# data[].attributes.body
Der Bundesrat hat an seiner Sitzung vom 28. Juni 2023 einen politisch-strategischen Krisenstab «Datenabfluss» mandatiert. Der departementsübergreifende Krisenstab soll die laufenden Arbeiten zur Bewältigung des Ransomware-Angriffes auf die Firma Xplain, von dem auch Daten aus der Bundesverwaltung betroffen sind, koordinieren und Massnahmen vorschlagen. Zudem lässt der Bundesrat ein Mandat für eine Administrativuntersuchung erarbeiten. Auch hat er entschieden, bestehende Verträge mit Informatikdienstleistern des Bundes überprüfen und nötigenfalls so anpassen zu lassen, dass die Cybersicherheit der Dienstleister verbessert wird und der Bund im Fall eines erfolgreichen Angriffs rasch reagieren kann. Schliesslich lässt er Massnahmen prüfen, mit denen sichergestellt werden kann, dass die heute von Xplain für die Polizei sowie für Sicherheits- und Migrationsbehörden erbrachten essenziellen Leistungen in jedem Fall gewährleistet werden können.

# data[].attributes.attachment_link.readable_text
28.06.2023 - Der Bundesrat hat an seiner Sitzung vom 28. Juni 2023 einen politisch-strategischen Krisenstab "Datenabfluss" mandatiert. Der departementsübergreifende Krisenstab soll die laufenden Arbeiten zur Bewältigung des Ransomware-Angriffes auf die Firma Xplain, von dem auch Daten aus der Bundesverwaltung betroffen sind, koordinieren und Massnahmen vorschlagen. Zudem lässt der Bundesrat ein Mandat für eine Administrativuntersuchung erarbeiten. Auch hat er entschieden, bestehende Verträge mit Informatikdienstleistern des Bundes überprüfen und nötigenfalls so anpassen zu lassen, dass die Cybersicherheit der Dienstleister verbessert wird und der Bund im Fall eines erfolgreichen Angriffs rasch reagieren kann. Schliesslich lässt er Massnahmen prüfen, mit denen sichergestellt werden kann, dass die heute von Xplain für die Polizei sowie für Sicherheits- und Migrationsbehörden erbrachten essenziellen Leistungen in jedem Fall gewährleistet werden können.
Die unter dem Namen "Play" auftretende Hackergruppierung hatte bei einem Ransomware-Angriff auf die Firma Xplain grosse Datenmengen gestohlen. Darunter befinden sich auch operative Daten aus der Bundesverwaltung. Da Xplain sich in Absprache mit den Strafverfolgungsbehörden und dem Bund nicht erpressen liess und keine Lösegeldzahlung an die Hacker leistete, veröffentlichten diese am 14. Juni 2023 mutmasslich das gesamte entwendete Datenpaket im Darknet. Seit Bekanntwerden dieses Datenabflusses hat das Nationale Zentrum für Cybersicherheit (NCSC) in enger Zusammenarbeit mit den betroffenen Behörden eine Organisation zur Bewältigung des Vorfalls etabliert. Es laufen weiterhin intensive Arbeiten zur Auswertung und Analyse der Daten. Der Bund hat zudem Massnahmen eingeleitet, um ein Sicherheitsrisiko für die Bundesverwaltung zu minimieren.

Bundesinterne Arbeiten koordinieren, Kantone einbeziehen

Seit dem 9. Juni 2023 hat sich der Bundesrat mehrmals über diesen Vorfall informieren lassen. Am 16. Juni 2023 hat er entschieden, einen politisch-strategischen Krisenstab "Datenabfluss" (PSK-D) einzusetzen, der die umfangreichen Arbeiten auf operativer Stufe ergänzen soll. Der PSK-D hat seither bereits zwei Mal - am 21. Juni und am 26. Juni 2023 - getagt. Dabei verschaffte er sich einen Überblick über die zu bewältigenden Aufgaben und erarbeitete zuhanden des Bundesrats Vorschläge zum weiteren Vorgehen. An seiner Sitzung vom 28. Juni 2023 hat der Bundesrat nun das Mandat des PSK-D verabschiedet. Unter der Leitung der Generalsekretärin des Eidgenössischen Finanzdepartements (EFD) arbeiten in diesem Krisenstab alle Departemente, die Bundeskanzlei sowie eine Vertretung der Konferenz der Kantonalen Justiz- und Polizeidirektorinnen und -direktoren (KKJPD) zusammen. Der Krisenstab soll die strategische Lage fortlaufend analysieren und beurteilen, die bundesinternen Arbeiten koordinieren, die Information nach innen und aussen sicherstellen und Grundlagen für weitere Entscheide des Bundesrats erarbeiten.

Verträge mit Informatik-Dienstleistern werden überprüft

Weiter hat der Bundesrat das EFD beauftragt, in Zusammenarbeit mit dem PSK-D ein Mandat für eine Administrativuntersuchung zu erarbeiten. Mit einer Administrativuntersuchung soll von unabhängiger Seite untersucht werden, ob, wo und weshalb die Sicherheitsvorgaben des Bundes allenfalls mangelhaft umgesetzt worden sind. Damit sollen Massnahmen identifiziert werden, um einen ähnlichen Vorfall künftig zu verhindern.

Der Bundesrat hat an seiner Sitzung zudem angeordnet, bestehende Verträge des Bundes mit Informatikdienstleistern zu überprüfen und nötigenfalls so anpassen zu lassen, dass die Cybersicherheit der Dienstleister verbessert wird und der Bund im Fall eines erfolgreichen Angriffs rascher reagieren kann. Damit und mit der Definition von Anforderungen im Beschaffungsprozess soll sichergestellt werden, dass Lieferanten des Bundes definierte Schutzstandards in Bezug auf Cyberangriffe einhalten müssen.

Die vom Hackerangriff betroffene Firma Xplain ist für nationale und kantonale Behörden ein zentraler IT-Dienstleister. Der Bundesrat hat deshalb das Eidgenössische Justiz- und Polizeidepartement beauftragt, unter Beizug der KKJPD und des EFD Massnahmen zu prüfen, um die Wartung und Weiterentwicklung dieser essentiellen Softwarekomponenten sicherzustellen.

Der Bund wird über die weiteren Schritte bei der Bewältigung dieses Vorfalls weiterhin transparent informieren.

Bisher getroffene Massnahmen

Nachdem die Bundesverwaltung Anfang Juni von Xplain über den Ransomware-Angriff informiert worden war, wurden umgehend Massnahmen getroffen, um das Sicherheitsrisiko für die Bundesverwaltung zu minimieren. Die Auswertung und vertieften Analysen des Datenpakets laufen weiter. Aufgrund der Grösse des Datenpaketes (mehrere Millionen Dateien) werden diese Arbeiten einige Wochen oder gar Monate in Anspruch nehmen.

# data[].attributes.attachment_link.description
28.06.2023 - Der Bundesrat hat an seiner Sitzung vom 28. Juni 2023 einen politisch-strategischen Krisenstab "Datenabfluss" mandatiert. Der departementsübergreifende Krisenstab soll die laufenden Arbeiten zur Bewältigung des Ransomware-Angriffes auf die Firma Xplain, von dem auch Daten aus der Bundesverwaltung betroffen sind, koordinieren und Massnahmen vorschlagen. Zudem lässt der Bundesrat ein Mandat für eine Administrativuntersuchung erarbeiten.

# data[].attributes.headline
Behördendaten gestohlen - Der Bund ist beunruhigt wegen des Hackerangriffs auf XPlain

# data[].attributes.subject
Behördendaten gestohlen - Der Bund ist beunruhigt wegen des Hackerangriffs auf XPlain

# data[].attributes.body
Anfang Juni wurde der Hackerangriff auf die Firma XPlain durch Medienberichte öffentlich. Seither entwickelt sich der Datendiebstahl immer mehr zur wohl gravierendsten Hackerattacke auf die Bundesverwaltung, die es je gegeben hat. XPlain ist ein zentraler Informatikdienstleister für verschiedenste Schweizer Behörden im Bereich Sicherheit und Justiz.
Wie jetzt bekannt geworden ist, hat sich der Bundesrat seit dem 9. Juni bereits mehrmals mit dem Thema beschäftigt. Und er ist äusserst besorgt, wie Finanzministerin Karin Keller-Sutter erklärt: «Wenn man mit einer Firma zusammenarbeitet, die gehackt wird und dann Daten abfliessen – da muss man schon beunruhigt sein.»

# data[].attributes.attachment_link.readable_text
Ein Krisenstab soll den Cyberangriff auf die Interlakner Firma untersuchen. XPlain arbeitet auch für Bund und Kantone.

Anfang Juni wurde der Hackerangriff auf die Firma XPlain durch Medienberichte öffentlich. Seither entwickelt sich der Datendiebstahl immer mehr zur wohl gravierendsten Hackerattacke auf die Bundesverwaltung, die es je gegeben hat. XPlain ist ein zentraler Informatikdienstleister für verschiedenste Schweizer Behörden im Bereich Sicherheit und Justiz.

Wie jetzt bekannt geworden ist, hat sich der Bundesrat seit dem 9. Juni bereits mehrmals mit dem Thema beschäftigt. Und er ist äusserst besorgt, wie Finanzministerin Karin Keller-Sutter erklärt: "Wenn man mit einer Firma zusammenarbeitet, die gehackt wird und dann Daten abfliessen - da muss man schon beunruhigt sein."

Krisenstab soll Datenabfluss untersuchen

Die Beunruhigung des Bundesrates ist so gross, dass er einen Krisenstab eingesetzt hat, in dem sämtliche Departemente und die Kantone vertreten sind. Er läuft unter dem Titel "Datenabfluss", was eigentlich alles sagt.

Besonders alarmiert ist der Bundesrat, weil bei der Firma XPlain, die eigentlich Software für Sicherheitsbehörden entwickelt, auch "operative" Daten der Bundesverwaltung und damit äusserst sensible Inhalte gestohlen worden sind. Es sind Daten, die eigentlich gar nicht bei der Firma XPlain hätten sein dürfen. Das Bundesamt für Polizei fedpol und das Bundesamt für Zoll und Grenzsicherheit haben deshalb Strafanzeige eingereicht.

Wir wollen wissen, wie es möglich war, dass ein Anbieter überhaupt über solche Daten verfügen konnte.

Die Bundesanwaltschaft hat mittlerweile ein Strafverfahren eröffnet. Der Eidgenössische Datenschutzbeauftragte wiederum hat gegen die beiden Bundesämter eine Untersuchung eingeleitet, weil Anzeichen auf "potenziell schwere Verstösse gegen die Datenschutzvorschriften" bestünden.

Und der Bundesrat setzt nun noch eins obendrauf: Man wolle eine Administrativuntersuchung einleiten. "Wir wollen wissen, wie es möglich war, dass ein Anbieter überhaupt über solche Daten verfügen konnte", sagt Keller-Sutter. Die Administrativuntersuchung soll zeigen, "ob, wo und weshalb die Sicherheitsvorgaben des Bundes allenfalls mangelhaft umgesetzt" worden seien.

Alle Verträge mit externen Firmen werden untersucht

Auch nicht grade vertrauenerweckend ist die Ankündigung des Bundesrates, mit Massnahmen sicherstellen zu wollen, dass die von der Firma XPlain für die Polizei sowie die Sicherheits- und Migrationsbehörden erbrachten "essenziellen" Leistungen in jedem Fall gewährleistet werden können. "Es muss sichergestellt sein, dass es nicht mehr möglich ist, dass solche Daten abfliessen können", sagt die Justizministerin. Das sei im Grunde Sinn und Zweck des Krisenstabs.

Darüber hinaus hat der Bundesrat angeordnet, dass sämtliche Verträge des Bundes mit externen Informatikunternehmen überprüft und falls nötig angepasst werden. Die Landesregierung verfolgt damit zwei Ziele: Zum einen soll die Cybersicherheit dieser Firmen verbessert werden. Und zum anderen soll der Bund im Fall eines erfolgreichen Hackerangriffs künftig rascher reagieren können.

Der Bundesrat verspricht, dass er die Öffentlichkeit über die weiteren Schritte "transparent informieren" werde.

Echo der Zeit, 28.6.2023, 18:00 Uhr

# data[].attributes.attachment_link.title
Behördendaten gestohlen - Der Bund ist beunruhigt wegen des Hackerangriffs auf XPlain

# data[].attributes.attachment_link.description
Ein Krisenstab soll den Cyberangriff auf die Interlakner Firma untersuchen. XPlain arbeitet auch für Bund und Kantone.

# data[].attributes.headline
SCION: Eine neue Architektur für ein sichereres Internet

# data[].attributes.subject
SCION: Eine neue Architektur für ein sichereres Internet

# data[].attributes.body
Es gibt viele Tools, um das Surfen im Internet sicherer zu machen. SCION geht einen anderen Weg: Die neue Architektur soll das Internet selbst weniger anfällig für Angriffe machen. Sie entstand unter der Leitung von ETH-Forschenden. Im Interview sagt Marcel Keller, CEO der SCION Association, weshalb das reguläre Internet nicht genügt, was SCION anders macht und wieso dies auch für Unternehmen interessant ist.

# data[].attributes.headline
« La Sécurité de la Suisse 2023 »: le Service de renseignement de la Confédération publie son nouveau rapport de situation

# data[].attributes.subject
« La Sécurité de la Suisse 2023 »: le Service de renseignement de la Confédération publie son nouveau rapport de situation

# data[].attributes.body
La guerre d’agression menée contre l’Ukraine par la Russie continue d’influencer la politique nationale et internationale en matière de sécurité. La Suisse reste marquée par la concurrence croissante des grandes puissances. Dans ce contexte, les capacités d'anticipation et d'identification précoce du Service de renseignement de la Confédération (SRC) sont essentielles, afin d’identifier et d’évaluer à temps les menaces et les risques importants dans l’environnement stratégique de la Suisse, puis de prendre les mesures préventives nécessaires. Le rapport de situation « La Sécurité de la Suisse 2023 » du SRC présente les principales évolutions de la situation du point de vue du renseignement.

# data[].attributes.headline
Avis de droit sur la pénalisation du hacking éthique

# data[].attributes.subject
Avis de droit sur la pénalisation du hacking éthique

# data[].attributes.body
À la demande de l’Institut national de test pour la cybersécurité NTC, l’étude d’avocats Walder Wyss a rédigé un avis de droit détaillé intitulé «Punissabilité du piratage éthique». L’une de ses conclusions est que le piratage éthique n’est pas punissable si certaines conditions-cadres sont respectées. En publiant cet avis de droit, le NTC contribue à la cyber stratégie nationale actuelle de la Confédération, qui entend institutionnaliser le piratage informatique éthique.

# data[].attributes.headline
Nach Cyberangriffen: Braucht es in der Schweiz ein neues Grundrecht in der Verfassung?

# data[].attributes.subject
Nach Cyberangriffen: Braucht es in der Schweiz ein neues Grundrecht in der Verfassung?

# data[].attributes.body
Schweizerinnen und Schweizer können sich sicher sein: Ihre persönliche Freiheit wird durch die Bundesverfassung garantiert. In Artikel 10 ist das Grundrecht auf körperliche und geistige Unversehrtheit festgeschrieben. Doch die Frage ist: Reicht diese Formulierung in Zeiten der fortschreitenden Digitalisierung noch aus?
Wir alle sind im Netz mit immer mehr und immer sensibleren Daten exponiert. Im Gleichschritt steigen auch die Möglichkeiten der Überwachung und der Missbrauch - die aktuelle Welle von Cyberattacken zeugt davon.
Im Kanton Genf haben die Bürgerinnen und Bürger nun als erste in der Schweiz ein Recht auf digitale Unversehrtheit eingefordert. Beispielhaft gesprochen wird damit signalisiert: Es ist genauso schlimm, ungefragt die Daten von jemandem zu verwenden, wie eine Person zu schlagen oder zu mobben.
Die Verfassungsänderung, angestossen durch die Genfer FDP, wurde mit einem Ja-Stimmen-Anteil von 94 Prozent angenommen. Sie beinhaltet unter anderem ein Recht auf Schutz vor Datenmissbrauch, ein Recht auf ein Offline-Leben und ein Recht auf Vergessen - also das Löschen von Daten.

# data[].attributes.attachment_link.readable_text
Nach Cyberangriffen: Braucht es in der Schweiz ein neues Grundrecht in der Verfassung?

Es ist eine Schweizer Premiere: Genferinnen und Genfer haben sich ein Recht auf digitale Unversehrtheit gegeben. Der Bund könnte bald folgen. Was ein neues Grundrecht bringt - und was nicht.

Schweizerinnen und Schweizer können sich sicher sein: Ihre persönliche Freiheit wird durch die Bundesverfassung garantiert. In Artikel 10 ist das Grundrecht auf körperliche und geistige Unversehrtheit festgeschrieben. Doch die Frage ist: Reicht diese Formulierung in Zeiten der fortschreitenden Digitalisierung noch aus?

Wir alle sind im Netz mit immer mehr und immer sensibleren Daten exponiert. Im Gleichschritt steigen auch die Möglichkeiten der Überwachung und der Missbrauch - die aktuelle Welle von Cyberattacken zeugt davon.

Im Kanton Genf haben die Bürgerinnen und Bürger nun als erste in der Schweiz ein Recht auf digitale Unversehrtheit eingefordert. Beispielhaft gesprochen wird damit signalisiert: Es ist genauso schlimm, ungefragt die Daten von jemandem zu verwenden, wie eine Person zu schlagen oder zu mobben.

Die Verfassungsänderung, angestossen durch die Genfer FDP, wurde am Sonntag mit einem Ja-Stimmen-Anteil von 94 Prozent angenommen. Sie beinhaltet unter anderem ein Recht auf Schutz vor Datenmissbrauch, ein Recht auf ein Offline-Leben und ein Recht auf Vergessen - also das Löschen von Daten.

Alle Parteien sind im Boot

Andere Westschweizer Kantone haben ähnliche Vorhaben in der Pipeline. Eine parlamentarische Initiative von Nationalrat Samuel Bendahan (SP/VD) fordert das Recht auf digitale Unversehrtheit zudem auf nationaler Ebene. Sie wurde von Politikerinnen aller Parteien mitunterzeichnet und soll im Vergleich zu kantonalen Vorlagen nicht nur die digitale Beziehung zwischen Bürger und Staat regeln, sondern sich auch auf Daten im Besitz von Unternehmen beziehen, wie den Tech-Giganten.

"Das klare Votum in Genf zeigt, dass die Bevölkerung ihre Rechte im Internet nicht geschützt sieht. Die Cyberattacken in den letzten Wochen haben den Handlungsbedarf nochmals unterstrichen", sagt Bendahan.

Was aber könnte ein neues Recht auf digitale Unversehrtheit konkret bewirken?

