weltfriedenstag 2024 befasst sich mit Künstlicher Intelligenz - Vatican News

# data[].attributes.attachment_link.description
Der katholische Weltfriedenstag 2024 nimmt das Thema Künstliche Intelligenz (KI) in den Fokus. Wie der Vatikan am Dienstag mitteilte, wird die ...

# data[].attributes.headline
The future of digital deterrence in Central and Eastern Europe

# data[].attributes.subject
The future of digital deterrence in Central and Eastern Europe

# data[].attributes.body
Russia’s belligerent actions over the past decade and a half have culminated in its full-scale invasion and illegal war against Ukraine. Given Russia’s track record of aggression, Central and Eastern European (CEE) countries are now raising a legitimate question: are we doing deterrence right?

# data[].attributes.attachment_link.provider_name
GLOBSEC - A Global Think Tank: Ideas Shaping the World

# data[].attributes.attachment_link.readable_text
Russia's belligerent actions over the past decade and a half have culminated in its full-scale invasion and illegal war against Ukraine. Given Russia's track record of aggression, Central and Eastern European (CEE) countries are now raising a legitimate question: are we doing deterrence right?
Ukraine's staunch and legitimate defence of its sovereignty has provided unprecedented lessons regarding what it takes to effectively resist a formidable adversary in the 21st century. It has also spotlighted the clear and powerful insight that modern warfare is increasingly centred around the digital element. While digital deterrence necessarily includes cyberwarfare, information warfare, and the use of digital technologies more broadly, this report will focus on software and data-driven capabilities. In ways that had not been tested before in a high intensity war between large conventional forces, these capabilities have become a critical enabler of cross-domain operations and an accelerator of more informed decision-making, with speed and at scale. If European allies are to get deterrence right, they cannot do so without more effective integration of software and data into their military capabilities.

This brief highlights the changing role of software in defence and deterrence and the accompanying lessons that can be learned from the war in Ukraine. It also puts forward initial recommendations on the steps CEE countries should take to achieve digital deterrence in the region.

Explore the full report below.

# data[].attributes.attachment_link.title
The future of digital deterrence in Central and Eastern Europe

# data[].attributes.attachment_link.description
Russia's belligerent actions over the past decade and a half have culminated in its full-scale invasion and illegal war against Ukraine. Given Russia's track record of aggression, Central and Eastern European (CEE) countries are now raising a legitimate question: are we doing deterrence right?

# data[].attributes.headline
Germany slashes digitisation budget by 99 percent

# data[].attributes.subject
Germany slashes digitisation budget by 99 percent

# data[].attributes.body
The German government has slashed the government budget for digitisation to three million, down from €377m last year. The coalition initially had pledged to "make life easier for citizens" and bring hundreds of government services online as part of the Online Access Act."We are advancing comprehensive digitisation of the administration," the coalition agreement stated a year and a half ago. But this project is now threatened by a financial shortfall after the finance ministry proposed to cut the budget for 2024 down to less than one percent of its former size.

# data[].attributes.attachment_link.title
Germany slashes digitisation budget by 99 percent

# data[].attributes.attachment_link.description
The German government has slashed the draft 2024 government budget for digitisation to three million, down from €377m last year.

# data[].attributes.headline
Cyber Insurance and the Ransomware Challenge

# data[].attributes.subject
Cyber Insurance and the Ransomware Challenge

# data[].attributes.body
The cyber insurance industry has been heavily criticised for providing coverage for ransom payments. A frequent accusation, which has become close to perceived wisdom in policymaking and cyber security discussions on ransomware, is that cyber insurance has incentivised victims to pay a ransom following a cyber incident, rather than seek alternative remediation options. Over a 12-month research project, researchers from RUSI, the University of Kent, De Montfort University and Oxford Brookes University conducted a series of expert interviews and workshops to explore the relationship between cyber insurance and ransomware in depth. This paper argues that there is, in fact, no compelling evidence that victims with cyber insurance are much more likely to pay ransoms than those without.

Ransomware remains one of the most persistent cyber threats facing the UK. Despite a range of government, law enforcement and even military cyber unit initiatives, ransomware remains lucrative for criminals.

# data[].attributes.attachment_link.title
Cyber Insurance and the Ransomware Challenge

# data[].attributes.attachment_link.description
A study examining the role of cyber insurance in addressing the threats posed by ransomware.

# data[].attributes.headline
Cyber Insurance Experts Make a Case for Coverage, Protection

# data[].attributes.subject
Cyber Insurance Experts Make a Case for Coverage, Protection

# data[].attributes.body
Cybersecurity and insurance continued their awkward dance this week at a Black Hat "mini summit" where the two industries continued to refine the best ways they might work together.

Held on cyber insurance, the summit covered whether there is a need for cyber insurance, how it is assessed, and how CISOs can use it. Alternatively there are claims that underwriting is not keeping upwith modern cybersecurity threats and trends, or even how (or why) the federal government could help protect companies, insurers, and the economy from the impact of a widespread, catastrophic cyberattack.

The points of contention are familiar: How cyber insurance premiums are calculated and which factors are taken into consideration. Insurance proponents argue that having cyber insurance keeps a CISO from worrying too much about the financial impact of an attack.

# data[].attributes.attachment_link.readable_text
BLACK HAT USA - Las Vegas - Wednesday, Aug. 9 - Cybersecurity and insurance continued their awkward dance this week at a Black Hat "mini summit" where the two industries continued to refine the best ways they might work together.

Held on cyber insurance, the summit covered whether there is a need for cyber insurance, how it is assessed, and how CISOs can use it. Alternatively there are claims that underwriting is not keeping up with modern cybersecurity threats and trends, or even how (or why) the federal government could help protect companies, insurers, and the economy from the impact of a widespread, catastrophic cyberattack.

The points of contention are familiar: How cyber insurance premiums are calculated and which factors are taken into consideration. Insurance proponents argue that having cyber insurance keeps a CISO from worrying too much about the financial impact of an attack.

Nonetheless, cleanup costs from an attack, including the added expense of post-incident forensic investigations, downtime, and credit monitoring, also need to be considered, said experts at the Black Hat summit. The recent ransomware attack on Applied Materials was estimated to have cost the company $250 million.

Catherine Lyle on stage at Black Hat 2023. Source: Dan Raywood at Black Hat

Catherine Lyle, head of claims at Coalition, said despite all indicators to the contrary, even lawyers care about the security of your company, especially after an attack or network breach. "Active insurance is there to right the ship when it happens," she said.

Lyle said that as threat actors are becoming increasingly sophisticated, so has their understanding and knowledge of the English language, which helps threat actors who are non-English speakers find the folders containing company's financial records. "They know what you're spending and who has the power to sign the checks," Lyle added.

Since most attacks are enabled by phishing, incidents of ransomware, business email compromise, and funds transfer fraud are all increasing. However, any attack where money has been sent is more of a challenge, since in a ransomware attack there can be a process of negotiation to drive down actual ransom costs, Lyle said.

She also noted that threat actors are likely to dwell in a network longer, on average being 42 days in 2022, twice as long as the average time from a year previous.

Business email compromise, ransomware, and fund transfer fraud all affect an insurance policy enormously, noted Ed Ventham, co-founder of cyber insurance broker Assured. "BEC and ransomware are the two most frequent cyber insurance payouts from insurers," he added. "Most of the technical questions insurers ask are about finding out what controls are in place to prevent these attacks. What endpoint protection is in place? How are systems monitored and how quickly are they patched?" These factors vary widely from customer to customer.

Lyle said insurance exists to help prevent the greater harm and there are steps that can be taken to improve your security posture so that cyber insurance costs are reduced. These include adding adding multifactor authentication (MFA), rehearsing for incident response, and the insurance company help with pre-claim assistance.

View From the CISO

John Caruthers on stage at Black Hat 2023. Source: Dan Raywood at Black Hat USA

John Caruthers, executive VP and CISO at Triden Group, said that while the idea of acquiring insurance may have seemed quaint at one time, in 2023 everyone understands cyber insurance and its purpose, despite some nuance.

He also wondered aloud if cyber insurance is for safety, a compliance play, or neither. "It is not a replacement for a cybersecurity program, but a motivator to build better cybersecurity programs," he said.

Caruthers compared cyber insurance attempts to medical and automobile insurance industries, and said that in cybersecurity there isn't historical data, so a list of minimum mandatory requirements is generated to achieve cybersecurity maturity. These include MFA, incident response plans, and backups, but patch management, remote access controls, supply chain management, and awareness training are also worth considering.

Ventham also noted that end-of-life software is considered a higher risk for insurers; unsupported software is also a related issue and a challenge for insurers and customers alike.

"Exploiting unsupported software is one of the most common attack surfaces, and naturally end-of-life heightens this," Ventham noted. When insurers make their assessments they take into consideration the detection and monitoring capabilities that businesses have in place for this unsupported software. They will want to know what the software is being used for, whether it's Internet facing, and is it segregated from the rest of the network."

# data[].attributes.attachment_link.title
Cyber Insurance Experts Make a Case for Coverage, Protection

# data[].attributes.attachment_link.description
At Black Hat "mini summit," providers and customers get clearer about premium costs and coverage - and the risk of doing without.

# data[].attributes.body
This edited volume represents an important contribution to our thinking on cyberspace and national security. It also serves as one example of an enduring and fruitful relationship between the U.S. Cyber Command (USCYBERCOM) and the College of Information and Cyberspace (CIC) at the National Defense University (NDU).

Essays were solicited in mid-2022 from across the USCYBERCOM Academic Engagement Network, a newly minted body developed in consultation with CIC. The top three submissions were selected by an esteemed committee that included Emily Goldman and Michael Warner. After approval by the USCYBERCOM J5, Rear Admiral Heidi Berg, USN, the authors of the selected essays were invited as panelists at the Cyber Symposium on Integrated Deterrence, an event co-hosted by USCYBERCOM and CIC at NDU, located at Fort Lesley J. McNair in Washington, DC, on November 17, 2022.

# data[].attributes.headline
Gouvernance algorithmique et démocratie, des finalités divergentes ?

# data[].attributes.subject
Gouvernance algorithmique et démocratie, des finalités divergentes ?

# data[].attributes.body
Le code informatique n’est pas la loi. C’est pourtant ce que voudraient nous faire penser toutes les entités qui définissent et commercialisent les programmes informatiques¹ que nous utilisons, nous conduisant à accepter passivement que ce code ait force de loi. Cela contribue à justifier l’inutilité de toute démarche de régulation classique ou du moins à la retarder. Le slogan du juriste américain et professeur de droit Lawrence Lessig « Code is Law : «  », initialement porté par un idéal de liberté dans le cyberespace au tournant de l’an 2000, est désormais associé au slogan « There Is No Alternative » utilisé en 1980 par la première ministre anglaise Margaret Thatcher. L’acronyme TINA est devenu le mantra de la gouvernance algorithmique des affaires publiques et du bien commun. Or, le code informatique ne devrait pas avoir pour vocation de réguler la vie des citoyens et des institutions publiques et privées.

Consentir à ce que le code informatique, produit dans l’obscurité du monde des affaires des multinationales, impose les règles de fonctionnement de la société, donc que la loi du marché devienne le régulateur des affaires publiques, constitue un renoncement à une organisation et un contrôle démocratiques de la société. Cela peut être interprété comme une abdication du pouvoir de l’État-nation, puisque celui-ci se soumet dès lors implicitement à ceux et à celles qui réalisent, ou plutôt dirigent, la réalisation du code informatique.

# data[].attributes.attachment_link.readable_text
Le code informatique n'est pas la loi

Le code informatique n'est pas la loi. C'est pourtant ce que voudraient nous faire penser toutes les entités qui définissent et commercialisent les programmes informatiques ¹ que nous utilisons, nous conduisant à accepter passivement que ce code ait force de loi. Cela contribue à justifier l'inutilité de toute démarche de régulation classique ou du moins à la retarder. Le slogan du juriste américain et professeur de droit Lawrence Lessig " Code is Law : " ", initialement porté par un idéal de liberté dans le cyberespace au tournant de l'an 2000, est désormais associé au slogan " There Is No Alternative " utilisé en 1980 par la première ministre anglaise Margaret Thatcher. L'acronyme TINA est devenu le mantra de la gouvernance algorithmique des affaires publiques et du bien commun. Or, le code informatique ne devrait pas avoir pour vocation de réguler la vie des citoyens et des institutions publiques et privées.

