Transcripts For CSPAN3 Hearing 20240702

This shift in the body politic, which we now need to address and i am in full agreement that we need to address it, dont mistake me here, but i think there is a corollary question of why. Why are we in this situation and is there something about our democracy that also needs to be addressed as part of this process . We believe is here but you can watch it in its entirety on our website, cspan. Org. Take you live now to capital hill where the House Committee is holding a hearing on how Artificial Intelligence can help defend and secure the u. S. Live coverage, here on cspan3. Cspan3 without objection, the chairman to claim in recess at any point. The purpose of this hearing is to receive test money from private sector stakeholders relating to the opportunities and challenges resented by the emergence of Artificial Intelligence and discuss how the a. I. Technologies in support of the Homeland Security mission. I now recognize myself for an opening statement. In this era of rapidly advancing technology, i am especially proud to live in a nation of innovators, some of whom join us today. Today, American Ingenuity is paving the way once again. Artificial intelligence, or a. I. , promises to transform the Global Economy as we know it. A. I. Has the potential to create new jobs, catalyze productivity in americans, and of course, protect our men and women in uniform and Law Enforcement. Throughout this congress, committees in both chambers have convened numerous hearings to understand the countless opportunities and challenges a. I. Presents. Like cybersecurity, a. I. s impact is a complex and crosscutting issue that cannot be handled by one jurisdiction alone. Therefore, we are here to examine what i believe to be the most promising areas of which to expand our use of a. I. , the security and defense of our homeland. The committee on Homeland Security has no obligation to make sure we harness it correct, as with any technology, it presents new risks and we must take the time to understand them. This includes prioritizing safety and security throughout a. I. Development. Deployment and use. It also requires us to treat a. I. With appropriate nuance so that we understand the impact of proposed regulatory measures on our businesses. Todays full Committee Hearing follows up on a productive cybersecurity and Infrastructure Protection subCommittee Hearing led by chairman last december. The subcommittee specifically considered the role of dhs and securing a. I. , a topic we will continue to explore today. As that hearing reaffirmed the threats facing our country or increasingly complex, and dhs plays a Critical Role in keeping americans safe at our country secure. Dhs has a Broad Mission and has explored and even implemented a. I. For specific purposes aligned with its unique missions. For example a u. S. Customs and Border Protection as used a. I. Powered systems to monitor monitor cameras, which help identify suspicious activity and unauthorized crossings in real time. The transportation and Security Administration is currently examining the ways in which a. I. Can enhance its security screening, including using a. I. To augment its xray imaging of travelers travelers carry on coverage. Powered by a. I. To identify security threats among the traveling public and enhance the prescreening process. With these a. I. Powered systems, while these a. I. Power systems offer the promise of increased security and efficiency, they also bring significant risk that Congress Must carefully assess. For instance, a. I. Powered facial recognition, which present substantial privacy concerns. We must ensure that the use of a. I. Powered facial recognition by tsa is balanced with strong protections of privacy, Civil Liberties and ethical standards. Furthermore, u. S. Immigrations and Customs Enforcement is using a. I. To help identify and track illegal activities such as Human Trafficking and smuggling. By analyzing large data sets and protecting patterns, in the cybersecurity and infrastructure and security is carefully examining the risks and opportunities presented by a. I. In the way can be leveraged to enhance our resilience against Cyber Threats. In the years ahead, it will play a Critical Role in addressing and managing risks at the nexus of a. I. , cybersecurity, and Critical Infrastructure. Considering the widespread push for a. I. Adoption within dhs, its critical that the department collaborate and with relevant stakeholders, including those from the private sector to manage a. I. s complexities and risks. In addition to domestic concerns relating to the emergence of a. I. , we must also consider the broader, strategic implications. Our nations primary strategic adversary, the peoples republic of china, has made a. I. Development a National Priority and is investing heavily in its research, talents, and infrastructure. Not only economically, but also in terms of our National Security. In fact, the 2024 threat assessment warns that developing, quote, malicious cyber actors have begun testing the capabilities of a. I. Develop malware, and a. I. Assistant Software Development. Technologies that have the potential to enable larger scale, faster, efficient, and more invasive Cyber Attacks against targets including pipelines, railways, and other infrastructure. This is extremely concerning, and as complex as these threats are, our efforts to combat them will be even more challenging if our adversaries development and innovation. For these reasons, it is important for congress, dhs, and the private sector to Work Together to ensure that we remain at the forefront of a. I. Innovation while safeguarding our National Security, economic competitiveness, and Civil Liberties. Today, we will hear from a panel of experts with insights and the steps that we can take to trust that a. I. , the a. I. We use, will be secure. To our witnesses, thank you for being here today for your efforts to educate members of this committee and the American People on how we can responsibly advance a. I. Innovation. I look forward to your testimony. I now recognize the Ranking Member, mr. Thompson for his opening statement. Thank you very much, mr. Chairman. Good morning to our witnesses. I would like to thank you for holding this important hearing on the intersection of Artificial Intelligence and Homeland Security. Artificial intelligence is not new. The department of Homeland Security and its components have a long history of trying to understand how to most appropriate leverage the capacity of a. I. Provides. The release of chatgpt in november of 2022 made clear that a. I. Has transformative potential and in accelerated efforts by the administration and congress to ensure the United States continued to lead the world on the responsible development in the use of a. I. Please consider to better secure the homeland, we must keep three critical principles in mind. First, we must ensure that a. I. Models be used in the data to train them do not reinforce existing biases. That requires that a. I. Used by the government be developed pursuant to specific policies designed to eliminate bias and is tested and retested to ensure it is not having that effect. Eliminating bias with a. I. Also requires a diverse a. I. Workforce. Comprised of people from a variety of backgrounds who can identify potential biases and prevent biases from being encoded into the models. Second, the government must rigorously assess appropriate use cases for a. I. And ensure that the deployment of a. I. Will not jeopardize the civil rights, Civil Liberties, or privacies of the product. Law enforcement and National Security agencies in particular must implement and exacting review of potential infringements on those fundamental democratic principles. Moreover, it is essential that the workforce be included in decisionmaking processes on how a. I. Will be deployed. The workforce is the is in the best position to understand capability gaps and where a. I. Can be affected. A. I. Is also, used to carry out their jobs more effectively. Its not, and should not ever be a replacement for people finally, the a. I. Tools we use must be secure. Admit exists, can be adopted to secure a. I. I commend the cybersecurity and infrastructure, Security Agency, commonly called for working with the private sector to ensure that the adoption of secure by Design Principles in the development of a. I. Moving forward, we must determine vulnerabilities unique to a. I. And Work Together to address them. I commend President Biden on last years executive order on a. I. Which put the government on the path to developing and deploying a. I. In a manner consistent with these principles. As dhs continues to assess how we use a. I. To carry out this mission said from cybersecurity to Disaster Response to aviation security, im confident that it will do so in a manner that incorporates feedback Civil Liberties and privacy. We cannot allow our optimism about the benefits of a. I. To shortcircuit as we evaluate this new technology. At the end of the day, Bad Technology is bad for security. As we consider the potential benefits a. I. s presenting for the mission, we must also consider the new threats it proposes. A. I. In the hands of our adversaries can jeopardize the security of federal and Critical Infrastructure networks, as well as the integrity of our elections. We know that china, russia, and iran have spent the past four years honing their abilities to influence our elections. So discord, among the american public, and undermine confidence in our election results. Advances in a. I. Will only make their job easier. So we must redouble our efforts to identify this content and empower the public to identify Malicious Foreign influence operations. I look forward to a robust conversation about how the department of Homeland Security can use a. I. Strategically to carry out its mission more effectively. I look forward to the witness testimony, mr. Chairman, i yield back the balance of my time. I want to thank the Ranking Member for his comments. A members of the committee, i want to remind you that Opening Statements may be submitted for the record. Im pleased to have a distinguished panel of witnesses before us today and i asked that our witnesses please stand and raise your right hand. Do you solemnly swear that the testimony you give before the committee on Homeland Security of the United States house of representatives will be the truth, the whole truth, and nothing but the truth, so help me god . Thank you, please be seated. I would now like to formally introduce our witnesses, mr. Troy demmer is the cofounder and chief product officer of gecko robotics, a company combining and a. I. Powered software to help ensure the reliability and sustainability of Critical Infrastructure. Today, the innovative climbing robots capture data from the real world that was never before assessed from pipeline, missile silos, and other critical asset types. Geckos a. I. Driven Software Platform enables human experts to contextualize the data and translated into operational improvements. Chief Technology Officer, Vice President of engineering. He has over 20 years of extremes working on high profile incidents and leading research and development teams, including at National Security agencies. Hes also an adjunct mr. Sikorski is also an adjunct at club university. Mr. Ajay amlani how do you pronounce your name, sir . Ajay amlani. Got it. Thank you. Currently serves as the president and head of the americans for iproov, a global provider of authentication proxies for online enrollment and verification. In addition, use well recognized identity as a strategic adviser for industry leaders, working in Artificial Intelligence, and ecommerce. The Deputy Director of the center of democracy and technology and surveillance project, prior to joining cdt, jake worked as senior counsel at the constitution project, the project on government oversight. He also previously served as a Program Fellow at the open Technology Institute and law clerk at the seneca subcommittee on technology and the law. Again, i think our witnesses for being here and i now recognize mr. Dummer for five minutes to summarize his opening statement. Good morning, chairman. Ranking member thomas thompson, and members of the committee. Thank you for the opportunity to join you today. My name is troy demmer and i am the cofounder of gecko robotics. That uses robots, software, and a. I. To change how we understand the health and integrity of physical infrastructure. Back in 2013, gecko started with a problem, the power plant where mike cofounder and i had to go to college to keep shutting down due to critical assets feeling. The problem was obvious in the first meeting. They had almost no data. The data that had been collected was collected very manually with the gauge reader and a single point. Sensor measurement. Furthermore, the data was often collected by workers working off of ropes at elevated heights or in confined spaces. Resulting in few measurement readings. That meant the powerpoint had to make power plant had to make reactive decisions rather than proactive. Using Rapid Technology technological advances to get better data and generate better outcomes. We use that armed with various sensor payloads that can gather 1000 times more data at 10 times the speed, compared to traditional methods. We also have a Software Platform that takes that data and combines it with other data sets to build a first order understanding of the health of Critical Infrastructure. Where are the vulnerabilities . What do we need to do to be proactive before fixing it, before the problem occurs . And how to prevent catastrophic disasters . Those are the problems gecko is solving today for some of the most Critical Infrastructure that protects the american way of life. We are helping and build the nextgeneration military equipment