Kritiker argumentieren, dass die rechtlichen Bestimmungen bereits heute ausreichen - etwa dank des Datenschutzgesetzes. Hapern tue es dagegen an der Umsetzung. So bezeichnete Florent Thouvenin, Professor für Informations- und Kommunikationsrecht an der Uni Zürich, die Einführung eines neuen Grundrechts gegenüber dem Branchenportal Inside-IT als "Symbolpolitik". Es gehe auch im digitalen Umfeld um eine Beeinträchtigung der geistigen Unversehrtheit, die bereits in der Verfassung verankert ist, und nicht um eine neue, separate digitale Identität.

Davon lässt sich Johan Rochel nicht beirren. Die heutige Verfassung könne zwar verschieden ausgelegt werden, anerkennt der Jurist und Ethik-Forscher an der ETH Lausanne. "Verankert man explizit das Recht auf digitale Unversehrtheit, wird die Ausgangslage aber eindeutig." Ein Opfer eines Datenklaus könnte sich dereinst auf dieses Grundrecht berufen, um vor Gericht wegen unzureichenden Sicherheitsstandards zu klagen.

Noch vor möglichen Auswirkungen auf Gerichtsprozesse löse das Recht auf digitale Unversehrtheit dringend nötige Überlegungen seitens Behörden und Firmen aus, ist sich Rochel sicher. "Alle müssen sich die Frage stellen, wie konkrete Projekte mit dem neuen Grundrecht in Einklang gebracht werden können. Dies auch beim Einsatz von neuen Technologien, für die es noch keine spezifischen Gesetzesparagrafen gibt." Aktuell ist die künstliche Intelligenz ein solcher Fall.

"Niemand kann die Augen verschliessen"

Gleichzeitig ist klar, dass das Recht auf digitale Unversehrtheit ein abstraktes Konstrukt bleibt - der Umsetzung kommt deshalb auch hier die entscheidende Bedeutung zu.

Digitalexperte Philippe Thevoz von Sicpa, dem weltweit führenden Anbieter von Sicherheitsdruckfarben für Banknoten, zieht einen Vergleich: "Das Grundrecht auf Bildung bringt nur dann etwas, wenn der Staat Schulen errichtet. Genauso ist es beim Recht auf digitale Unversehrtheit: Es braucht einen politischen Willen und technologische Innovationen - etwa auf dem Gebiet der Verschlüsselung -, damit Staat und Firmen die Sicherheit im digitalen Raum gewährleisten können."

Sicpa hat vor diesem Hintergrund kürzlich an ihrem Sitz im waadtländischen Prilly den Campus "unlimitrust" eröffnet, der Start-ups, Firmen und Forschende der ETH Lausanne vereint. Bis zu 3000 Menschen sollen hier Lösungen entwickeln, die Vertrauen in neue Technologien schaffen.

Thevoz hofft, dass ein Recht auf digitale Unversehrtheit in der Schweiz einen Sensibilisierungsschub für die Thematik auslösen wird. "Mit einem Grundrecht in der Verfassung könnte niemand mehr die Augen vor der Notwendigkeit des Datenschutzes verschliessen." (aargauerzeitung.ch)

# data[].attributes.attachment_link.title
Nach Cyberangriffen: Braucht es in der Schweiz ein neues Grundrecht in der Verfassung?

# data[].attributes.attachment_link.description
Es ist eine Schweizer Premiere: Genferinnen und Genfer haben sich ein Recht auf digitale Unversehrtheit gegeben. Der Bund könnte bald nachziehen.

# data[].attributes.body
"Der Bundesrat will das elektronische Patientendossier (EPD) mit gezielten Massnahmen weiterentwickeln", schreibt die Regierung in einer aktuellen Mitteilung schönfärberisch. Sie hätte auch schreiben könnten, dem sterbenskranken Patienten neues Leben einhauchen oder das palliativ liegende EPD wieder gesundpflegen. Fakt ist: Bisher ist das elektronische Patientendossier ein desaströses Millionengrab.

Das soll sich nun ändern. Für alle krankenversicherten Menschen in der Schweiz soll, wenn es nach dem Bundesrat geht, kostenlos ein EPD eröffnet werden. Jede und jeder entscheidet anschliessend selber, welche Gesundheitsfachpersonen auf das Dossier zugreifen dürfen. Wer kein E-Dossier will, kann bei seinem Kanton Widerspruch gegen die Eröffnung einlegen. Dieses Opt-out-Modell kennt das Gesundheitswesen schon von der Organspende.

Eine Pflicht will der Bundesrat des Weiteren für ambulante Leistungserbringer wie Ärztinnen, Apotheker, Physiotherapeutinnen oder Chiropraktoren, heisst es in der Mitteilung. Diese müssten sich einem EPD-Anbieter – derzeit gibt es 8 Stammgemeinschaften – "anschliessen und Informationen zu Behandlungen mit den dafür relevanten Daten und Resultaten im EPD ablegen".

# data[].attributes.attachment_link.description
Täglich kostenlose News, Trends, Nachrichten und Hintergründe aus der Schweizer und der internationalen Informatik. Für Anwenderunternehmen und Anbieter.

# data[].attributes.headline
Kohlmeier vs. Laux: Verhindert Datenschutz Innovation in der Verwaltung?

# data[].attributes.subject
Kohlmeier vs. Laux: Verhindert Datenschutz Innovation in der Verwaltung?

# data[].attributes.body
Die auf IT-Recht spezialisierten Anwälte Sven Kohlmeier und Christian Laux beleuchten für inside-it.ch Aktuelles. Heute diskutieren sie die Frage, wie viele technische Aspekte in die Gesetzgebung gehören.

Technische Innovationen in der Verwaltung habens schwer, auch wegen des Datenschutzes. Sollte man Behörden erst machen lassen und erst danach Rechtsgrundlagen schaffen?

# data[].attributes.attachment_link.readable_text
Kohlmeier vs. Laux: Verhindert Datenschutz Innovation in der Verwaltung?
Von Christian Laux, Sven Kohlmeier, 27. Juni 2023 um 07:30

Die auf IT-Recht spezialisierten Anwälte Sven Kohlmeier und Christian Laux beleuchten für inside-it.ch Aktuelles. Heute diskutieren sie die Frage, wie viele technische Aspekte in die Gesetzgebung gehören.

Technische Innovationen in der Verwaltung habens schwer, auch wegen des Datenschutzes. Sollte man Behörden erst machen lassen und erst danach Rechtsgrundlagen schaffen?

Sven Kohlmeier: Nein, Verwaltung und Staat haben eine Vorbildfunktion und müssen sich gesetzestreu verhalten!

Der Staat (rein juristisch die Legislative) schafft eine gesetzliche Regelung, an die sich Bürgerinnen und Bürger, Unternehmen und Verbände halten müssen. Andernfalls gibt es eine Busse oder andere Sanktionen. Der selbe Staat (jetzt hier in der Rolle als Exekutive) ist dann immer wieder erstaunt, wenn ihm entweder Technologiefeindlichkeit vorgeworfen wird, weil er neue Entwicklungen nicht sofort umsetzt oder aber durch eigene Gesetze in seiner Handlungsfähigkeit beschränkt wird.

Staatliches Handeln muss rechtmässig sein, auf einer gesetzlichen Grundlage beruhen und darf niemals den Eindruck erwecken, man würde es mit der Einhaltung der gesetzlichen Vorschriften nicht so ernst nehmen. Es zwingt ja keiner den Gesetzgeber, ein Gesetz so eng zu erlassen, dass neue Techniken später nicht erfasst sind. Der Gesetzgeber könnte auch eine Regelung erlassen, die generell abstrakt Sachverhalte umschreibt, technologieoffen ist und Verpflichtungen für das Inverkehrbringen von neuen Technologien regelt.

Nutzung von KI wäre heute problemlos möglich

Auch die Nutzung von KI in der Verwaltung wäre heute ohne weiteres möglich. Aber nur, wenn es eine explizite gesetzliche Grundlage dafür gibt. KI muss als Technik generell abstrakt explizit genannt sein, sonst genügt die Grundlage nicht dem Bestimmheitserfordernis. Der Gesetzgeber hätte das längst regeln können. Beispielsweise auch mit Transparenzpflichten über die Offenlegung von Quellcode und dem Umfang der Datennutzung oder der Offenlegung dahinterstehende Technologie für wissenschaftliche Auswertungen.

Damit wäre es für Verwaltung (also den Staat) und Unternehmen möglich, neue Technologien einzuführen, die dann von Zivilgesellschaft, dem Gesetzgeber und der Wissenschaft evaluiert werden könnten. Die Risikodiskussion bei Cloud-Computing wie auch dem Einsatz Künstlicher Intelligenz kommt doch daher, dass kaum offengelegt ist, wie die Funktionsweise ist, welche Daten einbezogen wurden und wer den Zugriff auf die Daten hat (Unternehmen und Staaten).

Mit der Möglichkeit von Pilotversuchen zur digitalen Transformation der Bundesverwaltung im Bundesgesetz über den Einsatz elektronischer Mittel zur Erfüllung von Behördenaufgaben (Embag) wurde eine gute Möglichkeit geschaffen, technische Neuerungen einzusetzen, auch wenn noch nicht alle Einzelheiten bekannt sind. Das ist ein guter Weg.

Wenn der Datenschutz bremst, ist das Gesetz schlecht gemacht

Dem Datenschutz wird oft vorgeworfen, Bremser von Verwaltungshandeln zu sein oder auch nur vorgeschoben zu werden, wenn irgendwer irgendwas verhindern will. Wenn der Datenschutz Innovationen und staatliches Handeln ausbremst, dann ist das Datenschutzgesetz schlecht gemacht und muss überarbeitet werden.

Das Datenschutzrecht verfolgt das legitime Ziel, unsere Personendaten zu schützen. Wir werden eines Tages dankbar sein, in einem Land zu leben, wo der Datenschutz jedenfalls qua Gesetz noch gilt.

Keiner von uns will eine Massenüberwachung wie in China mit Social-Credits oder dass der Staat alle unsere Daten nach Gutdünken zusammenführen kann. Der Staat hat bei der Einhaltung des Datenschutzes eines Vorbildfunktion. Wenn grosse Digital-Anbieter sich nicht an das Gesetz halten oder es nur lieblos umsetzen, dann hilft es nicht, einen Politiker-Arbeitskreis zu gründen, sondern dann kann und muss die Exekutive handeln und Unternehmen auch mal büssen.

Jeder Bürger wird sofort gebüsst, wenn er falsch parkiert. Von der Verwaltung erwarte ich erst recht, dass sich diese an die Gesetze halten. Oder noch besser: Der Gesetzgeber erlässt gute und vorausschauende Gesetzte, die die Technik des 21. Jahrhunderts mitdenkt und es dann für Verwaltung und Wirtschaft einfacher macht, neue Technologien ohne Datenschutzbedenken einzuführen.

Christian Laux: Nein. Aber Technologie gehört trotzdem nicht ins Gesetz!

Natürlich haben Staat und Verwaltung eine Vorbildfunktion. Und selbstverständlich müssen sie sich gesetzestreu verhalten. Und nein: Ohne rechtliche Grundlage darf der Staat nicht handeln. Aber das ist doch gar nicht die Frage.

1. Man soll wissen, was gilt (Transparenzregel)

2. Wichtige Themen (z.B. Datenschutz) sollen demokratisch legitimiert sein (Demokratieregel)

3. Der Staat soll sich nicht grenzenlos ausdehnen (Kontrollregel)

Es geht darum, ob KI oder "die Cloud" als Mittel zum Erreichen eines berechtigten Ziels eingesetzt werden darf, auch wenn das Gesetz "KI" oder "die Cloud" nicht ausdrücklich erwähnt.

Es geht um die Frage, wie detailliert die Rechtsgrundlage sein muss - juristisch gesprochen. Was verlangt das sogenannte Erfordernis des Rechtssatzes denn genau?

"Das Erfordernis des Rechtssatzes ist wichtig, aus drei Gründen:

Wenn ich höre, dass man neue Technologien ohne eine explizite Nennung der Technologie selber im Rechtssatz nicht einführen darf, hört es für mich auf. Man muss sich vor Augen halten, worüber wir reden: Ein Szenario, wo die Verwaltung eine gesetzliche Grundlage zum Handeln hat. Sie verhält sich somit gesetzestreu. Und jetzt kommt der Datenschutz und sagt: "Nein, mit dieser Technologie nicht!"

"Künstliche Intelligenz" für erlaubtes Verwaltungshandeln. "KI" ist ein Marketingbegriff und unscharf. Positiv formuliert ist der Begriff der Versuch, die Funktionsweise gewisser Software zu beschreiben. KI ist aber kein eigenständiger Verwendungszweck. KI = "Weg ins Ziel".

Business Intelligence für die Verbesserung der IT-Sicherheit in einem Personalverwaltungssystem (Verwendungszweck ist von der Haupttätigkeit, z.B. Amtsführung, gedeckt; Beobachtung von Mitarbeitenden wäre nicht gedeckt). BI = "Weg ins Ziel".

Cloud Computing für eine erlaubte Datenanalyse = "Weg ins Ziel". Der Verwendungszweck ändert dadurch nicht.

Es würde die Verwaltungstätigkeit gelähmt, wenn auch die Technologie im Rechtssatz stehen muss. Dies wäre undemokratisch: Das Parlament hat ja schon gesagt, dass die Verwaltung handeln soll; warum soll man sie jetzt bremsen dürfen? Nota bene: Die Minderheit, die bremst, hat nicht dieselbe demokratische Legitimation (und muss auch keine Verantwortung übernehmen; die Verwaltung schon).

Art. 1 des neuen Datenschutzgesetzes (nDSG) sagt, worum es gehen muss: Die Freiheit der Bürgerin im Staat beziehungsweise vor dem Staat. Man muss vor neuen Auswertungen und Verwendungszwecken schützen, die nicht zum (bereits gesetzlich genehmigten) Verwaltungshandeln gehören. Kurz: Die Zieldefinition der Verwaltungstätigkeit (Verwendungszweck) gehört ins Gesetz, der Weg ins Ziel (Technologie) nicht.

Beispiele für erlaubte Nutzungen, auch wenn im Gesetz nichts dazu steht:

Sprechen wir über Gefahren. Dass jede Datenbearbeitung ein Risiko mit sich bringen kann, wenn sie nicht gut verwaltet wird, ist klar. Dies allein ist aber kein Grund, die Anforderungen an den Rechtssatz zu weit zu formulieren. Im Rahmen einer abstrakten Prüfung kann ohnehin kaum je über Rechtmässigkeit beziehungsweise Rechtswidrigkeit einer Technologie geurteilt werden (das hat der Entscheid von Oktober 2022 in Sachen Bundes-Cloud gezeigt). Entscheidend ist, wie das Umsetzungsprojekt ausgeführt wird. Dort trennt sich dann das gut umgesetzte Projekt (rechtmässig) vom fehlerhaft umgesetzten Projekt (rechtswidrig). Im Rahmen des Umsetzungsprojekts ist das nDSG einzuhalten. Der Edöb beaufsichtigt (Art. 49 ff. nDSG): Es besteht somit bereits ein genügender Schutz durch das nDSG.

Wenn eine Technologie ausnahmsweise per se notwendigerweise und unvermeidbar neue Datenbearbeitungen mit sich brächte, könnte es anders aussehen.

Denkbar: Wenn (a) einer Ausweitung der Datennutzung ohne Regelung im Rechtssatz Tür und Tor geöffnet würde und (b) die Verwendungszwecke der Datennutzung nicht limitiert wären. Das wäre aber ein Ausnahmefall.

Und zuletzt: Was bringt's denn überhaupt? In der Praxis wird der Datenschutz im Gesetz stets mitgeregelt. Faktisch bringt das Ganze keine Verbesserung im Verhältnis zu Art. 6 nDSG, der ohnehin schon gilt.

Darum meine Frage: Zielt man hier nicht einfach nur auf Verlangsamung? Verlangsamung ist kein Selbstzweck. Jedenfalls ist es kein Ziel des neuen Datenschutzgesetzes.

"In Bezug auf Folgendes besteht Einigkeit zwischen Sven Kohlmeier und Christian Laux:

Loading

# data[].attributes.attachment_link.title
Kohlmeier vs. Laux: Verhindert Datenschutz Innovation in der Verwaltung?

# data[].attributes.attachment_link.description
Die auf IT-Recht spezialisierten Anwälte Sven Kohlmeier und Christian Laux beleuchten für inside-it.ch Aktuelles. Heute diskutieren sie die Frage, wie viele technische Aspekte in die Gesetzgebung gehören.

# data[].attributes.headline
Das elektronische Patientendossier soll zu einem Pfeiler im Gesundheitssystem werden

# data[].attributes.subject
Das elektronische Patientendossier soll zu einem Pfeiler im Gesundheitssystem werden

# data[].attributes.body
Der Bundesrat will das elektronische Patientendossier (EPD) mit gezielten Massnahmen weiterentwickeln und damit den Nutzen für Patientinnen und Patienten, Ärzteschaft, Pflegende, Spitäler, Heime und alle weiteren Gesundheitseinrichtungen erhöhen. So soll das EPD künftig von allen Fachpersonen im Gesundheitsbereich angewandt werden müssen, nicht nur im stationären Bereich, sondern auch in der Arztpraxis, den Apotheken oder in ambulanten Therapien. Zudem soll für alle Menschen in der Schweiz kostenlos ein EPD eröffnet werden. Der Bundesrat hat an seiner Sitzung vom 28. Juni 2023 eine entsprechende Revision des Bundesgesetzes über das elektronische Patientendossier in die Vernehmlassung geschickt.

# data[].attributes.headline
Ukraine's cyber defence: Insights on private sector contributions since the Russian invasion

# data[].attributes.subject
Ukraine's cyber defence: Insights on private sector contributions since the Russian invasion

# data[].attributes.body
While the cyber domain of conflict has not received as much attention in the war waged against Ukraine, the country has been determinedly building its cyber resilience allowing it to defend in cyberspace as formidably as it has. In part, Ukraine has been able to build resilience by partnering with the private sector as a key ally. By partnering with technology companies, Ukraine has been able to access critical cybersecurity tools and intelligence, which has complemented its own cyber defence efforts.

Domestically, Ukraine’s engagement with the private sector has been particularly significant in protecting privately-owned critical infrastructure companies and building trust with the government. However, challenges remain in delineating the scope of private sector involvement in cyber conflict and navigating the differing incentives of the public and private sector. These challenges are also roadblocks to any feasible institutionalised cyber defence model, even as the level of cooperation between CERTs, technology companies, and security agencies suggests that ad-hoc collective cyber defence efforts are already underway.