Consentir à ce que le code informatique, produit dans l'obscurité du monde des affaires des multinationales, impose les règles de fonctionnement de la société, donc que la loi du marché devienne le régulateur des affaires publiques, constitue un renoncement à une organisation et un contrôle démocratiques de la société. Cela peut être interprété comme une abdication du pouvoir de l'État-nation, puisque celui-ci se soumet dès lors implicitement à ceux et à celles qui réalisent, ou plutôt dirigent, la réalisation du code informatique.

La transformation numérique de la société est conçue selon une logique de rentabilité, de rationalité et de performance économiques au bénéfice de certains acteurs. Cela contribue entre autres à masquer les coûts sociaux et environnementaux, ainsi que les externalités négatives engendrées. Par la conception même qui caractérise le numérique, les inégalités sociales sont reproduites et renforcées, d'autant plus que le marché impose une solution unique initialement conçue pour gérer des entreprises privées tout en optimisation la valeur pour les actionnaires.

Désormais, ce sont notamment les villes, les hôpitaux, les écoles, les espaces et les transports publics qui sont gérés comme des entreprises, avec les conséquences subies par la population et les coûts portés par la société. S'opposer au fait que, subrepticement, le code informatique fasse la Loi et devienne la Loi passe non seulement par la défense de nos valeurs démocratiques mais aussi par une certaine idée de la souveraineté numérique. Une telle défense et une telle idée ne sont pas compatibles avec une soumission de la population à des algorithmes non transparents, non explicables et non vérifiables. Les algorithmes ne sont en effet qu'un ensemble de règles transcrites dans des programmes informatiques qui conditionnent notre vie en nous donnant accès ou non à des biens et services selon des critères variables. Ces algorithmes ne sont jamais décidés ouvertement, ni démocratiquement, ni vérifiés par des tiers indépendants (avec quelques exceptions dans les cas de code open source). Ils ne peuvent être questionnés, pourtant ce sont eux qui vont décider de notre employabilité, de notre accès à un crédit financier, du montant de notre assurance, du coût d'un trajet ou encore des soins auxquels nous allons avoir droit.

Alors qu'il s'agit souvent de choix relevant de la vie en société, de la manière de faire société et, par conséquent, de la morale et de la culture d'un pays, ces algorithmes complexes, développés dans l'obscurité et le secret des affaires des entreprises qui les commercialisent, sont opaques. Ils créent l'illusion que les questions morales difficiles peuvent avoir des réponses technologiques simples. Ce qui est faux.

Les algorithmes ne sont pas construits d'une manière démocratique, collective et responsable. Leur conception n'est pas le reflet d'une compréhension définie en commun de ce qui est désirable, équitable ou socialement juste. Les algorithmes du numérique sont conçus, réalisés, gérés, utilisés pour être au service d'une vision entrepreneuriale caractérisée par la recherche de la rentabilité et du profit. Ils ne représentent pas l'idéal démocratique d'une société alors même qu'ils imposent ce qui devrait relever du politique, du juridique et du social, donc être soumis à la décision et au contrôle démocratiques.

L'obscurité algorithmique

Comment être sûr de la véracité et de l'exactitude des résultats produits par un système invérifiable, dont on ne connaît pas le jeu de données utilisé, ni les opérations effectuées pour obtenir des résultats ? Un système, qui plus est, dont ni la fiabilité, ni l'innocuité ni la sécurité ne peuvent être garanties.

Le numérique que nous mettons en œuvre avec une recherche sans fin de nouveaux gains d'efficacité, de rapidité et de pseudo-réduction des coûts ne fait que déplacer ces derniers sur d'autres entités. La technologie, la mise en données du monde, les traitements informatiques ne sont pas neutres ni " propres" du point de vue écologique. Ils reflètent une vision du monde et servent les intérêts de certains acteurs au détriment des populations, notamment des plus humbles, et de nombreux écosystèmes. Ils servent une idéologie qui n'est pas compatible avec les valeurs démocratiques telles que défendues jusqu'à présent. Désormais, ce n'est pas le " souverain " (le peuple), mais une poignée de techniciens, qui code les nouvelles règles comportementales, règles qui ne sont jamais définies ou débattues démocratiquement.

Comme le souligne le journaliste spécialisé et ancien rédacteur en chef de la plateforme InternetActu.net Hubert Guillaud dans son article " Les algorithmes contre la Sociale. On ne fera pas société en calculant son efficacité maximale " : " Derrière l'interconnexion totale, il y a une orientation politique, des "objectifs" assignés au calcul " ². Le risque auquel nous sommes confrontés c'est de laisser décider aux ingénieurs et systèmes le rôle de définir les frontières morales des systèmes techniques qu'ils mettent en place.

La démocratie algorithmique n'existe pas

Les entreprises privées réalisent des services, y compris d'intelligence artificielle, et contribuent à imposer des normes et des comportements. Elles ne sont pas des institutions démocratiques, mais représentent une oligarchie numérique.

Il s'agit d'un régime techno-politique dans lequel la souveraineté appartient à un petit groupe de personnes, constitutives d'une élite puissante qui met en code et en services informatisés tous les aspects de la vie. Ces services, dont les individus, les organisations et les États sont devenus dépendants, reflètent la vision du monde des acteurs économiques les plus puissants de la Planète. Même s'il arrive que des services soient déclinés par des acteurs aux slogans et motivations plus acceptables socialement ou qu'il existe des acteurs soucieux des questions de justice sociale et environnementale, la majorité des fournisseurs de technologie numérique ne représentent pas le peuple, ni ses intérêts. La plupart font partie d'une nouvelle aristocratie numérique constituée par quelques privilégiés qui détiennent les infrastructures numériques et le pouvoir associé, sans qu'il existe encore un réel contre-pouvoir. Cette nouvelle élite du code qui se décline en une armée de consultants oriente les choix politiques et sociaux, cela à l'échelle mondiale.

Nous ne pouvons pas ignorer les propos du data scientist David G. Robinson, dans son ouvrage paru en 2022 Voices in the Code: A Story about People, Their Values, and the Algorithm They Made : " Le risque est de transformer les questions morales en questions techniques pour faire disparaître leur aspect moral et donc politique " ³. Robinson met en évidence le fait que plus il y a de décisions prises de manière algorithmique, plus il y a d'informatique, moins il y a de démocratie.

Auteure

Solange Ghernaouti est docteure en Informatique et Télécommunication. Première femme professeure nommée en 1987 à la faculté des HEC de l'Université de Lausanne, elle est une figure pionnière de l'interdisciplinarité de la sécurité et des risques numériques. Experte internationale en cybersécurité, cyberdéfense et lutte contre la cybercriminalité, très engagée en faveur des droits humains et des libertés civiles, elle siège à la Commission suisse pour l'UNESCO en tant qu'experte de la maitrise des risques liés aux technosciences et à leurs impacts sur la société et le vivant. Elle dirige le Swiss Cybersecurity Advisory and Research Group. Elle préside la Fondation suisse SGH - Institut de recherche Cybermonde. Ses derniers livres : " Cybersécurité, risques & solutions " ; " Off ", avec Philippe Monnin, roman sur la dépendance numérique, les interdépendances critiques et la fragilité du nouvel ordre ainsi instauré.

Open Access

Cette publication est en accès libre, sous licence CreativeCommons CC BY-SA 4.0.

Disclaimer

Les articles du blog peuvent contenir des opinions exprimées par les auteur·e·s et ne représentent pas nécessairement la position de l'employeur respectif ou de l'ASSH.

# data[].attributes.attachment_link.title
Gouvernance algorithmique et démocratie, des finalités divergentes ?

# data[].attributes.attachment_link.description
La gouvernance algorithmique envahit tous les champs d'action et secteurs d'activités de la société. Cet article présente quelques aspects problématiques de cette transformation numérique au regard des principes démocratiques.

# data[].attributes.headline
How Palantir Is Shaping the Future of Warfare

# data[].attributes.subject
How Palantir Is Shaping the Future of Warfare

# data[].attributes.body
There is a sense of uneasiness when the screen lights up. Excitement, yes, because you’re being shown a new way to fight a war, having gained access to a perspective until now closed to human perception. But also modesty because the action is down below, a thousand miles below, and all the courage and suffering of the battle are so distant as to almost lose their human meaning. In a recent visit to Palantir’s offices in London, I was able to witness first-hand how the firm’s superior data technology really works. I have not been able to stop thinking about the experience ever since.

# data[].attributes.attachment_link.title
How Palantir Is Shaping the Future of Warfare

# data[].attributes.attachment_link.description
A visit to Palantir reveals how the company is reshaping the battlefield in Ukraine and where algorithmic war is heading

# data[].attributes.headline
Technology Competition: A Battle for Brains

# data[].attributes.subject
Technology Competition: A Battle for Brains

# data[].attributes.body
Emerging technologies—including artificial intelligence (AI), quantum information science and technology (QIST), and biotechnology—will transform people’s lives and work worldwide. Existing studies consider how technological advances could reshape the workplace, including substituting labor with machines, moving labor into complementary tasks, and enabling new ways to access labor.¹ This paper examines a lesser studied but equally important aspect of the intersection between technology and work: Does the United States have the science, technology, engineering, and mathematics (STEM) talent to win the global competition to build, scale, and commercialize emerging technologies? And are current methods of developing and accessing STEM talent sufficient to meet workforce demands?

# data[].attributes.attachment_link.readable_text
Image credit: Exdez/Getty Images and Rin Rothback/CNAS

July 24, 2023

Introduction

Emerging technologies-including artificial intelligence (AI), quantum information science and technology (QIST), and biotechnology-will transform people's lives and work worldwide. Existing studies consider how technological advances could reshape the workplace, including substituting labor with machines, moving labor into complementary tasks, and enabling new ways to access labor. This paper examines a lesser studied but equally important aspect of the intersection between technology and work: Does the United States have the science, technology, engineering, and mathematics (STEM) talent to win the global competition to build, scale, and commercialize emerging technologies? And are current methods of developing and accessing STEM talent sufficient to meet workforce demands?

The possible strategic advantages of emerging technologies are numerous and significant. They promise to deliver lucrative breakthroughs in various industries, from medicine and agriculture to automotive and clean energy. At the same time, countries could leverage emerging technologies to build new weapons systems, bolster intelligence and surveillance tools, or crack an adversary's encryption methods. Given their tremendous economic and national security potential, emerging technologies have become central to U.S.-China competition. The country that leads in the development and implementation of emerging technologies will possess a set of capabilities that can overwhelm unprepared adversaries. The global technology leader will also gain the upper hand in establishing market dominance and setting technology standards. Access to STEM talent is one key factor determining which country prevails in the technology battle.

The STEM workforce-defined here as individuals from all education levels working in science and engineering occupations-is integral to a country's innovation potential and technology competitiveness. A robust and skilled pipeline of STEM talent is a crucial component of continued technological progress. It also plays a key role in harnessing emerging technologies' positive potential while mitigating risks.

This paper evaluates the state of U.S. STEM education and the demand for and availability of STEM talent in three critical technology areas: QIST, semiconductors, and critical minerals. Though U.S. education policy and reform are not the focus of this paper, a broad assessment of the quality and accessibility of STEM education sheds light on U.S. preparedness to build and sustain a pipeline of future STEM talent. An evaluation of the demand for and availability of STEM talent in specific critical technology areas helps clarify the health of the STEM workforce today. The QIST, semiconductor, and critical mineral industries were selected as case studies because they are significant to U.S. national security and encompass a broad range of STEM positions requiring various levels of prior training and education-from no degree requirements to PhD-level expertise. They can thus illuminate the breadth and gravity of U.S. STEM talent challenges.

The paper finds that the United States has concerning gaps in its STEM talent pool. Further, a comparison of U.S. and Chinese human capital opportunities and constraints reveals that heightened global competition for STEM talent threatens to undermine the positive impact of the United States' historic human capital advantages, including its large population size, diversity, and research openness. Absent intervention, the United States risks falling behind China and other competitors in the quest to train, recruit, and retain STEM talent.

The STEM talent gaps and opportunities brought to light here are not revolutionary. The private sector, academia, and government have already initiated several promising efforts to cultivate a more robust and skilled U.S. STEM workforce. The United States can remedy its STEM workforce pitfalls and ensure its technology competitiveness by developing assessment frameworks for grassroots programs and implementing processes to replicate and scale the successful ones. It is not too late for the United States to refine its STEM preeminence, but the onus is on key stakeholders to cultivate a STEM-capable workforce.

