Policy Position Paper December 2024
Artificial Intelligence and Critical Infrastructure: The Advent of the Future Dr. Ratna Okhai
Summary
Background and Overview
Artificial Intelligence (AI) and its impacts on cybersecurity has been a growing concern around the world, as increasing reliance on technology to support our advancements has created a space for a race to be better no matter the cost. In the U.S., the Cybersecurity and Infrastructure Security Agency (CISA) has delineated processes to help guide how we prepare for, respond to and recover from these threats. This is the same in Florida, where we host critical infrastructures (CIs) that have the potential to be impacted (e.g., 21 military bases, 3 nuclear power plants, 67 counties’ buildings). However, we are still at a disadvantage when it comes to the why. Why do we need concentrated efforts to address this issue? The reasoning is simple: It has the potential to derail entire nations. More specifically, it can derail our critical infrastructures. Critical infrastructure is a gold mine for cyber-threats due to the inherent value of information it holds, therefore its innate vulnerability and potential to lead 1 to widespread harm and panic. (Figure 1 identifies full list of these CI’s). A comprehensive review of literature has highlighted the urgent need to develop guidelines that will protect from cyberattacks that are strengthened through AI. The State of Florida needs to leverage this extensive discussion surrounding this topic of AI and its impact on our critical infrastructure and follow suit of other states that have already proceeded with state-level legislation and regulations to better protect our critical infrastructure and citizens.
Critical infrastructure has three major components for consideration, as it relates to cybersecurity, and the future of AI. First, a large part of cybersecurity has been thus far focused on responding to and recovering from breaches. As AI seamlessly becomes an innate part of our existing technologies (e.g., cars, phones, internet searches), we must look to ensuring our policies and practices are proactive rather than reactive. A large part of this integration of AI in cybersecurity will be to understand how the hosting hardware systems operate, the vulnerabilities exposed, and how to minimize them. According to the National conference of State Legislatures, at least 40 states across the U.S. and Puerto Rico have already begun to address this issue, whether it’s through statesponsored agencies created for cybersecurity, passing of legislation, or even incentivizing research and education programs for our future generations. Second, smart cities are the future of the world, with increased connectivity, intelligence systems that can enhance efficiencies of how we run our communities, and machine learning capabilities that can promote better practices. However, these new age cities come with cybersecurity risks that are augmented with AI. For instance, with the number of remote workers increasing, we see an increased number of sensitive data more compromised. In December 2023, U.S. authorities intercepted an attempt by foreign actors to 1
1
Critical Infrastructure sectors as defined by CISA: Chemical, Commercial Facilities, Communications, Critical Manufacturing, Dams, Defense Industrial Base, Emergency Services, Energy, Financial Services, Food and Agriculture, Government Facilities, Healthcare and Public Health, Information Technology, Nuclear Reactors/Materials, Transportation Systems, Water/Wastewater.