This policy brief outlines some key takeaways from the active private sector participation in Ukraine’s cyber defences since Russia’s invasion in February 2022.  It contains insights from industry experts, government representatives, and researchers on cybersecurity who participated in a closed-door roundtable discussion conducted as part of the GLOBSEC Future of Cyberspace Cooperation Initiative: Transatlantic Chapter.

# data[].attributes.attachment_link.provider_name
GLOBSEC - A Global Think Tank: Ideas Shaping the World

# data[].attributes.attachment_link.readable_text
While the cyber domain of conflict has not received as much attention in the war waged against Ukraine, the country has been determinedly building its cyber resilience allowing it to defend in cyberspace as formidably as it has. In part, Ukraine has been able to build resilience by partnering with the private sector as a key ally. By partnering with technology companies, Ukraine has been able to access critical cybersecurity tools and intelligence, which has complemented its own cyber defence efforts.

Domestically, Ukraine's engagement with the private sector has been particularly significant in protecting privately-owned critical infrastructure companies and building trust with the government. However, challenges remain in delineating the scope of private sector involvement in cyber conflict and navigating the differing incentives of the public and private sector. These challenges are also roadblocks to any feasible institutionalised cyber defence model, even as the level of cooperation between CERTs, technology companies, and security agencies suggests that ad-hoc collective cyber defence efforts are already underway.

This policy brief outlines some key takeaways from the active private sector participation in Ukraine's cyber defences since Russia's invasion in February 2022. It contains insights from industry experts, government representatives, and researchers on cybersecurity who participated in a closed-door roundtable discussion conducted as part of the GLOBSEC Future of Cyberspace Cooperation Initiative: Transatlantic Chapter.
Learn more in the brief below.

# data[].attributes.attachment_link.title
Ukraine's cyber defence: Insights on private sector contributions since the Russian invasion

# data[].attributes.attachment_link.description
While the cyber domain of conflict has not received as much attention in the war waged against Ukraine, the country has been determinedly building its cyber resilience allowing it to defend in cyberspace as formidably as it has. In part, Ukraine has been able to build resilience by partnering with the private sector as a key ally.

# data[].attributes.headline
Diese Cyberlehren zieht der Nachrichtendienst aus dem Krieg in der Ukraine

# data[].attributes.subject
Diese Cyberlehren zieht der Nachrichtendienst aus dem Krieg in der Ukraine

# data[].attributes.body
Die Sicherheitslage im Umfeld der Schweiz ist instabiler, unübersichtlicher und unberechenbarer geworden. Dies schreibt der Nachrichtendienst des Bundes (NDB) im unlängst veröffentlichten Lagebericht "Sicherheit Schweiz 2023". Darin stellt die Behörde die aus ihrer Sicht "die wichtigsten Lageentwicklungen" vor. Terrorismus, gewalttätiger Extremismus, Cyberangriffe, Spionage und Proliferation bleiben "aktuelle, teils akute Bedrohungen, die anhaltend nachrichtendienstliche Aufklärung und sicherheitspolitische Aufmerksamkeit verlangen", wie Bundesrätin Viola Amherd, Vorsteherin des Departements für Verteidigung, Bevölkerungsschutz und Sport (VBS), in der Einleitung des Berichts schreibt.

# data[].attributes.headline
China's Grand Strategy For Global Data Dominance

# data[].attributes.subject
China's Grand Strategy For Global Data Dominance

# data[].attributes.body
Report author and Hoover visiting fellow Matthew Johnson finds that Xi Jinping’s Party-state is building a massive institutional architecture to maximally exploit data as the fundamental resource of the future global economy and governance system, and proposes robust policy solutions to arrest the exposure of huge swaths of the world’s population to the CCP's data accumulation, espionage, and manipulation. Johnson joined Orville Schell, Susan Aaronson, Grady McGregor, and Glenn Tiffert to discuss the implications of the CCP’s bid to shape how data will be distributed and controlled, and how Washington can lead in building a data regime shaped by democratic values.

# data[].attributes.headline
China’s Technology Strategy: Leverage Before Growth

# data[].attributes.subject
China’s Technology Strategy: Leverage Before Growth

# data[].attributes.body
Whether China likes it or not, sustained and fast economic growth is not in its present or future. Political and military strategies dependent on fast growth are no longer viable options. This hardly means Chinese Communist Party (CCP) Chairman Xi Jinping has given up. He has outlined new objectives, and his regime has implemented new strategies flowing from those objectives.¹ The US and others have only partly recognized this shift and have barely begun to respond to it.

Similar to its military strategy, the People’s Republic of China’s (PRC) current economic competitive strategy is asymmetric. Beijing focuses on the PRC’s “strengths,” which include being able to produce at scale, having some of the world’s largest consumer market segments, employing predatory regulatory practices, and using coercive technology acquisition. China is trying to neutralize American advantages stemming from an open, wealth-seeking, highly innovative economy. If the US keeps competing as if its rival is another open-market economy organized for individual prosperity, it risks losing the crucial contest for economic leverage and political influence. To defeat the PRC’s geo-economic strategy, the US needs to ensure it no longer helps Chinese companies seeking to catch up and consider defending its most innovative companies.

# data[].attributes.headline
Comparing U.S. and Chinese Contributions to High-Impact AI Research

# data[].attributes.subject
Comparing U.S. and Chinese Contributions to High-Impact AI Research

# data[].attributes.body
In the past decade, Chinese researchers have become increasingly prolific authors of highly cited AI publications, approaching the global research share of their U.S. counterparts. However, some analysts question the impact of Chinese publications; are they well respected internationally, and do they cover important topics? In this data brief, the authors build on prior analyses of top AI publications to provide a richer understanding of the two countries’ contributions to high-impact AI research.

# data[].attributes.attachment_link.provider_name
Center for Security and Emerging Technology

# data[].attributes.attachment_link.title
Comparing U.S. and Chinese Contributions to High-Impact AI Research - Center for Security and Emerging Technology

# data[].attributes.attachment_link.description
In the past decade, Chinese researchers have become increasingly prolific authors of highly cited AI publications, approaching the global research share of their U.S. counterparts. However, some analysts question the impact of Chinese publications; are they well respected internationally, and do they cover important topics?

# data[].attributes.headline
China als Hauptquelle für APT-Angriffe bestätigt

# data[].attributes.subject
China als Hauptquelle für APT-Angriffe bestätigt

# data[].attributes.body
Im ersten Quartal fielen koordinierte Spionageaktionen im Cyberraum besonders auf, wobei APT-Gruppen wie Mustang Panda und UNC4191 mit China in Verbindung gebracht wurden. Diese Akteure waren für erstaunliche 79 Prozent aller staatlich unterstützten Angriffe verantwortlich.

# data[].attributes.attachment_link.readable_text
Zukünftig ist zu erwarten, dass APT-Gruppen weiterhin die Verknüpfung von Spionage und Störungen im Cyberraum mit herkömmlichen militärischen Aktivitäten anstreben. Diese Schlussfolgerungen gehen aus dem aktuellen CyberThreat Report hervor, der eine Zunahme von Angriffen auf den Finanz-, Telekommunikations- und Energiesektor belegt.

Der Juni-Bericht des Trellix Advanced Research Center enthält wichtige Erkenntnisse zu den Sicherheitstrends des ersten Quartals 2023. Der Bericht basiert auf einem globalen Netzwerk professioneller Beobachter, die täglich mehr als 80 Millionen sicherheitsrelevante Vorfälle dokumentieren und untersuchen. Durch die Kombination von Telemetriedaten aus 1 Milliarde Sensoren mit Informationen aus Open- und Closed-Source-Quellen liefert Trellix umfassende Einblicke in das CyberThreat-Geschehen.

„Ein Jahr nach Beginn des Ukrainekriegs haben sich Cyberangriffe zu einer strategischen Waffe entwickelt, die von Staaten gezielt eingesetzt wird, um Spionage zu betreiben und gesellschaftliche Spaltungen voranzutreiben", erklärt John Fokker, Head of Threat Intelligence im Trellix Advanced Research Center.

„Bekannte APT-Gruppen stellen sowohl für führende Wirtschaftsnationen als auch für Schwellenländer eine reale Bedrohung dar, insbesondere für kritische Infrastrukturen wie Telekommunikation, Energieversorgung und Produktion. Öffentliche und private Akteure müssen dringend angemessene Abwehrmaßnahmen ergreifen, um sich vor den zunehmend raffinierten Angriffen staatlich unterstützter Cyberkrimineller zu schützen."

Der jüngste Bericht des Trellix Advanced Research Center beleuchtet sicherheitsrelevante Aktivitäten in den Bereichen Ransomware, Nation-State-APT-Angriffe, E-Mail-Bedrohungen und Missbrauch von Sicherheitstools. Dabei wurden folgende Hauptergebnisse herausgestellt:

Koordinierte Spionage im Cyberraum: Im ersten Quartal waren APT-Gruppen wie Mustang Panda und UNC4191 mit China am auffälligsten, und sie waren für 79 Prozent aller festgestellten staatlich unterstützten Angriffe verantwortlich. Die Verbindung von Spionage und Disruption im Cyberraum mit herkömmlichen militärischen Aktivitäten wird auch in Zukunft erwartet.

Ransomware: Finanzieller Gewinn steht nach wie vor im Vordergrund, weshalb der Versicherungs- und Finanzsektor häufige Ziele sind. US-amerikanische Unternehmen mittlerer Größe mit 51 bis 200 Mitarbeitern und einem Umsatz von 10 bis 50 Millionen US-Dollar sind die Hauptopfer von Leak-Sites.

Beliebtheit von Cobalt Strike: Trotz der Bemühungen, Cobalt Strike weniger attraktiv für missbräuchliche Zwecke zu machen, hat es bei Cyberkriminellen und Ransomware-Akteuren an Beliebtheit gewonnen. Cobalt Strike war an 35 Prozent der Nation-State-Aktivitäten und 28 Prozent der Ransomware-Bedrohungen beteiligt.

Schwachstellen und Cloud-Angriffe: Viele kritische Schwachstellen entstehen aufgrund von Umgehung von Patches, Lieferketten-Bugs oder unzureichender Sicherheitsmaßnahmen. Cyberkriminelle konzentrieren sich vermehrt auf die Infrastruktur von Amazon, Microsoft und Google und nutzen dabei vor allem den unbefugten Zugriff auf legitime Benutzerkonten.

Der CyberThreat Report basiert auf proprietären Daten des Trellix-Sensornetzwerks, Analysen des Trellix Advanced Research Center zu staatlich unterstützten und kriminellen Cyberaktivitäten sowie Informationen aus Open- und Closed-Source-Quellen und Leak-Sites von Bedrohungsakteuren. Die Telemetrie-basierte Erkennung und Meldung von Dateien, URLs, IP-Adressen, verdächtigen E-Mails, Netzwerkverhalten und anderen Indikatoren über die Trellix XDR-Plattform dient als Nachweis für Bedrohungen.

# data[].attributes.attachment_link.title
China als Hauptquelle für APT-Angriffe bestätigt

# data[].attributes.attachment_link.description
Im ersten Quartal fielen koordinierte Spionageaktionen im Cyberraum besonders auf, wobei APT-Gruppen wie Mustang Panda und UNC4191 mit China in Verbindung gebracht wurden. Diese Akteure waren für erstaunliche 79 Prozent aller staatlich unterstützten Angriffe verantwortlich.

# data[].attributes.headline
Nuclear Weapons Cybersecurity: Status of NNSA's Inventory and Risk Assessment Efforts for Certain Systems

# data[].attributes.subject
Nuclear Weapons Cybersecurity: Status of NNSA's Inventory and Risk Assessment Efforts for Certain Systems

# data[].attributes.body
At the National Nuclear Security Administration (NNSA), information technology is embedded in more than computers—it's in equipment used to produce nuclear weapon components and in nuclear weapons themselves. Federal law requires NNSA to manage cybersecurity risks. NNSA has been developing risk management policies and practices for both of these IT environments.

However, NNSA's efforts to identify, assess, and mitigate cyber risks—to specific weapons or manufacturing equipment—are still in the early stages of development. For instance, NNSA is still trying to inventory systems with potential cybersecurity vulnerabilities.

# data[].attributes.attachment_link.readable_text
Fast Facts

At the National Nuclear Security Administration (NNSA), information technology is embedded in more than computers-it's in equipment used to produce nuclear weapon components and in nuclear weapons themselves. Federal law requires NNSA to manage cybersecurity risks. NNSA has been developing risk management policies and practices for both of these IT environments.

However, NNSA's efforts to identify, assess, and mitigate cyber risks-to specific weapons or manufacturing equipment-are still in the early stages of development. For instance, NNSA is still trying to inventory systems with potential cybersecurity vulnerabilities.

Highlights

What GAO Found

The National Nuclear Security Administration (NNSA) and its contractors who operate its laboratory and production sites are increasingly integrating digital systems into nuclear weapons and into manufacturing and industrial control processes and operations at sites across the nuclear security enterprise. These digital systems could be targeted by malicious actors, and NNSA has stated that securing its digital assets is an agency priority. To protect against such threats, federal law and policies require that NNSA establish a program to manage cybersecurity risk.

NNSA and its contractors remain in the early stages of efforts-even after several years-to address cybersecurity at the system level in its operational technology (OT) and nuclear weapons IT environments.

The operational technology environment includes manufacturing equipment and industrial control systems with embedded IT. NNSA has estimated that there could be hundreds of thousands of OT systems at sites across the nuclear security enterprise. NNSA is taking some steps as a precursor to creating an inventory of systems in its OT environment and assessing and mitigating the risks to such systems. Such steps include developing an OT-specific guidebook for assessing risk to OT systems and creating and conducting OT training for NNSA and site contractors. NNSA's efforts to create an inventory of OT systems across all its sites and to assess and mitigate risks to them, however, are still in very early stages and limited in scope. NNSA's main actions include working with the sites to identify the most critical OT capability at each and having them conduct an assessment of a single OT system or component as a learning exercise.

The nuclear weapons IT environment includes IT within or in contact with weapons. NNSA officials do not have an estimate of the number of nuclear weapons IT systems, but they told us that the number is smaller compared with the OT environment. NNSA has begun a number of efforts to facilitate the creation of an inventory of nuclear weapon IT systems and to assess and mitigate the cyber risks to such systems, but these efforts are not yet complete. Such steps are intended to result in creating a formal definition of nuclear weapons IT, developing a cybersecurity risk management framework, analyzing gaps between NNSA's cybersecurity risk management framework and existing engineering processes, and revising internal guidance.

NNSA officials told us that cyber risks vary from one nuclear weapon type to another. NNSA officials said that they have conducted preliminary reviews and determined that current nuclear weapons generally contain little IT that is at risk due to their age and reliance on older technology. Newer and more modern weapons are slated to begin entering the stockpile after 2030 and may contain more IT, however. For these weapons, NNSA officials said that each program is still considering approaches to managing cybersecurity risks as part of the weapon design and development process.

Why GAO Did This Study

The classified annex to Senate Report 116-48 accompanying the National Defense Authorization Act for Fiscal Year 2020 includes a provision for GAO to review NNSA's practices and policies for the cybersecurity of nuclear weapons, and we were asked to perform related work. In September 2022, we issued a report that assessed NNSA's nuclear weapon cybersecurity efforts from a broad organizational and planning perspective in these two environments. This report describes the steps that NNSA has taken to inventory the range of systems in the OT and nuclear weapons IT environments and to assess and mitigate the cyber risks to such systems.

We reviewed NNSA directives and guidance that direct NNSA and its site contractors to establish cybersecurity risk management frameworks. We also reviewed NNSA and contractor documents, such as OT assessment reports and program protection plans for certain weapons. We also interviewed NNSA officials and evaluated responses to written questions sent to contractor representatives at each of the sites.

For more information, contact Allison B. Bawden at (202) 512-3471 or BawdenA@gao.gov, or David B. Hinchman at (214) 777-5719 or HinchmanD@gao.gov.

Full Report

GAO Contacts

# data[].attributes.attachment_link.title
Nuclear Weapons Cybersecurity: Status of NNSA's Inventory and Risk Assessment Efforts for Certain Systems

# data[].attributes.attachment_link.description
At the National Nuclear Security Administration (NNSA), information technology is embedded in more than computers-it's in equipment used to produce...

# data[].attributes.headline
National Artificial Intelligence Advisory Committee Releases First Report

# data[].attributes.subject
National Artificial Intelligence Advisory Committee Releases First Report

# data[].attributes.body
The National Artificial Intelligence Advisory Committee (NAIAC) has delivered its first report to the president, established a Law Enforcement Subcommittee to address the use of AI technologies in the criminal justice system, and completed plans to realign its working groups to allow it to explore the impacts of AI on workforce, equity, society and more.

The report recommends steps the U.S. government can take to maximize the benefits of AI technology, while reducing its harms. This includes new steps to bolster U.S. leadership in trustworthy AI, new R&D initiatives, increased international cooperation, and efforts to support the U.S. workforce in the era of AI. The report also identifies areas of focus for NAIAC for the next two years, including in rapidly developing areas of AI, such as generative AI.

# data[].attributes.attachment_link.readable_text
WASHINGTON - The National Artificial Intelligence Advisory Committee ( NAIAC) has delivered its first report to the president, established a Law Enforcement Subcommittee to address the use of AI technologies in the criminal justice system, and completed plans to realign its working groups to allow it to explore the impacts of AI on workforce, equity, society and more.

The report recommends steps the U.S. government can take to maximize the benefits of AI technology, while reducing its harms. This includes new steps to bolster U.S. leadership in trustworthy AI, new R&D initiatives, increased international cooperation, and efforts to support the U.S. workforce in the era of AI. The report also identifies areas of focus for NAIAC for the next two years, including in rapidly developing areas of AI, such as generative AI.

"We are at a pivotal moment in the development of AI technology and need to work fast to keep pace with the changes it is bringing to our lives," said U.S. Deputy Secretary of Commerce Don Graves. "As AI opens up exciting opportunities to improve things like medical diagnosis and access to health care and education, we have an obligation to make sure we strike the right balance between innovation and risk. We can lead the world in establishing trustworthy, inclusive and beneficial AI, and I look forward to considering the committee's recommendations as we do that."

When it comes to AI, President Biden has been clear that in order to seize the opportunities AI presents, we must first mitigate its risks. NAIAC's work supports the Biden-Harris administration's ongoing efforts to promote responsible American innovation in AI and protect people's rights and safety.

Given the fast pace of development and deployment of AI technology such as generative AI, which includes the large language models that power chatbots and other tools that create new content, the committee also plans to consider various mechanisms for carrying out its work on short time frames in the coming years.

The committee recently completed plans to realign its working groups to allow it to explore the impacts of AI on workforce, equity, society and more. The new NAIAC focus areas are:

AI Futures: Sustaining Innovation in Next Gen AI

AI in Work and the Workforce

AI Regulation and Executive Action

Engagement, Education and Inclusion

Generative and NextGen AI: Safety and Assurance

Rights-Respecting AI

International Arena: Collaboration on AI Policy and AI-Enabled Solutions

Procurement of AI Systems

AI and the Economy

The full report, including all of its recommendations, is available on the AI.gov website. Join our mailing list to receive updates on committee activities.