smarter. We are helping the u. S. Air force create a digital baseline for the largest Infrastructure Program since the eisenhower interstate highway project. And we are working with various other critical public and commercial Infrastructure Projects across the country. And every one of these cases, the missing link is the data and that brings us to the conversation we are having in todays hearing. A. I. Models are only as good as the inputs they are trained on. Trustworthy a. I. Requires trustworthy data inputs. Data inputs that are audible, interrogate will come a day inputs that provide a complete and undiluted answer to questions we are asking. When it comes to our Critical Infrastructure, infrastructure that powers the american way of life and protection of the homeland, though data inputs do not exist. Without better data, even the most sophisticated a. I. Models will be a best and effective, and at worst, harmful. If the way america collects data on infrastructure today hasnt fundamentally changed in 50 years, today, despite advances and Data Collection technologies like robots, drones, sensors, smart probes that can detect we are still largely gathering data manually, even on her most Critical Infrastructure like dams, pipelines, power plants, and more. To give you one more example, we have one who collects classes, both manually and with the robots. The manual process collected by handheld sensors and the robots on the same asset collect more than 1 million. That more than 2600 times the data, data that multiplies the power of a. I. Models, that is the scale and the difference between new technology and manual processes that still largely rely on critical info structure. Without better Data Collection, a. I. Will never meet his potential to that protects the homeland and the american way of life. As i conclude, i want to touch briefly on how we think about robotics and a. I. In the workforce. At gecko, we talk a lot about the workforce. Its a big priority for many of our partners. We responded by hiring a significant number of former, manual, and speculative workers and train them to operate our robots. More than 20 of our employees dont have a dangerous heights are now operating robots. Workers who built their careers inspecting assets are now helping our Software Developers build the tools to make that work better. Thank you again for the opportunity to join today and i look forward to your questions. Thank you, mr. Demmer. I now recognize mr. Sikorski for five minutes to summarize his opening statement. Chairman green, Ranking Member thompson, distinguished members of the committee. Take you for the opportunity to testify on Critical Role that Artificial Intelligence plays in enhancing Cyber Security defenses and security the homeland. My name is michael sikorsky and im the chief Technology Officer and Vice President of engineering, which is Threat Intelligence and Response Division of Palo Alto Networks. For those not familiar with Palo Alto Networks, we are an american headquartered Company Founded in 2005 that has since become the Global Leader. We support 95 of the fortune 100, the u. S. Federal government, Critical Infrastructure operators, and a wide range of state and local partners. This means that we have deep and broad visibility into the cyber Threat Landscape. We are committed to being trusted National Security partners with the federal government. As my written testimony outlines, a. I. Is central to realizing this commitment. We encourage everyone to embrace a. I. s Transformative Impact for Cyber Defense. A reality of todays Threat Landscape is that adversaries are growing increasingly sophisticated and a. I. Will further amplify this scale and speed of their attacks. However, this fact only heightens the importance of maximizing the substantial benefits that a. I. Offers for Cyber Defense. The a. I. Impact for Cyber Defense is already very significant. By leveraging precision a. I. , each day, Palo Alto Networks to text three 2. 3 million attacks that were not present the day before. This process of continuous discovery and analysis allows Threat Detection to stay ahead of the adversary, blocking 11. 3 billion total attacks each day and remediating cloud threats 20 times faster. The bottom line is that a. I. Makes security data actionable for cyber defenders. Giving them realtime visibility across their Digital Enterprises and the ability to prevent, detect, and respond to Cyber Attacks quickly. Accordingly, Palo Alto Networks firmly believes that to stop the bad guys from winning, we must aggressively leverage a. I. For Cyber Defense. My written testimony highlights a compelling use case of a. I. Powered cybersecurity that is showing notable results. Up leveling and modernizing the Security Operations center, also known as the s. O. C. This creates an inefficient game of walkable. While critical alerts are missed and vulnerabilities remain exposed. We have seen transformative results from customer use of a. I. Powered s. O. C. This includes the following, a reduction of time to respond from 2 to 3 days to under a five times increase in closeout rates and a four times increase in the amount of security data adjusted and analyze each day. Outcomes like these are necessary to stop threat actors before they can encrypt systems or steal sensitive information. And none of this would be possible without a. I. This new a. I. Infused world we live in also necessitates what we like to call secure a. I. By design. Organizations will need two, one, secure every step of the a. I. Application lifecycle and supply chain, two, protect a. I. Data from unauthorized access and leakage at all times and three oversee employee a. I. Usage to ensure with internal policies. These principles are aligned with and based on the Security Concepts already included within the a. I. Risk management framework and should be promoted for ecosystem wide benefit. Now the issues we are discussing today are important to me also on a personal level. Spent decades as both a cybersecurity partner both to stop threats and as an educator, training the Cyber Workforce of tomorrow. Is with that background that i can say confidently that Homeland Security, National Security, and Critical Infrastructure resilience are being enhanced by a. I. Have powered Cyber Defense as we speak, and we must keep the pedal to the metal because our adversaries are certainly not sitting on their hands. Thank you again for the opportunity to testify and i look forward to your questions and continuing this important conversation. Thank you i now recognize mr. Amlani for his five minutes of opening statement. Good morning, Ranking Member thompson and members of the committee. I have been building Innovative Solutions to help organizations for the last 20 years. I serve as president head of america. I started my federal services as a white house fellow to secretary tom ridge, the first secretary of Homeland Security in the aftermath of the 9 11 attacks. At a time in which the federal government was rethinking how to manage its natural security missions. A large part of that found new ways to benefit from the innovation happening in the private sector. The past 20 years, i have forge partnerships with the federal government and the commercial sector. That facilitate the utilization of commercial technology to augment National Security initiatives. Today, this committee is considering how to harness the power of a. I. As part of a multilayered defense against our adversaries. To best answer that question, we need to start with understanding how a. I. Enables threat actors. What capabilities can dhs and its component agencies develop to combat these threats . What actions can the department take to better work with industry as it promotes standards for a. I. Adoption . A. I. Exponentially increases the capabilities and the speed to deploy new fraud and Cyber Attacks on the homeland. They enable new threat and Technology Developers to dramatically shorten their cycles. Ultimately, add technologies are unique in a way that they upscale threat actors. The actors themselves no longer have to be sophisticated. A. I. Is democratizing the Threat Landscape by providing any aspiring cyber criminal easyto use, advanced tools, capable of achieving sophisticated outcomes. The crime as a service dark web is a very affordable. The only way to combat a. I. Based attacks is to harness the power of a. I. In our cybersecurity strategies. At iproov, we develop a. I. Powered Biometric Solutions to answer a fundamental question. How can we be sure of someones identity . Iproov is trusted by Financial Institutions globally by verifying that an individual is not only the right person, but also a real person. Our technology is monitoring and enhanced by an internal team of scientists, specializing in computer vision, deep learning, and other a. I. Focused technologies. Level attacks are identified, investigated, and triage in real time, and in Technology Enhancements are continuous. This combination of human experts is indispensable to harness a. I. In defending and securing the homeland. But equally important is the need for a. I. Based Security Technologies to be inclusive and uphold privacy mandates by design. Dhs and its component and accountability. Including performing routine self assessments and collecting public input on matters of Privacy Protection and limitations on data use. Those actions serve as a great model for how dhs and other agencies should treat kate a. I. Capabilities, both in regulating a. I. Adoption. The u. S. Government has used biometrics and a growing number of programs of the past few decades to with jen a. I. , biometrics take on an expanded role of helping to ensure that someone is who they claim to be in digital ecosystems. For example, defects and synthetic identities have recently become so realistic that they are in perceivable to the human eye. Because of this biometric verification plays a Critical Role in the security of the nation. Congress should support the creation of more useful standards for systems and testing. Give access to the best talent developing new Technology Tools with the agility necessary to respond to the changing Threat Landscape. The Silicon Valley Innovation Program is a very powerful model for both acquiring the expertise of the nations best engineering minds will also creating a collaborative testbed for providing new technologies. Iproov has worked with in all phases of the program and can testify firsthand to the powerful impact that this program could have if expanded to scale with a Broader Group of stakeholders. Another example could be expanded upon to incorporate a wider range of perspectives is Biometric Technologies work to address future threats. In conclusion, we at iproov are completely focused on pioneering capabilities, while collaborating with federal stakeholders. To advance innovation. We seek to play a constructive role in a. I. Practices and hope the committee will see us as a resource as you consider a path forward. Thank you. I look forward to your questions. Thank you, trainee. I now recognize mr. Laperruque to summarize his opening statement. Chairman green, Ranking Member thompson, and members of the House Committee. Thank you for inviting me to testify on the topic of Artificial Intelligence and how we can ensure that its use aids americas National Security, as well as our values as a democracy. I am jake laperruque, Deputy Director of the surveillance project at the center of technology. Cdt is a defense in the civil each. We worked for nearly three decades to ensure that Rapid Advances such as a. I. Promote our core values as a democratic society. A. I. Technology can only provide security if they are used in a responsible manner and as chairman green say, treated with appropriate nuance. This is not only critical for keeping america safe, its also necessary for protecting our Constitutional Values. Today, i would like to offer a set of principles for the responsible use of a. I. , as well as policy recommendations for National Security space. We must be wary that for a. I. Technologies, garbage in will lead to garbage out. Too often, a. I. Is treated as a sorcerers stone that can turn lead into gold. In reality, it only performs as well as the data that is given. Reckless deployment of a. I. Technologies, such as using input data that is lowquality well be on the balance of what any given system is designed to will yield bad results. In the National Security space, this can have dire consequences. Wasted resources. Triggering false alarms that leave genuine threats unattended to. Ensuring that a. I. Is used responsibly is also critical to protecting our values as a democracy. A. I. Is often framed as an arms race, especially in terms of National Security, but we must take care in what we are racing towards. Authoritarian regimes in china, russia, and iran have shown how a. I. Technologies such as facial recognition and throttle dissent, oppressive marginalize groups and supercharged surveillance. Truly winning the a. I. Arms race does not mean the fastest bullet on the broadest scale. It requires Civil Liberties. As ranking mirror thompson highlighted, responsible use requires exercising care for creation to input of data into a. I. Systems, to the use of the results from those systems. To facilitate responsible use, Government Applications of a. I. Should be centered on the following principles. A. I. Should be built upon proper Training Data it should be subject to independent testing. It should be deployed from the parameters for it was designed for. It should be used by specially trained staff and corroborated by human review. It should be subject to strong internal government speculations. Should be bound by safeguards to protect Constitutional Values and it should be regulated by institutional mechanisms for transparency and oversight. Although the