What keeps this FBI director up at night? China’s AI work, for one
Hacking the world with ML is Uncle Sam's job, buddy
China's AI development program poses a serious threat to America and other countries' national security, or so says FBI Director Christopher Wray.
Speaking on a World Economic Forum panel in Davos, Switzerland, about dual-use technology, Wray said he's "deeply concerned" about Beijing potentially boosting its army of malware developers and network intruders with next-gen machine-learning tools. In turn, China will be able to steal more blueprints and code from other nations, he said, and put all that ill-gotten knowledge to use.
"The Chinese government has a bigger hacking program than any other nation in the world, and their AI program is not constrained by the rule of law," Wray told his audience.
The Chinese government has a bigger hacking program than any other nation in the world and their AI program is not constrained by the rule of law
"It is built on top of the massive troves of intellectual property and sensitive data that they've stolen over the years and will be used — unless checked — to advance that same hacking program, to advance that same intellectual property theft, to advance the repression that occurs not just back home in mainland China but increasingly is a product that they export around the world."
The discussion turned to the dual-use nature of machine-learning technology: like nuclear know-how, it can be used constructively or destructively. Text-generating models can automatically generate code for useful applications, or pump out convincing text for millions of phishing emails.
"AI is a classic example of a technology where I have the same reaction every time," Wray said. "I think, 'Wow, we can do that.' And then, 'Oh god, they can do that.'"
The technology is again a double-edged sword in that AI can improve organizations' cyberdefenses, if the software can rapidly and accurately identify and act on malicious activity in network traffic. Or it can aid criminals in evading IT defenses while carrying out cyberattacks.
"So there is a degree to which the cat and mouse game that occurs in that realm, cyberdefense, cybersecurity, and cyber offense, are being critically permeated by the whole AI discussion," Wray said, adding that one of the FBI's top concerns in this area surrounds the aggregation of data that modern AI requires.
He pointed to autonomous vehicles as an example. There's the concern over the car itself being weaponized by miscreants remotely taking over critical systems or tricking sensors into failing and causing the car to accelerate through a stop sign.
There's also the potential for a different kind of harm in the data that the vehicle collects, Wray said. "Any time you aggregate lots and lots of sensitive data, it makes a very tempting target," he added.
- Russian criminals can't wait to hop over OpenAI's fence, use ChatGPT for evil
- AI-generated phishing emails just got much more convincing
- Cybercrooks are telling ChatGPT to create malicious code
- Homeland Security, CISA builds AI-based cybersecurity analytics sandbox
Cloudflare CEO Matthew Prince, who also spoke on the panel, had a slightly more optimistic take on the AI arms race.
'The challenge is the data'
"The challenge isn't the algorithms," Prince said. "The challenge is the data. And whoever has the most data wins the AI game. The thing that makes me optimistic in this space: there are more good guys than bad guys."
Information sharing has always been a hot topic in security: sharing threat intel with other organizations means everyone is better equipped to protect critical resources. It's essentially the rising tide lifts all ships theory.
Both Prince and Wray said that "good guys" are better at cooperating and sharing information than the bad guys, and this will help cyber defenders stay ahead of current and future AI-enabled threats.
"In a world where all these technologies are available to both the good guys and the bad guys, the good guys are constrained by the rule of law and international norms," Wray said. "The bad guys aren't, which you could argue gives them a competitive advantage."
While cyber criminals also work together to share (or sell) exploit information and the like, these relationships are transactional. "They'll turn on each other in a heartbeat if it suits them," Wray added. "The competitive advantage the good guys have…when we're all working together, then they're no match." ®