The NAIAC was created by the National AI Initiative Act of 2020 to advise the president and the National AI Initiative Office in the White House Office of Science and Technology Policy. The authorizing statute called for a Law Enforcement Subcommittee, the membership of which was finalized in April 2023. The NAIAC is administered by the U.S Department of Commerce's National Institute of Standards and Technology (NIST).

# data[].attributes.attachment_link.title
National Artificial Intelligence Advisory Committee Releases First Report

# data[].attributes.attachment_link.description
NAIAC's work supports the Biden-Harris administration's ongoing efforts to advance a comprehensive approach to AI-related risks and opportunities.

# data[].attributes.headline
NATO moves to protect undersea pipelines, cables as concern mounts over Russian sabotage threat

# data[].attributes.subject
NATO moves to protect undersea pipelines, cables as concern mounts over Russian sabotage threat

# data[].attributes.body
NATO launched a new center Friday for protecting undersea pipelines and cables following the still-unsolved apparent attack on the Nord Stream pipelines and amid concern Russia is mapping vital Western infrastructure for energy and the internet in waters around Europe.

“The threat is developing,” Lt. Gen. Hans-Werner Wiermann, who heads a special cell focused on the challenge, said after NATO defense ministers gave the greenlight for the new center, located in Northwood, northwest London.

“Russian ships have actively mapped our critical undersea infrastructure. There are heightened concerns that Russia may target undersea cables and other critical infrastructure in an effort to disrupt Western life,” he told reporters at NATO headquarters in Brussels.

# data[].attributes.attachment_link.readable_text
BRUSSELS (AP) - NATO launched a new center Friday for protecting undersea pipelines and cables following the still-unsolved apparent attack on the Nord Stream pipelines and amid concern Russia is mapping vital Western infrastructure for energy and the internet in waters around Europe.

"The threat is developing," Lt. Gen. Hans-Werner Wiermann, who heads a special cell focused on the challenge, said after NATO defense ministers gave the greenlight for the new center, located in Northwood, northwest London.

"Russian ships have actively mapped our critical undersea infrastructure. There are heightened concerns that Russia may target undersea cables and other critical infrastructure in an effort to disrupt Western life," he told reporters at NATO headquarters in Brussels.

NATO was spurred into action after an apparent attack on two Baltic Sea gas pipelines in September.

The suspected attacks on the Nord Stream 1 and Nord Stream 2 pipelines, which were built to carry Russian natural gas to Germany, are still being investigated. No blame has been officially attributed, but NATO has boosted its presence in the Baltic and North Seas since then, with dozens of ships, supported by maritime patrol aircraft and undersea equipment like drones.

About 8,000 kilometers (5,000 miles) of oil and gas pipelines crisscross the North Sea alone, and systems, networks and grids are impossible to watch 24/7. Around 100 cable cutting incidents are reported every year around the world, and it is often hard to tell whether they are deliberate.

"There's no way that we can have NATO presence along also these thousands of kilometers of undersea infrastructure," NATO Secretary-General Jens Stoltenberg told reporters after chairing the meeting.

"But we can be better at collecting ... intelligence, sharing information, connecting the dots, because also in the private sector there is a lot of information" about ship movements and maritime surveillance, he added.

Rather than trying to watch it all, the new center and NATO allies are focusing on high-risk areas. Pipelines in shallow waters that can easily be reached by divers are considerably vulnerable. Potential damage to data cables can be mitigated more easily by simply dropping in more cables.

Whatever the target, NATO believes it's important to catch saboteurs as they prepare their attacks.

"To support the center, allies have decided to set up a critical undersea infrastructure network, bringing together NATO, allies and private sector actors. This will help to help improve information sharing about evolving risks and threats," Wiermann said.

# data[].attributes.attachment_link.title
NATO moves to protect undersea pipelines, cables as concern mounts over Russian sabotage threat

# data[].attributes.attachment_link.description
NATO has launched a new center to help protect vulnerable undersea pipelines and cables. The military organization is concerned about Russia's mapping activities to locate vital Western infrastructure in waters around Europe used to transport energy and internet data.

# data[].attributes.headline
Telecom Troubles: Adapting Networks to Defend Europe

# data[].attributes.subject
Telecom Troubles: Adapting Networks to Defend Europe

# data[].attributes.body
Russia’s war against Ukraine underlines the importance – and vulnerability – of modern, high-speed telecommunications. High-speed data connectivity has proved crucial on the battlefield. It powers surveillance and reconnaissance. It operates drones, optimizes logistics, and supports command and control.

Despite Russian attacks on its telecom networks, Ukraine has managed to stay connected. It was fortunate to rely on Western rather than Chinese vendors. Ericsson, Cisco, Oracle, and Microsoft provided essential support to keep Ukraine’s internet running during its existential struggle.

Securing civilian telecom networks for military usage remains a challenge for transatlantic cohesion.

# data[].attributes.attachment_link.readable_text
During a security crisis, European armies and intelligence services must interact in a safe and secure way with civilian 5G-telecom systems. This means removing Chinese suppliers.

Russia's war against Ukraine underlines the importance - and vulnerability - of modern, high-speed telecommunications. High-speed data connectivity has proved crucial on the battlefield. It powers surveillance and reconnaissance. It operates drones, optimizes logistics, and supports command and control.

Despite Russian attacks on its telecom networks, Ukraine has managed to stay connected. It was fortunate to rely on Western rather than Chinese vendors. Ericsson, Cisco, Oracle, and Microsoft provided essential support to keep Ukraine's internet running during its existential struggle.

Securing civilian telecom networks for military usage remains a challenge for transatlantic cohesion.

During the past decade, the US has been urging its allies to move away from Chinese providers such as Huawei and ZTE in their roll-out of the fifth-generation (5G) telecom. President Donald Trump made the issue a priority and President Joseph Biden is following the same policy. Both argue that NATO must be sure that information can be exchanged in a secure way.

Washington's campaign has been only partially successful. The EU in 2020 agreed on a risk-mitigating 5G toolbox to reduce their reliance on 'high-risk' (i.e. Chinese) vendors. European governments agree in most cases to must remove Chinese technology from networks running critical infrastructure. They also agree that it should be removed from the network 'core', which performs crucial functions such as server authentication and access.

Yet in 2023, Germany and Italy continue to rely on Chinese 5G, with Huawei building 59% and 51% of their respective networks, according to a recent study. In contrast, Baltic countries, which are most exposed to potential Russian aggression, have eliminated Chinese technology in their 5G rollouts.

Many European governments still do not agree on the strict need to remove it also from the 'periphery' networks, or the Radio Access Network (RAN) that interacts directly with users. Experts highlight the difficulty in separating 'core' from 'periphery' because telecom operators are bringing core operations closer to users in order to reduce delays between data requests and data deliveries. It is also difficult to separate core from periphery because common software is increasingly deployed in all parts of the network.

The transatlantic divide also reflects different starting points. Washington never allowed Chinese vendors into its telecom market (seeing China is a rising peer competitor) and suffered little extra expense from banning them. In contrast, European countries (more agnostic about reliance on China) now have to remove installed equipment and incur the extra, significant cost.

A new telecom technology called Open RAN offers one way forward. It allows various vendors to build a common system rather than relying on a single vendor's integrated system. Americans embrace it, while Europeans remain skeptical.

Europeans' first concern is security, a fear that Open RAN interfaces will increase the number of entry points for malicious actors. A single system built by a single vendor is safer than one composed of parts from multiple vendors, they argue. In fact, the opposite may be true. As an open system, it is easy to switch out any troublesome or risky equipment with other equipment from safe sources.

Europeans also fear that the technology may not be ready for widespread deployment. No national existing brownfield networkhas yet replaced Chinese equipment with Open RAN. So far, only one Japanese company, Rakuten, has built a large-scale Open RAN network - a greenfield operation that covers all of Japan. Rakuten's core network contains no Chinese parts. Most hardware is Japanese, while the software and semiconductors are American.

This nourishes fear among Europeans that Open RAN would loosen their competitive advantage on telecom technology. The continent is home to the world's two biggest non-Chinese vendors, Nokia and Ericsson, which run the risks of losing out to a new generation of decentralized, software-driven vendors.

Regardless of the adoption or not of Open RAN among European countries, the EU will need to keep up the pressure to reduce Chinese-supplied equipment. The European Commission urged countries to implement a toolbox restricting non-trusted vendors. Some EU member states, notably Hungary, Bulgaria, Czechia, and Portugal still have no legislation in place to comply.

But change may be coming. A number of European nations are reassessing their dependence on China for critical telecommunications infrastructure. Portugal, reliant on Huawei equipment, now envisions a ban. Earlier this month, officials in Brussels said that the EU is considering a bloc-wide mandatory ban on Huawei. Thierry Breton, the EU's internal market commissioner, urged the bloc's telecoms ministers that the continent's continued reliance on Chinese telecom equipment 'exposes the union's collective security.'

The message is clear. Europe experienced the consequences of becoming dependent on Russian gas. It must avoid making the same mistake in telecommunications by giving China a stranglehold.

Dr. Henrik Larsen is a Senior Researcher in the Swiss and Euro- Atlantic Security Team at the Center for Security Studies at the ETH Zürich with a focus on NATO and transatlantic security. Before, he served as a Political Adviser with the EU Delegation to Ukraine and was a Research Fellow at Harvard University's Belfer Center, the Carnegie Endowment for International Peace and at Stanford University's Center on Democracy, Development, and the Rule of Law.
Bandwidth is CEPA's online journal dedicated to advancing transatlantic cooperation on tech policy. All opinions are those of the author and do not necessarily represent the position or views of the institutions they represent or the Center for European Policy Analysis.

# data[].attributes.attachment_link.title
Telecom Troubles: Adapting Networks to Defend Europe

# data[].attributes.attachment_link.description
European armies and intelligence services must securely interact with civilian 5G-telecom systems - this means removing Chinese suppliers.

# data[].attributes.headline
Le monde open source se sent menacé par le Cyber Resilience Act européen

# data[].attributes.subject
Le monde open source se sent menacé par le Cyber Resilience Act européen

# data[].attributes.body
Treize associations européennes impliquées dans l’open source estiment que le projet européen de loi sur la cyber-résilience pourrait avoir un effet dissuasif sur le développement des logiciels open source. Dans une lettre ouverte, ils appellent à être davantage consultés dans l'élaboration de la loi.

# data[].attributes.wish_content.attachment_props.text
«Zeichne mir ein Schaf!»  

Meine heutige @walliserbote #WB #Kolumne über Bilder von Schafen, Rosen, Helfer, generative KI-Systeme und wie wichtig die Rolle des kleinen Prinzen hierbei ist.

#KI #AI #Schaf #Rose #DerKleinePrinz #PetitPrince #ChatGPT #Bard #GenerativeAI #KISystem

# data[].attributes.wish_content.attachment_props.original_text
«Zeichne mir ein Schaf!»  

Meine heutige @walliserbote #WB #Kolumne über Bilder von Schafen, Rosen, Helfer, generative KI-Systeme und wie wichtig die Rolle des kleinen Prinzen hierbei ist.

#KI #AI #Schaf #Rose #DerKleinePrinz #PetitPrince #ChatGPT #Bard #GenerativeAI #KISystem https://t.co/qfe0MS6AqU

# data[].attributes.attachment_link.embed_code
«Zeichne mir ein Schaf!»

Meine heutige @walliserbote #WB #Kolumne über Bilder von Schafen, Rosen, Helfer, generative KI-Systeme und wie wichtig die Rolle des kleinen Prinzen hierbei ist.#KI #AI #Schaf #Rose #DerKleinePrinz #PetitPrince #ChatGPT #Bard #GenerativeAI #KISystem pic.twitter.com/qfe0MS6AqU
— Prof. Diego Kuonen (@DiegoKuonen) June 27, 2023

# data[].attributes.attachment_link.metadata.attachment_props_source.data.text
«Zeichne mir ein Schaf!»  

Meine heutige @walliserbote #WB #Kolumne über Bilder von Schafen, Rosen, Helfer, generative KI-Systeme und wie wichtig die Rolle des kleinen Prinzen hierbei ist.

#KI #AI #Schaf #Rose #DerKleinePrinz #PetitPrince #ChatGPT #Bard #GenerativeAI #KISystem https://t.co/qfe0MS6AqU

# data[].attributes.attachment_link.metadata.attachment_props.original_text
«Zeichne mir ein Schaf!»  

Meine heutige @walliserbote #WB #Kolumne über Bilder von Schafen, Rosen, Helfer, generative KI-Systeme und wie wichtig die Rolle des kleinen Prinzen hierbei ist.

#KI #AI #Schaf #Rose #DerKleinePrinz #PetitPrince #ChatGPT #Bard #GenerativeAI #KISystem https://t.co/qfe0MS6AqU

# data[].attributes.attachment_link.metadata.attachment_props.text
«Zeichne mir ein Schaf!»  

Meine heutige @walliserbote #WB #Kolumne über Bilder von Schafen, Rosen, Helfer, generative KI-Systeme und wie wichtig die Rolle des kleinen Prinzen hierbei ist.

#KI #AI #Schaf #Rose #DerKleinePrinz #PetitPrince #ChatGPT #Bard #GenerativeAI #KISystem

# data[].attributes.headline
Cognitive Warfare as Part of Society: Never-Ending Battle for Minds - HCSS

# data[].attributes.subject
Cognitive Warfare as Part of Society: Never-Ending Battle for Minds - HCSS

# data[].attributes.body
This paper by Robin Burda (Masaryk University) examines the experiences of Czechia and Ukraine in dealing with Cognitive Warfare (CW) and the implications for the European Union (EU) and the North Atlantic Treaty Organisation (NATO). It highlights the challenges faced by liberal democracies, which have their “hands tied” against CW threats. Cooperation and support of proven policies against CW are crucial for the EU and NATO to remain strong. The paper emphasises the importance of each nation addressing CW within their own societies while encouraging the EU and NATO to enforce necessary defensive measures. A balance between improving democracy and regulating malign influences in media and society is essential.

# data[].attributes.attachment_link.readable_text
This paper by Robin Burda (Masaryk University) examines the experiences of Czechia and Ukraine in dealing with Cognitive Warfare (CW) and the implications for the European Union (EU) and the North Atlantic Treaty Organisation (NATO). It highlights the challenges faced by liberal democracies, which have their "hands tied" against CW threats. Cooperation and support of proven policies against CW are crucial for the EU and NATO to remain strong. The paper emphasises the importance of each nation addressing CW within their own societies while encouraging the EU and NATO to enforce necessary defensive measures. A balance between improving democracy and regulating malign influences in media and society is essential.

The paper suggests involving actors across all societal groups to minimise CW's negative impact, while acknowledging that CW will persist as an indivisible part of society. To protect liberal democracy values and maintain their identity, the EU and NATO must adopt best practices from countries like Finland and consider implementing a transparent framework for balancing active defense and freedom of speech in the face of CW challenges.

The military application of information has a long history in influencing the outcome of war and conflict on the battlefield. Be it by deceiving the opponent, maintaining troop confidence, or shaping public opinion. These tactics are placed under the banner of influencing human behaviour. Behavioural influencing is the act of meaningfully trying to affect the behaviour of an individual by targeting people's knowledge, beliefs and emotions. Within the Dutch armed forces these tactics fall under title of Information Manoeuvre. With the ever-larger and more evasive employment of information-based capabilities to target human cognition, the boundaries of the physical and cognitive battlefield have begun to fade.

For this paper series scholars, experts and policymakers submitted their papers on the employment of information-related capabilities to influence human behaviour in the military context. From the perspective of an individual European or NATO country's perspective.

The Information-based behavioural influencing and Western practice paper series is edited by Arthur Laudrain, Laura Jasper and Michel Rademaker.

The views, thoughts and opinions expressed in this paper are solely that of the author(s) and do not necessarily reflect the views, policy or opinion of HCSS.

# data[].attributes.attachment_link.title
Cognitive Warfare as Part of Society: Never-Ending Battle for Minds - HCSS

# data[].attributes.attachment_link.description
This paper by Robin Burda (Masaryk University) examines the experiences of Czechia and Ukraine in dealing with Cognitive Warfare (CW) and the implications for the European Union (EU) and the North Atlantic Treaty Organisation (NATO). It highlights the challenges faced by liberal democracies, which have their "hands tied" against CW threats.

# data[].attributes.body
This joint report from Georgetown University’s Center for Security and Emerging Technology (CSET) and The Alan Turing Institute’s Centre for Emerging Technology and Security (CETaS) assesses the current state-of-the-art in autonomous cyber defence and its future potential, identifies barriers to progress and recommends specific action that can be taken to overcome those barriers.

Given the immense economic and societal damage caused by cyberattacks and recent advances in artificial intelligence (AI), interest in the application of AI to enhance cyber defence has grown in recent years. This report focuses on one promising approach to creating these autonomous cyber defence agents: reinforcement learning (RL).

While the breadth of promising and relevant modelling approaches, techniques and technologies that relate to autonomous cyber defence is large, our focus on RL is guided by the increased efforts in applied RL for cyber defence and the promising results RL has achieved in other problem domains. Academic publications have surged in recent years and gyms for training cyber-RL agents have begun to proliferate. However, capabilities remain rudimentary and incomplete compared to the more complex real-world network environments these agents will face. Sustained funding, coordinated effort to bolster simulation, emulation and evaluation tools, securing skilled personnel, and provisioning access to realistic data and infrastructure will help assure progress.

The research found that there is substantial potential for growth if technical challenges can be overcome. The existing agents and environments built for cyber defence currently consider fewer variables and possibilities than the more famous RL agents for playing board games like Go or video games like Atari or DOTA2. This means there is ample potential for increasingly intelligent agents; ones that can manage a larger number of possible defensive actions and operate in more complex environments that require them to explore more situations. Our exploration of the technical challenges revealed that autonomous cyber defence is going to be a long-term ambition that can only be realised years into the future.

# data[].attributes.headline
How Big Is the Cyber Insurance Market? Can It Keep Growing?

# data[].attributes.subject
How Big Is the Cyber Insurance Market? Can It Keep Growing?

# data[].attributes.body
The cyber insurance market may be small, new, and volatile, but it could also become an important form of economic security. In fact, the Biden administration appears to be counting on that. Cybersecurity strategy could be improved with a better understanding of the basic characteristics of the cyber insurance market, particularly its size, the size of the cyber reinsurance market on which it depends, where future risk capital could come from, and at what price. Publicly available data on the size and reach of the cyber insurance and reinsurance, or re/insurance, market is thin and often dated. Views on how much premium is written or coverage is outstanding often have to be cobbled together from disparate sources, with subsequent projections built on a shaky foundation.