The Importance of STEM Talent

In 2019, the U.S. National Security Commission for Artificial Intelligence (NSCAI) provided an interim report to Congress that identified STEM talent as "the most important driver of progress" in all facets of technological innovation. Nearly every recent U.S. government initiative related to technology, including the National Standards Strategy for Critical and Emerging Technology, the National Cybersecurity Strategy, and the National Strategic Overview for Quantum Information Science, recognizes the essential role of STEM talent by including a workforce development component. Further, in public addresses, high-ranking U.S. officials, like National Security Advisor Jake Sullivan and Secretary of Commerce Gina Raimondo, routinely highlight STEM talent as a necessary component of a successful U.S. technology strategy.

Complementary initiatives indicate that the Chinese government's workforce development efforts extend beyond expanding the STEM talent pool. The Artificial Intelligence Innovation Action Plan for Institutions of Higher Learning aims to enhance the quality of China's STEM talent and cultivate military-civil fusion in technology education. Such initiatives are yielding results across China's education and research ecosystem. China has produced more STEM doctorates than the United States since the mid-2000s, for instance, and could produce nearly twice as many STEM PhD graduates as U.S. universities by 2025. Given that China's PhD graduate growth stems mainly from the country's most elite institutions, the quality of STEM doctoral education in China appears to be improving. China is now home to the world's fastest-growing AI research community, publishes nearly 2.5 times as many research papers in top AI journals as U.S. contributors, and produces more top-tier AI engineers than any other country.

Workforce development, once the exclusive domain of domestic and education policy, is now a national security imperative for the United States, its allies, and its strategic rivals. Ensuring U.S. technological superiority requires patching critical vulnerabilities in the U.S. STEM education and workforce ecosystem and addressing global competition in workforce recruitment and training.

The State of U.S. STEM Education and the U.S. STEM Workforce

U.S. STEM Education

Younger American students also fared poorly on the Trends in International Mathematics and Science Study (TIMSS), which compares U.S. students' math and science performance to those of other countries. Fourth- and eighth-grade U.S. students ranked below their Chinese counterparts in 2019 and demonstrated no improvement from the 2015 TIMSS. Further, the United States had "relatively large score gaps" between the top- and bottom-performing students in both subjects and grades, which had increased from prior years.

Student performance on standardized tests and STEM degree completion rates provide a narrow snapshot of the overall health of the U.S. STEM education system but indicate that the United States must overcome significant challenges to build a robust, skilled, and representative pool of future STEM talent. Equally concerning, an analysis of the demand for and availability of STEM talent in the QIST, semiconductor, and critical minerals industries suggests that the United States already lacks the STEM talent required to progress and compete in several critical technology areas.

Quantum Information Science and Technology

QIST talent is a commodity already in short supply, and demand for QIST talent is increasing rapidly. According to the NSTC, the United States, its allies, and its competitors struggle to find the talent required to develop QIST and "global investments in QIST are intensifying the workforce shortage as countries strive to produce, attract, and retain top talent."

QIST requires a diverse workforce representing various disciplines and skill sets. To be competitive in quantum technology, the United States needs "deep technical quantum expertise" to "advance the basic science," "broad quantum-capable engineering skills" to "build the base and supporting technologies," and "quantum-awareness across a range of end-users" to "define and execute on potential applications." No authoritative data source for projecting future QIST workforce requirements currently exists. Still, the NSTC observes that various indicators-including job board analyses and conversations with industry, academia, national laboratories, and government agencies-"suggest a significant unmet demand for talent at all levels."

Semiconductors

Critical Minerals

In 2022, 86 percent of surveyed mining executives experienced recruiting and retention challenges, and 71 percent indicated that talent shortages held them back from delivering on production targets and strategic objectives. Further, approximately 221,000 workers-constituting more than half of the domestic mining workforce-will be retired or replaced by 2029, and the pipeline of available talent to replace them is meager. The United States awarded just 327 mining and mineral engineering degrees in 2020. U.S. mining graduates have decreased 39 percent since 2016. As of 2023, the United States maintains just 15 mining schools and universities. Comparatively, China has over 38 mineral processing schools and 44 mining engineering programs. The United States must recruit, train, and retain more people-from equipment operators and electricians to underground miners and geotechnical engineers-to meet its critical mineral supply chain and clean energy objectives.

Takeaways

The above analyses of U.S. STEM education and talent availability indicate that the United States has unsustainable strategic vulnerabilities. The United States lacks the STEM education system to produce a skilled and diverse STEM talent pipeline. It also lacks a readily available STEM-capable workforce to compete in critical technology areas. However, the United States has several human capital advantages, including a large, diverse general population and a sizeable immigrant community. It is uniquely positioned to prevail in the battle for talent if it plays to its strengths. In particular, the United States can draw on untapped talent pools-including minority communities, individuals without college degrees, and individuals residing in non-metropolitan areas-to expand and diversify its STEM workforce.

Opportunities and Constraints in the Human Capital Environment

The United States maintains several advantages it can leverage to overcome its workforce challenges and strengthen U.S. STEM competitiveness. First, the United States has a large pool of potential talent from which to draw. The U.S. population is sizable and growing. The Congressional Budget Office expects the U.S. population to increase by nearly 37 million people by 2053. Though the share of people aged 65 or older is increasing faster than the working-age population, the United States is nonetheless projected to maintain a robust group of working-aged people who can step into STEM occupations.

STEM industries are well-positioned to maximize the full potential of the large and growing U.S. population. STEM employment opportunities in the United States are available in multiple geographic locations and include various occupations, presenting opportunities for individuals from several age groups, backgrounds, and education levels. The number and proportion of workers from an underrepresented race or ethnicity, for example, has steadily increased within the U.S. STEM workforce and is expected to continue growing.

STEM workers generally have better labor market outcomes than non-STEM workers, experiencing lower unemployment rates and maintaining higher salaries than those in other fields. STEM workers without a bachelor's degree-who comprise over half of the U.S. STEM workforce-maintain higher median earnings and more professional development opportunities than their non-STEM counterparts. The variety and flexibility of STEM professions present significant opportunity for minority communities, American workers who lack a college degree, and individuals residing in non-metropolitan areas, who constitute sizeable portions of the general U.S. population. In addition to a large domestic talent pool, the United States also benefits from an ample population of international talent.

Though not the primary focus of this paper, immigration has an outsized impact on U.S. innovation and technology competitiveness, constituting another key U.S. human capital advantage. In December 2022, the National Bureau of Economic Research found that immigrants are responsible for 36 percent of aggregate U.S. innovation over the past three decades, despite representing just 16 percent of total U.S. inventors. The unique American research culture, characterized by a high degree of freedom and collaboration, makes the United States an attractive destination for international talent. At the same time, however, complex U.S. immigration laws increasingly dissuade top-tier individuals and organizations from contributing to the U.S. STEM ecosystem. Absent immigration reform, the U.S. legal system could soon constitute a human capital constraint.

In June 2023, Australia unveiled plans to ensure competitiveness in "the global race for next-generation technologies" by paying foreign workers higher salaries, streamlining visa application processes, and introducing a "point test" to screen permanent residency applicants for skills that could "contribute to the future national interest." The initiatives, set to take effect in July 2023, mark the first time Australia has amended its immigration policy in a decade.

While the United States benefits from a diverse domestic and international population, China also has some human capital advantages it can leverage to bolster its talent supply and ensure its competitiveness. China is home to the world's largest population and has experience mobilizing human capital to support national objectives. State-directed efforts to expand the share of the population entering the workforce and attaining high levels of education enabled China's recent transition from an agrarian to an industrial base, for example. But several significant constraints hinder China's ability to realize its full human capital potential.

Considering these comparative advantages, the United States should capitalize on its strengths to develop a more robust and better-skilled STEM workforce. The private sector, academia, and government have initiated several promising efforts. The United States can ensure its technological competitiveness by supporting grassroots workforce initiatives and scaling the successful ones.

Current Models for Boosting American Competitiveness

Academia and the private sector have initiated several efforts to improve STEM education and proficiency with encouraging results. One example is Purdue University's Semiconductor Degrees and Credentials Program, which combines classroom lectures with experiential learning opportunities.

Student-oriented initiatives help improve the quality of U.S. STEM education by ensuring that access to educational opportunities is evenly distributed across socioeconomic groups and boosting young people's interest in STEM careers. But students form just one segment of the large and diverse U.S. resource pool. Minority communities, individuals without college degrees, and individuals in rural areas represent sizeable untapped talent pools in the United States.

Relatedly, Qubit by Qubit, a nonprofit initiative focused on developing a diverse quantum workforce, launched a four-week summer program designed to bring together a group of individuals historically underrepresented in STEM professions. In 2022, 48 percent of participants were female or nonbinary, 20 percent were Hispanic, and 17 percent were Black. Post-program surveys and interviews revealed that participants were 86 percent more interested in pursuing a career in quantum computing after completing the program. Several participants reflected that while quantum computing was initially daunting and challenging to understand, completing Qubit by Qubit's program encouraged them to view quantum as an area of study where they could succeed.

Organizations also increasingly offer virtual credentialing opportunities, such as boot camps and accelerated learning programs. Course Report's Coding Boot Camps-intensive learning programs that teach various digital skills-are one example. Eighty-three percent of Coding Boot Camp graduates are employed in jobs that leverage the technical skills learned at the camp, with a median salary increase of 51 percent after graduating. IBM's virtual Qiskit Global Summer School is a comparable two-week intensive learning program intended to give quantum researchers and developers the tools and skills required to write quantum applications. Although IBM expected an enrollment of approximately 200 students annually, the program has attracted more than 4,000 students each year. AT&T's multiyear $1 billion Future Ready Initiative, which aims to reeducate 100,000 employees for new jobs by providing personalized online digital skills courses, has been equally successful. As of 2018, AT&T had awarded virtual "badges" to roughly 57,000 employees marking their completion of online coursework in in-demand skill areas, including data science, computer analytics, and cloud computing.

U.S. companies should continue to pursue reskilling and upskilling initiatives. However, reskilling and upskilling serve distinct purposes and are most impactful when pursued simultaneously. Companies must account for the limitations of reskilling in the technology industry.

Reskilling in the semiconductor industry presents similar challenges. Like in quantum computing, most jobs in the semiconductor industry require a niche level of expertise that limits immediate skill set transferability from other positions or industries. The jobs holding the greatest potential for successful reskilling, like design and software engineers, are the least in demand and the most desirable, offering high pay and flexible remote work options. But lower paying and less flexible jobs in semiconductor fabs, like manufacturing technicians and process engineers, constitute the most acute talent shortages. While an experienced design engineer could hypothetically be reskilled to work in a fab, they are unlikely to pursue jobs at the lower ends of the value chain.

In short, opportunities for reskilling in highly specialized industries may be relatively limited and reskilling initiatives alone will not close talent gaps. Given the breadth and severity of the U.S. STEM talent shortage, technology organizations must pursue various workforce development initiatives at multiple skill and education levels to reduce STEM talent vulnerabilities.

Recommendations

Existing programs to expand and diversify the pool of available STEM talent, reduce barriers to entry associated with STEM careers, and reskill and upskill U.S. workers are promising, but their long-term effectiveness and sustainability are not yet apparent. Developing grassroots initiatives is a laudable first step toward patching U.S. STEM workforce vulnerabilities, but additional follow through is required.

To maximize the impact of existing workforce efforts, technology organizations and academic institutions should:

Recruit independent external research teams to study the effectiveness of recent workforce development programs. Understanding which workforce development initiatives work and why is critical to determine which programs can be replicated and scaled. Independent external research teams-which should be diverse and interdisciplinary and may include think tank analysts, academic experts, or retired industry executives-should develop frameworks and metrics to objectively measure the success of grassroots programming. Research teams should publish routine performance reports detailing the impact of technology organizations' workforce development programs and assessing their potential applicability to other STEM sectors.

Academia, the private sector, and government agencies-each with distinct roles in strengthening and expanding the U.S. STEM talent pool-can also initiate additional programs to complement existing efforts.

To improve U.S. STEM education, increase students' interest in STEM fields, and guide underprivileged students into STEM careers, universities should:

Partner with private companies to develop industry-specific postsecondary education programs and create a pipeline of candidates ready to fill critical talent gaps. University-private sector collaboration like Purdue University's partnership with SkyWater Technology could be expanded to other technology areas. Leading quantum companies like IBM, IonQ, and PsiQuantum, for example, could partner with the Massachusetts Institute of Technology, the University of California, Berkeley, or the University of Chicago to bolster and expand existing quantum computing degree programs and ensure that students gain the practical experience required to fill critical talent gaps immediately upon graduation.