degree of secrecy make upholding these principles especially challenging, we can and must find ways of promoting responsible use of a. I. Ct proposes two policies and furtherance of this goal. First, congress should establish an Oversight Board for the use of a. I. In National Security context. This will be a bipartisan, independent entity within the executive branch with members of staff giving access to all use of a. I. Within the National Security sphere. The board would act to promote responsible use of a. I. This would support both compliance as well as lead to improved practices. The boards role would also allow for Greater Public knowledge and engagement. This would serve as a conduit for harnessing outside expertise and Building Public trust in the governments ongoing use of a. I. The privacy and Civil Liberties board has demonstrated how effective this model can be. The boards role in counterterrorism oversight in a manner that aided both security and Civil Liberties alike. A new board focused on the use of a. I. In the National Security realm would be similarly beneficial. Second, congress should enact requirements for the use of a. I. This should include required declassification review of key documents such as a. I. It should also require annual public reporting and information such as the full set of a. I. Technologies, the number and the nature of that impact. While we support prompted option of these to be solved by a silver bullet. Promoting responsible use of a. I. Will require continual review, engagement, and adaptation. This work should be done in consultation for a broad set of stakeholders, impact communities, and experts. Thank you for time, and i look forward to your questions. Thank you, sir. Members will be recognized by order of seniority for the five minutes of questioning and an additional round of questioning may be called. After all members have been reckoned nice. I now recognize myself for five minutes of questioning. Mr. Amlani , in the evolution of a. I. , would you discuss your perception or opinion on whether or not you think, as the threat evolves, we are evolving ahead of the threat . Thank you, mr. Chairman for the question. This is a very important component of the work that we do at iproov. We have a Central Operation Center where we monitor all the threats happening globally. Singapore, uk, australia, latin america, and the United States and we are constantly using our human people there with phds to be of to assess the threats that are actually we are migrating and adapting our a. I. Technology to stay multiple steps ahead of the adversary and i think this is very critical as we look at a. I. Technology to build in and understanding what steps are having globally so we can continue to modify our systems. Thank you for that. Im glad to hear that. Makes everybody sigh a little bit of relief. I want to ship to the subject a little bit because we are talking about a. I. As a tool and as, you know, all the positives and the challenge of it when its on the attack side but i want to ask something about workforce. What do we need to do uniquely, and we really, i think this would be for you since, you know, your company employs a very large number of individuals in this fight. How do we need to be thinking about developing the workforce for a. I. , as well as cybersecurity itself . Thats a great question, congressman. Its super imperative, myself, ive trained cyber agents for the fbi at quantico, the department of energies, private companies, and that ive been teaching at the University Level for over a decade and firsthand ive seen that we really need to focus in as a. I. , cybersecurity, its here to stay and we really need to make strides to continue to push down, get people trained up , our work for us, our children, get them learning these concepts very early on. Its super important. And then from the Palo Alto Networks perspective, we are very invested in this, as well. So as far as the unit 42 team goes, we have what is called the unit 42 academy, which takes undergraduates, gives them internships, during the college years, handson training, and then they come to work with us as a class, like a cocourt, where they learn a lot of up leveling skills and their first year spent engaged in learning and growing and im proud to say that 80 of the unit 42 academy in the last year has been made up of women. Do me a favor and lets go just a little bit more granular on this question. What are the skills, specific skills that these individuals seem to have . What are we teaching them . I get, you know, the coding and all that stuff, but what specifically do you need to see in a candidate . That you would want to hire . So number one is having a background and understanding how to engage these technologies. We spent a lot of time Building Technologies over the last 10 or 20 years in the cybersecurity industry. So what they get access to and how they can leverage them to fight against, you know, evil thats coming into these networks. I also think about things like understanding of how forensics works, malware analysis, the ability to really dive deep into the Technical Details so that if they can dig out and sift through the noise, and then it also comes into play with a. I. Do they have an understanding of a. I. And how it is being leveraged in the product. One thing we deal with heavily is these analysts, inundated with too many alerts with all these products firing. So it opens up for them to dive deep into whats really there. Essentially, is now fighting the a. I. , basically. The machines are fighting the machines. Am i getting this right . I think to some extent, i think that there is definitely that kind of thing for sure but at the end of the day, the cyber analyst is being up leveled in their ability to fight back. Weve got some legislation coming out pretty soon on workforce development. I just want to make sure that the aips is captured in that. Thank you. My time has expired. I now organize the Ranking Member for his five minutes of questioning. Thank you, mr. Chairman. I want one of the things that weve become accustomed to is if we are feeling filling out selling online as we complete it, it wont figure out if you are a robot or if you are a human and so youve got to figure out now, is this a bus, is this a all of this are kind of trying to figure this out. So you gentlemen that are giving us some conflict that there are some things out here. Let me just give you half a hypothetical question. How you see the role of the government as a. I. Develops and what do we need to do to ensure the public that that development does not allow our adversaries to become even more then it is . We will start with mr. Demmer. I, thank you, mr. Ranking member, for the question. I agree that the country needs to Prioritize Building a. I. That is safe, with the executive order that, you know, where i stand is that we need to collect highly accurate data that ultimately informs these models and increasingly, what i think can be done is to help create testbeds for helping to validate those models and creating the Training Data sets that enable, you know, good a. I. To be created, leveraging only good data sets and so thats my position. I think one thing that i think of is my history in cybersecurity. We rushed as innovators to get the internet out and we didnt build while thinking about security and the spot we are in. Thats why its really important that we build a. I. And have it secure by design. Its one of these things where it falls into a few different categories, making sure that the a. I. We are building, was rushing to get the technology in their products and out to consumers but we need to think about it as we build it. For example, what is the Application Development lifecycle . What is the supply chain of that being built, and is that secure . Thinking about these things as they are running in real time, are we protecting those applications so that they dont get manipulated . How about the models we are building, how about the data . Is that, you know, subject to manipulation . How are we modeling monitoring it . And how are we monitoring our employees without who are using this today . Those are our areas of focus. In addition, when building the internet, identity was on a layer that was ever thought about. The challenge that you just described about the changes, the buses, i just encountered seaplanes versus normal planes. Its very difficult to decipher whats the difference, in terms of the captcha thats what its called. I think we need to constantly test all the tools to make sure that they are inclusive in making sure that they are accurate. Standards are another important component here that comes at a testing but its also very focused on leveraging and organizations like this, continue to invest in organizations like this. Talent organization and much of that resides in the private sector. And partnerships with private Sector Companies and we survey the top engineering schools about where they wanted to work after graduating and there was no Government Agency other than nasa on that whole list. There was no defense or Government Contractor on that whole list. Other than spacex and as we start to think about this, and we actually get access to the top engineers across society and its actually through partnerships with commercial thank you. Yeah, i would echo several things of whats been said already. We need welltrained system, we need high standards to make sure that we are using good systems. We need proper data inputs be going into these a. I. Systems and proper treatment of whats going out. I would also emphasize that meeting our adversaries in this field make sure we do not end up imitating adversaries. Right now, facial recognition is an example of being harped on thats used in a freighting way in regimes like china, russia, iran. Right now, federally, we do not have any regulations and although the cases are limited, there are document cases of it being used against Peaceful Protesters in the United States. Thats the type of standard we should be prohibiting. Thank you very much. Maybe i will submit, for the record, we have elections coming up in november. The last time there was some involvement by russia, china, specifically, with our elections, are you in a position to say, whether or not we are robust enough to defend against our adversaries for elections or for you to encourage us to be a little more attentive in any aspect of our elections . Thats a great question. I think that certainly, generative a. I. Makes it easier for malicious actors to actually come after us in that way, weve actually already seen them in the cyber arena, start to build more efficient phishing emails, so things like typos, grammar mistakes, all the kind stuff, thats a thing of the past. That will be something that we encounter anymore. And in other words, there wont be any more typos. Right. And they can also read someones inbox and talk like that individual. They can leverage it in that way. I do think that sisa, we are a member of the j cdc and they are taking election securities, thats a big priority for them and so, we are assisting in those ways i think that its definitely super concerning and something that we need to lean into with the election cycle coming up. Anyone else want to address that . Thats a good question. I will let the gentlemens time continue if anyone else wants to answer. I think from act and identity perspective this is also very important in regards to who it is that is actually posting online and being able to discuss so from an identity perspective, making sure that its the right person, its a real person that sexy posting and communicating and making sure that person is, in fact, right there at that time is a very important component to make sure that we know who it is that actually generating content online. There is no identity layer to the internet currently today. We have a lot of work thats being done on Digital Credentials here in the United States, our country is one of the only in the western world that doesnt have a Digital Identity strategy. We have some work that the flea been done in section 4. 