# data[].attributes.headline
You Can't Regulate What You Don't Understand

# data[].attributes.subject
You Can't Regulate What You Don't Understand

# data[].attributes.body
The world changed on November 30, 2022 as surely as it did on August 12, 1908 when the first Model T left the Ford assembly line. That was the date when OpenAI released ChatGPT, the day that AI emerged from research labs into an unsuspecting world. Within two months, ChatGPT had over a hundred million users—faster adoption than any technology in history.

The hand wringing soon began. Most notably, The Future of Life Institute published an open letter calling for an immediate pause in advanced AI research, asking: “Should we let machines flood our information channels with propaganda and untruth? Should we automate away all the jobs, including the fulfilling ones? Should we develop nonhuman minds that might eventually outnumber, outsmart, obsolete and replace us? Should we risk loss of control of our civilization?”

# data[].attributes.attachment_link.readable_text
The world changed on November 30, 2022 as surely as it did on August 12, 1908 when the first Model T left the Ford assembly line. That was the date when OpenAI released ChatGPT, the day that AI emerged from research labs into an unsuspecting world. Within two months, ChatGPT had over a hundred million users-faster adoption than any technology in history.

The hand wringing soon began. Most notably, The Future of Life Institute published an open letter calling for an immediate pause in advanced AI research, asking: "Should we let machines flood our information channels with propaganda and untruth? Should we automate away all the jobs, including the fulfilling ones? Should we develop nonhuman minds that might eventually outnumber, outsmart, obsolete and replace us? Should we risk loss of control of our civilization?"

In response, the Association for the Advancement of Artificial Intelligence published its own letter citing the many positive differences that AI is already making in our lives and noting existing efforts to improve AI safety and to understand its impacts. Indeed, there are important ongoing gatherings about AI regulation like the Partnership on AI's recent convening on Responsible Generative AI, which happened just this past week. The UK has already announced its intention to regulate AI, albeit with a light, "pro-innovation" touch. In the US, Senate Minority Leader Charles Schumer has announced plans to introduce " a framework that outlines a new regulatory regime " for AI. The EU is sure to follow, in the worst case leading to a patchwork of conflicting regulations.

All of these efforts reflect the general consensus that regulations should address issues like data privacy and ownership, bias and fairness, transparency, accountability, and standards. OpenAI's own AI safety and responsibility guidelines cite those same goals, but in addition call out what many people consider the central, most general question: how do we align AI-based decisions with human values? They write:

"AI systems are becoming a part of everyday life. The key is to ensure that these machines are aligned with human intentions and values."

But whose human values? Those of the benevolent idealists that most AI critics aspire to be? Those of a public company bound to put shareholder value ahead of customers, suppliers, and society as a whole? Those of criminals or rogue states bent on causing harm to others? Those of someone well meaning who, like Aladdin, expresses an ill-considered wish to an all-powerful AI genie?

There is no simple way to solve the alignment problem. But alignment will be impossible without robust institutions for disclosure and auditing. If we want prosocial outcomes, we need to design and report on the metrics that explicitly aim for those outcomes and measure the extent to which they have been achieved. That is a crucial first step, and we should take it immediately. These systems are still very much under human control. For now, at least, they do what they are told, and when the results don't match expectations, their training is quickly improved. What we need to know is what they are being told.

What should be disclosed? There is an important lesson for both companies and regulators in the rules by which corporations-which science-fiction writer Charlie Stross has memorably called " slow AIs"-are regulated. One way we hold companies accountable is by requiring them to share their financial results compliant with Generally Accepted Accounting Principles or the International Financial Reporting Standards. If every company had a different way of reporting its finances, it would be impossible to regulate them.

Today, we have dozens of organizations that publish AI principles, but they provide little detailed guidance. They all say things like "Maintain user privacy" and "Avoid unfair bias" but they don't say exactly under what circumstances companies gather facial images from surveillance cameras, and what they do if there is a disparity in accuracy by skin color. Today, when disclosures happen, they are haphazard and inconsistent, sometimes appearing in research papers, sometimes in earnings calls, and sometimes from whistleblowers. It is almost impossible to compare what is being done now with what was done in the past or what might be done in the future. Companies cite user privacy concerns, trade secrets, the complexity of the system, and various other reasons for limiting disclosures. Instead, they provide only general assurances about their commitment to safe and responsible AI. This is unacceptable.

Imagine, for a moment, if the standards that guide financial reporting simply said that companies must accurately reflect their true financial condition without specifying in detail what that reporting must cover and what "true financial condition" means. Instead, independent standards bodies such as the Financial Accounting Standards Board, which created and oversees GAAP, specify those things in excruciating detail. Regulatory agencies such as the Securities and Exchange Commission then require public companies to file reports according to GAAP, and auditing firms are hired to review and attest to the accuracy of those reports.

So too with AI safety. What we need is something equivalent to GAAP for AI and algorithmic systems more generally. Might we call it the Generally Accepted AI Principles? We need an independent standards body to oversee the standards, regulatory agencies equivalent to the SEC and ESMA to enforce them, and an ecosystem of auditors that is empowered to dig in and make sure that companies and their products are making accurate disclosures.

But if we are to create GAAP for AI, there is a lesson to be learned from the evolution of GAAP itself. The systems of accounting that we take for granted today and use to hold companies accountable were originally developed by medieval merchants for their own use. They were not imposed from without, but were adopted because they allowed merchants to track and manage their own trading ventures. They are universally used by businesses today for the same reason.

So, what better place to start with developing regulations for AI than with the management and control frameworks used by the companies that are developing and deploying advanced AI systems?

The creators of generative AI systems and Large Language Models already have tools for monitoring, modifying, and optimizing them. Techniques such as RLHF ("Reinforcement Learning from Human Feedback") are used to train models to avoid bias, hate speech, and other forms of bad behavior. The companies are collecting massive amounts of data on how people use these systems. And they are stress testing and " red teaming" them to uncover vulnerabilities. They are post-processing the output, building safety layers, and have begun to harden their systems against " adversarial prompting " and other attempts to subvert the controls they have put in place. But exactly how this stress testing, post processing, and hardening works-or doesn't-is mostly invisible to regulators.
Regulators should start by formalizing and requiring detailed disclosure about the measurement and control methods already used by those developing and operating advanced AI systems.
In the absence of operational detail from those who actually create and manage advanced AI systems, we run the risk that regulators and advocacy groups " hallucinate " much like Large Language Models do, and fill the gaps in their knowledge with seemingly plausible but impractical ideas.
Companies creating advanced AI should work together to formulate a comprehensive set of operating metrics that can be reported regularly and consistently to regulators and the public, as well as a process for updating those metrics as new best practices emerge.
What we need is an ongoing process by which the creators of AI models fully, regularly, and consistently disclose the metrics that they themselves use to manage and improve their services and to prohibit misuse. Then, as best practices are developed, we need regulators to formalize and require them, much as accounting regulations have formalized the tools that companies already used to manage, control, and improve their finances. It's not always comfortable to disclose your numbers, but mandated disclosures have proven to be a powerful tool for making sure that companies are actually following best practices.

It is in the interests of the companies developing advanced AI to disclose the methods by which they control AI and the metrics they use to measure success, and to work with their peers on standards for this disclosure. Like the regular financial reporting required of corporations, this reporting must be regular and consistent. But unlike financial disclosures, which are generally mandated only for publicly traded companies, we likely need AI disclosure requirements to apply to much smaller companies as well.

Disclosures should not be limited to the quarterly and annual reports required in finance. For example, AI safety researcher Heather Frase has argued that "a public ledger should be created to report incidents arising from large language models, similar to cyber security or consumer fraud reporting systems." There should also be dynamic information sharing such as is found in anti-spam systems.

It might also be worthwhile to enable testing by an outside lab to confirm that best practices are being met and what to do when they are not. One interesting historical parallel for product testing may be found in the certification of fire safety and electrical devices by an outside non-profit auditor, Underwriter's Laboratory. UL certification is not required, but it is widely adopted because it increases consumer trust.

This is not to say that there may not be regulatory imperatives for cutting-edge AI technologies that are outside the existing management frameworks for these systems. Some systems and use cases are riskier than others. National security considerations are a good example. Especially with small LLMs that can be run on a laptop, there is a risk of an irreversible and uncontrollable proliferation of technologies that are still poorly understood. This is what Jeff Bezos has referred to as a " one way door," a decision that, once made, is very hard to undo. One way decisions require far deeper consideration, and may require regulation from without that runs ahead of existing industry practices.

Furthermore, as Peter Norvig of the Stanford Institute for Human Centered AI noted in a review of a draft of this piece, "We think of 'Human-Centered AI' as having three spheres: the user (e.g., for a release-on-bail recommendation system, the user is the judge); the stakeholders (e.g., the accused and their family, plus the victim and family of past or potential future crime); the society at large (e.g. as affected by mass incarceration)."

Princeton computer science professor Arvind Narayanan has noted that these systemic harms to society that transcend the harms to individuals require a much longer term view and broader schemes of measurement than those typically carried out inside corporations. But despite the prognostications of groups such as the Future of Life Institute, which penned the AI Pause letter, it is usually difficult to anticipate these harms in advance. Would an "assembly line pause" in 1908 have led us to anticipate the massive social changes that 20th century industrial production was about to unleash on the world? Would such a pause have made us better or worse off?

Given the radical uncertainty about the progress and impact of AI, we are better served by mandating transparency and building institutions for enforcing accountability than we are in trying to head off every imagined particular harm.

We shouldn't wait to regulate these systems until they have run amok. But nor should regulators overreact to AI alarmism in the press. Regulations should first focus on disclosure of current monitoring and best practices. In that way, companies, regulators, and guardians of the public interest can learn together how these systems work, how best they can be managed, and what the systemic risks really might be.

# data[].attributes.attachment_link.title
You Can't Regulate What You Don't Understand

# data[].attributes.attachment_link.description
The world changed on November 30, 2022 as surely as it did on August 12, 1908 when the first Model T left the Ford assembly line. That was the date when OpenAI released ChatGPT, the day that AI emerged from research labs into an unsuspecting world.

# data[].attributes.headline
Don't let AI Wither on the Vine - Disruptive Competition Project

# data[].attributes.subject
Don't let AI Wither on the Vine - Disruptive Competition Project

# data[].attributes.body
Artificial intelligence (AI) has the potential to reshape society in a way not seen since the personal computer became widely available. But, as AI develops, so too do the calls for its regulation. Since its emergence, the technology has grown at a rapid pace and has begun to be applied to many aspects of society. As such, world leaders are callingfor the development and adoption of technical standards to keep AI “trustworthy” and “accountable.”

Governments across the globe are taking action. Leaders such as President Biden and UK Prime Minister Sunak are meeting with AI experts, civil society, the private sector, and each other to promote responsible innovation and advancement in artificial intelligence. The European Parliament recently passed a new draft law known as the A.I. Act, which would put new restrictions on AI via a risk-based approach, would be one of the first major laws to regulate artificial intelligence. DisCo has previously discussed the EU’s A.I. Act, and cautions that

Instead of hitting the brakes on AI innovation, EU policymakers should hit the accelerator on smart AI regulation…Putting a brake on research and innovation in AI will not only deprive society of all its benefits, but also jeopardise the development of many other technologies.

# data[].attributes.attachment_link.readable_text
Artificial intelligence (AI) has the potential to reshape society in a way not seen since the personal computer became widely available. But, as AI develops, so too do the calls for its regulation. Since its emergence, the technology has grown at a rapid pace and has begun to be applied to many aspects of society. As such, world leaders are calling for the development and adoption of technical standards to keep AI "trustworthy" and "accountable."

Governments across the globe are taking action. Leaders such as President Biden and UK Prime Minister Sunak are meeting with AI experts, civil society, the private sector, and each other to promote responsible innovation and advancement in artificial intelligence. The European Parliament recently passed a new draft law known as the A.I. Act, which would put new restrictions on AI via a risk-based approach, would be one of the first major laws to regulate artificial intelligence. DisCo has previously discussed the EU's A.I. Act, and cautions that

Instead of hitting the brakes on AI innovation, EU policymakers should hit the accelerator on smart AI regulation...Putting a brake on research and innovation in AI will not only deprive society of all its benefits, but also jeopardise the development of many other technologies.

In the past week alone, U.S. Congress members Ted Lieu, Anna Eshoo, and Ken Buck introduced a bill to direct the White House and Congress to create a National Artificial Intelligence Commission, and Senate Majority Leader Chuck Schumer recently elaborated upon his proposed " SAFE Innovation Framework" for AI. Moreover, the Biden-Harris Administration also announced new actions that will "further promote responsible American innovation in artificial intelligence (AI) and protect people's rights and safety."

CCIA President Matt Schruers noted the positive steps forward here in the U.S., stating

We appreciate members of Congress taking the lead and gathering information before writing regulations that could impact U.S. leadership in artificial intelligence.

However, Schruers additionally made clear that any eventual AI legislation must be a carefully considered flexible regulatory framework that can encourage innovation and competition while mitigating potential risks.

While governments across the globe are cautiously monitoring AI or already crafting regulations for it, people and businesses across all sectors are making leaps and bounds in AI applications, from AI chatbots, to integrations in Google Search and Microsoft Bing intended to increase search efficiency, to its use in detecting equipment condition to control wildfire risk. Academia is also putting AI to use, not just in research but also in teaching, where AI is attempting to help catch cheaters and even aid in teaching classes. AI has already become an integral part of our lives in fields such as healthcare or security and it is only being further incorporated into more aspects of society, these are just a few notable examples.

In the rapidly advancing landscape of artificial intelligence, responsible development and deployment are paramount. However, it is crucial to balance between regulation and flexibility, avoiding overly prescriptive principles that may stifle innovation. Rather than rushing to create new laws regulating AI, it is essential to evaluate whether existing laws adequately address the concerns posed by AI. The effective application of existing laws to deal with problems presented by artificial intelligence will provide the vast majority of appropriate AI regulation. DisCo has discussed both Section 230 and copyright law ( at home and abroad) with regards to artificial intelligence. The effective application of existing laws can serve to properly regulate AI. However, in the circumstances where existing law is not enough or there is the employment of a high-risk AI application, the principles of responsible AI should be considered in designing thoughtful, adaptable regulation that can be applied in all contexts:

1. Design for social benefit

2. Design to avoid unfair outcomes

3. Analyze and minimize risks as you design

4. Consider the risks to third parties from AI systems during design, but also the benefits

5. Use up-to-date safety, security, and privacy best practices

6. Monitor and govern identified risks in deployed systems

7. Provide appropriate disclosures for deployed AI systems

These principles, applied in the context of any given system, provide the flexibility to manage in AI applications while ensuring the benefits AI can deliver.

The U.S. must not cut off the streams of nutrients artificial intelligence needs to grow. To do so risks AI withering on the vine in the United States, jeopardizing the development of other technologies that rely on it and the U.S.'s leadership position in innovation. The United States has the opportunity to become a leader in AI but if we overregulate or inhibit innovation, we risk falling behind other countries pushing forward in this sector. AI will bring new challenges, but the benefits AI will bring are incredible, rivaling the changes that computers brought to the world. With smart regulation and governance, AI will lead to a more innovative and prosperous United States. Let's not kill off the plant that can provide us with food, oxygen, energy, and so much more.

# data[].attributes.attachment_link.title
Don't let AI Wither on the Vine - Disruptive Competition Project

# data[].attributes.attachment_link.description
Artificial intelligence (AI) has the potential to reshape society in a way not seen since the personal computer became widely available. But, as AI develops,

# data[].attributes.headline
Another huge US medical data breach confirmed after Fortra mass-hack

# data[].attributes.subject
Another huge US medical data breach confirmed after Fortra mass-hack

# data[].attributes.body
Hackers stole another half a million people’s personal and health information during a ransomware attack on a technology vendor earlier this year.

Intellihartx, a Tennessee-based company that handles patient payment balances and collections, said in a notice filed with the Maine attorney general’s office that 489,830 patients had information stolen in the cyberattack targeting its vendor, Fortra.

According to the notice, the hackers stole patient names, addresses, dates of birth and Social Security numbers. The breach also compromised patient medical billing and insurance information, as well as diagnoses and medication.

# data[].attributes.attachment_link.readable_text
Hackers stole another half a million people's personal and health information during a ransomware attack on a technology vendor earlier this year.

Intellihartx, a Tennessee-based company that handles patient payment balances and collections, said in a notice filed with the Maine attorney general's office that 489,830 patients had information stolen in the cyberattack targeting its vendor, Fortra.

According to the notice, the hackers stole patient names, addresses, dates of birth and Social Security numbers. The breach also compromised patient medical billing and insurance information, as well as diagnoses and medication.

Intellihartx is the latest company to come forward as a victim of the mass ransomware attack targeting Fortra's GoAnywhere file-transfer software, which organizations use for sharing large data sets across the internet. The Clop ransomware group claimed responsibility for mass-exploiting a previously undisclosed security flaw in Fortra's GoAnywhere software in February, which affected more than a hundred companies and organizations, including digital financier Hatch Bank, security giant Rubrik, and the City of Toronto.

Millions of patients across the United States also had their health information stolen in the cyberattack, including children's data.

The impact of Clop's ransomware attack prompted the U.S. Department of Health and Human Services to publish an alert warning that the ransomware group was targeting the healthcare industry.

Clop has targeted other vendors of file transfer tools, including Accellion's file transfer appliance and more recently, a mass-hack involving MOVEit, a file transfer tool developed by Progress Systems.

# data[].attributes.attachment_link.title
Another huge US medical data breach confirmed after Fortra mass-hack

# data[].attributes.attachment_link.description
More than a hundred organizations are affected by a mass-ransomware attack targeting Fortra's file transfer software.

# data[].attributes.body
Seit Dienstag ist Bexio Opfer eines DDoS-Angriffs. Dieser hält bis heute an und sorgt dafür, dass der Zugang zur Software für Kundinnen und Kunden des Unternehmens beeinträchtigt ist. Nicht betroffen sind Website, Lohnbuchhaltung und API.

Auch die Kundendaten scheinen nicht betroffen zu sein. "Ihre Daten sind weiterhin sicher", verspricht Bexio auf seiner Status-Seite und in einer E-Mail an die Kundschaft, welche inside-it.ch vorliegt. Man arbeite intensiv daran, den normalen Betrieb so schnell wie möglich wiederherzustellen.

# data[].attributes.attachment_link.description
Täglich kostenlose News, Trends, Nachrichten und Hintergründe aus der Schweizer und der internationalen Informatik. Für Anwenderunternehmen und Anbieter.