Share resources, best practices, and expertise with local community colleges, technical schools, and high schools to increase access to opportunity. Universities with robust microelectronics programs could, for example, provide hands-on clean-room experience to community college students who typically lack such access due to prohibitive costs. Universities could also work with community colleges, technical schools, and high schools to develop new, more widely accessible learning tools. Education institutions could explore using desktop laboratory equipment to teach students about chip fabrication processes or using augmented-reality and virtual-reality tools to allow students to experiment in simulated fabs. Such initiatives would help generate broad interest in the STEM field, reduce barriers to entry, and increase the speed at which students gain the practical training required to step into full-time positions with little supervision.

Private industry is well-positioned to help build the tools and technologies that enable educators to deliver high-quality STEM education. They can also help increase the opportunities available to minority communities, who constitute large proportions of the American workforce but are vastly underrepresented in STEM professions.

To improve STEM proficiency and support the development of a diverse and highly skilled workforce, U.S. technology companies should:

Partner with local organizations to expand learning opportunities for youth and primary school students. Companies could provide no-cost educational opportunities-like science and technology festivals, STEM-related museums, summer camps, or STEM career days at local YMCAs or sports clubs-to foster hands-on learning and connect underserved and rural communities to STEM careers.

Augment and support innovative industry-specific university programs. Industry partners can take several steps to enhance the attractiveness of programs like Purdue's Semiconductor Degrees and Credentials Program and maximize the impact of universities' workforce investments. Technology companies could fund scholarships or offer guaranteed internships, mentorships, or apprenticeships to students in industry-specific programs. They could also commit to interviewing students who maintain a certain grade point average and provide employees with competitive student loan repayment benefits. Such efforts would help lower-income students pursue STEM degrees and increase the likelihood that graduates ultimately use their degrees to pursue STEM-related careers.

Industry partners could further support innovative university programs by volunteering speakers for lecture series and recruiting events and providing input on course curricula and training offerings. They could also host university faculty at their manufacturing, research, and development facilities for information sessions, tours, and roundtable discussions. Increased communication and cooperation between industry leaders and university faculty would help the two communities better understand each other's needs and facilitate best practices and resource sharing.

Continue to build, fund, and expand reskilling initiatives, but supplement reskilling efforts with upskilling initiatives tailored to individuals underrepresented in STEM fields. Individuals without college degrees comprise a sizeable untapped talent pool in the United States, and technology industries are uniquely positioned to offer them stable, high-wage jobs. More than 60 percent of jobs in a semiconductor fab do not require a college degree. To fill critical talent gaps, U.S. technology companies could design and implement upskilling initiatives to attract and uplift this community. Apprenticeship programs, accelerated skill development programs, or online certification programs would allow underrepresented individuals to hone their skills and advance their earning and promotion potential.

Partner with state and local governments to expand opportunities for individuals in rural areas. Projected growth in the STEM field is expected to disproportionately benefit workers residing in metropolitan areas in coastal states, who typically hold advanced degrees. To leverage the unused talent offered by workers without college degrees, companies should focus their upskilling efforts in remote regions of the South and Midwest of the United States, where proportionately more of these groups reside.

U.S. companies could host town halls in local communities to stimulate interest in the STEM industry, offer educational opportunities, and allow residents to learn about job openings. Such initiatives could be expanded to include information sessions on pathways to STEM careers, STEM-related seminars or briefings from industry representatives, and panel discussions about where to find affordable apprenticeships, internships, or related technical experience. Town halls should be well-advertised in local grocery stores, gas stations, libraries, and schools and held at various times of day, allowing both shift and traditional workers to attend.

Aside from ensuring sufficient funding for federal and state-level workforce development initiatives, government institutions can take several steps to help employers identify their talent needs and connect skilled workers to suitable job opportunities.

Specifically, government institutions should:

Create a digital talent matching platform for each critical technology area to connect job seekers to potential employers. The Department of Labor should create and maintain online talent matching platforms for each critical technology area on the Critical and Emerging Technologies List. The Tasmanian Government's Rapid Response Skills Matching Service, which helped businesses adversely affected by the COVID-19 pandemic fill critical vacancies, could serve as a model for this effort.

The platforms should feature a centralized database to which job seekers can voluntarily upload a resume, cover letter, relevant certificates, and related application materials. Government agencies and private technology companies could use the database to quickly identify candidates with the skills and experience required to fill key positions. The platforms could also include resources that help job seekers learn about the educational requirements of their desired careers, identify training opportunities, and connect with career counselors, mentors, or other job seekers.

Promote the value of vocational training programs, technical education, and nontraditional skill sets. Various national surveys indicate that U.S. adults value a college education and view a university degree as the key enabler of a successful future. Government institutions can play a role in reducing the stigma associated with nontraditional skill sets, experiences, and educational pathways and help employers understand how diverse backgrounds can benefit their organizations.

High-ranking U.S. government officials-including the national security advisor, the secretary of commerce, and the secretary of labor-should routinely visit technical schools and vocational training facilities to signal their significance to U.S. national security and encourage students. First Lady Jill Biden's October 2022 visit to Bates Technical College is a strong first step that could be emulated. U.S. government officials should also continue recognizing technical workers' contributions to U.S. national and economic security in public speeches, addresses, and strategy documents.

Further, the Office of Personnel Management should issue formal guidance on the value of technical degrees and vocational training programs to federal employers. The guidance should indicate how technical skills fit into the General Schedule (GS) pay grade and job requirements. Such guidance would help government agencies maximize the potential of untapped talent resource pools, connect underrepresented groups to more job opportunities, and enhance the credibility of emerging vocational training initiatives.

Conclusion

Securing access to STEM talent is essential to global leadership in a world increasingly dependent on and molded by emerging technologies. A robust STEM workforce is necessary to invent and develop new technologies and ensure responsible technology use and deployment.

The United States is at a critical inflection point. Despite its historical strengths in diversity, research openness, and student attraction and retention, the United States is at risk of losing its competitive edge in human capital. The quality of STEM education and general STEM proficiency in the United States exhibit concerning trends, and key technology industries are struggling to meet workforce requirements. Meanwhile, demand for STEM expertise is rising rapidly, and U.S. adversaries and allies are harnessing efforts to outcompete the United States for available talent resources.

Academia, the private sector, and government must work together to ensure U.S. competitiveness. To maximize U.S. advantages and expand the pool of American STEM talent, U.S. stakeholders should empower and uplift key untapped talent pools: minority communities, individuals without college degrees, and individuals residing in non-metropolitan areas. The United States can advance national and economic security by expanding access to educational opportunities, supporting and celebrating workforce skill diversification, and reducing the barriers to entry associated with STEM professions.

Acknowledgments

This CNAS Technology Policy Lab was made possible with the generous support of The Markle Foundation. CNAS also thanks all experts who participated in this Lab.

As a research and policy institution committed to the highest standards of organizational, intellectual, and personal integrity, CNAS maintains strict intellectual independence and sole editorial direction and control over its ideas, projects, publications, events, and other research activities. CNAS does not take institutional positions on policy issues, and the content of CNAS publications reflects the views of their authors alone. In keeping with its mission and values, CNAS does not engage in lobbying activity and complies fully with all applicable federal, state, and local laws. CNAS will not engage in any representational activities or advocacy on behalf of any entities or interests and, to the extent that the Center accepts funding from non-U.S. sources, its activities will be limited to bona fide scholastic, academic, and research-related activities, consistent with applicable federal law. The Center publicly acknowledges on its website annually all donors who contribute.

About the Technology Policy Lab

This policy brief is a product of the CNAS Technology Policy Lab, a working group structure designed to incubate solutions to crucial yet underdeveloped technology policy problems. Each lab is composed of subject matter experts from academia, industry, and the policy community collaborating to develop concrete recommendations to bolster U.S. national security interests and promote American competitiveness. We thank all experts who participated in this Lab.

Endnotes

Research Assistant, Technology and National Security Program

Sam Howell is a Research Assistant with the Technology and National Security Program at CNAS. Her research interests include quantum information science, semiconductors, and t...

# data[].attributes.attachment_link.title
Technology Competition: A Battle for Brains

# data[].attributes.attachment_link.description
Developing strong, pragmatic and principled national security and defense policies.

# data[].attributes.headline
Ransomware Payments are at a Record High for 2023: $449.1 million through June.

# data[].attributes.subject
Ransomware Payments are at a Record High for 2023: $449.1 million through June.

# data[].attributes.body
The significant plunge in cyber crimes shows a decent rise in legitimate services in the mid of this year, 2023. However, the rise in ransomware attacks still continues to threaten individuals and organizations, and the proliferation of cyber crimes related to ransomware could be seen. The recent chain analysis report shows a 65% decrease in crypto inflows to known illicit entities in the past two years, while a surge of 80% in cryptocurrency values has been observed. Ransomware attacks are increasing, and attackers are on track for their second-highest earning year ever. As of June, they have already extorted a minimum of $449.1 million.

# data[].attributes.attachment_link.readable_text
The significant plunge in cyber crimes shows a decent rise in legitimate services in the mid of this year, 2023.

However, the rise in ransomware attacks still continues to threaten individuals and organizations, and the proliferation of cyber crimes related to ransomware could be seen.

The recent chain analysis report shows a 65% decrease in crypto inflows to known illicit entities in the past two years, while a surge of 80% in cryptocurrency values has been observed.

Ransomware attacks are increasing, and attackers are on track for their second-highest earning year ever. As of June, they have already extorted a minimum of $449.1 million.

Payment Inflows

The year 2023 so far has been seen as a year of recovery for cryptocurrency after a chaotic 2022, with prices of digital assets like Bitcoin up over 80% as of June 30.

The above graph shows the cumulative inflow to legitimate, risky, and illicit services over the year 2023, where we could see a 42% down in risky inflows and only a 28% decline in legit services in spite of the lousy market.

SCAMS High as Usaual:

Scams are always the highest-revenue form of cryptocurrency-based crime, but after the disappearance of two major scams, total scam revenue has plummeted compared to last year.

By the end of June, crypto scams had made 77% less money than they had by the same time in 2022.

The scam revenue decline is largely driven by the abrupt disappearance of two large-scale scams: VidiLook and Chia Tai Tianqing Pharmaceutical Financial Management.

Usually, these scams are immediately replaced by other scams but the industry and law enforcement are becoming more vigilant to circumvent new scams.

The impersonation scams are increased to 49%, which shows that more people have fallen victim to impersonation scams in 2023

Ransomware Attacks on Raise

Ransomware attacks are on the rise, with attackers having extorted at least $449.1 million through June.

Some ransomware strains have payment sizes at both ends of the spectrum, as reflected by their average and median values.

If it continues, ransomware attackers will extort $898.6 million from victims in 2023, trailing only 2021's $939.9 million.

This year, ransomware incidents have reached an all-time peak and have become more sophisticated.

Sujatha is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under her belt in Cyber Security, she is covering Cyber Security News, technology and other news.

# data[].attributes.attachment_link.title
Ransomware Payments are at a Record High for 2023: $449.1 million through June.

# data[].attributes.attachment_link.description
Ransomware attacks are increasing, and attackers are on track for their second-highest earning year ever. As of June, they have already extorted a minimum of $449.1 million.

# data[].attributes.body
The explosion of digital transformation in every business today is inevitable. Companies are increasingly competing by enhancing their customers’ digital experience. Similarly, global government organizations are significantly accelerating digital programs enabling citizens with e-governance, biometric identities and cardless payments to overcome financial exclusion. This has led to staggering amounts of software being developed in the last few years and a surge in software vulnerabilities with many more to come. Combine this with the shortage of skilled cybersecurity professionals, and CISOs and security teams are left with the daunting challenge of keeping up with the sheer volume of information coming at them. CISOs and security teams must continuously work to keep up with the fast pace of technological advancement and evolving cyber threats to reach their goal of reducing their organization’s risk.

Today’s cybersecurity tools, which solely focus on generating more and more detections
and alerts are not enough to help secure organizations. Organizations require assistance in prioritizing the most severe vulnerabilities present in their critical assets and resolving them before attackers exploit them. Additionally, they need a risk-based approach to quantify and align cyber risk to their business and communicate effectively with their executives and boards.

# data[].attributes.headline
2023 Threat Hunting Report | CrowdStrike

# data[].attributes.subject
2023 Threat Hunting Report | CrowdStrike

# data[].attributes.body
The problem isn’t malware — it’s adversaries. To stop these adversaries, security teams must understand how they operate. In the 2023 Threat Hunting Report, CrowdStrike’s Counter Adversary Operations team exposes the latest adversary tradecraft and provides knowledge and insights to help stop breaches.

# data[].attributes.attachment_link.readable_text
Know them. Find them. Stop them.

The problem isn't malware - it's adversaries. To stop these adversaries, security teams must understand how they operate. In the 2023 Threat Hunting Report, CrowdStrike's Counter Adversary Operations team exposes the latest adversary tradecraft and provides knowledge and insights to help stop breaches.