5 but it hasnt really been expanded upon and i think that some work that we should think about encountering and doing. If i may, you know, i have some questions on that, too, that i might submit in writing because this digital identification thing is, you know, its banking and all that goes on the phone its, these digital idea, its critical. So, you know, thank you Ranking Member. I now recognize mr. Higgins, gentleman from louisiana for his five minutes of questioning thank you, mr. Chairman, chairman, i worked extensively with my colleagues in the household House Oversight Committee Regarding Artificial Intelligence and not necessarily opposed to the emerging technology, even if i opposing the income and tied to the ocean. Its happening. I think its important that congress provides a framework so that a. I. Can not be leveraged in any manner that is contrary to americans individual rights and liberties. I introduced the automated governments attack, the tat act to set limits as a whole. The bill seeks to ensure federal agencies notify individuals when they are interacting with were subject to decisions made using a. I. Or other Automated Systems and directs federal agencies to establish a human review of appeal process to ensure to ensure that human beings have supervision of a. I. Generated decisions that can impact the lives of americans and specifically our freedoms so i have concerns about this technology but we may as well embrace it. I think its crucial that america lead in the emergence of a. I. Technologies and how it interfaces with our daily lives. And may i say, we can have hours and hours of discussion about this, but i have five minutes. So, im going to ask you gentlemen, regarding the use of a. I. As it could contribute towards more effective counterintelligence or criminal investigations, as those criminal investigations and counterintelligence efforts really to Homeland Security, trying to focus in on this committee, our committee here and our responsibilities here. What are your thoughts, gentleman, on how we can best deploy a. I. With our existing Law Enforcement endeavors, for Border Security and criminal investigations that result from our effort to secure and resecure our border. Mr. Sikorski, i like to start with you. That the great question. One thing i look towards is the way we are already leveraging a. I. For Cyber Defenses. As i spoke about in my statement , we have been taking really large amounts of data and distilling it into very few actionable items. You say taking large amount of data. Where you getting that data from . So for us, as a Cybersecurity Company, we are focused on processing security data, which means ones and zeros, the malware thats found on the systems, the vulnerability and enumerations of the systems, lowlevel operating system information that enables us to like tease out what is the actual threat, which is very distinct. So you are drawing on raw data from open sources and like how are you, are you accessing the raw data that you are analyzing . Thats a great question. Some of the data we are getting is from you know, the customer collection that we have in our products that are spread throughout the world. From the fortune 100, you said, the company that works with 95 of the top 100. Thats right. Okay, so those companies have agreements with their users, thats the part we dont read. As it comes up on your phone you renew the agreement and nobody reads it, we go to the bottom and we click yes. So when the 95 companies have agreed to share that data, you are sharing that to analyze a. I. For the purposes of, what . Yeah, in order to find new attacks, so one of the things we are doing is its firewall data, Network Level telemetry, its very different than, you know, say, personal information or Something Like that. Instead, we are focused on the lower level data, bring it together, and leveraging a. I. To say how is that Network Attack related to whats happening on the actual computer, bring that together quickly so that the analyst can find the threat and a limited very quickly. Your specifically referring to cybersecurity, but chairman, mike time has expired. Thank you for convening this hearing. Its very important. Absolutely. I now recognize mr. Carter. Thank you, thank you. I now recognize mr. Carter, the gentleman from louisiana. Thank you, mr. Chairman. Thank you for everyone joining today. Ai technology and its demands for use possesses significant challenges spread we must leverage ai to improve our National Security. Please support hr 8388 the Task Force Act which proposes the creation of a dedicated task force that focuses on safety, security, and accountability challenges posed by ai. It is crucial for the American People as we work to tackle these pressing issues. Ai is not new. We know that. It is relatively new to the general public. Some of its applications have enormous value. Some of them can be quite frightening. National security, obviously, is major. I would like to ask each of you to take a crack at answering the questions relative to civil rights, Civil Liberties in general for the American People. How is this contemplated as we develop further, delving into ai . Mr. Damer . I for to my fellow witnesses on this issue. It is complicated. We are focused on Building Data sets in a way that promotes National Security. Im a cybersecurity practitioner so im not i dont know all the ins and outs of policy itself but my sense is that when we think about ai and regulation, we have to think about the purpose. So defining what is high risk and saying, you know, what are the ai use cases that are high risk and focusing on the unique security requirements for it. On the cybersecurity site, the security data, the ones and zeros i talked about earlier, they are not high risk compared to other technologies being rolled out. At iproov, we work with every independent Assessment Organization out there. We are urging to stay ahead of the technology. Many times, these organizations focus on threats or challenges in the past. We need to stay up to speed and above and go beyond. We build inclusivity by Design Project that includes skin tone, but also cognitive and physical capabilities, making sure those are taken into consideration. Socioeconomic class. Many tools are expensive to obtain. I got the iphone 15 pro and i can attest to that. Age is also a very important component, as well as ginger, so making sure that all of those characteristics are embedded into the design. Ai is an important component of success. There is a range in some systems, for example, Damage Assessment systems that dhs uses may not pose a risk to civil rights and liberties. Other technologies like face recognition are automated targeting systems present significant risks to civil rights and Civil Liberties. It puts a good stress on care for civil rights and Civil Liberties. We hope thats a good step towards development. This is an area where oversight is essential to evaluating the effectiveness of those roles, evaluating whether more steps are needed and, as necessary, prompting congress to step in and make their own rules. With face recognition, there are no federal regulations for Law Enforcement to use. I think that needs to change. The information out is only as good as the information in. The data becomes paramount. How do we take into account cultural nuances, natural biases, so we are not replicating biases that humans have, and then become part of the bias that is in ai . We operate in singapore and many african countries, as well as latin american countries. We take consideration to make sure we see the threats coming in but also look at the data and make sure we have a representative database that we train on. We go over and above when it comes to make sure that our Training Data is representative of the overall population. I would encourage you to be able to include standards to invest in those to make sure other providers are doing the same. From our standpoint, as you have heard from the questions here that you continue to hear that congress has concern on making sure that we learn from the mistakes may not be the right word, but we learn from how fast the internet came, facebook, instagram, and all of those things, and they are constantly bringing about new challenges. The good, the bad, and the ugly. Had we learn from that to make sure that we are managing this ai as it unfolds and becomes more prevalent in our society . I realize that my time has expired. Mr. Chairman, if you allow them to answer that, i will yield. Despite the gentleman can ask the question. Sure. That is directed at me, i assume. Or anyone else that cares to take a crack at it. Is staying on top of all of the different technologies is very important, making sure that we have independent organizations within the federal government that can have Different Companies submit their ai to testing, making sure that we have the right people staffed within those organizations who can stay on top of all the latest opportunities and threats in the market. Yes. There is a lot of interest that this overall industry has in making sure that it is well represented databases and common standards that we can all adhere to. But i think that making sure those Accurate Solutions can be in front of customers for biometric verification is also an important component. Biometric verification is also something that is different than biometric recognition. I want to make sure that we can call out the differences between the two. The gentlemans time has expired. The chair has been flexible and generous with time, but i asked the members to watch the clock. The gentleman from mississippi is recognized. Thank you, mr. Chair. I want to thank all of our guests for joining us today. After seeing the incredible growth of ai, we know the growth ai can be used to analyze data. We know they have offensive and defensive technologies. The technology can be used for good and evil. As we drill down today on Homeland Security, and looking at the role that ai is playing in Homeland Security, i think it is easy for many of us to see the role that ai plays in cybersecurity, and we have heard testimony about the offensive and defensive capabilities of ai in the cyber world. But i want to talk a little bit about the role that ai made play in securing our physical borders. One of the things this committee has been focused on is securing our southwest border. There were 3. 2 million encounters on the southwest corner, a Record Number of encounters. We are on track to break that this year. We know from the secretary of state and the secretary of Homeland Security he reported that 85 of those individuals encountered are at some point released into the interior. And so my question is, how can we use ai to better identify the individuals that are being encountered . I have a great fear that we are not identifying and properly vetting those individuals before they were released into the interior. Ill start with you, mr. Amlani. You talk about biometrics and the use of biometrics and the things that yall are doing. So i would ask first if you could start off and if anyone else would like to join in, how can we within the department of Homeland Security better use ai to identify the numerous individuals that we are encountering on a daily basis along the southwest border so that we are not allowing people into the country that would cause ill will . People with criminal records and criminal backgrounds. We see people apprehended all the time that a criminal backgrounds. Individuals that have been previously arrested and convicted in other countries. How can we use ai to better vet those individuals and do so in a more timely fashion, before they are released . I will start with you and allow you to kick that off. I would ask anyone who would like to join in to please continue in this discussion. Thank you, congressman, for the question. This is a very important question in my mind. We cannot speak on behalf of dhs, but i can speak on behalf of my experience in 2003 at the department of Homeland Security originally, launching biometrics at the border. Secretary tom ridge did assess biometrics as one of the Core Technologies to improve department capabilities, improving throughput and security at the same time. My personal experience with biometrics was introduced to me in 2003. It was rolled out at airports for the first time for people coming into the country that were not citizens, we used Fingerprint Technology at the borders. It was eyeopening for me and for people walking up to customers customs and Border Patrol agents, that had a look of fear, where they would have to be asked private questions. That interaction, for me, was something that lit a fire within me over the last 20 years to recognize that this was not just a security tool and a capability that was focused on Law Enforcement. It is a tool for consumers to allow themselves to protect their privacy. Yes . I would just add that this is a good example of input data and what you bring into the system can make such a difference. A photo that is done with good lighting, closeup, clean profile, such as a dmv photo or a photo during processing, and booking, that is more likely to yield accurate results. That something in the field from a distance. If i took my smart phone out now or a photo taken at night it is something during processing. That makes a difference. It is highly situational. I will give you an opportunity if anyone would like to add to this discussion. Mr. Chairman, im overtime, so i yield back. The gentleman yields. The gentleman from maryland is recognized. Thank you, mr. Chairman. I appreciate that. To my republican colleagues, if you will relate to chairman greene, my appreciation for having this. I think this is an outstanding topic for us. In fact, we might need to have additional hearings on the stock because time goes so quickly. But thanks again for having it, and to mr. Amlani, welcome, from maryland. Their representative from prince georges county. You are just outside of our district. Lovely when it comes up, we can ask you to murder move a little bit further south. I want to ask a question of you, mr. Sikorski. That is something i was worrying about quite a bit. We have identified a lot of threats , and the challenge, i think is that sometimes, it can replicate very quickly, faster than a litigation approach can mitigate those. Lets take the deep fakes types of imagery that some of those pop up that can embarrass individuals. Revenge porn kinds of things. Since i dont know that litigation is best not to do it, and i think you mentioned that your company is taking steps to try to deal with that moving forward, i would like to hear a little bit more about it, but in addition to that, how can the government create incentives from the private sector to do more on that front . I think it is going to be better than the government fighting ai. How can we go about it in a way that allows us to keep pace . That is a great question, congressman. I think there are some things that are happening that are really great with the government. A few things im pretty passionate about myself. Things like collaborative defense. Back when i worked for the nsa, you didnt tell anybody that you worked there. Now theres a Collaboration Center that realizes that we can go much further defending the nation if we Work Together, versus incomplete and utter silos. So a continued push, like we have seen with jc dc, for example, has been successful and is moving the needle, pushing her on that front, i think is imperative. I think it is important to think about cyber hygiene and what