# data[].attributes.headline
Over 100,000 ChatGPT accounts stolen via info-stealing malware

# data[].attributes.subject
Over 100,000 ChatGPT accounts stolen via info-stealing malware

# data[].attributes.body
​More than 101,000 ChatGPT user accounts have been stolen by information-stealing malware over the past year, according to dark web marketplace data.

Cyberintelligence firm Group-IB reports having identified over a hundred thousand info-stealer logs on various underground websites containing ChatGPT accounts, with the peak observed in May 2023, when threat actors posted 26,800 new ChatGPT credential pairs.

# data[].attributes.attachment_link.readable_text
​More than 101,000 ChatGPT user accounts have been stolen by information-stealing malware over the past year, according to dark web marketplace data.

Cyberintelligence firm Group-IB reports having identified over a hundred thousand info-stealer logs on various underground websites containing ChatGPT accounts, with the peak observed in May 2023, when threat actors posted 26,800 new ChatGPT credential pairs.

Regarding the most targeted region, Asia-Pacific had almost 41,000 compromised accounts between June 2022 and May 2023, Europe had nearly 17,000, and North America ranked fifth with 4,700.

Victims distribution (Group-IB)

Information stealers are a malware category that targets account data stored on applications such as email clients, web browsers, instant messengers, gaming services, cryptocurrency wallets, and others.

These types of malware are known to steal credentials saved to web browsers by extracting them from the program's SQLite database and abusing the CryptProtectData function to reverse the encryption of the stored secrets.

These credentials, and other stolen data, are then packaged into archives, called logs, and sent back to the attackers' servers for retrieval.

ChatGPT accounts, alongside email accounts, credit card data, cryptocurrency wallet information, and other more traditionally targeted data types, signify the rising importance of AI-powered tools for users and businesses.

Because ChatGPT allows users to store conversations, accessing one's account might mean gaining insights into proprietary information, internal business strategies, personal communications, software code, and more.

"Many enterprises are integrating ChatGPT into their operational flow," comments Group-IB's Dmitry Shestakov.

"Employees enter classified correspondences or use the bot to optimize proprietary code. Given that ChatGPT's standard configuration retains all conversations, this could inadvertently offer a trove of sensitive intelligence to threat actors if they obtain account credentials."

It is due to these concerns that tech giants like Samsung have outright banned staff from using ChatGPT on work computers, going as far as threatening to terminate the employment of those who fail to follow the policy.

Group-IB's data indicates that the number of stolen ChatGPT logs has grown steadily over time, with almost 80% of all logs coming from the Raccoon stealer, followed by Vidar (13%) and Redline (7%).

Compromised ChatGPT accounts (Group-IB)

If you input sensitive data on ChatGPT, consider disabling the chat saving feature from the platform's settings menu or manually delete those conversations as soon as you are done using the tool.

However, it should be noted that many information stealers snap screenshots of the infected system or perform keylogging, so even if you do not save conversations to your ChatGPT account, the malware infection could still lead to a data leak.

Unfortunately, ChatGPT has already suffered a data breach where users saw other users' personal information and chat queries.

Therefore, those working with extremely sensitive information shouldn't trust inputting it on any cloud-based services, but only on secured locally-built and self-hosted tools.

Update 6/22 - An OpenAI spokesperson has sent BleepingComputer the following comment:

The findings from Group-IB's Threat Intelligence report is the result of commodity malware on people's devices and not an OpenAI breach.

We are currently investigating the accounts that have been exposed.

OpenAI maintains industry best practices for authenticating and authorizing users to services including ChatGPT, and we encourage our users to use strong passwords and install only verified and trusted software to personal computers.

# data[].attributes.attachment_link.title
Over 100,000 ChatGPT accounts stolen via info-stealing malware

# data[].attributes.attachment_link.description
More than 101,000 ChatGPT user accounts have been compromised by information stealers over the past year, according to dark web marketplace data.

# data[].attributes.headline
What every CEO should know about generative AI

# data[].attributes.subject
What every CEO should know about generative AI

# data[].attributes.body
Generative AI is evolving at record speed while CEOs are still learning the technology’s business value and risks. Here, we offer some of the generative AI essentials. Amid the excitement surrounding generative AI since the release of ChatGPT, Bard, Claude, Midjourney, and other content-creating tools, CEOs are understandably wondering: Is this tech hype, or a game-changing opportunity? And if it is the latter, what is the value to my business?

# data[].attributes.attachment_link.readable_text
Amid the excitement surrounding generative AI since the release of ChatGPT, Bard, Claude, Midjourney, and other content-creating tools, CEOs are understandably wondering: Is this tech hype, or a game-changing opportunity? And if it is the latter, what is the value to my business?

The public-facing version of ChatGPT reached 100 million users in just two months. It democratized AI in a manner not previously seen while becoming by far the fastest-growing app ever. Its out-of-the-box accessibility makes generative AI different from all AI that came before it. Users don't need a degree in machine learning to interact with or derive value from it; nearly anyone who can ask questions can use it. And, as with other breakthrough technologies such as the personal computer or iPhone, one generative AI platform can give rise to many applications for audiences of any age or education level and in any location with internet access.

All of this is possible because generative AI chatbots are powered by foundation models, which contain expansive neural networks trained on vast quantities of unstructured, unlabeled data in a variety of formats, such as text and audio. Foundation models can be used for a wide range of tasks. In contrast, previous generations of AI models were often "narrow," meaning they could perform just one task, such as predicting customer churn. One foundation model, for example, can create an executive summary for a 20,000-word technical report on quantum computing, draft a go-to-market strategy for a tree-trimming business, and provide five different recipes for the ten ingredients in someone's refrigerator. The downside to such versatility is that, for now, generative AI can sometimes provide less accurate results, placing renewed attention on AI risk management.

With proper guardrails in place, generative AI can not only unlock novel use cases for businesses but also speed up, scale, or otherwise improve existing ones. Imagine a customer sales call, for example. A specially trained AI model could suggest upselling opportunities to a salesperson, but until now those were usually based only on static customer data obtained before the start of the call, such as demographics and purchasing patterns. A generative AI tool might suggest upselling opportunities to the salesperson in real time based on the actual content of the conversation, drawing from internal customer data, external market trends, and social media influencer data. At the same time, generative AI could offer a first draft of a sales pitch for the salesperson to adapt and personalize.

The preceding example demonstrates the implications of the technology on one job role. But nearly every knowledge worker can likely benefit from teaming up with generative AI. In fact, while generative AI may eventually be used to automate some tasks, much of its value could derive from how software vendors embed the technology into everyday tools (for example, email or word-processing software) used by knowledge workers. Such upgraded tools could substantially increase productivity.

CEOs want to know if they should act now-and, if so, how to start. Some may see an opportunity to leapfrog the competition by reimagining how humans get work done with generative AI applications at their side. Others may want to exercise caution, experimenting with a few use cases and learning more before making any large investments. Companies will also have to assess whether they have the necessary technical expertise, technology and data architecture, operating model, and risk management processes that some of the more transformative implementations of generative AI will require.

The goal of this article is to help CEOs and their teams reflect on the value creation case for generative AI and how to start their journey. First, we offer a generative AI primer to help executives better understand the fast-evolving state of AI and the technical options available. The next section looks at how companies can participate in generative AI through four example cases targeted toward improving organizational effectiveness. These cases reflect what we are seeing among early adopters and shed light on the array of options across the technology, cost, and operating model requirements. Finally, we address the CEO's vital role in positioning an organization for success with generative AI.

Excitement around generative AI is palpable, and C-suite executives rightfully want to move ahead with thoughtful and intentional speed. We hope this article offers business leaders a balanced introduction into the promising world of generative AI.

Generative AI technology is advancing quickly (Exhibit 1). The release cycle, number of start-ups, and rapid integration into existing software applications are remarkable. In this section, we will discuss the breadth of generative AI applications and provide a brief explanation of the technology, including how it differs from traditional AI.

More than a chatbot

Generative AI can be used to automate, augment, and accelerate work. For the purposes of this article, we focus on ways generative AI can enhance work rather than on how it can replace the role of humans.

While text-generating chatbots such as ChatGPT have been receiving outsize attention, generative AI can enable capabilities across a broad range of content, including images, video, audio, and computer code. And it can perform several functions in organizations, including classifying, editing, summarizing, answering questions, and drafting new content. Each of these actions has the potential to create value by changing how work gets done at the activity level across business functions and workflows. Following are some examples.

Classify

A fraud-detection analyst can input transaction descriptions and customer documents into a generative AI tool and ask it to identify fraudulent transactions.

A customer-care manager can use generative AI to categorize audio files of customer calls based on caller satisfaction levels.

Edit

A copywriter can use generative AI to correct grammar and convert an article to match a client's brand voice.

A graphic designer can remove an outdated logo from an image.

Summarize

A production assistant can create a highlight video based on hours of event footage.

A business analyst can create a Venn diagram that summarizes key points from an executive's presentation.

Answer questions

Employees of a manufacturing company can ask a generative AI-based "virtual expert" technical questions about operating procedures.

A consumer can ask a chatbot questions about how to assemble a new piece of furniture.

Draft

A software developer can prompt generative AI to create entire lines of code or suggest ways to complete partial lines of existing code.

A marketing manager can use generative AI to draft various versions of campaign messaging.

As the technology evolves and matures, these kinds of generative AI can be increasingly integrated into enterprise workflows to automate tasks and directly perform specific actions (for example, automatically sending summary notes at the end of meetings). We already see tools emerging in this area.

How generative AI differs from other kinds of AI

As the name suggests, the primary way in which generative AI differs from previous forms of AI or analytics is that it can generate new content efficiently, often in "unstructured" forms (for example, written text or images) that aren't naturally represented in tables with rows and columns (see sidebar "Glossary" for a list of terms associated with generative AI).

The underlying model that enables generative AI to work is called a foundation model. Transformers are key components of foundation models-GPT actually stands for generative pre-trained transformer. A transformer is a type of artificial neural network that is trained using deep learning, a term that alludes to the many (deep) layers within neural networks. Deep learning has powered many of the recent advances in AI.

However, some characteristics set foundation models apart from previous generations of deep learning models. To start, they can be trained on extremely large and varied sets of unstructured data. For example, a type of foundation model called a large language model can be trained on vast amounts of text that is publicly available on the internet and covers many different topics. While other deep learning models can operate on sizable amounts of unstructured data, they are usually trained on a more specific data set. For example, a model might be trained on a specific set of images to enable it to recognize certain objects in photographs.

In fact, other deep learning models often can perform only one such task. They can, for example, either classify objects in a photo or perform another function such as making a prediction. In contrast, one foundation model can perform both of these functions and generate content as well. Foundation models amass these capabilities by learning patterns and relationships from the broad training data they ingest, which, for example, enables them to predict the next word in a sentence. That's how ChatGPT can answer questions about varied topics and how DALL·E 2 and Stable Diffusion can produce images based on a description.

Given the versatility of a foundation model, companies can use the same one to implement multiple business use cases, something rarely achieved using earlier deep learning models. A foundation model that has incorporated information about a company's products could potentially be used both for answering customers' questions and for supporting engineers in developing updated versions of the products. As a result, companies can stand up applications and realize their benefits much faster.

However, because of the way current foundation models work, they aren't naturally suited to all applications. For example, large language models can be prone to "hallucination," or answering questions with plausible but untrue assertions (see sidebar "Using generative AI responsibly"). Additionally, the underlying reasoning or sources for a response are not always provided. This means companies should be careful of integrating generative AI without human oversight in applications where errors can cause harm or where explainability is needed. Generative AI is also currently unsuited for directly analyzing large amounts of tabular data or solving advanced numerical-optimization problems. Researchers are working hard to address these limitations.

The emerging generative AI ecosystem

While foundation models serve as the "brain" of generative AI, an entire value chain is emerging to support the training and use of this technology (Exhibit 2). Specialized hardware provides the extensive compute power needed to train the models. Cloud platforms offer the ability to tap this hardware. MLOps and model hub providers offer the tools, technologies, and practices an organization needs to adapt a foundation model and deploy it within its end-user applications. Many companies are entering the market to offer applications built on top of foundation models that enable them to perform a specific task, such as helping a company's customers with service issues.

The first foundation models required high levels of investment to develop, given the substantial computational resources required to train them and the human effort required to refine them. As a result, they were developed primarily by a few tech giants, start-ups backed by significant investment, and some open-source research collectives (for example, BigScience). However, work is under way on both smaller models that can deliver effective results for some tasks and training that's more efficient. This could eventually open the market to more entrants. Some start-ups have already succeeded in developing their own models-for example, Cohere, Anthropic, and AI21 Labs build and train their own large language models.

CEOs should consider exploration of generative AI a must, not a maybe. Generative AI can create value in a wide range of use cases. The economics and technical requirements to start are not prohibitive, while the downside of inaction could be quickly falling behind competitors. Each CEO should work with the executive team to reflect on where and how to play. Some CEOs may decide that generative AI presents a transformative opportunity for their companies, offering a chance to reimagine everything from research and development to marketing and sales to customer operations. Others may choose to start small and scale later. Once the decision is made, there are technical pathways that AI experts can follow to execute the strategy, depending on the use case.

Much of the use (although not necessarily all of the value) from generative AI in an organization will come from workers employing features embedded in the software they already have. Email systems will provide an option to write the first drafts of messages. Productivity applications will create the first draft of a presentation based on a description. Financial software will generate a prose description of the notable features in a financial report. Customer-relationship-management systems will suggest ways to interact with customers. These features could accelerate the productivity of every knowledge worker.

But generative AI can also be more transformative in certain use cases. Following, we look at four examples of how companies in different industries are using generative AI today to reshape how work is done within their organization. The examples range from those requiring minimal resources to resource-intensive undertakings. (For a quick comparison of these examples and more technical detail, see Exhibit 3.)

Lessons CEOs can take away from these examples

The use cases outlined here offer powerful takeaways for CEOs as they embark on the generative AI journey:

Transformative use cases that offer practical benefits for jobs and the workplace already exist. Companies across sectors, from pharmaceuticals to banking to retail, are standing up a range of use cases to capture value creation potential. Organizations can start small or large, depending on their aspiration.

Costs of pursuing generative AI vary widely, depending on the use case and the data required for software, cloud infrastructure, technical expertise, and risk mitigation. Companies must take into account risk issues, regardless of use case, and some will require more resources than others.

While there is merit to getting started fast, building a basic business case first will help companies better navigate their generative AI journeys.

The CEO has a crucial role to play in catalyzing a company's focus on generative AI. In this closing section, we discuss strategies that CEOs will want to keep in mind as they begin their journey. Many of them echo the responses of senior executives to previous waves of new technology. However, generative AI presents its own challenges, including managing a technology moving at a speed not seen in previous technology transitions.

Organizing for generative AI

Many organizations began exploring the possibilities for traditional AI through siloed experiments. Generative AI requires a more deliberate and coordinated approach given its unique risk considerations and the ability of foundation models to underpin multiple use cases across an organization. For example, a model fine-tuned using proprietary material to reflect the enterprise's brand identity could be deployed across several use cases (for example, generating personalized marketing campaigns and product descriptions) and business functions, such as product development and marketing.

To that end, we recommend convening a cross-functional group of the company's leaders (for example, representing data science, engineering, legal, cybersecurity, marketing, design, and other business functions). Such a group can not only help identify and prioritize the highest-value use cases but also enable coordinated and safe implementation across the organization.

Reimagining end-to-end domains versus focusing on use cases

Generative AI is a powerful tool that can transform how organizations operate, with particular impact in certain business domains within the value chain (for example, marketing for a retailer or operations for a manufacturer). The ease of deploying generative AI can tempt organizations to apply it to sporadic use cases across the business. It is important to have a perspective on the family of use cases by domain that will have the most transformative potential across business functions. Organizations are reimagining the target state enabled by generative AI working in sync with other traditional AI applications, along with new ways of working that may not have been possible before.

Enabling a fully loaded technology stack

A modern data and tech stack is key to nearly any successful approach to generative AI. CEOs should look to their chief technology officers to determine whether the company has the required technical capabilities in terms of computing resources, data systems, tools, and access to models (open source via model hubs or commercial via APIs).

For example, the lifeblood of generative AI is fluid access to data honed for a specific business context or problem. Companies that have not yet found ways to effectively harmonize and provide ready access to their data will be unable to fine-tune generative AI to unlock more of its potentially transformative uses. Equally important is to design a scalable data architecture that includes data governance and security procedures. Depending on the use case, the existing computing and tooling infrastructure (which can be sourced via a cloud provider or set up in-house) might also need upgrading. A clear data and infrastructure strategy anchored on the business value and competitive advantage derived from generative AI will be critical.

Building a 'lighthouse'

CEOs will want to avoid getting stuck in the planning stages. New models and applications are being developed and released rapidly. GPT-4, for example, was released in March 2023, following the release of ChatGPT (GPT-3.5) in November 2022 and GPT-3 in 2020. In the world of business, time is of the essence, and the fast-paced nature of generative AI technology demands that companies move quickly to take advantage of it. There are a few ways executives can keep moving at a steady clip.

Although generative AI is still in the early days, it's important to showcase internally how it can affect a company's operating model, perhaps through a "lighthouse approach." For example, one way forward is building a "virtual expert" that enables frontline workers to tap proprietary sources of knowledge and offer the most relevant content to customers. This has the potential to increase productivity, create enthusiasm, and enable an organization to test generative AI internally before scaling to customer-facing applications.

As with other waves of technical innovation, there will be proof-of-concept fatigue and many examples of companies stuck in "pilot purgatory." But encouraging a proof of concept is still the best way to quickly test and refine a valuable business case before scaling to adjacent use cases. By focusing on early wins that deliver meaningful results, companies can build momentum and then scale out and up, leveraging the multipurpose nature of generative AI. This approach could enable companies to promote broader AI adoption and create the culture of innovation that is essential to maintaining a competitive edge. As outlined above, the cross-functional leadership team will want to make sure such proofs of concept are deliberate and coordinated.

Balancing risk and value creation

As our four detailed use cases demonstrate, business leaders must balance value creation opportunities with the risks involved in generative AI. According to our recent Global AI Survey, most organizations don't mitigate most of the risks associated with traditional AI, even though more than half of organizations have already adopted the technology. Generative AI brings renewed attention to many of these same risks, such as the potential to perpetuate bias hidden in training data, while presenting new ones, such as its propensity to hallucinate.

As a result, the cross-functional leadership team will want to not only establish overarching ethical principles and guidelines for generative AI use but also develop a thorough understanding of the risks presented by each potential use case. It will be important to look for initial use cases that both align with the organization's overall risk tolerance and have structures in place to mitigate consequential risk. For example, a retail organization might prioritize a use case that has slightly lower value but also lower risk-such as creating initial drafts of marketing content and other tasks that keep a human in the loop. At the same time, the company might set aside a higher-value, high-risk use case such as a tool that automatically drafts and sends hyperpersonalized marketing emails. Such risk-forward practices can enable organizations to establish the controls necessary to properly manage generative AI and maintain compliance.