312%

increase in abuse of remote monitoring and management (RMM) tools

79 minutes

average eCrime breakout time, a 5-minute drop from 2022

7 minutes

fastest eCrime breakout time recorded

62%

of interactive intrusions involved compromised identities

Read the CrowdStrike 2023 Threat Hunting Report

Expose adversaries and stop them in their tracks.

Download now

Read the CrowdStrike 2023 Threat Hunting Report

Expose adversaries and stop them in their tracks.

Download now

Identity threats have become mainstream

Overall, 62% of interactive intrusions involve compromised identities. It's not surprising that identity-based intrusions are on the rise - stolen credentials give adversaries immediate access. There's been a 583% increase in Kerberoasting and 147% increase in broker advertisements on the dark web since 2022, highlighting the growth in the end-to-end criminal ecosystem exploiting identity-based attacks.

Adversaries are getting smarter in the cloud

Threat actors are becoming cloud experts, knowing as much as or more about cloud environments than organizations do. As security teams adopt more cloud-based technologies, adversaries are becoming more adept at exploiting misconfigurations and abusing cloud management tools. In fact, adversaries are exploiting the cloud more than ever. There's been a 95% rise in cloud attacks and a 160% increase in credential theft via cloud instance metadata APIs.

eCrime is surging as adversaries become faster

Adversaries are breaking in and out of environments faster than ever. The average eCrime breakout time has dropped to 79 minutes. The fastest recorded time is just 7 minutes. Furthermore, eCrime threat actors are also finding more efficient ways to break in. Among them is the misuse of legitimate remote monitoring and management tools with a 312% increase since 2022.

Cross-platform proficiency is growing

Many of today's adversaries confidently target and navigate multiple operating systems, with growing prowess in Linux and macOS. CrowdStrike® Falcon OverWatch℠ saw a 3X increase of adversaries replacing Pluggable Authentication Modules (PAM) with malicious modules in Linux - especially in the finance, technology, and services industries.

Discover the adversaries targeting you

Explore your threat landscape and find out which adversaries are targeting organizations like yours in the Adversary Universe.

# data[].attributes.attachment_link.title
2023 Threat Hunting Report | CrowdStrike

# data[].attributes.attachment_link.description
Download the report to discover trends in ransomware, endpoint and workload attacks, and strategies for protecting your organization.

# data[].attributes.headline
Criminals Have Created Their Own ChatGPT Clones

# data[].attributes.subject
Criminals Have Created Their Own ChatGPT Clones

# data[].attributes.body
It didn't take long. Just months after OpenAI’s ChatGPT chatbot upended the startup economy, cybercriminals and hackers are claiming to have created their own versions of the text-generating technology. The systems could, theoretically at least, supercharge criminals’ ability to write malware or phishing emails that trick people into handing over their login information.

# data[].attributes.attachment_link.title
Criminals Have Created Their Own ChatGPT Clones

# data[].attributes.attachment_link.description
Cybercriminals are touting large language models that could help them with phishing or creating malware. But the AI chatbots could just be their own kind of scam.

# data[].attributes.headline
BlackBerry Global Threat Intelligence Report - August 2023 Edition

# data[].attributes.subject
BlackBerry Global Threat Intelligence Report - August 2023 Edition

# data[].attributes.body
Since the publication of our first quarterly issue in January 2023, the BlackBerry Global Threat Intelligence Report has quickly become a key reference guide in the cybersecurity industry. This report is used by cybersecurity professionals worldwide, including CISOs, security managers, and other decision makers, to stay informed of the latest cybersecurity threats and challenges affecting their industries and platforms.

In this new issue, our global BlackBerry Threat Research and Intelligence team examines the challenges to governments and public entities, vulnerabilities in the healthcare sector, risks to financial institutions, and the criticality of safeguarding vital infrastructure. We also include a new geopolitical analysis and comments section that provides additional context and gives a strategic perspective to the data presented. The report covers March 2023 to May 2023.

# data[].attributes.attachment_link.readable_text
Infostealers

RedLine

RedLine is a well-known .NET-based infostealer that targets Windows systems. According to BlackBerry telemetry, RedLine was one of the most widely observed malware families during this period. This widespread malware family was also discussed in the Global Threat Intelligence Report - April 2023.

RedLine is a relatively inexpensive infostealer that attempts to exfiltrate personal information from an infected system, such as passwords, social security numbers, and credit card information saved in browsers. Additionally, RedLine can gather and send lists of applications (including security software) installed on a victim's device to the attacker, which helps attackers plot secondary attacks. RedLine can also execute commands and is often one component of a multi-stage execution chain.

RedLine is widely distributed on underground forums and is sold as a standalone product or as part of a MaaS subscription package. At the time of writing, it can be purchased for approximately $100 to $150 USD.

RedLine's popularity and ability to inflict damage are a result of its versatility. The malware can be delivered in several different ways and is often deployed as a secondary or tertiary payload of other malware to increase the damage to a victim's system. In recent months, RedLine was distributed via Trojanized Microsoft ® OneNote attachments to phishing emails.

RaccoonStealer/RecordBreaker

RaccoonStealer is an infostealer that obtains browser cookies, passwords, auto-fill web browser data, and cryptocurrency wallet data. The malware has been reportedly sold as MaaS across dark web forums and similar platforms.

In mid-2022, after a hiatus and temporary suspension of operations, the group behind the malware announced a new version of RaccoonStealer dubbed RaccoonStealer 2.0 or RecordBreaker. This updated malware is currently distributed as MaaS across dark markets. The group claims that they rebuilt it from scratch with an updated infrastructure and improved infostealing capabilities.

Vidar

Vidar is another frequently used commodity malware that is openly distributed in underground forums. Reportedly a fork of the Arkei infostealer, Vidar harvests banking information, browser credentials, and cryptocurrency wallets, as well as standard files. On execution, the malware gathers critical system information as well as data about hardware, running processes, and software and sends it back to the threat actor.

Since its initial release in 2018, multiple iterations of Vidar have bolstered its capabilities, capacity for evasion, and overall complexity, which has increased its popularity with threat actors. Other malware families have been observed dropping Vidar as a secondary payload.

IcedID

Often referred to as BokBot, this banking Trojan was first uncovered in 2017. Since then, IcedID has reinvented itself multiple times to become consistently prevalent across the threat landscape. IcedID is modular by nature, and its core functionality is that of a sophisticated banking Trojan.

Because IcedID is frequently updated to be more evasive and damaging, it remains a prominent threat in 2023. In addition, IcedID often serves as a dropper of additional payloads for secondary-stage malware, including ransomware and Cobalt Strike compromises.

# data[].attributes.attachment_link.title
BlackBerry Global Threat Intelligence Report - August 2023 Edition

# data[].attributes.attachment_link.description
This report by the BlackBerry Threat Research and Intelligence team provides the latest actionable and contextualized cyber intelligence to increase cyber resilience.

# data[].attributes.headline
Blocking access to ChatGPT is a short term solution to mitigate risk

# data[].attributes.subject
Blocking access to ChatGPT is a short term solution to mitigate risk

# data[].attributes.body
Netskope found that source code is posted to ChatGPT more than any other type of sensitive data, at a rate of 158 incidents per 10,000 users per month. Other sensitive data being shared in ChatGPT includes regulated data- including financial and healthcare data, personally identifiable information – along with intellectual property excluding source code, and, most concerningly, passwords and keys, usually embedded in source code.

In order for organizations to enable the safe adoption of AI apps, they must centre their approach on identifying permissible apps and implementing controls that empower users to use them to their fullest potential, while safeguarding the organisation from risks. Such an approach should include domain filtering, URL filtering, and content inspection to protect against attacks. Other steps to safeguard data and securely use AI tools include:

Block access to apps that do not serve any legitimate business purpose or that pose a disproportionate risk to the organisation.

Employ user coaching to remind users of company policy surrounding the use of AI apps.

Use modern data loss prevention (DLP) technologies to detect posts containing potentially sensitive information.

# data[].attributes.attachment_link.readable_text
For every 10,000 enterprise users, an enterprise organization is experiencing approximately 183 incidents of sensitive data being posted to ChatGPT per month, according to Netskope.

Source code accounts for the largest share of sensitive data being exposed.

Based on data from millions of enterprise users globally, researchers found that generative AI app usage is growing rapidly, up 22.5% over the past two months, amplifying the chances of users exposing sensitive data.

ChatGPT dominates generative AI market

Researchers found that organizations with 10,000 users or more use an average of 5 AI apps daily. ChatGPT sees more than 8 times as many daily active users as any other generative AI app. At the current growth rate, the number of users accessing AI apps is expected to double within the next seven months.

Over the past two months, the fastest growing AI app was Google Bard, currently adding users at 7.1% per week, compared to 1.6% for ChatGPT. At current rates, Google Bard is not poised to catch up to ChatGPT for over a year, though the generative AI app space is expected to evolve significantly before then, with many more apps in development.

ChatGPT most prone to source code exposure

Netskope found that source code is posted to ChatGPT more than any other type of sensitive data, at a rate of 158 incidents per 10,000 users per month. Other sensitive data being shared in ChatGPT includes regulated data- including financial and healthcare data, personally identifiable information - along with intellectual property excluding source code, and, most concerningly, passwords and keys, usually embedded in source code.

"It is inevitable that some users will upload proprietary source code or text containing sensitive data to AI tools that promise to help with programming or writing," said Ray Canzanese, Threat Research Director, Netskope Threat Labs. "Therefore, it is imperative for organizations to place controls around AI to prevent sensitive data leaks. Controls that empower users to reap the benefits of AI, streamlining operations and improving efficiency, while mitigating the risks are the ultimate goal. The most effective controls that we see are a combination of DLP and interactive user coaching."

Safe adoption of AI apps

Netskope Threat Labs is currently tracking ChatGPT proxies and more than 1,000 malicious URLs and domains from opportunistic attackers seeking to capitalise on the AI hype, including multiple phishing campaigns, malware distribution campaigns, and spam and fraud websites.

Blocking access to AI related content and AI applications is a short term solution to mitigate risk, but comes at the expense of the potential benefits AI apps offer to supplement corporate innovation and employee productivity. The data shows that in financial services and healthcare - both highly regulated industries - nearly 1 in 5 organizations have implemented a blanket ban on employee use of ChatGPT, while in the technology sector, only 1 in 20 organizations have done likewise.

"As security leaders, we cannot simply decide to ban applications without impacting on user experience and productivity," said James Robinson, Deputy CISO at Netskope. "Organizations should focus on evolving their workforce awareness and data policies to meet the needs of employees using AI products productively. There is a good path to safe enablement of generative AI with the right tools and the right mindset."

In order for organizations to enable the safe adoption of AI apps, they must centre their approach on identifying permissible apps and implementing controls that empower users to use them to their fullest potential, while safeguarding the organisation from risks. Such an approach should include domain filtering, URL filtering, and content inspection to protect against attacks. Other steps to safeguard data and securely use AI tools include:

Block access to apps that do not serve any legitimate business purpose or that pose a disproportionate risk to the organisation.

Employ user coaching to remind users of company policy surrounding the use of AI apps.

Use modern data loss prevention (DLP) technologies to detect posts containing potentially sensitive information.

# data[].attributes.attachment_link.title
Blocking access to ChatGPT is a short term solution to mitigate risk - Help Net Security

# data[].attributes.attachment_link.description
In order for organizations to enable the safe adoption of ChatGPT and avoid data exposure, they must create specific rules for users.

# data[].attributes.headline
The state of AI in 2023: Generative AI's breakout year

# data[].attributes.subject
The state of AI in 2023: Generative AI's breakout year

# data[].attributes.body
The latest annual McKinsey Global Survey on the current state of AI confirms the explosive growth of generative AI (gen AI) tools. Less than a year after many of these tools debuted, one-third of our survey respondents say their organizations are using gen AI regularly in at least one business function. Amid recent advances, AI has risen from a topic relegated to tech employees to a focus of company leaders: nearly one-quarter of surveyed C-suite executives say they are personally using gen AI tools for work, and more than one-quarter of respondents from companies using AI say gen AI is already on their boards’ agendas. What’s more, 40 percent of respondents say their organizations will increase their investment in AI overall because of advances in gen AI. The findings show that these are still early days for managing gen AI–related risks, with less than half of respondents saying their organizations are mitigating even the risk they consider most relevant: inaccuracy.