entities are doing, so companies that are out there, how are they protecting themselves, with cyber hygiene, thats great, one thing that we lacked somewhat is like, whats the report card on how efficient some of these cybersecurity things are when you talk about the researcher and healthcare and so forth. Maybe we can roll out things we can track overtime like mean time to respond. How quickly are we responding to attacks and sifting through all that nice . I want to monitor my time, but just a followup, if you could respond in writing, perhaps, unit two for the academy was interesting to me. I was wondering how it might replicate other ways that the government could encourage private entities or, you know, colleges and universities that might be willing to do it, but find ways to expand that effort, too, and the too many alerts point you made earlier is another one i would like to find out a little bit more about print with respect to talent development, i appreciate the fact that, you know, their efforts going on, and mr. Sikorski, i think your company mentioned it, and mr. Amlani, i think your company did, as well. I think that is a good solution for intermediate and longterm. For the short run, i think we are importing a lot of the talent. In some instances, we have had people come and testify before this committee that they are coming from hostile states, frankly. And so one of the things that im wondering about, since the government monitors it to some extent on the way in through the immigration process, which has its challenges, for sure, with respect to these types. The other is, once these guys get in and go to these companies, how do we know that the company is doing a good job of monitoring these individuals to make sure that they are staying on the right track and not misusing their position . Theres no economic espionage going on. Should we be confident that these companies are doing a good enough job to make sure that the United States is protected and that their industry is protected from those sources of attacks. I apologize to chair for running into the line, but i appreciate the chairs indulgence on this. Anyone who would like to answer. That is a great question. Ive been doing instant response for almost 12 years and it varies. Its not just nationstates that have threats. Its not just rent somewhere. Another big threat is insider. We see Insider Threats when unit 42 is responding, where, you know, it is not just the threat of them may be putting something into the supply chain and getting out the door and that kind of threat, which we know nationstates are embedding employees in that way, but where we see them go out the door and they have stolen data, and then they start engaging in rent somewhere like behavior, especially if their country doesnt have the ability to make money and has their economy cut off. Those are just some ideas i have. Anyone else . Well, mr. Chairman, thank you. I yield back. I appreciate it. I did see your kind words when i was out in the lobby out there. I appreciate that. I will tell you that, i think, honestly, and i would ask members for feedback on this we need more of the five minutes of the hearing and we just arent getting it. What i may do is have a townhall type thing where we are the townhall, and we are just asking questions. I think that would be more informative. Maybe some presentations, so to speak, on data poisoning for ai and all that kind of stuff. Us understanding a little better to ask more formal questions. Thank you for saying that. Well get more stuff on the books. I appreciate that, mr. Chair. I now recognize the gentleman from mississippi. Thank you, mr. Chair. Thank you for being here today. This is something that we are all concerned about. We appreciate you being here today. The capabilities of ai are quickly advancing. When i look at it, it feels futuristic. It holds the power to significantly improve the way we work and go about our daily lives. However, we also know that advancements in Technology Create new opportunities for bad actors to operate effectively. I agree that Congress Must be closely monitoring this tool to ensure the application is not misused, but the government cannot get in the way of american leaders in this sector in their building to improve the product. The Chinese Communist party has intense ambitions to win the ai race. When i talk to people in the private sector, it is clear we are in a global ai arms race. Our adversaries are innovating quickly and it is critical that we do not restrict the capabilities of american businesses. I would like to direct this to the entire panel. How can we ensure americas leadership in ai and what government actions could jeopardize this . Ill start with anyone that wants to answer. Thank you so much for the question. This is really critically important point for me. I think continuing to stay ahead of our adversaries on technology requires both investment in our talent and workforce. I just took my 15yearold son on college visits and i can tell you it is actually very difficult to get into an Engineering University today. I think there is an Unprecedented Demand for people wanting to study ai and wanting to study cybersecurity and wanting to study other types of engineering that are being left out of the workforce at the college stage. They get intimidated by software engineering. And being able to make that a part of the High School Curriculum leading into college i think will help and creating more Educational Opportunities for more individuals to get into the workforce to learn those skills. Not just at the college age, but also, going forward, as they are progressing through their careers. In particular, investing in companies and making sure that we are actually hiring companies that have the best talent is another component. This companies themselves can recruit the best talent. They provide entrepreneurial worlds that allow individuals to be able to create and solve problems in settings that are fun environments to be able to do that. And i think if we can actually make a concerted effort through organizations like the Silicon Valley Innovation Program to Hire Companies to solve our massive government problems is an important component to stay ahead. Thank you very much. Anyone else like to say anything . I would say that encouraging procurement and other incentives, responsible development of tools and proper use of those tools is key. In making sure that we are not simply trying to barrel ahead with reckless development, or reckless applications thats not going to yield good results. As i said before, winning the ai arms race doesnt just mean the fastest and broadest buildup. It means the most efficient and effective one. It is also a matter of looking at our values. We look at countries like china, russia, et cetera. It is a deployment of ai that is ciccone and in nature that supports those regimes. I think it is important that we not just be a Global Leader in innovation, but a Global Leader in values in this space and make sure that when we are promoting these things, we promote the use that is in conjunction with democratic values. Thank you very much. Mr. Sikorski spoke the act says information through censorship i assume they will continue to use restrictions on ai. How does americas freedom in a capitalist economy help to attract global of the investment around ai . That is a great question. I think one way that we do is just by that fact. We are more open with regards to how we are able to innovate and in what regard we are able to innovate. I think putting that together with your previous question, i think about, you know, what is the high risk ai models we are building that are impactful to our citizens . Things like someone applying for credit or for university. Right. Those kinds of things are high risk and something we should hunker down on as far as how are they being built up, versus on the cyberSecurity Side, i think the risk is a lot different. Therefore, pouring in a ton of innovation, which we are doing in industry, and we see organizations doing so us, together with the government to integrate fast and think about the charge of how we sift through the noise of all this security alerts and make sense of it to find the next big attack. Thank you. Mr. Chairman, i yelled back. As chairman kamal take a second here to shamelessly look that academic institutions in tennessee. Vanderbilt University Just hired general nakasone. They go out high schools and middle schools. There starting cyber at an early age. Great schools in tennessee. Sorry. I had to do that. Im sorry. I looked at the nameplate. I represent michigan and detroit. My question is for mr. Sikorski. You mentioned in your testimony the need to secure every step of Ai App Development lifecycle. As we saw with the solar winds, one silver but he can have long reaching consequences. That is a great question. I was heavily involved and help reverse engineer the solar winds back door. It was exciting to brief Homeland Security about that as we were on boxing it. I think about that. That is one of the biggest concerns we have when we think about Cyber Threats is the supplychain attack. There have been numerous other examples since solar winds, which is now a few years in the past, where our adversaries were able to get into the supply chain, deploy code, and it gets shipped out to customers, which gives them a backdoor into networks. At the networks, we are focused on thinking about how to eliminate that. As you are building your code, and as you are shifting out your products. So there are multitears that weird thing about when it comes to ai security but one of the biggest is supplychain because people very quickly develop this. They are pulling in technologies there are out there on the internet or otherwise. That makes a really Good Opportunity for an adversary to slip something in. And so we adopt technologies and have focused our ai on eliminating those threats. Thank you. And can you elaborate on what shortfalls the ai industry has demonstrated when it comes to securing Ai App Development lifecycles . Im sorry. What was that . There was a horn. Can you elaborate on what shortfalls the ai industry has demonstrated when it comes to securing Ai App Development. When we are rushing out new technologies, we are not seeing who can get this out first. We are talking about how fast Ai Development is working and we have all talked about how much it will evolve our life over time, and it is inevitable. I think that when you do that, people end up rushing, doing things and cutting corners to get those technologies out, not thinking about security. Shocker. That is what we do with with a lot of innovation over the time. I think that making sure that we are actually putting in mechanisms to think through what is Peoples Security posture are they doing the right things as they ship out applications . To a large extent, Software Development in our country is a National Security issue when we talk about the supplychain. This is a question for the panel. The world has not yet seen a major ai driven cyber attack. On the scale of attacks, what is the likelihood that we see an attack on this scale were worse in the next five years . Anybody. I will take that one, as well. I may cybersecurity guy. One thing i think about that is a huge threat and concern i have because we sought went somewhere spread like fire, takedown systems, like you mentioned. I remember seeing Grocery Stores knocked out. I think about my experience with the solar winds and the fact that dish just imagine that russia, that was using ai in that attack they wouldve been able to focus more on getting their hooks into systems for which the solar winds attack gave them access. If they couldve done that in an automated way, rather than using their human army, it wouldve been a much more efficient attack. Are. Anybody else . Thank you. It might be used to facilitate a phishing attempt. Instead of sending an email you will get a fake call or voice message or even a video saying open up that email i just sent you, making it less suspicious. They can also target Critical Infrastructure. They use those in ways that might not be related to National Security. If there is a vulnerability or manipulation of ai systems than that could also be a vulnerability point. Maybe how we might use ai to distribute power along the grid, or how we use it to check it for people coming into a sitting or log doge largescale event. If those were the target of an attack or subject to human ablation, that could raise a host of risks. Mr. Chair, thank you. Ill take my own seat next time. Poisoned the data there. Thank you. Sorry i got your name wrong. I now recognize the gentleman from texas. Thank you, mr. Chair. I think its an important discussion. Im glad were having it. Thanks to the witnesses for being here. The Publicprivate Partnership that we have throughout the United States between government dish including the prompt of Homeland Security and other industries, including Critical Infrastructure, i dont know that it has ever been as important as it is today. I think the witnesses for being here because i think the goal is for us to be able to keep up. One of the ways we can keep up and one of the ways we can continue to train the next generation is happening in my hometown at angelo state university. They are a center of excellence. They are eight hispanic serving institution. It is a rural area. They have a strong focus, in addition to just general cyber issues, on ai. In san angelo, we have Goodfellow Air force base, which is a joint intelligence training base. You pair these up together. You have University Work being done. You have the university that trains are mental professionals. The majority of them trained at that location. I want to put a plug in there for that. I may ask some questions on that. Let me go to mr. Sikorski. In