CEOs and their teams will also want to stay current with the latest developments in generative AI regulation, including rules related to consumer data protection and intellectual property rights, to protect the company from liability issues. Countries may take varying approaches to regulation, as they often already do with AI and data. Organizations may need to adapt their working approach to calibrate process management, culture, and talent management in a way that ensures they can handle the rapidly evolving regulatory environment and risks of generative AI at scale.

Applying an ecosystem approach to partnerships

Business leaders should focus on building and maintaining a balanced set of alliances. A company's acquisitions and alliances strategy should continue to concentrate on building an ecosystem of partners tuned to different contexts and addressing what generative AI requires at all levels of the tech stack, while being careful to prevent vendor lock-in.

Partnering with the right companies can help accelerate execution. Organizations do not have to build out all applications or foundation models themselves. Instead, they can partner with generative AI vendors and experts to move more quickly. For instance, they can team up with model providers to customize models for a specific sector, or partner with infrastructure providers that offer support capabilities such as scalable cloud computing.

Companies can use the expertise of others and move quickly to take advantage of the latest generative AI technology. But generative AI models are just the tip of the spear: multiple additional elements are required for value creation.

Focusing on required talent and skills

To effectively apply generative AI for business value, companies need to build their technical capabilities and upskill their current workforce. This requires a concerted effort by leadership to identify the required capabilities based on the company's prioritized use cases, which will likely extend beyond technical roles to include a talent mix across engineering, data, design, risk, product, and other business functions.

As demonstrated in the use cases highlighted above, technical and talent needs vary widely depending on the nature of a given implementation-from using off-the-shelf solutions to building a foundation model from scratch. For example, to build a generative model, a company may need PhD-level machine learning experts; on the other hand, to develop generative AI tools using existing models and SaaS offerings, a data engineer and a software engineer may be sufficient to lead the effort.

In addition to hiring the right talent, companies will want to train and educate their existing workforces. Prompt-based conversational user interfaces can make generative AI applications easy to use. But users still need to optimize their prompts, understand the technology's limitations, and know where and when they can acceptably integrate the application into their workflows. Leadership should provide clear guidelines on the use of generative AI tools and offer ongoing education and training to keep employees apprised of their risks. Fostering a culture of self-driven research and experimentation can also encourage employees to innovate processes and products that effectively incorporate these tools.

Businesses have been pursuing AI ambitions for years, and many have realized new revenue streams, product improvements, and operational efficiencies. Much of the successes in these areas have stemmed from AI technologies that remain the best tool for a particular job, and businesses should continue scaling such efforts. However, generative AI represents another promising leap forward and a world of new possibilities. While the technology's operational and risk scaffolding is still being built, business leaders know they should embark on the generative AI journey. But where and how should they start? The answer will vary from company to company as well as within an organization. Some will start big; others may undertake smaller experiments. The best approach will depend on a company's aspiration and risk appetite. Whatever the ambition, the key is to get under way and learn by doing.

# data[].attributes.attachment_link.title
What every CEO should know about generative AI

# data[].attributes.attachment_link.description
Gen AI is evolving at record speed while CEOs are still learning the technology's business value and risks. Here, we offer some of the generative AI essentials.

# data[].attributes.headline
IBM quantum computer passes calculation milestone

# data[].attributes.subject
IBM quantum computer passes calculation milestone

# data[].attributes.body
‘Benchmark’ experiment suggests quantum computers could have useful real-world applications within two years.

# data[].attributes.body
Cryptography is a ubiquitous technique that supports secure, private communications. In the digital age, conventional cryptography relies on hard mathematical problems to encrypt data; these mathematical problems are infeasible to solve with current computers. However, the rise of quantum computers, which have enhanced computational capabilities, poses a threat to conventional techniques by offering a path to efficiently solve these hard problems and breach encryption. In response, the field of post-quantum cryptography (PQC) has emerged to research and develop new cryptographic approaches that will allow for the secure transfer of information in the wake of quantum computers.

Although quantum computing is still in its nascent stages and the scaled, commercial viability of error-corrected quantum computers likely will not be reached for some time, experts widely recommend that migration of classical cryptographic standards to PQC must be understood as a time-critical undertaking, requiring present-day action by major industries and organizations. In fact, cyberthreats to encrypted data (that can be decrypted using quantum tools in the future) are already a concern.

# data[].attributes.attachment_link.provider_name
Belfer Center for Science and International Affairs

# data[].attributes.attachment_link.description
Quantum computers pose a threat to conventional cryptography, putting our information and communication systems at risk. In an effort to sustain the privacy and integrity of our data ecosystems, researchers are turning to post-quantum cryptography (PQC). This publication describes how PQC works, and the governance, application, and public purpose considerations for implementing PQC.

# data[].attributes.headline
Solar activity is ramping up faster than scientists predicted. Does it mean an "internet apocalypse" is near?

# data[].attributes.subject
Solar activity is ramping up faster than scientists predicted. Does it mean an "internet apocalypse" is near?

# data[].attributes.body
Fears are brewing that an apocalypse is coming. But instead of burning buildings and utter chaos, there's a monthslong global internet blackout. The concern comes amid recent solar storm data that has emerged, but is the current activity on the sun really enough to cause what's been dubbed the "internet apocalypse?"

Videos have been making the rounds on social media claiming that this apocalypse is on its way. One video, which has amassed more than 4 million views on TikTok, claims that a solar storm could cause such an event to happen within the decade.

Despite the trending claims, such an event is thought to only occur once every half-millennium. Here's what's actually happening with the sun, and how it can impact communications on Earth.

# data[].attributes.attachment_link.title
Solar activity is ramping up faster than scientists predicted. Does it mean an “internet apocalypse” is near?

# data[].attributes.attachment_link.description
When a major solar storm hit in 1859, “telegraph systems worldwide went haywire.” Here’s what to know if such an event were to hit today – and how likely it is to happen.

# data[].attributes.headline
A Grid Collapse Would Make a Heat Wave Far Deadlier

# data[].attributes.subject
A Grid Collapse Would Make a Heat Wave Far Deadlier

# data[].attributes.body
CONSIDER THIS NIGHTMARE scenario. For four days now, temperatures have soared past 110 degrees. Those able to stay home are cranking their air-conditioning while officials scramble to move the unhoused into cooling centers. Even at night, the sweltering is relentless, thanks to the urban heat island effect: The concrete and brick of this metropolis absorbs the sun’s energy during the day and releases it throughout the evening.

# data[].attributes.attachment_link.readable_text
Climate change is making summers hotter, blackouts more common, and heat-related illness more dangerous. The power system may be resilient-but it still has vulnerabilities.

Consider this nightmare scenario. For four days now, temperatures have soared past 110 degrees. Those able to stay home are cranking their air-conditioning while officials scramble to move the unhoused into cooling centers. Even at night, the sweltering is relentless, thanks to the urban heat island effect: The concrete and brick of this metropolis absorbs the sun's energy during the day and releases it throughout the evening.

There is no relief, and then suddenly there's disaster: The grid fails, snatching away the AC that's staving off mass heat illness. If this scenario were to unfold across Phoenix, according to a recent paper, half of the city's 1.6 million people would need medical attention. More than 13,000 would die.

With climate change, then, won't living in a place like Phoenix get ever more precarious? After all, the hotter it gets, the more people have to run their AC, adding ever more stress to the grid. Well, there's a reason the United States hasn't seen such an extreme mass-mortality event: For all its faults, the electric grid is surprisingly resilient to heat emergencies.

And yet, heat is already a hidden disaster. Statistically, it causes more deaths each year than any other weather-related event-an estimated 12,000 per year in the US-but it doesn't get the headlines that hurricanes, floods, or tornadoes do. And beyond that mortality rate, extreme heat exacerbates underlying health problems, sends people to hospitals, stresses emergency medical transport, and hikes health care spending.

The risk of heat illness and death, like many health problems, falls hardest on those who can do the least to protect themselves. Lower-income neighborhoods are quantifiably hotter than richer areas, because they tend to have fewer trees that cool the landscape. And of course, lower-income households are less likely to have air-conditioning in the first place, meaning their residents are already more susceptible even before the power goes out.

When an urban heat wave rages for several days, and temperatures don't come down much at night, the body gets no time to recover. "These buildings are very dense: concrete materials push the heat into the residences and expose those folks to levels that it's not going to be easy to comfortably sleep," says Portland State University climate adaptation scientist Vivek Shandas, who studies the urban heat island effect. "It's not going to be easy for the body to really go into that deep rest state."

The good news is that the electrical grid is better able to withstand a heat wave than you might think. A hurricane or earthquake causes widespread destruction of the grid infrastructure, downing power lines or damaging power plants. Heat, by contrast, might overload some transformers, or force a power plant to reduce its energy generation to keep from overheating. But the grid as a whole remains intact.

"Those issues are real, and they do occur, but it's not widespread," says Jeff Dagle, chief electrical engineer at the Pacific Northwest National Laboratory, who studies the grid. "It's not like every time we have a heat wave, we have massive numbers of transformers that fail. It's a relatively small impact on the overall system that's designed with redundancy and resilience."

Still, those impacts are occurring more frequently. Earlier research by the multi-university 3HEAT Study that modeled the effect of a heat wave plus grid failure on Phoenix (and also Atlanta and Detroit) has found that the risk of urban blackouts lasting at least an hour and affecting at least 50,000 households increased by 151 percent between 2015 and 2021. "Blackouts that impacted more than a million people, of which there were about one a year, had an average duration of five days," says Brian Stone Jr., a professor and director of the Urban Climate Lab at the Georgia Institute of Technology, and principal investigator at 3HEAT. "Those are real events that happened, yet every one of those events was considered extremely low probability."

The challenge of a heat wave is that a grid has to constantly balance its supply of power and the demand for it. When the mercury rises, more people turn on their AC, and a grid operator has to increase generation. This demand typically reaches a peak in the late afternoon, as people return home from work and switch on their appliances. So when you hear about rolling blackouts, that's a consequence of supply not balancing with demand. But instead of the grid operator blacking out a whole city at once, power is cut to different neighborhoods at different times, reducing demand and stabilizing the system.

In the event of a power outage during a heat wave, officials in Phoenix work to get people into cooling centers, which have backup generators, says Brian Lee, director of emergency management for the city. The unhoused population might also need extra help, since they haven't been able to enjoy AC in the first place. "We can conduct our own outreach to those affected areas," says Lee. "And we can offer or extend additional support services to them until that power comes back online."

But short of Godzilla stomping across the Southwest, it'd be difficult to kick off a lengthy, widespread power outage in Phoenix. "The only thing that's plausible along those lines is if it's some sort of physical attack-sabotage or something like that-where the infrastructure is targeted," says Dagle. "While cyberattacks against any grid anywhere are possible, it is implausible, in my opinion, for a cyberattack to result in a multi-day outage."

An electrical utility like Arizona Public Service, which operates in Phoenix, can of course see heat waves coming with weather forecasts. "We plan for 117-degree temperatures," says Justin Joiner, vice president of resource management at APS. "When you hit 117 degrees, and it goes to 118 or 119, it's all the same at that point, because at 117 every AC unit is already on."

If APS isn't able to generate enough energy locally to meet increased demand, it can buy it from neighboring states. So if it's relatively cool in California, energy can flow into the southwest. Then if California starts roasting, and Arizona is cooler, energy can flow back west. (Texas tends to get in trouble when it's either too hot-like during the brutal heat wave it's experiencing right now -or too cold, because it runs its own isolated grid, so it can't import large amounts of power from other states.)

The complexity of drawing power from elsewhere becomes more challenging when the reason for the grid failure isn't mere demand, but damage-the kind that major weather can wreak. Parts of Florida were without power for a week last year following Hurricane Ian. A straight-line derecho in June 2012 took out power for 4 million people in 11 states and Washington, DC. And after Hurricane Katrina in 2005, areas in Louisiana were without power for a month, according to assessments by the Department of Homeland Security in 2017. To underline the cascading risks: Almost half of the prolonged outages studied by Stone and his colleagues occurred between May and September, when temperatures rise.

When blackouts take away air-conditioning-or trap heat in buildings that were never fitted with climate control, a factor in deadly heat waves in the UK and Europe-the occurrence of heat exhaustion and heat stroke spikes. And health care, especially emergency departments, detects them first. In the Pacific Northwest's record-breaking heat wave in 2021, ER visits increased 69 times over, and heat-related deaths among people over age 65 rose by half. Outages also pose a risk to people who rely on powered equipment such as oxygen concentrators and electric wheelchairs-and excess heat places a much greater burden on those with chronic illnesses such as cardiovascular disease, asthma, diabetes, and pulmonary insufficiency.

After New Orleans' Charity Hospital catastrophically lost power during Hurricane Katrina-because its backup generators were stashed in the basement, which flooded-the federal Center for Medicare and Medicaid Services created emergency preparedness rules that mandate uninterrupted power in critical parts of buildings: operating rooms, ICUs, and call centers, for instance. (Though not necessarily exam rooms. Or plumbing plants.)

"So on the one hand, hospitals might be an island of power and air-conditioning, able to cool water and make ice," says Jeremy Ackerman, an emergency physician and associate professor at Emory University School of Medicine. "But on the other hand, we're suddenly faced with an increased volume of patients, and that may mean we need to be using more IV fluids and other cooling measures."

Because hospitals are now more likely to stay cool, some jurisdictions have folded them into extreme-heat emergency plans. New York City, for instance, asks hospitals to allow unhoused people to rest in their waiting rooms during heat waves, even if they have no other medical need.

Ensuring that hospitals stay cool isn't the sole solution for the health stresses of extreme heat, though, because many other facilities, such as nursing homes, don't have the same back-up power rules. Extracting people from buildings that can't be cooled-whether that's a long-term care facility or a high-rise apartment with a nonfunctioning elevator-becomes a challenge for emergency medical transport. A further challenge: The things you need to cool people down-misters, cold blankets, chilled IV fluids-are impractical to transport in an ambulance.

So municipalities that have drafted extreme-heat plans, such as Phoenix and New York City, are looking at ways to get people out of hot places and into cold ones without taking them all the way into an ER's ambulance bay. "One of the lessons of the pandemic was that we need more flexibility in hospital design," says Craig Zimring, an emeritus professor of architecture at Georgia Tech and an expert in evidence-based design. "We'd want, as we did in the pandemic, to evaluate people before they get into the [emergency department]. That could be in tents in the parking lots, or closing off streets around the hospital, developing a portable infrastructure."

In extreme heat, though, even those cooling centers need advance consideration. Stone's team, for instance, found in 2022 that the number of cooling centers planned for Phoenix, Detroit, and Atlanta could care for no more than 2 percent of those cities' populations. And none of the municipalities required them to have back-up generators. (The city of Phoenix says its facilities are equipped with redundant or back-up power, and that its emergency operations plan can be scaled up to accommodate all affected community members if need be.)

People who've been dealing for a while with the public health impact of heat stress say that it's crucial to plan for this in advance-which means not just a week or so ahead when forecasters announce a heat wave is coming, but months or years ahead, as part of municipal and health care disaster planning. At the time of the Pacific Northwest heat wave, Seattle had no heat action plan that could be activated-for instance, to protect residents in neighborhoods likeliest to heat up, or to redirect ambulances to hospitals that were not already maxed out. A year later, it created an " extreme heat mitigation strategy " that coordinates the actions of government departments, EMS, hospitals, and nonprofit and volunteer organizations.

"There are specific things you can do in advance of a heat wave to prepare, and then there are things you do that are all-hazards preparedness, which make you more resilient," says Jeremy Hess, a professor of emergency medicine at the University of Washington who worked clinically during that heat wave and who researches the impact of climate change on health care. "Because when things fail, they often don't fail in quite the ways you expect."

Phoenix's APS, for its part, is confident it can provide enough energy to power all that AC during a heat wave, and it can import electricity if needed. "It's like an airplane-we have multiple redundancies for everything," Joiner says. Bits and pieces of it might fail at times, Joiner continues, but the whole thing is unlikely to crash. "So we can have a plant come offline, we can have a transmission line come off. But to take all of them off at once, we'd have to feel something from New Mexico all the way to California, and even north of us, for that to be something that was even in the realm of possibility."

# data[].attributes.attachment_link.title
A Grid Collapse Would Make a Heat Wave Far Deadlier

# data[].attributes.attachment_link.description
Climate change is making summers hotter, blackouts more common, and heat-related illness more dangerous. The power system may be resilient-but it still has vulnerabilities.

# data[].attributes.headline
How will AI change work? A look back at the 'productivity paradox' of the computer age shows it won't be so simple

# data[].attributes.subject
How will AI change work? A look back at the 'productivity paradox' of the computer age shows it won't be so simple

# data[].attributes.body
The explosion of interest in artificial intelligence has drawn attention not only to the astonishing capacity of algorithms to mimic humans but to the reality that these algorithms could displace many humans in their jobs. The economic and societal consequences could be nothing short of dramatic

The route to this economic transformation is through the workplace. A widely circulated Goldman Sachs study anticipates that about two-thirds of current occupations over the next decade could be affected and a quarter to a half of the work people do now could be taken over by an algorithm. Up to 300 million jobs worldwide could be affected. The consulting firm McKinsey released its own study predicting an AI-powered boost of $4.4 trillion to the global economy every year.

The implications of such gigantic numbers are sobering, but how reliable are these predictions?

# data[].attributes.attachment_link.readable_text
The explosion of interest in artificial intelligence has drawn attention not only to the astonishing capacity of algorithms to mimic humans but to the reality that these algorithms could displace many humans in their jobs. The economic and societal consequences could be nothing short of dramatic.

The route to this economic transformation is through the workplace. A widely circulated Goldman Sachs study anticipates that about two-thirds of current occupations over the next decade could be affected and a quarter to a half of the work people do now could be taken over by an algorithm. Up to 300 million jobs worldwide could be affected. The consulting firm McKinsey released its own study predicting an AI-powered boost of $4.4 trillion to the global economy every year.

The implications of such gigantic numbers are sobering, but how reliable are these predictions?

I lead a research program called Digital Planet that studies the impact of digital technologies on lives and livelihoods around the world and how this impact changes over time. A look at how previous waves of such digital technologies as personal computers and the internet affected workers offers some insight into AI's potential impact in the years to come. But if the history of the future of work is any guide, we should be prepared for some surprises.

The IT revolution and the productivity paradox

A key metric for tracking the consequences of technology on the economy is growth in worker productivity - defined as how much output of work an employee can generate per hour. This seemingly dry statistic matters to every working individual, because it ties directly to how much a worker can expect to earn for every hour of work. Said another way, higher productivity is expected to lead to higher wages.