The organizations that have already embedded AI capabilities have been the first to explore gen AI’s potential, and those seeing the most value from more traditional AI capabilities—a group we call AI high performers—are already outpacing others in their adoption of gen AI tools.

# data[].attributes.attachment_link.readable_text
The latest annual McKinsey Global Survey on the current state of AI confirms the explosive growth of generative AI (gen AI) tools. Less than a year after many of these tools debuted, one-third of our survey respondents say their organizations are using gen AI regularly in at least one business function. Amid recent advances, AI has risen from a topic relegated to tech employees to a focus of company leaders: nearly one-quarter of surveyed C-suite executives say they are personally using gen AI tools for work, and more than one-quarter of respondents from companies using AI say gen AI is already on their boards' agendas. What's more, 40 percent of respondents say their organizations will increase their investment in AI overall because of advances in gen AI. The findings show that these are still early days for managing gen AI-related risks, with less than half of respondents saying their organizations are mitigating even the risk they consider most relevant: inaccuracy.

The organizations that have already embedded AI capabilities have been the first to explore gen AI's potential, and those seeing the most value from more traditional AI capabilities-a group we call AI high performers-are already outpacing others in their adoption of gen AI tools.

The expected business disruption from gen AI is significant, and respondents predict meaningful changes to their workforces. They anticipate workforce cuts in certain areas and large reskilling efforts to address shifting talent needs. Yet while the use of gen AI might spur the adoption of other AI tools, we see few meaningful increases in organizations' adoption of these technologies. The percent of organizations adopting any AI tools has held steady since 2022, and adoption remains concentrated within a small number of business functions.

Table of Contents

1. It's early days still, but use of gen AI is already widespread

2. Leading companies are already ahead with gen AI

3. AI-related talent needs shift, and AI's workforce effects are expected to be substantial

4. With all eyes on gen AI, AI adoption and impact remain steady

5. About the research

1. It's early days still, but use of gen AI is already widespread

The findings from the survey-which was in the field in mid-April 2023-show that, despite gen AI's nascent public availability, experimentation with the tools is already relatively common, and respondents expect the new capabilities to transform their industries. Gen AI has captured interest across the business population: individuals across regions, industries, and seniority levels are using gen AI for work and outside of work. Seventy-nine percent of all respondents say they've had at least some exposure to gen AI, either for work or outside of work, and 22 percent say they are regularly using it in their own work. While reported use is quite similar across seniority levels, it is highest among respondents working in the technology sector and those in North America.

Organizations, too, are now commonly using gen AI. One-third of all respondents say their organizations are already regularly using generative AI in at least one function-meaning that 60 percent of organizations with reported AI adoption are using gen AI. What's more, 40 percent of those reporting AI adoption at their organizations say their companies expect to invest more in AI overall thanks to generative AI, and 28 percent say generative AI use is already on their board's agenda. The most commonly reported business functions using these newer tools are the same as those in which AI use is most common overall: marketing and sales, product and service development, and service operations, such as customer care and back-office support. This suggests that organizations are pursuing these new tools where the most value is. In our previous research, these three areas, along with software engineering, showed the potential to deliver about 75 percent of the total annual value from generative AI use cases.

In these early days, expectations for gen AI's impact are high: three-quarters of all respondents expect gen AI to cause significant or disruptive change in the nature of their industry's competition in the next three years. Survey respondents working in the technology and financial-services industries are the most likely to expect disruptive change from gen AI. Our previous research shows that, while all industries are indeed likely to see some degree of disruption, the level of impact is likely to vary. Industries relying most heavily on knowledge work are likely to see more disruption-and potentially reap more value. While our estimates suggest that tech companies, unsurprisingly, are poised to see the highest impact from gen AI-adding value equivalent to as much as 9 percent of global industry revenue-knowledge-based industries such as banking (up to 5 percent), pharmaceuticals and medical products (also up to 5 percent), and education (up to 4 percent) could experience significant effects as well. By contrast, manufacturing-based industries, such as aerospace, automotives, and advanced electronics, could experience less disruptive effects. This stands in contrast to the impact of previous technology waves that affected manufacturing the most and is due to gen AI's strengths in language-based activities, as opposed to those requiring physical labor.

Responses show many organizations not yet addressing potential risks from gen AI

According to the survey, few companies seem fully prepared for the widespread use of gen AI-or the business risks these tools may bring. Just 21 percent of respondents reporting AI adoption say their organizations have established policies governing employees' use of gen AI technologies in their work. And when we asked specifically about the risks of adopting gen AI, few respondents say their companies are mitigating the most commonly cited risk with gen AI: inaccuracy. Respondents cite inaccuracy more frequently than both cybersecurity and regulatory compliance, which were the most common risks from AI overall in previous surveys. Just 32 percent say they're mitigating inaccuracy, a smaller percentage than the 38 percent who say they mitigate cybersecurity risks. Interestingly, this figure is significantly lower than the percentage of respondents who reported mitigating AI-related cybersecurity last year (51 percent). Overall, much as we've seen in previous years, most respondents say their organizations are not addressing AI-related risks.

2. Leading companies are already ahead with gen AI

The survey results show that AI high performers-that is, organizations where respondents say at least 20 percent of EBIT in 2022 was attributable to AI use-are going all in on artificial intelligence, both with gen AI and more traditional AI capabilities. These organizations that achieve significant value from AI are already using gen AI in more business functions than other organizations do, especially in product and service development and risk and supply chain management. When looking at all AI capabilities-including more traditional machine learning capabilities, robotic process automation, and chatbots-AI high performers also are much more likely than others to use AI in product and service development, for uses such as product-development-cycle optimization, adding new features to existing products, and creating new AI-based products. These organizations also are using AI more often than other organizations in risk modeling and for uses within HR such as performance management and organization design and workforce deployment optimization.

AI high performers are much more likely than others to use AI in product and service development.

Another difference from their peers: high performers' gen AI efforts are less oriented toward cost reduction, which is a top priority at other organizations. Respondents from AI high performers are twice as likely as others to say their organizations' top objective for gen AI is to create entirely new businesses or sources of revenue-and they're most likely to cite the increase in the value of existing offerings through new AI-based features.

As we've seen in previous years, these high-performing organizations invest much more than others in AI: respondents from AI high performers are more than five times more likely than others to say they spend more than 20 percent of their digital budgets on AI. They also use AI capabilities more broadly throughout the organization. Respondents from high performers are much more likely than others to say that their organizations have adopted AI in four or more business functions and that they have embedded a higher number of AI capabilities. For example, respondents from high performers more often report embedding knowledge graphs in at least one product or business function process, in addition to gen AI and related natural-language capabilities.

While AI high performers are not immune to the challenges of capturing value from AI, the results suggest that the difficulties they face reflect their relative AI maturity, while others struggle with the more foundational, strategic elements of AI adoption. Respondents at AI high performers most often point to models and tools, such as monitoring model performance in production and retraining models as needed over time, as their top challenge. By comparison, other respondents cite strategy issues, such as setting a clearly defined AI vision that is linked with business value or finding sufficient resources.

The findings offer further evidence that even high performers haven't mastered best practices regarding AI adoption, such as machine-learning-operations (MLOps) approaches, though they are much more likely than others to do so. For example, just 35 percent of respondents at AI high performers report that where possible, their organizations assemble existing components, rather than reinvent them, but that's a much larger share than the 19 percent of respondents from other organizations who report that practice.

Many specialized MLOps technologies and practices may be needed to adopt some of the more transformative uses cases that gen AI applications can deliver-and do so as safely as possible. Live-model operations is one such area, where monitoring systems and setting up instant alerts to enable rapid issue resolution can keep gen AI systems in check. High performers stand out in this respect but have room to grow: one-quarter of respondents from these organizations say their entire system is monitored and equipped with instant alerts, compared with just 12 percent of other respondents.

3. AI-related talent needs shift, and AI's workforce effects are expected to be substantial

Our latest survey results show changes in the roles that organizations are filling to support their AI ambitions. In the past year, organizations using AI most often hired data engineers, machine learning engineers, and Al data scientists-all roles that respondents commonly reported hiring in the previous survey. But a much smaller share of respondents report hiring AI-related-software engineers-the most-hired role last year-than in the previous survey (28 percent in the latest survey, down from 39 percent). Roles in prompt engineering have recently emerged, as the need for that skill set rises alongside gen AI adoption, with 7 percent of respondents whose organizations have adopted AI reporting those hires in the past year.

4. With all eyes on gen AI, AI adoption and impact remain steady

While the use of gen AI tools is spreading rapidly, the survey data doesn't show that these newer tools are propelling organizations' overall AI adoption. The share of organizations that have adopted AI overall remains steady, at least for the moment, with 55 percent of respondents reporting that their organizations have adopted AI. Less than a third of respondents continue to say that their organizations have adopted AI in more than one business function, suggesting that AI use remains limited in scope. Product and service development and service operations continue to be the two business functions in which respondents most often report AI adoption, as was true in the previous four surveys. And overall, just 23 percent of respondents say at least 5 percent of their organizations' EBIT last year was attributable to their use of AI-essentially flat with the previous survey-suggesting there is much more room to capture value.

Organizations continue to see returns in the business areas in which they are using AI, and they plan to increase investment in the years ahead. We see a majority of respondents reporting AI-related revenue increases within each business function using AI. And looking ahead, more than two-thirds expect their organizations to increase their AI investment over the next three years.

About the research

The online survey was in the field April 11 to 21, 2023, and garnered responses from 1,684 participants representing the full range of regions, industries, company sizes, functional specialties, and tenures. Of those respondents, 913 said their organizations had adopted AI in at least one function and were asked questions about their organizations' AI use. To adjust for differences in response rates, the data are weighted by the contribution of each respondent's nation to global GDP.

# data[].attributes.attachment_link.title
The state of AI in 2023: Generative AI's breakout year

# data[].attributes.attachment_link.description
Explore McKinsey's State of AI in 2023 report, a detailed new survey that looks at how generative AI is reshaping the world's industries and workforces.

# data[].attributes.headline
Ist die Angst vor Künstlicher Intelligenz in der Berufswelt berechtigt?

# data[].attributes.subject
Ist die Angst vor Künstlicher Intelligenz in der Berufswelt berechtigt?

# data[].attributes.body
Spätestens seit November letzten Jahres hört es nicht mehr auf: Jeden Tag gibt es neue News über Künstliche Intelligenz. Seither bietet sich Big Tech ein Wettstreit um die Marktführerschaft und die Debatten über Regulierungen sind schon längst in der Politik angekommen. Gleichzeitig schüren die neuen Möglichkeiten Ängste in der Berufswelt.

"ChatGPT und seine KI-Kollegen könnten 300 Millionen Arbeitsplätze weltweit vernichten", heiss es im März 2023 von Ökonomen der Grossbank Goldman Sachs. Es ist die neuste bedrohliche Zahl in einer Abfolge von Zukunftswarnungen vor der Automatisierung.

Dystopische Zukunftsszenarien zu den Auswirkungen von KI haben auch Wissenschaftler der Universität Oxford prognostiziert: Laut ihnen würde die Digitalisierung in den USA fast die Hälfte der Arbeitsplätze kosten – und damit sorgten sie für grosse Aufregung in der Öffentlichkeit, aber auch für Kritik von weiteren Forschenden.

# data[].attributes.attachment_link.title
Ist die Angst vor Künstlicher Intelligenz in der Berufswelt berechtigt?

# data[].attributes.attachment_link.description
Viele fürchten sich um ihren Job, doch die Technologie kann in der Berufswelt durchaus auch Chancen bieten. Dazu braucht es aber gesellschaftliche und ethische Debatten.

# data[].attributes.headline
150+ Artificial Intelligence Statistics You Need to Know in 2023 - Who is Using It & How?

# data[].attributes.subject
150+ Artificial Intelligence Statistics You Need to Know in 2023 - Who is Using It & How?

# data[].attributes.body
Artificial intelligence is fast encroaching upon every area of our lives, and it seems like there’s no stopping it. This technology is proving particularly game-changing in the world of business, where it’s enabling data-driven decision-making, automation, and improved customer experiences.

With things moving so fast, and so many sources of information available, we’ve gathered these up-to-date AI statistics to give you a snapshot of AI in 2023. Keep reading for fascinating insights on who is using AI, how they are using it, and how it’s impacting the workplace.

# data[].attributes.attachment_link.readable_text
Artificial intelligence is fast encroaching upon every area of our lives, and it seems like there's no stopping it. This technology is proving particularly game-changing in the world of business, where it's enabling data-driven decision-making, automation, and improved customer experiences.