your testimony, you talk about how adversaries are leveraging ai. I would like to get your whether it is fishing or some other technique or whether it is a new technique, maybe talk to me about how you see adversaries increasing the scope, the scale, and the threat, using ai. That is a great question, congressman. I think that goes to the question earlier. Right. The what if. If some of the attacks we saw on the best leveraged ai in a wider attack i also think about the evolution. Right. So the first thing that the attackers did it we are monitoring the dark web. We are seeing what they are talking about in the forms. What they are selling to each other. The access to networks. But also, talking about how to leverage this technology to create really efficient attacks. The big focus so far has been on social engineering attacks, which means things like phishing, like we talked about. And also manipulate you to get multifactor authentication. You know where you need the extra token to log in. There focusing there, as well. Where we start to see them poking around is using ai to be able to do better reconnaissance on the networks they are attacking to know what holes are in networks across the world, and then also, starting doge they are starting to wade into how can they develop malware efficiently and variations of it so its not the same attack you see over and over again, which goes back to the point of, how do you fight against that . Which is you need to develop technologies that are really efficient using ai to see those variations. I want to ask all of you in the last two minutes to speak to this this model that Angeles State University is using, where they train students. They may go into the nsa or the military. They may go to the private sector. What should the university be doing . Weve got about a minute and a half. Are not a hard science person. I found in my field, it is invaluable for people in the policy space like me to learn from the people that understand the tech. It helps with how we can translate across to each other and it helps as he did you Design Systems to figure out how to do it and how it promotes what we care about as a society. I think there is a vocabulary around cybersecurity that is an important component to educate the youth on. Spearfishing you mentioned all the other types of attacks. I think these are important things to be of the teach people about to make sure that they themselves are not attacked. They should understand what attacks are happening and how to guard against them. Identity is the big component of all Cyber Attacks. With the credential that it has been hacked or compromised in some way it can be activated afterwards on an ongoing basis. Having better identification mechanisms to make sure that individuals dont have to change their password every day. They dont have to have multiple things that are hard to remember. Would you say that the universities should be doing this in a classified setting, that they should be working on these types of techniques and partnering with Government Agencies as well . Government agencies as well as the commercial sector. Very good. My time is expired. Im sorry, mr. Chairman, i didnt get a chance to talk to you. You are recognized for five minutes. Thank you, mr. Chairman. Thank you for doing this hearing. Im interested in you doing some kind of offsite retreat to delve into this more in depth. When i listen to you and i think more and more about ai, the more terrified i become, quite frankly. There are great opportunities, but im scared. In 1974, i was in seventh grade, and i remember sister ruth at st. Patricks grade school saying technology is moving so fast these days. That we dont have a chance to figure out how its affecting us. How its affecting our values. How its affecting our families. How its affecting our society. It is moving too fast. That was because of the space race. Atari had, with pong in 1972. Think about how fast everything is moving now. And think of all the impacts we have seen from social media on our young people. These polls come out and say, you know, 35 of kids are patriotic, or for boomers like me, it is 70 something percent. Nobody believes in any religion anymore for any institutions. We have all these kids with Mental Health issues related to their selfesteem. Everything is moving so quickly, and im confident that you are going to figure out how to protect as mr. Sikorski said, he represents 90 of the fortune 500. We will find ways to protect businesses and make sure they are looking out for their security and interest and hopefully we will think of more things with our government. But im worried about our kids. Im worried about our Senior Citizens getting scammed. Im worried about people using our voices to say things we didnt say. Im worried about our society that is so divided and our foreign adversaries Chinese Communist party, russia, iran, trying to divide us more by using Social Security against our freedom. They will use defects to try to divide us a little more. So im worried about this divisiveness. Im worried about fraud. So im going to give you the rest of my time and im asking each of you, can you just talk about values . Im worried about the values in our country just like the people that believe in our values. Im worried about our own country and our values and promoting those values. Each of you, just give me 30 seconds each, if you can. What is the number one thing in the big picture you think we need to be focused on right now to address not the positive parts of ai, but the scary parts of ai. What is number one in your mind . I would say it has to be the conference of approach from the creation systems to input of data in proper situations to retrieval and use of results. That is something that there are a lot of factors that are together in the National Security space. We have to fight mechanisms for transparency and oversight. You dont typically have that light you can shine on the private sector or other parts of government. I think we have to find ways to promote that oversight and make sure we are upholding those principles for responsible use, even when you dont always have the same level of insight. Oversight to watch the input of data . From procurement to what is being input to how they are using data and what kind of human review and corroboration you have. That sounds awfully big effort. Mr. Amlani. As a father of three children, all of whom use Digital Tools regularly, i think, for stuff, we are placing a large responsibility on parents to be able to monitor the Digital Communications of our children. There arent age verification mechanisms to provide a gateway to make sure that the right people are accessing the right systems at any point in time. It goes back to the identity layer of the internet that i mentioned before. As you mentioned, there are all kinds of online bullying. Extremism is, recruiting, things like that on but it is being done not just on a dark web, but in the open. It is because we dont have the ability to recognize when people are online, and it creates mechanisms and difficulties for making sure that we can actually have stronger values in forest and allow parents to be empowered better idea of people. Mr. Sikorski. The other idea i would put out there is the education piece. I talked heavily about cyber education for the workforce that is going to defend the nation next as being permanent. There is also the education piece for the rest of society when it comes to security and ai and being and disinformation and knowing that what you are seeing on your phone may or may not be real. And people are at an age where people are getting news by scrolling through their phone second after second. I think that is something that needs to be considered, and how do we eliminate those kinds of things that are not real. Mr. Chairman, can we allow mr. Demmer to answer . Thank you for the question, mr. Congressman. I agree with you on the societal advancements creating impacts that are unintended. I believe that Technology Advancement that is happening today creates a promising future for all workers to be able to upscale and have more fulfillment in their work and to be able with these technologies, but it starts with the critical data. If we dont have good data going into these systems, then, you know, garbage in, garbage out. Thank you. Thank you, mr. Chairman. I now recognize the chairman of the cyber subcommittee for five minutes of questioning. Thank you. Thank you, witnesses, for being here. My colleague was talking about 1974. Where was i . I wasnt alive. 1984, though. Recently, one of our biggest concerns has been the repositioning of Chinese State actors. They are postured for a cyber attack if a conflict with the United States were to arise. U. S. Intelligence community has said that ai has been helping them detect this activity, given it is much more technology to decipher than traditional tactics that involve malware. How have you been thinking about this challenge . Absolutely. The threats are dual. Theres the Cyber Threats. Theres others on this witness stand that can best answer that. On the physical infrastructure, specifically, critical assets, that is a vulnerability. We have seen it. Gecko is a partner for the u. S. Industrial base, both public and private sector. We need Energy Security Critical Infrastructure like roads, bridges, dams. These are susceptible to physical attacks. Ultimately, we are creating wins for the industrial base. It allows us to fight these other threats, as well. Thank you. Appreciate it. Mr. Sikorski , i understand you teach cybersecurity at Columbia University which means you have a receipt to our upcoming talent. In your view, what does the government need to do to bring more sufficient numbers of people to the Cyber Workforce . Its a great question. I think, back to my experience, right. When i was in school, it wasnt until i was a senior in college in new york city and 9 11 happened that i was like, i want to go work for the nsa. That is what i want to go do. But i didnt really think about that before. It was things like video games and things like that. I think getting people excited earlier on is a really good place that we can focus, of, like, there are cybersecurity attacking clubs at universities and high schools. This gets people excited to gamify it and play along. I think, while we look at the workforce gap, i think our workforce capability where we have the academy and we are bringing people in who dont maybe have the handson experience we are giving it to them with onthejob training, and then i also think about Government Programs like i was in when i went to the nsa, and i was in a Technical Development program there where i got ramped up on all the things i learned during my education previous to that. Those types of programs that are feeders are powerful in getting people to level up at the skills they didnt get in college. That answered my second question. Not all the way. You have these clubs and feeder organizations. What is congresss role in further improving those . Do we have a role . Its over half 1 million jobs cyber job openings in the u. S. That is what keeps me up at night, that we dont have the workforce to defend against these Cyber Attacks. Ai can only bring us so far. We need that human element. Do we have a role . What is it . Have you thought that far . I think we absolutely do. There is an ability to create these types of programs where it makes it really easy for people to apply and get into. And to the point made earlier about, hey, it is hard to get into schools that have these programs available and i think we often think that it needs to be a very specific Cyber Program that they are doing. Some of it they can learn skills on the job when they get in. It is more about building out the broad base of Technical Capability in our workforce. I think that is one great area. I think there are a lot of great agencies like cisa that have information out there where people can learn and train up. There are things like that going on that are very powerful. Thinking about how to drag in that workforce. Some of that is earlier on. We are talking sometimes about giving people skills. When i taught at the fbi, i was like, all of a sudden, these people work cyber agents and they had none of the background in cyber. They had no technical Computer Science background. It was challenging. It is not just a snap your fingers, trained them in a month. It starts early. Companies need to start focusing on skillsbased hiring instead of degree based hiring. Chairman, i yelled back. The gentleman yields. I now recognize the congressman who represents palo alto, i think. Mr. Swallow for five minutes. Thank you for holding this hearing. We are best as a committee when we are taking on issues like this. Ive enjoyed working with the gentleman from long island on the cyber committee. I was hoping to talk about something that californians are concerned about. Entertainment industry is the second largest job crater. Creator. It is offscreen. Ai is the future. There is no putting it back in the bottle. It is the future. We have to embrace it and put guardrails on it and contours around it. When it comes to the creative community, you know, the example over the weekend of what happened to scarlet johansson with her voice eventually being stolen from her for an ai product, what should we be thinking about to make sure that we protect artists and creators from this, but as i said, embrace ai and recognize that this is where we are going. It is important to find ways to be proactive and find a way to find what peoples rights are going to be. In a situation like that, im not saying that was imagined or contemplated in the movie where she played an ai for five years ago came out. This is something that has come up a lot. I think in the recent writer strike, how do we build in those