A four-thousand year old legal principle is critical to sorting out the increasingly messy and misunderstood interface between frontier AI and cyber security
I like the Hammurabi framing. It moves the question from "is AI safe?" to "who answers when it isn't", which is the only question a regulator can actually act on.
One addition from the UK end, and it bears on the question of likelihood: part of the machinery is already being assembled. The Cyber Security and Resilience Bill (CSRB) puts designated-critical-supplier duties on whoever operates systems customers depend on (24-hour initial notification, 72-hour full report), which is Hammurabi applied to the supply chain, MSPs included. And on 7 September the government committed (HCWS314) to consider whether protections for "increasingly autonomous AI systems" should be strengthened through the Cyber Assessment Framework, a statutory code of practice, or NCSC guidance, with the AI Security Institute supplying the evidence base. Notably, AI vendors were kept out of the CSRB's scope at Lords stage.
So the accountability vehicle exists. The open question is whether it arrives before agent autonomy outruns it.
The erosion of accountability from powerful organizations (governments, major corporations and industries...) has done the majority of harm in our lifetimes, and I look forward to some day soon having responsibility and power once again better balanced.
I like the Hammurabi framing. It moves the question from "is AI safe?" to "who answers when it isn't", which is the only question a regulator can actually act on.
One addition from the UK end, and it bears on the question of likelihood: part of the machinery is already being assembled. The Cyber Security and Resilience Bill (CSRB) puts designated-critical-supplier duties on whoever operates systems customers depend on (24-hour initial notification, 72-hour full report), which is Hammurabi applied to the supply chain, MSPs included. And on 7 September the government committed (HCWS314) to consider whether protections for "increasingly autonomous AI systems" should be strengthened through the Cyber Assessment Framework, a statutory code of practice, or NCSC guidance, with the AI Security Institute supplying the evidence base. Notably, AI vendors were kept out of the CSRB's scope at Lords stage.
So the accountability vehicle exists. The open question is whether it arrives before agent autonomy outruns it.
10/10, no notes.
The erosion of accountability from powerful organizations (governments, major corporations and industries...) has done the majority of harm in our lifetimes, and I look forward to some day soon having responsibility and power once again better balanced.
The split is the contribution hacker misuse is tractable, the loss of control framing is where labs project anxieties onto the security industry.
Don't mean to nitpick, AI couldn't want immunity. Although some might regard it as alive, it really isn't a living thing.
More accurately speaking, the humans behind AI or software, needs to be held accountable and responsible, not the organisations/firms/companies.
As we haven’t yet applied the principal of accountability to conventional software, is it at all likely that we shall do so to AI?