With things moving so fast, and so many sources of information available, we've gathered these up-to-date AI statistics to give you a snapshot of AI in 2023. Keep reading for fascinating insights on who is using AI, how they are using it, and how it's impacting the workplace.

The global AI market is expected to reach a value of $1.35 trillion by 2030.

By 2030, the growth in AI technology has the potential to contribute $15.7 trillion to the global economy.

It's estimated that ChatGPT costs at least $700,000 per day to run.

Over 4 million AI-generated images are produced per day using Dall-E.

57% of Americans are looking forward to AI technology replacing household chores.

The field of artificial intelligence has witnessed remarkable growth in recent years, and these growth in AI stats underline its unprecedented expansion.

From chatbots to generative AI and image generators, the proliferation of AI technologies across various industries has propelled transformative advancements and unleashed a wave of innovation.
Their report predicts a CAGR of 37.3% from 2023 to 2030.
A global AI forecast from Marketsandmarkets predicts a slightly lower CAGR of 36.8%. According to this report, the AI market will be worth $1.35 trillion by 2030. Meanwhile, another report from Presedence Research predicts a more modest value of $962 billion by 2030, increasing rapidly to $1.87 trillion by 2032.

The AI in social media market is expected to reach $12 billion by 2031, representing a CAGR of 28.7% from 2022 to 2031, according to Allied Market Research .
91% of leading organizations are investing in AI activities.
ChatGPT launched in November 2022 and within five days, over one million users had signed up for the service.
PwC's Global Artificial Intelligence Study predicts that AI technology could contribute an additional $15.7 trillion to the global economy by 2030.
This equates to an increase in GDP of as much as 26% in China and 14.5% in North America. These two regions together account for almost 70% of the total expected gains globally.

Significant gains are expected to come from productivity improvements and product enhancements that stimulate customer demand.

Next, we take a look at who is using AI, what they are using it for, and how it's expected to affect the workforce in the years ahead.

How is AI Being Used at Work?

Product and/or service development: 55%

Marketing and sales: 55%

Service operations (including customer service and back office): 54%

Risk modeling and analytics: 15%

A further breakdown can be seen in the chart below:
Statistics from Forbes gathered from 600 business owners reveal the following ways that companies are using or plan to use AI to improve the customer experience:

Chatbots for instant messaging: 73%

Composing emails: 61%

Product recommendations and other personalized services: 55%

Composing text messages: 49%

Personalized advertising: 46%

Long-form written content for websites, etc.:42%

Phone calls: 36%

56% of these business owners say they already use or plan to use AI for customer service.
Other top uses are cybersecurity and fraud management, digital personal assistants, and customer relationship management, coming in at 51%, 47%, and 46%, respectively.
We are already seeing surprising use cases outside of the technology and marketing space:

The University of British Columbia and BC Cancer researchers have developed AI that predicts cancer survival with 80% accuracy by reading doctor's notes.

According to an article published in Nature , a revolutionary AI tool can now predict the structures of 200 million proteins. Stored on a 23-terabyte database, this information could offer new possibilities for the development of drugs, which are mostly based on these protein structures.

Oxford University scientists have developed an AI that can lip-read with 400% greater accuracy than a human lip-reader.

Emotion AI, which uses natural language processing (NLP) to detect human emotions in text, could soon be used in healthcare apps to help doctors assess and monitor the emotional state of patients, especially those with neurodiverse conditions. It could also be used to offer mental health assessments and diagnose conditions, Neuroscience News reports.

How is AI Affecting Jobs and Workers?
According to Deloitte's State of AI in the Enterprise survey, 82% of business leaders believe that AI enhances job satisfaction and performance.
At the same time, 47% say the use of AI technology creates fear or concern.

Marketsandmarkets predicts that by 2030, AI will have reached human-level sophistication and therefore could be threatening many more jobs than at present.
Younger people are more optimistic about AI in the workplace, though. Do Americans think artificial intelligence will lead to there being more jobs for people or fewer jobs?
The study also noted that two-thirds of US occupations are vulnerable to AI to some degree.

Office and administrative support: 46%

Legal work: 44%

Architecture and engineering: 37%

Life, physical, and social sciences: 36%

Business and financial operations: 35%

The professions most at risk of automation in the US, according to the proportion of tasks that could be automated, are:
Economists estimate that 60% of the current workforce is employed in jobs that didn't exist 80 years ago.

This equates to 85% of employment growth coming from positions created around new technology.

This may not sound like a lot, but it's a number that has been climbing steadily for the past few years. Canada was in second place with 1.45% of jobs requiring AI skills, and Spain came third with 1.33%. The researchers noted that in all the countries they studied, the percentage of jobs requiring AI skills had increased since 2014.

That crown goes to India, with a rate of 3.23; 45% higher than the US, which takes second place.
The US is not the market with the highest AI skill penetration rate.
What Jobs Require AI Skills?

The McKinsey Global Survey on AI sheds some light on this.

Software engineers came out top, with 39% of companies saying they had recruited for this position in relation to AI. Data engineers and AI data scientists came next, with 35% and 33%, respectively.

There is some hope for people without an engineering background, though, as design specialists and translators both made it into the top 10.

When it comes to specific AI skills, Python - a widely used programming language - is mentioned in 37% of AI job postings in the US, of which there were almost 800,000 in 2022, Visual Capitalist reports .

Two other languages make the top 10: SQL is mentioned in 23% of job posts and Java in 17%. Computer science, data analysis, and data science also feature prominently, being cited in 33%, 20%, and 20% of jobs, respectively.

This is more than double second-place Texas, with 8.4%. However, with some companies relocating to Texas to take advantage of lower taxes and operating costs, this gap is showing signs of closing.

How much is all this AI going to cost to implement? And, just as importantly, how much are companies going to save by using it?

Industrial companies that embrace AI technology are already seeing significant cost and time savings.

Cost savings and efficiencies are the top benefits for companies using AI, with 54% of organizations citing this in a 2022 IBM survey. Improvements in IT or network performance came a close second with 53%, while better customer experience took third place with 48%.
It's no surprise that the state responsible for the most AI jobs is California, taking 17.9% of the share across the US.
This is largely due to the fact that viewers engage more with personal recommendations compared to generic 'popular' ones. This increased engagement helps them retain satisfied customers, decrease cancelations, and plan future in-house productions. That was back in 2015, so the use and impact of AI can only have increased and improved.
Netflix famously reported that their AI-powered personalized recommendation system was saving them $1 billion a year.
There have also been great successes with AI-enabled supply-chain management. Early adopters of this technology saved 15% on logistics costs while increasing inventory by 35% and service levels by 65% compared to their competitors, McKinsey reports .
The industries that are set to gain the most from AI systems are those that have conventionally been labor-intensive or capital-intensive.
McKinsey also reported one of the most dramatic use cases of AI back in 2017, when Amazon acquired Kiva, a robotics company that automates warehouse picking and packing. The result was that Amazon's click-to-ship cycle, which typically took 60-75 minutes with humans, dropped to an astounding 15 minutes with robots. Alongside this, inventory capacity increased by 50% while operating costs fell by 20%.

Despite all these positive findings, a significant number of companies still see cost as a barrier to implementing AI solutions. IBM reports that 29% of businesses are putting off adopting AI because of the price. This is second only to a lack of AI skills or expertise, which 34% reported as a hindrance.

That's equivalent to about $0.36 per query, based on figures from February 2023 when the research was published. Since then, ChatGPT has upgraded from OpenAI's GPT-3 to GPT-4, which requires considerably more computational power. The actual cost today may therefore be much higher.

There is also the environmental cost to consider. A paper from the University of Massachusetts Amherst found that training a single deep-learning algorithm could emit 313 tons of CO2. That's five times more than the average car emits in its lifetime.

The Stanford University report looked at the risk of gender and racial bias when using AI technology.

This research also found that certain adjectives like "unreasonable", "stubborn", and "intellectual" were generally associated with men, whereas "compassionate", "sensitive", and "emotional" were more often linked with women.

This presents concerning risks if AI technology starts to be used for things like creating job profiles before the bias has been neutralized. However, this may be an uphill struggle as the models are typically trained on real-world data that inherently contain these biases.

Businesses seem quite aware of the risks that AI technology presents in their companies. According to the Stanford report, these are the top risks from adopting AI that organizations consider relevant in 2022:

However, the report noted that "there are meaningful gaps between the risks organizations cite as relevant and those which organizations have taken steps to mitigate".
Images generated with DALL-E 2 portrayed 97% of people in positions of authority (such as CEO and Director) as white men, despite the fact that these roles are occupied by 29.1% and 39.6% women, respectively.
Further to this, an IBM study found that 74% of organizations already using AI have not taken any steps to reduce unintended bias in their AI systems. 60% have not yet developed policies about the ethical use of AI in their workplace.

A survey by Forbes revealed some additional concerns that business owners have about the impact of AI:

43% are worried about becoming dependent on AI tech

33% are concerned about the potential reduction of the workforce

31% have privacy concerns

30% are apprehensive about AI providing the business or its customers with misinformation

28% are concerned about bias errors

24% believe it will reduce traffic to their websites

Let's take a look at some statistics surrounding the use of artificial intelligence in our homes and everyday lives.

57% of Americans are excited about AI replacing household chores, according to Pew Research Center. 40% say the same about AI diagnosing medical conditions, and 9% are excited about AI helping them make important life decisions.

Responding to people via text or email: 45%

Answering financial questions: 43%

Planning a travel itinerary: 38%

Crafting an email: 31%

Preparing for a job interview: 30%

Writing a social media post: 25%

Summarizing complex or lengthy copy: 19%

Driverless cars, also known as autonomous vehicles, seem to be one example of AI technology where consumer sentiment lags behind. The driverless car market is predicted to grow at a CAGR of 13.3% from 20.3 million units in 2021 to 62.4 million units in 2030.

Road accidents caused 38,680 fatalities in the US in 2020, and there are approximately 1.2 million road deaths globally. According to an article published in The Atlantic , by the middle of the century, driverless cars could reduce these fatalities by 90%. This is equivalent to over 30,000 lives a year saved in the US alone.

However, Americans seem reluctant to adopt this technology. Pew Research Center conducted a survey which found that only 26% of Americans believe that the widespread use of autonomous vehicles would be good for society. This is compared to 44% who believe it is a bad idea.

Out of the main digital assistants, Google Assistant has been shown to be the most accurate at responding to queries. Data published on Statista shows that Google Assistant has 93% accuracy overall, compared to 83% for Siri and 80% for Alexa. The only category in which Siri outperformed Google Assistant was with voice commands for phone-related functions.

Microsoft Bing surpassed 100 million daily users in March 2023, spurred along by its addition of an AI chatbot to its search function.

ChatGPT-4 passed the bar exam with a score that surpasses 7% of human test-takers and exceeds the passing threshold, according to research published on SSRN in March 2023.

There are around 1.8 billion visits per month to chat.openai.com, the website where ChatGPT is accessed, according to Similarweb. That's around 60 million visits per day.

The US is the top user of ChatGPT's generative AI tool. 12% of these visits are from the US, 8% are from India, and 4% are from Japan.

While ChatGPT is booming, one of the original AI writing tools, Jarvis (previously Jasper) is taking a hit. Traffic to the site dropped by 67% between April and June 2023, from 71.6K users/month to 23.7K.

Over half (52%) of UK adults have heard of generative AI, and over a quarter (26%) have used it themselves, according to research published in July 2023 by Deloitte .

After 10 years working for Google, computer scientist Geoffrey Hinton resigned from his role in May 2023 and warned the public of the "existential risk" that AI systems pose to mankind.

AI tech has been all over the news since the start of the decade. Here are some of the top AI statistics that have made the headlines:

# data[].attributes.attachment_link.title
150+ Artificial Intelligence Statistics You Need to Know in 2023 - Who is Using It & How?

# data[].attributes.attachment_link.description
Up-to-date AI stats about the growth of AI in the workplace, how it will impact businesses, and what people are already using it for.

# data[].attributes.headline
A framework to securely use LLMs in companies

# data[].attributes.subject
A framework to securely use LLMs in companies

# data[].attributes.body
The potential of using AI in enterprises has been on the rise for the last few years. The release of ChatGPT made it apparent to enterprises that AI could supercharge their existing applications. However, like with any new technology, the usage of LLMs also brings with it some risks. Depending on how the LLMs are deployed (training an in-house LLM v/s 3rd party LLMs) and how the LLMs are used (by individuals to supercharge their work v/s integrating with LLM APIs in applications), the risks LLMs pose will change. This post outlines key risks and helps prioritize them based on your organization’s use case.