protections not just for how ai is being used right now in this industry, but how will it be used in 10 years . This is a little outside of my field, but from the technology standpoint, it moves so fast, i think it is important to be proactive thinking about, not just current risks and factors to care about, but what do we need to care about down the line that we might not be ready for. When we talk about creators, that is not post ai. That is such a basic, hot take. They dont oppose ai. They just want rights. They are willing to engage around their likeness and their voices, but they should be compensated. In the majority of people who are writers and actors or people you have never heard of, but this is their livelihood. In california, we are especially sensitive to that. I wanted to ask mr. Amlani, because we are in the same backyard, the bay area. The chair alluded that our culture has created, you know, so many in the bay area, but i do worry about, with ai, i have a community in my area called pleasanton, one of the most wealthy communities in america. Youve probably heard of it. I have other places like san lorenzo and hayward and union city and they have some of the poorest communities in the country with schools that dont have enough resources. Those kids have dreams as big as kids in pleasanton. I just fear that at a childs earliest days in schools, that theres going to be two classes created. Those who are given access to ai in their classrooms and those who are not. What can the private sector do because you are often some of the best solutions out there to partner with School Districts to make sure that you are imparting your knowledge and skills in places where you must have the need to recruit talent down the track as well . Sure. Comments and questions. This is a pretty personal issue with me but with regards to actually allowing people to have access to the technology and ai in particular, it is interesting, the way that ai is democratizing itself and is making itself available to everybody. It is as much of a concern to make sure that actually everyone has access to it and is actually able to have these tools, but also, people that have gone through large universities and masters degrees and phds, now, a lot of that content and knowledge is available at peoples fingertips that have never gone through those programs. So with different ai tools, that are now available at think peoples fingertips, you can code. You can write apps. You can create content. I have my 12yearold creating music right now. This kind of democratization of ai capabilities is an opportunity but also a massive threat. It really does upscale many cyber criminals around the globe to be able to attack systems. People that are not as well off, potentially, and would love to have the ability to be able to create malware that could potentially create a ransom payment. These opportunities to educate the youth and make sure they know how to use it responsibly and for the right aspects are things that our Society Needs to embrace and do a lot more with. Thanks. Thanks again. The gentleman yields. I now recognize mr. Desposito from new york. This is something that affects the United States of america and the world and has real promise for the future. Just last week, during police week, i shared an Emergency Management subCommittee Hearing with the Law Enforcement and hearing about the use of drones. We heard a lot about the expanding field of how Law Enforcement agencies are utilizing drones to assist them in doing their jobs. It was good to hear and promising that they were embracing technology about how to handle issues that are plaguing so many cities across this country. As we embrace technology, and as the field expands, we need challenges. We find challenges. Listening to all of you speak about the power of ai to assist the United States from attacks from our enemies, it seems that there may be a space for ai with these drones. So generally speaking, any of you could answer. Is ai already being used in drones, either by those in Law Enforcement, the government, or privately . Congressman, thank you for the question. Being in a related field with doing wall climbing robots primarily, i can say that ai is useful for using these smart tools properly, everything from localizing data, ensuring that the data point is synced to a location on a realworld asset, to processing millions of data points, or in this case, visual images. We heard earlier about drones being used to secure the border. There are definitely applications here for that. You mentioned data. Obviously, drones are utilized by Law Enforcement to collect that data, whether it is audio, visual, location data, gps, among others. So that information that is collected, we need to make sure that it is collected correctly and kept private, so. Is there a role that ai can play in ensuring that this information remains secure and doesnt give the bad guys access . Absolutely. I defer to my fellow witnesses here on specific policy recommendation for cybersecurity, but echo clicks massive amounts of data on the physical world and we take very seriously the responsibility of securing that data. Thats for the standards of securing the data and also providing training to the entire workforce so they know how to properly handle any type of information is classified information. Any other witnesses have regulations with regards to that . I could just add that, you know, securing the models, the data used to build them, is critical. One of the things we deal with the most when doing instant response, especially Ransomware Attacks have shifted. They no longer encrypt files on disk anymore. They focus on stealing data and then using that to extort victims. And so securing the crown jewels of data, which is what most entities have is paramount. Sorry. Did you have something . Sure. This is a Defense Innovation unit for the Autonomous Systems portfolio, part of my role years ago was to manage Autonomous Systems within drones but i think one of the biggest concerns is actually chinese made technology within drones and making sure that we create a list of different drones that people could potentially use in Law Enforcement and other avenues to make sure that we have eight safe list of drones, which is something that Defense Innovation did create. You are leading into my next question. It is almost like you planned this out. Part of the conversation we had last week from the nypd was the fact that they currently use utilize Chinese Technology in their drones to eliminate them from the fleet because of the issues and concerns that we have. My colleague from new york, mrs. Stefanik introduced legislation that would help Law Enforcement make sure they only purchase American Made technology and americanmade drones. Obviously, those chinese drones are still in our atmosphere. Still being utilized by First Responders and lawenforcement agencies. Quickly, how can ai help us mitigate the threats that they pose . Theres also a significant amount of work being done by Defense Innovation unit and other agencies on mitigation of drones and counter drone work. So ai being used for it has changed so much and just the progress of ai in just the last six months to a year has been startling. And how it can also improve our lives as americans. I also want to focus on the challenges it faces to our own democracy process. Just in the last 24 hours, dhs issued a warning of threats that it poses to our early elections. Continues to threaten global democracy. And just last week, intelligence community. The intelligence officials have testified in the senate that since 2016, that the threats are happening even more so as we know today. Others competing to influence not just their own countries but whats happening in our own elections here in the u. S. That is a danger to all of us and concern for us as well. This past january we know that voters were exposed to one of the most highprofile cases of ai. We know that there was a robo call impersonating President Joe Biden telling people not to vote. The attempt was identified and stopped and i think were all very grateful for it. We can see that those types of efforts can cause enormous havoc especially in elections that were close and in communities across the country. We already know that there has been unsuccessful and successful attempts to undermine our elections and folks are trying to do it again in 2024. The rise of ai is very concerning to all of us. One of the advantages in the u. S. Is that our elections are decentralized. They are run by states, counties, towns, cities. The technology to know how to deal with the oncoming wave of ai. Im really concerned about how these smaller agencies, the city clerks actually were able to take on ai and have the resources to do so. We know that there is a new task force coming out of Homeland Security is really important. This is a huge responsibility of this committee how we provide and get assistance to these clerks across the country. What additional safeguards and how can Congress Better support all of these election organizations and officials across the country that have a decentralized system and how are they supposed to get support . I think that is very concerning. The decentralized in some ways provides a lot of assets is a significant challenge when youre facing threats like this. Over the last decade we have built up a Robust Network that provides support for Election Security for things such as Cyber Threats. We should supplement that by having the same entities serve as a means for highlighting ai threats. But also from the general awareness and education, that can be brought from those, the small side of federal entities to the Broad Network trying to educate about here are the types of technologies, here is something that might be used to trying to use ai to create spam to overload your office to building up fake materials about pulling information to using ai. Our elections are obviously for president , these are federal elections but they rely on data from local towns and counties. They just send their information up through the process. The real concern is that you can micro target precincts, small towns and cities with these ai disruptions in certain states. That is something that we really have to consider and think about as we move forward. The education that is needed to take on these defects and ai concerns. With that, thank you. I now recognize from florida. Good afternoon, mr. Sikorski i would like to go back to your testimony where you mention that our cyber adversaries are utilizing ai to really enable some of their malicious behavior. Finding new attack vectors, enhancing the speed of lateral movements once they do intrude in that work. I am interested in hearing more about how we are using Machine Learning to build and enhance our Cyber Defenses about these kinds of attacks. Precision ai including some revisions to how the socks are operating. Would you elaborate for us on how Machine Learning can enhance our Cyber Defenses . Actually, the networks and myself have been involved on this journey for over 10 years. Other technologies like that have gotten really popular really quick. We have been rebuking and time our technology to be able to detect malware on systems. We have been training model to do that for quite some time. And that detects variation and making sure that the variance will be stopped do to that training. There is also the idea of the leveraging ai to get rid of the noise. That is the recent evolution we have been focused on. Everybody is inundated with all of these tools, when i go back to these for example, i did numerous responses to that after that came out. Went on to Corporate Networks and one of the big problems that they had was that they actually detected the attack. They detected being dropped on the system. They did not know it was there because they were flooded with so much noise and so what we are doing is taking our technology and very much focusing on how to put these alerts together and reduce the amount of information. The brains of the analysts who are getting earned out, instead it gives them a chance to zero in on the attack and actually move the needle. You also mentioned in your testimony at a point about the unintended consequences of disclosure. I would like to go back to that. Particularly raise a concern and a Public Disclosure that require information about how we are using ai to train, they could unintentionally create a road map for the adversaries and reduce our overall security. If you are a policymaker, how would you balance Disclosure Requirements with not alerting our adversaries to the type of information that we dont want them to have . That is also a great question. What is your end goal with respect to the ai that you are trying to get to customers or to protect the network . You have to think about the tradeoff. The more that we regulate things on oversight, it could slow down the innovation and the protection. Etiquette is the appropriate thing to do when we are talking about summary applying for a home loan or Something Like that. I think when we start to talk about cybersecurity we have to focus on what is the data and is the date of the ones and zeros, the malware, the detections to be able to limit attacks and how important it is to make sure that we continue to make a difference with the technologies that we are building on the cyber war that we are fighting day in and day out. You also mentioned, that reminds me of secure by design. This goes back to the point that ai is here to stay no matter what any of us do. It is sort of like the internet. We didnt plan security into the internet, and what we are doing comes up as a Cybersecurity Company we missed out on an opportunity to build things in a secure way and thats where when it comes to securing ai by design music about what are you building, how