AI Abuse and Misuse

Suppose that when the electric motor was introduced all the media coverage had been about the potential for users to be electrocuted?  Suppose that when Ford popularized the automobile all the discussion had been about the highway death rate when it peaked in 1921 (24 deaths per 100M miles driven compared to 2 in 1991)?  That is what we see in artificial intelligence today.  Every Tesla self-driving accidents make news and are counted without any comparison to the rate of accidents of human drivers.  Indeed, the media coverage of AI abuse and misuse is out of proportion to that of its productivity.

That said, there are security implications that need to be addressed.  For example, the use of AI for "social engineering," what the rogues define as "the acquisition of special knowledge by means of wit and skill" and the rest of us call "fraud and deceit."  For decades we have been recognizing bait in part by its appeals to greed, lust, sloth, curiosity, and urgency, and by the errors in it made by the originators.  AI bots may craft the appeals and reduce the detectable errors.  Heavens, it may be used to create "disinformation," propaganda, and other lies.  

Recently one has seen news articles labeled as "produced by AI which can make errors," as though human reporters do not make errors, and as though AI cannot also detect and correct errors.  

Anthropics Mythos AI model has demonstrated the ability to identify software vulnerabilities, and even craft exploits for some of them.  Instead of focusing on and encouraging  the use of the model by developers to improve the quality and timeliness of their products, the coverage is on the use by the rogues to identify and exploit vulnerabilities and the potential for the developers to be overwhelmed by the early discovery of numbers of vulnerabilities.  The lesson should be that our current strategy of patching in quality late must be replaced by one of using AI tools to ensure quality early.  Given its efficiency in coding and testing, all code intended for use by people other than its author should be scrutinized using AI. 

The net is that the potential for the abuse and misuse of AI is dwarfed by its potential for use as intended.  Productivity is where our focus should begin.  

Go back to the electric motor and the internal combustion engine.  Any abuse or misuse was dwarfed, first by its economic disruption, and finally by our enrichment.  AI is different from the motors and engines; it can be applied to minimize its misuse and abuse, and its economic disruption while maximizing its potential for improving our health, increasing our wealth, and generally improving our lives.  Replace fear and anxiety with hope and ambition.  

One last thing, as the result of the motor and the engine, we passed, wage and hour laws, occupational health and safety laws, unemployment compensation, and social security.  As a result of these public policies we have a forty hour work week, a safer work place, vacations, and retirement.  These are things that only a productive and wealthy society can afford.  However, it took us fifty years, two world wars, and massive unemployment to adopt these enlightened policies.

Let us not make the same mistakes again.  Let's use enlightened public policy to ease the disruption.  Consider taxing capital, not labor, robots not people, and consumption rather than production.  Consider guaranteed income and training programs to ease the inevitable job rotation and skill obsolescence.  Consider shorter work weeks, longer vacations, and earlier retirement to create more but shorter jobs, and spread both the work and leisure more equitably.  

On Post Quantum Crypto

 "Nothing useful can be said about the security of a mechanism except in the context of a particular application and environment."  --Robert H. Courtney, Jr.  His First Law

Cryptographic mechanisms provide us with good examples.  The Data Encryption Standard (DES) asserted that the cheapest attack was an exhaustive attack against the key.  That remains as true today as it was fifty years ago.  While the cost of such an attack may be trivial today, it might still be inefficient for low value short lived data.  While generally disparaged and deprecated "Triple DES (3DES)" is sufficiently resistant to attack for most known applications and environments.  

Similarly, while Google asserts that, using Schorr's algorithm and a quantum computer, one might be able to solve for an Rivest Shamir Adelman (RSA) or an Elliptic Curve Crypto (ECC) private key in hours to days, rather than decades, this would still be inefficient for many applications and environments.  For example, while it might be efficient for decrypting a state secret with a life of three generations, it would not be efficient for surveillance of a large population.  Think of how many RSA and ECC key pairs we create for protecting Internet traffic each day.  

While we may need "post quantum crypto (PQC)" for some sensitive applications and  hostile environments, RSA and ECC will be adequate for many of the applications that we use them for today for as far into the future as we can see.