Generative AI products are capable of producing written, graphic and audio content or software programs with minimal human involvement. Professions such as advertising, entertainment and creative and analytical work could be among the first to feel the effects. Individuals in those fields may worry that companies will use generative AI to do jobs they once did, but economists see great potential to boost productivity of the workforce as a whole.

The Goldman Sachs study predicts productivity will grow by 1.5% per year because of the adoption of generative AI alone, which would be nearly double the rate from 2010 and 2018. McKinsey is even more aggressive, saying this technology and other forms of automation will usher in the " next productivity frontier," pushing it as high as 3.3% a year by 2040.

That sort of productivity boost, which would approach rates of previous years, would be welcomed by both economists and, in theory, workers as well.

If we were to trace the 20th-century history of productivity growth in the U.S., it galloped along at about 3% annually from 1920 to 1970, lifting real wages and living standards. Interestingly, productivity growth slowed in the 1970s and 1980s, coinciding with the introduction of computers and early digital technologies. This " productivity paradox" was famously captured in a comment from MIT economist Bob Solow: You can see the computer age everywhere but in the productivity statistics.

Digital technology skeptics blamed "unproductive" time spent on social media or shopping and argued that earlier transformations, such as the introductions of electricity or the internal combustion engine, had a bigger role in fundamentally altering the nature of work. Techno-optimists disagreed; they argued that new digital technologies needed time to translate into productivity growth, because other complementary changes would need to evolve in parallel. Yet others worried that productivity measures were not adequate in capturing the value of computers.

For a while, it seemed that the optimists would be vindicated. In the second half of the 1990s, around the time the World Wide Web emerged, productivity growth in the U.S. doubled, from 1.5% per year in the first half of that decade to 3% in the second. Again, there were disagreements about what was really going on, further muddying the waters as to whether the paradox had been resolved. Some argued that, indeed, the investments in digital technologies were finally paying off, while an alternative view was that managerial and technological innovations in a few key industries were the main drivers.

Regardless of the explanation, just as mysteriously as it began, that late 1990s surge was short-lived. So despite massive corporate investment in computers and the internet - changes that transformed the workplace - how much the economy and workers' wages benefited from technology remained uncertain.

Early 2000s: New slump, new hype, new hopes

While the start of the 21st century coincided with the bursting of the so-called dot-com bubble, the year 2007 was marked by the arrival of another technology revolution: the Apple iPhone, which consumers bought by the millions and which companies deployed in countless ways. Yet labor productivity growth started stalling again in the mid-2000s, ticking up briefly in 2009 during the Great Recession, only to return to a slump from 2010 to 2019.

Throughout this new slump, techno-optimists were anticipating new winds of change. AI and automation were becoming all the rage and were expected to transform work and worker productivity. Beyond traditional industrial automation, drones and advanced robots, capital and talent were pouring into many would-be game-changing technologies, including autonomous vehicles, automated checkouts in grocery stores and even pizza-making robots. AI and automation were projected to push productivity growth above 2% annually in a decade, up from the 2010-2014 lows of 0.4%.

But before we could get there and gauge how these new technologies would ripple through the workplace, a new surprise hit: the COVID-19 pandemic.

The pandemic productivity push - then bust

Devastating as the pandemic was, worker productivity surged after it began in 2020; output per hour worked globally hit 4.9%, the highest recorded since data has been available.

Much of this steep rise was facilitated by technology: larger knowledge-intensive companies - inherently the more productive ones - switched to remote work, maintaining continuity through digital technologies such as videoconferencing and communications technologies such as Slack, and saving on commuting time and focusing on well-being.

While it was clear digital technologies helped boost productivity of knowledge workers, there was an accelerated shift to greater automation in many other sectors, as workers had to remain home for their own safety and comply with lockdowns. Companies in industries ranging from meat processing to operations in restaurants, retail and hospitality invested in automation, such as robots and automated order-processing and customer service, which helped boost their productivity.

But then there was yet another turn in the journey along the technology landscape.

The 2020-2021 surge in investments in the tech sector collapsed, as did the hype about autonomous vehicles and pizza-making robots. Other frothy promises, such as the metaverse's revolutionizing remote work or training, also seemed to fade into the background.

In parallel, with little warning, "generative AI" burst onto the scene, with an even more direct potential to enhance productivity while affecting jobs - at massive scale. The hype cycle around new technology restarted.

Looking ahead: Social factors on technology's arc

Given the number of plot twists thus far, what might we expect from here on out? Here are four issues for consideration.

First, the future of work is about more than just raw numbers of workers, the technical tools they use or the work they do; one should consider how AI affects factors such as workplace diversity and social inequities, which in turn have a profound impact on economic opportunity and workplace culture.

For example, while the broad shift toward remote work could help promote diversity with more flexible hiring, I see the increasing use of AI as likely to have the opposite effect. Black and Hispanic workers are overrepresented in the 30 occupations with the highest exposure to automation and underrepresented in the 30 occupations with the lowest exposure. While AI might help workers get more done in less time, and this increased productivity could increase wages of those employed, it could lead to a severe loss of wages for those whose jobs are displaced. A 2021 paper found that wage inequality tended to increase the most in countries in which companies already relied a lot on robots and that were quick to adopt the latest robotic technologies.

Second, as the post-COVID-19 workplace seeks a balance between in-person and remote working, the effects on productivity - and opinions on the subject - will remain uncertain and fluid. A 2022 study showed improved efficiencies for remote work as companies and employees grew more comfortable with work-from-home arrangements, but according to a separate 2023 study, managers and employees disagree about the impact: The former believe that remote working reduces productivity, while employees believe the opposite.

Third, society's reaction to the spread of generative AI could greatly affect its course and ultimate impact. Analyses suggest that generative AI can boost worker productivity on specific jobs - for example, one 2023 study found the staggered introduction of a generative AI-based conversational assistant increased productivity of customer service personnel by 14%. Yet there are already growing calls to consider generative AI's most severe risks and to take them seriously. On top of that, recognition of the astronomical computing and environmental costs of generative AI could limit its development and use.

Finally, given how wrong economists and other experts have been in the past, it is safe to say that many of today's predictions about AI technology's impact on work and worker productivity will prove to be wrong as well. Numbers such as 300 million jobs affected or $4.4 trillion annual boosts to the global economy are eye-catching, yet I think people tend to give them greater credibility than warranted.

Also, "jobs affected" does not mean jobs lost; it could mean jobs augmented or even a transition to new jobs. It is best to use the analyses, such as Goldman's or McKinsey's, to spark our imaginations about the plausible scenarios about the future of work and of workers. It's better, in my view, to then proactively brainstorm the many factors that could affect which one actually comes to pass, look for early warning signs and prepare accordingly.

The history of the future of work has been full of surprises; don't be shocked if tomorrow's technologies are equally confounding.
Learn what you need to know about artificial intelligence by signing up for our newsletter series of four emails delivered over the course of a week. You can read all our stories on generative AI at TheConversation.com. Bhaskar Chakravorti is Dean of Global Business, The Fletcher School, Tufts University. This article is republished from The Conversation under a Creative Commons license. Read the original article.

# data[].attributes.attachment_link.title
How will AI change work? A look back at the 'productivity paradox' of the computer age shows it won't be so simple

# data[].attributes.attachment_link.description
MIT economist Bob Solow famously said you can see the computer age everywhere but in the productivity statistics.

# data[].attributes.headline
The Last AI Boom Didn't Kill Jobs. Feel Better?

# data[].attributes.subject
The Last AI Boom Didn't Kill Jobs. Feel Better?

# data[].attributes.body
IF CHATGPT AND generative AI live up to even a tenth of the hype surrounding them, wide-scale job losses might seem inevitable. But new economic data shows that the last big leap in AI did not coincide with a reduction of jobs in affected industries—despite widespread fears of rapid replacement at the time.

# data[].attributes.attachment_link.readable_text
If ChatGPT and generative AI live up to even a tenth of the hype surrounding them, wide-scale job losses might seem inevitable. But new economic data shows that the last big leap in AI did not coincide with a reduction of jobs in affected industries-despite widespread fears of rapid replacement at the time.

In a new research paper, economists looked at the job market across a number of European countries between 2011 and 2019. That's the period during which the AI technique deep learning emerged as a powerful way to automate tasks like transcribing speech, analyzing images, and making algorithmic recommendations for social feeds and ecommerce sites. Back then, deep learning was widely expected to have a broad and swift impact on employment.

To check up on what really happened, researchers at the European Central Bank, Spain's central bank, and the universities of Oxford and Pittsburgh used two established methods for measuring how vulnerable professions are to AI-powered automation. Both involved examining the tasks workers do and how they compare with the capabilities of algorithms. The researchers cross-referenced that information with survey data on EU workers that shows the number of people leaving or joining different occupations in industries ranging from agriculture to financial services.

The headline result was that industries where AI could be the most useful did not see a reduction of jobs. In fact, for more highly skilled jobs vulnerable to AI, such as white-collar office work that involves working with data, there was around a 5 percent increase in the number of employed workers. The researchers say this supports the idea that new technology can increase demand for more skilled workers at the same time that it replaces those who do routine work. Less skilled workers didn't seem to be significantly affected by software or AI.

Although fears about new technologies taking jobs are common-and entirely understandable-economic research offers a complex, mixed picture. In general, many economists believe that automation can increase demand for jobs overall, as shown by some recent studies. If you are not one of those more skilled workers, however, the arrival of new technology might be a problem.

None of this research makes it possible to predict what effect ChatGPT or other generative AI technologies will have. They may be too new to cause noticeable changes. And it's possible that generative AI has an entirely different effect on jobs to what came before. "While in the period of our analysis the association is positive, these results may not be extrapolated into the future," the authors of the new study write.

Generative AI is undeniably already causing some disruption. You don't have to look far to find stories of individuals and businesses that are already being changed by the kind of AI behind ChatGPT.

Some copywriters, for instance, are having to find new careers after customers replaced them with generative AI tools. A number of publications are also experimenting with AI-generated content. The German tabloid Bild recently cited AI as one reason for planned job cuts.

But let's not forget that tools like ChatGPT are still unreliable coworkers, as they make up facts, reinforce biases, and can otherwise misbehave. And it's worth remembering that the emergence of deep learning in the 2010s prompted some AI experts to predict the elimination of certain jobs, including radiologists-a prognostication that has hardly come true.

# data[].attributes.attachment_link.title
The Last AI Boom Didn't Kill Jobs. Feel Better?

# data[].attributes.attachment_link.description
ChatGPT is stoking fears of mass layoffs, but a study of several EU countries found the deep-learning boom of the 2010s actually created job opportunities.

# data[].attributes.headline
Signal's Meredith Whittaker: 'These are the people who could actually pause AI if they wanted to'

# data[].attributes.subject
Signal's Meredith Whittaker: 'These are the people who could actually pause AI if they wanted to'

# data[].attributes.body
The president of the not-for-profit messaging app on how she believes existential warnings about AI allow big tech to entrench their power, and why the online safety bill may be unworkable.

# data[].attributes.attachment_link.readable_text
eredith Whittaker is the president of Signal - the not-for-profit secure messaging app. The service, along with WhatsApp and similar messaging platforms, is opposing the UK government's online safety bill which, among other things, seeks to scan users' messages for harmful content. Prior to Signal, Whittaker worked at Google, co-founded NYU's AI Now Institute and was an adviser to the Federal Trade Commission.

After 10 years at Google you organised the walkout over the company's attitude to sexual harassment accusations, after which in 2019 you were forced out. How did you feel about that?
Let me go back into some of the details, because there's a kind of broad story, and it matters for this moment. I was running a research group looking at the social implications of AI. I was pretty well known in the company and outside as somebody who discussed these issues in ways that were counter to Google's public messaging. I was an internal dissenter, an academic.

Toward late 2017 I had a colleague flag me that there was a secret contract [known as Maven] between Google and the Department of Defense [DOD] to build AI systems for drone targeting. That for me was when my organising started, because I realised I had been presenting very clear arguments that people agreed with ... but it didn't really matter. This was not an issue of force of argument. This was an issue of the ultimate goals of this company are profit and growth and DOD contracts were always going to sort of trump these intellectual and moral considerations.

So that was when you began organising a walkout?
What do you do if you don't have the power to change it, even if you win the debate? That was where the organising started for me. I wrote the Maven letter [which gathered 3,000 employee signatures] and we got the Maven contract cancelled.

The walkout was a big spectacle. There was a news story about Andy Rubin getting a $90m (£72m) payout after an accusation of sexual misconduct [which he denies]. What came to a head was deep concerns about the moral and ethical direction of Google's business practices and an understanding that those moral and ethical lapses were also reflected in the workplace culture.

How did I feel about that? I am very happy. I did not stand by and let my integrity get eaten away by making excuses for being complicit.

The minute it was announced that I was getting the FTC role, far-right news articles dropped

Would you say Google is pretty typical of big tech companies, that they're only really bothered about moral and ethical concerns if they affect their bottom line?
Ultimately every quarter the executives at Google meet the board and they need to be reporting up into the right projections on growth and revenue. Those are the key objectives of shareholder capitalism. If Sundar [Pichai, Google CEO] went to the board and said: "Morally we need to leave $10bn on the table. Let Microsoft have this contract," he'd be fired in an instant. It is not a form or a set of goals that is going to be amenable with putting the social good first.

Isn't there a business case for stamping out sexual harassment, and having a diverse workforce, and fixing biases in algorithms and so on?
There is no Cartesian window of neutrality that you can put an algorithm behind and be like, "This is outside our present and history." These algorithms are trained on data that reflects not the world, but the internet - which is worse, arguably. That is going to encode the historical and present-day histories of marginalisation, inequality etc. There isn't a way to get out of that and then be like, "This is a pristine, unbiased algorithm," because data is authored by people. It's always going to be a recycling of the past and then spitting that out, projecting that on to the present.

We can say there's a business case, but let's be real about it. If you're going to see a workforce transformed in the name of equality there are many powerful people who will have to lose their position, or their status, or their salary. We live in a world where people are misogynist and racist. Where there is behaviour from some that assumes women or non-white men shouldn't be in the room. They're making billions of dollars now. We can't leave this up to a business case, I think, is the argument I'm making.

So in 2020-21 when Timnit Gebru and Margaret Mitchell from Google's AI ethics unit were ousted after warning about the inequalities perpetuated by AI, did you feel, "Oh, here we go again"?
Timnit and her team were doing work that was showing the environmental and social harm potential of these large language models - which are the fuel of the AI hype at this moment. What you saw there was a very clear case of how much Google would tolerate in terms of people critiquing these systems. It didn't matter that the issues that she and her co-authors pointed out were extraordinarily valid and real. It was that Google was like: "Hey, we don't want to metabolise this right now."

Is it interesting to you how their warnings were received compared with the fears of existential risk expressed by ex-Google "godfather of AI" If you were to heed Timnit's warnings you would have to significantly change the business and the structure of these companies. If you heed Geoff's warnings, you sit around a table at Davos and feel scared.

Geoff's warnings are much more convenient, because they project everything into the far future so they leave the status quo untouched. And if the status quo is untouched you're going to see these companies and their systems further entrench their dominance such that it becomes impossible to regulate. This is not an inconvenient narrative at all.

After Google you were appointed senior advis er on AI at the Federal Trade Commission (FTC). Did you find the process of trying to regulate disillusioning?
I didn't come in with rose-coloured glasses. I had been speaking with folks in Congress, folks in the FTC and various federal agencies for years and at one point I testified in front of Congress. I wasn't new, I wasn't coming to DC with a suitcase and a dream, but it did give me a sense of how fierce the opposition was. I'll say the minute it was announced that I was getting the FTC role, far-right news articles dropped. The bat-signal went out.

Of course, I'm not the only one. Lina's office [Khan, FTC chair] was inundated with this. But within an agency where there's a vision, where there is an analysis that is not grounded in sci-fi but in an understanding of these systems and this industry, there was a huge amount of opposition. That was coming from tech lobbyists, that was coming from the Chamber of Commerce, that was coming from some folks within the FTC who would like to go get a nice little general counsel job at a firm and don't want their name on something that might be seen as anti-business. There was great vision there, but the machinery is difficult to operate under those conditions.

Unlike many other tech entrepreneurs and academics you didn't sign either of the two recent petitions, the Future of Life institute "pause AI" letter or last month's Center for AI Safety "existential threat" letter.
No. I don't think they're good faith. These are the people who could actually pause it if they wanted to. They could unplug the data centres. They could whistleblow. These are some of the most powerful people when it comes to having the levers to actually change this, so it's a bit like the president issuing a statement saying somebody needs to issue an executive order. It's disingenuous.

What appealed to you about taking the position at Signal?
I've been on their board for a number of years. Signal plays an important harm-reduction role in providing a mechanism for truly private communications in a world where in the past 30 years large corporations have made the decisions for us that all of our communications, our activity etc should be surveilled.

You've threatened to pull Signal from the UK if the online safety bill currently making its way through parliament is passed.
I'll repeat what I said, which wasn't quite the headline. We will never undermine our privacy promises. We will never adulterate our encryption, we will never participate in any regime that would enforce breaking those promises.

The bill proposes that users' messages are scanned "client side" - ie on the phone - and the messages would be encrypted when sent...
The claims being made around client-side scanning, that it can protect privacy while also conducting mass surveillance, is magical thinking. It is cynically weaponising a meaningless semantic distinction between mass surveillance that happens before encryption takes effect and breaking encryption. You have politicians out there saying: "This doesn't break encryption, don't worry." That is extraordinarily dishonest.

And moderation in other spheres doesn't work particularly well - software AI scanning messages and then difficult cases being referred to humans...
This system could never work without massive amounts of human intervention. What you're looking at is an unthinkably expensive system that would need constant human labour, constant updating. You're looking at hundreds of thousands of people being locked out of their accounts with no recourse, grinding people's daily lives, employment, and the economy. This is a fantasy made up by people who don't understand how these systems actually work, how expensive they are, and how fallible they are.

What is helping drive this, helping this seem plausible, is the AI hype. That is painting these systems as superhuman, as super capable, which leads to a sense in the public, and even among some politicians, that tech can do anything.

# data[].attributes.attachment_link.title
Signal's Meredith Whittaker: 'These are the people who could actually pause AI if they wanted to'

# data[].attributes.attachment_link.description
The president of the not-for-profit messaging app on how she believes existential warnings about AI allow big tech to entrench their power, and why the online safety bill may be unworkable

# data[].attributes.headline
Film mit KI erstellt: Unfassbare AI Video Tools!

# data[].attributes.subject
Film mit KI erstellt: Unfassbare AI Video Tools!

# data[].attributes.attachment_link.title
Film mit KI erstellt: Unfassbare AI Video Tools!

# data[].attributes.headline
China's Grand Strategy For Global Data Dominance

# data[].attributes.subject
China's Grand Strategy For Global Data Dominance