# data[].attributes.attachment_link.readable_text
The potential of using AI in enterprises has been on the rise for the last few years. The release of ChatGPT made it apparent to enterprises that AI could supercharge their existing applications. However, like with any new technology, the usage of LLMs also brings with it some risks. Depending on how the LLMs are deployed (training an in-house LLM v/s 3rd party LLMs) and how the LLMs are used (by individuals to supercharge their work v/s integrating with LLM APIs in applications), the risks LLMs pose will change. This post outlines key risks and helps prioritize them based on your organization's use case.

Most posts in this newsletter are based on my personal AppSec experience. Like most people in Appsec, I do not have any significant experience building, managing, or securing LLM usage at scale. In that sense, this post is a departure from the norm. However, I am still publishing this as a submission to the growing body of work on this subject. In the coming months, I hope we will have some consensus on how to address this important topic.

Here are a few caveats you should keep in mind before you read this document:

1. There is a reasonable chance that some of this information will be outdated a few weeks from now. That is just the nature of fast-changing technology. Most posts in Boring AppSec are "timeless topics". This one is timely and fluid.

2. Most of my research for this post is secondary. This means, not all the information provided here is based on my experience securing LLMs. Much of it is from other authors who have published excellent, public work (e.g.: OWASP Top 10 for LLMs). For instance, if an excellent description of a vulnerability already exists, it has been used here. All the material which has influenced my thinking is linked in the references section.

Side note: The reference section has some amazing resources. Please feel free to enter rabbit holes :)

There are many ways to slice and dice LLM use cases, but from a Security perspective, it may help to categorize them as follows:

1. Use-cases

1. Employees use LLM tools to improve productivity or help with their work. (e.g.: Github Copilot, ChatGPT, and Google BARD).

2. Integrating applications with LLM APIs

1. Internal applications leveraging LLMs to improve their efficacy or inform internal decision-making.

2. Customer-facing applications, where customer input informs part (or all) of the prompts sent to the LLM, and the response is consumed in some form by the customer.

Note: I am using "customer" as a proxy for "someone external". In your context, this could be a non-paying user, a business that uses your product, and so on.

2. Deployment type. Companies can choose from 2 broad paths:

A few points on the trade-off between self-hosted and 3rd party LLMs:

1. Unless significant investments are made in building a cross-functional team involving ML engineers, security engineers, and privacy professionals, self-hosting an open-source LLM and training brings more security risk than leveraging a trusted 3rd party.

2. On the flip side, 3rd party hosted LLMs pose more privacy and data security risks. Over time, 3rd party hosted LLMs can also get really expensive.

3. If using an LLM has to be a business differentiator for your organization, deploying and training a model in-house is the right way to go

4. Irrespective of which path your organization chooses, it is critical to understand the risks it poses and find ways to manage them.

There are many excellent lists of risks to using LLMs (see references for a solid list). In this post, I am focusing on seven patterns that can pose a high level of risk for your organization. While it's clear that new risk categories will emerge over time, this list should give us a broad overview of the risks out there and more importantly, help us understand what risks are applicable to our organization.

While it's tempting to solve all risks, it is important to prioritize. Companies should evaluate which use-case and deployment type is most prevalent in their organization and focus on mitigating High-risk items first. The below table provides a summary of risk levels for the use cases and deployment models mentioned above. In the next section, we will dive deeper into each of the highlighted "high-risk" scenarios.

1. Prompt injection: "Prompt Injection Vulnerabilities in LLMs involve crafty inputs leading to undetected manipulations. The impact ranges from data exposure to unauthorized actions, serving attacker goals." - OWASP Top 10 for LLMs

Self-hosted LLMs: An attacker can take advantage of the concatenation of user input to a pre-written prompt string to override the guardrails put in place for user prompts. Much like other forms of injection, user input is used as instructions to control the outcome of the application. Prompt injection is a broad attack vector and can take many forms, including

1. Trusting data from plugins or other third parties

2. Exploiting LLM hallucination. If an attacker can predict that LLMs recommend made-up package names, the attacker can create and publish such packages with malicious software in them

2. Data leakage:"Data leakage in LLMs can expose sensitive information or proprietary details, leading to privacy and security breaches. Proper data sanitization and clear terms of use are crucial for prevention." - OWASP Top 10 for LLMs

Customer-facing applications: When used without sufficient guardrails, customer-facing applications leveraging LLMs can leak sensitive (PHI, PII) and proprietary information to the customer.

Note: Even when guardrails are in place, Prompt Injection can be used to bypass the guardrails, leading to data leakage

3. Training data poisoning: - "LLMs learn from diverse text but risk training data poisoning, leading to user misinformation. Overreliance on AI is a concern. Key data sources include Common Crawl, WebText, OpenWebText, and books" - OWASP Top 10 for LLMs

4. Denial of service: " An attacker interacts with an LLM in a way that is particularly resource-consuming, causing the quality of service to degrade for them and other users, or for high resource costs to be incurred." - OWASP Top 10 for LLMs

5. Money loss: Much like cloud computing resources, 3rd party LLMs charge based on consumption (OpenAI uses "tokens", others use a similar mechanism). Unvalidated usage of these APIs can lead to a massive, unplanned cost escalation.

6. Insecure supply chain: "LLM supply chains risk integrity due to vulnerabilities leading to biases, security breaches, or system failures. Issues arise from pre-trained models, crowdsourced data, and plugin extensions." - OWASP Top 10 for LLMs

7. Overreliance on LLM-generated content: "Overreliance on LLMs can lead to misinformation or inappropriate content due to "hallucinations." Without proper oversight, this can result in legal issues and reputational damage" - OWASP Top 10 for LLMs

Internal applications: Given its propensity to hallucinate and introduce undesired bias, relying solely on LLM output can lead to undesirable outcomes. This can especially lead to systemic, long-term issues if the training data itself is poisoned.

There is a possibility that there is no clarity on which of these use cases and deployment models are prevalent in your organization. In that scenario, your first job as a Security team would be to understand how LLMs are currently used and understand the plans for future usage. On the data gathered, you can apply the above framework to narrow down the risks that matter most to your organization.

That's it for today! Are there significant risks that are missed in this post? What other aspects of leveraging LLMs worry you? Is there value in having yet another author talking about securing LLMs? Tell me more! You can drop me a message on Twitter, LinkedIn, or email. If you find this newsletter useful, share it with a friend, or colleague, or on your social media feed.

# data[].attributes.attachment_link.title
Edition 21: A framework to securely use LLMs in companies - Part 1: Overview of Risks

# data[].attributes.attachment_link.description
Part 1 of a multi-part series on using LLMs securely within your organisation. This post provides a framework to categorize risks based on different use cases and deployment type.

# data[].attributes.headline
DeepMind's ChatGPT-Like Brain for Robots Lets Them Learn From the Internet

# data[].attributes.subject
DeepMind's ChatGPT-Like Brain for Robots Lets Them Learn From the Internet

# data[].attributes.body
Ever since ChatGPT exploded onto the tech scene in November of last year, it’s been helping people write all kinds of material, generate code, and find information. It and other large language models (LLMs) have facilitated tasks from fielding customer service calls to taking fast food orders. Given how useful LLMs have been for humans in the short time they’ve been around, how might a ChatGPT for robots impact their ability to learn and do new things? Researchers at Google DeepMind decided to find out and published their findings in a blog post and paper released last week.

# data[].attributes.attachment_link.readable_text
Ever since ChatGPT exploded onto the tech scene in November of last year, it's been helping people write all kinds of material, generate code, and find information. It and other large language models (LLMs) have facilitated tasks from fielding customer service calls to taking fast food orders. Given how useful LLMs have been for humans in the short time they've been around, how might a ChatGPT for robots impact their ability to learn and do new things? Researchers at Google DeepMind decided to find out and published their findings in a blog post and paper released last week.

They call their system RT-2. It's short for robotics transformer 2, and it's the successor to robotics transformer 1, which the company released at the end of last year. RT-1 was based on a small language and vision program and specifically trained to do many tasks. The software was used in Alphabet X's Everyday Robots, enabling them to do over 700 different tasks with a 97 percent success rate. But when prompted to do new tasks they weren't trained for, robots using RT-1 were only successful 32 percent of the time.

RT-2 almost doubles this rate, successfully performing new tasks 62 percent of the time it's asked to. The researchers call RT-2 a vision-language-action (VLA) model. It uses text and images it sees online to learn new skills. That's not as simple as it sounds; it requires the software to first "understand" a concept, then apply that understanding to a command or set of instructions, then carry out actions that satisfy those instructions.

One example the paper's authors give is disposing of trash. In previous models, the robot's software would have to first be trained to identify trash. For example, if there's a peeled banana on a table with the peel next to it, the bot would be shown that the peel is trash while the banana isn't. It would then be taught how to pick up the peel, move it to a trash can, and deposit it there.

RT-2 works a little differently, though. Since the model has trained on loads of information and data from the internet, it has a general understanding of what trash is, and though it's not trained to throw trash away, it can piece together the steps to complete this task.

The LLMs the researchers used to train RT-2 are PaLI-X (a vision and language model with 55 billion parameters), and PaLM-E (what Google calls an embodied multimodal language model, developed specifically for robots, with 12 billion parameters). "Parameter" refers to an attribute a machine learning model defines based on its training data. In the case of LLMs, they model the relationships between words in a sentence and weigh how likely it is that a given word will be preceded or followed by another word.

Through finding the relationships and patterns between words in a giant dataset, the models learn from their own inferences. They can eventually figure out how different concepts relate to each other and discern context. In RT-2's case, it translates that knowledge into generalized instructions for robotic actions.

Those actions are represented for the robot as tokens, which are usually used to represent natural language text in the form of word fragments. In this case, the tokens are parts of an action, and the software strings multiple tokens together to perform an action. This structure also enables the software to perform chain-of-thought reasoning, meaning it can respond to questions or prompts that require some degree of reasoning.

Examples the team gives include choosing an object to use as a hammer when there's no hammer available (the robot chooses a rock) and picking the best drink for a tired person (the robot chooses an energy drink).

"RT-2 shows improved generalization capabilities and semantic and visual understanding beyond the robotic data it was exposed to," the researchers wrote in a Google blog post. "This includes interpreting new commands and responding to user commands by performing rudimentary reasoning, such as reasoning about object categories or high-level descriptions."

The dream of general-purpose robots that can help humans with whatever may come up-whether in a home, a commercial setting, or an industrial setting-won't be achievable until robots can learn on the go. What seems like the most basic instinct to us is, for robots, a complex combination of understanding context, being able to reason through it, and taking actions to solve problems that weren't anticipated to pop up. Programming them to react appropriately to a variety of unplanned scenarios is impossible, so they need to be able to generalize and learn from experience, just like humans do.

RT-2 is a step in this direction. The researchers do acknowledge, though, that while RT-2 can generalize semantic and visual concepts, it's not yet able to learn new actions on its own. Rather, it applies the actions it already knows to new scenarios. Perhaps RT-3 or 4 will be able to take these skills to the next level. In the meantime, as the team concludes in their blog post, "While there is still a tremendous amount of work to be done to enable helpful robots in human-centered environments, RT-2 shows us an exciting future for robotics just within grasp."
Image Credit: Google DeepMind

# data[].attributes.attachment_link.title
DeepMind's ChatGPT-Like Brain for Robots Lets Them Learn From the Internet

# data[].attributes.attachment_link.description
General-purpose robots that can help humans with whatever may come up won't be achievable until robots can learn on the go.

# data[].attributes.headline
Unifrutti & Tevel Partner To Bring Autonomous Harvesting to Chile

# data[].attributes.subject
Unifrutti & Tevel Partner To Bring Autonomous Harvesting to Chile

# data[].attributes.attachment_link.title
Unifrutti & Tevel Partner To Bring Autonomous Harvesting to Chile

# data[].attributes.headline
Réalités du XXIe siècle : Conflits hybrides et nouvelles stratégies mondiales

# data[].attributes.subject
Réalités du XXIe siècle : Conflits hybrides et nouvelles stratégies mondiales

# data[].attributes.attachment_link.title
Réalités du XXIe siècle : Conflits hybrides et nouvelles stratégies mondiales

# data[].attributes.headline
MWI Podcast: The Robotic Revolution is Here - Modern War Institute

# data[].attributes.subject
MWI Podcast: The Robotic Revolution is Here - Modern War Institute

# data[].attributes.attachment_link.title
MWI Podcast: The Robotic Revolution is Here - Modern War Institute

# data[].attributes.attachment_link.description
This episode of the MWI Podcast features a conversation with August Cole. He is the coauthor, along with Peter Singer, of a new book called Burn-In: A Novel of the Real [...]