are you building it, how are you protecting the application as is running, how are you protecting models, the data everything as its actually flowing out to customers or otherwise. I think that is where a really big focus on building things in a secure way is really important. I now recognize for five minutes question. Thank you, chairman for having us here today, thank you all, the witnesses. I want to start and build off some of the questions that my colleagues have asked about training Cybersecurity Workforce and first we want to acknowledge the Community College which is the eighth congressional district. It is designated as a Natural National center, they are recently awarded 600,000 to expand their renowned Cybersecurity Program and just getting more to the cybersecurity field. Incredibly proud of the work that they are doing. Thank you for emphasizing the need to educate and train our Cyber Workforce. I am wondering in your experience, what are you seeing as the most prominent barriers to Cyber Workforce . There are a few parts to that, i think the first is desire. I think that getting people at a much younger age focused on getting excited about these technologies and wanting to get involved and it goes back to whats going on earlier, and actually talking about cybersecurity at a very early age. The point of what is happening in your district, they are really feeding the engine of all of these cybersecurity. I think working with industry to make sure that they are lining up for the jobs a lot of Cybersecurity Companies struggle to find talent. Collaborating with cisa and other things that were doing. Theres not enough people to pull from there. Everyone is looking to enhance their cybersecurity capabilities which includes adding cybersecurity professionals, whether it is a private entity that is concerned about these issues. Just quickly following back, you mentioned a desire at a younger age for people to engage in this field. Are you seeing anything from that student demographic that draws them that maybe we should be sort of using to highlight and amplify at a younger age . That is a great question. I think that one thing i think about is the game of dictation of it. And i think of myself personally i wanted to be a video game programmer originally because that was really cool and i had the tech skills for it. Once i realized that cybersecurity is like this a good versus evil kind of situation going on in the real world, its only going to get bigger i started to get really excited. And then there are hacking competitions and driving into getting people to participate more because of the fun that could be had in the Team Building that could be had working toward that. It doesnt really exist out there but thats what actually happens, there is the Cybersecurity Club where they focus on that. They go to competitions together and it rallies them into a common goal. I think those types of things are great. Im going to shift really quick. In your testimony you touched on how ai can be used to better secure the infrastructure, the collection of high quality high quantity data, we are overseeing the major investment that is being utilized by the Infrastructure Investment and jobs act. It is building our future infrastructure. One of my favorite projects was restored the george when they went through cables and was a completely intricate project. As we think about investing in our infrastructure so we dont have to make these huge investments, how could the use of ai touch on and used to better of keep our existing infrastructure . This is something we care deeply about, of course protecting infrastructure we have today capturing the right data sets so that we can ensure that they are here for us when we need them, not vulnerable to old age or some external threat, we also see the opportunity with these data sets to help us build more intelligently in the future. As we bring new systems online, how do we instrument them in ways where we can do that . Modernization of what is going on with that equipment so that we dont have the failures of the vulnerabilities and hopefully lower the cost because two thirds of the infrastructure is usually concerned after the initial bill. Reporter what type of dollar amount investment could be made to quickly scale up this technology . There are very Much Technology Ready Solutions out there for National Security and there are ways that i would love to followup with some guidance on that in terms of programs that can be utilized to help bring this technologies to the forefront and accelerate the adoption of them whether it be investment in hardware technologies as well as ensuring the policy side says that not all solutions are created equal. Today we do a lot of things that seemingly placate the ability to think they have a handle on what is going on but it is actually willfully inadequate in terms of how we are actually managing and maintaining. We appreciate the continuous conversation. I am out of time so i yelled back. I now recognize gentlemen from north carolina. I yelled my time to you. Thank you. Quick question on creating a sense of security for the public. There is all the fear that is out there and are there requirements that we can place in the system that we can give people a sense of security and kill switches, what are some things that we can do to give the public a sense of security that we are not going to create the terminator or Something Like that . Anyone . You are smiling. Control is one of several factors that is critical for Something Like this. You need strong principles from creation to what data you are putting in to systems and what systems you are using it for to what data you are taking out and how you are using it. As you said for human review, one of the steps on the outside is there should be human cooperation, it shouldnt just be ai making its own decisions and we have to know how reliable ai is in certain circumstances. Sometimes it can provide small bits of insight and sometimes it can be very reliable sometimes it gives a degree and you have to treat it with a bit of skepticism but also it provides a bit of value along those lines, not just human review but especially trained staff, thats why it is so port important for folks, general buys, that is a tendency for individuals to always assume that the systems tend to work better than humans that has been documented in the cases. You need to understand what type of biases you might want to apply to any given system in that situation. There were some negative things said about facial recognition earlier, i think if i heard, maybe not negative, but concerning. The fairness, the use of it against large groups, population stuff. Law enforcement. What is your thoughts on the reliability of facial recognition . This is your field, i am aware of my district and company that has use of the threedimensional of the hand, facial recognition has failed so what are your thoughts on, i think youre right it sort of begins and ends with being able to make sure that the person is the person in the system to make sure that what are your thoughts on that . Thank you mr. Chairman. This is actually a really important question. From even going back to your prior question about Building Confidence in individuals and ai, i think it ties to that as well which is fundamentally, post 9 11 after the terrorist attacks, one of the steps that we did was we created tsa. Having federal agents at the checkpoints made people feel safer. That used to just be a private contracted workforce but, by having federal agents there and made people feel more comfortable. These steps are really important to be able to put into place. People do not feel comfortable with identification steps that are necessary to access systems. Passports, the most secure place to secure passports according to all of the major experts in the field right now is actually in a personal book that you write with you because nobody oversees is trying to steal your personal book for passports, they can access your systems but your book of passports is something that they have very difficult access to receive. Leveraging better authentication builds confidence. People have become very comfortable with face i. D. To be able to secure their systems. People have no confidence in what member thompson mentioned in regards to captchas. And facial verification is an important component. Have a quick question, data poisoning, how big of a threat is that for the systems that are using that data to make very quick decisions particularly in the defense world and if we need to go somewhere else to have that conversation we can postpone it until then. If you can just really quickly share a few concerns about that if you have any . It goes back to the secure ai by design. How are we securing that information, how are we securing the models themselves that make those decisions as well as the Training Data that goes there. There is a lot of research and a lot of thought about what attackers could do if they could manipulate that data which then in turn not even necessitate an attack against the technology itself it is an attack against the underlying data and its definitely a concern that needs to be taken into account and built into as the technology is being built out. Thank you, i yields. Thank you all for being here. The worldwide threat assessment warns that our most sophisticated adversaries, russia, iran, they see the president ial election is an opportunity to undercut our democracy. And many of our Law Enforcement intelligence agencies have confirmed that there also seeing upcoming threats. We know russia used social media and cyber to interfere in our election in 2016. We know that these actors posed as proud boys in an online operation to intimidate voters in 2020. Just recently we learned that china is experimenting with ai to enhance their influence operations. Within the operation of Homeland Security, cisa is charged with protecting the security of our elections. I know you work closely with cisa on these issues and i would love to just ask you a relatively openended question which is how is cisa prepared or how is our government prepared to address the use of ai by foreign adversaries to undermine and interfere in our elections . That is an excellent question. I think cisa is doing a great job with the collaboration with private industry to work with us and many other private entities on thinking through what are we actually saying in the landscapes. One of the things i am tasked with is running the Threat Intelligence and how do we take all of the information that we are getting from other private entities bring it all together and share it back this is where we are seeing these directors go whether it be what china is up to today, what russia is doing staying on top of these threats and finding the new ones. For example we saw novel attack of how russia was sending emails, phishing emails to the ukrainian embassies and actually making that discovery and showing how that actually went down. The hyper collaboration is definitely going to move the needle. Deep fakes, we know intelligence agencies said that they had spotted chinese and iran in deep fakes that were not used but the fbi has recently identified that recent elections in slovakia were impacted by the use of deep fakes, how prepared are we to prohibit or prevent the use of deep fakes that might have a Significant Impact on our election . What we have seen with ai it really lowers the bar for attackers to be able to generate believable communications whether it is emails, phishing, voice, or even deep fakes technology. I think that that lowering of the bar makes it a lot easier to select the deep fake technology, the impacts of an authentic contract is really concerning. That is actually what we do, we use green lighting from a cell phone screen or a desktop screen that detects against live human skin, all simultaneously while you are actually recording a video or doing a match, verifying that it is a live human being with the right person at the right time. With being there at the creation of the video is an important component that you can tag the video and verify that it is in fact not a deep fake. Are you coordinating with cisa on this . No. Beyond just the deep fakes in the misinformation one of the risks is the benefit. It is something that when you are evaluating truthful information someone can just say no, that was just a defect, it is not just the initial misinformation it is trying to create an entire ecosystem of uncertainty. It is just to emphasize why it is such a significant threat and why we need to make sure we have clear information and ways to debunk this that are reliable. You and many of the members on this committee are concerned about Election Security and i would just urge you to encourage some of your colleagues who are trying to interfere with Law Enforcement efforts to coordinate Election Security and prevent election interference with the Cyber Companies who through which the adversaries do try to influence and i hope that we dont see any more members of the Republican Party trying to cut funding in cisa and that we work closely with cisa to make sure that our elections are safe. I yield back. The chair now recognizes mr. Crane. Thank you, mr. Chairman. I realize that this hearing is about utilizing ai to bolster Homeland Security. I want to bring up an interesting meeting that i had in my office before coming to the committee. I was with one of the Largest Tech Companies in the United States and arguably global companies. They were talking about major Cyber Security attacks that they are saying. I was told that they used to see a range of tens of thousands of days, they are now seeing attacks to about 100,000 a day. Is thats consistent with you all, with what you all are seeing and hearing in your space as well . An increase in Cyber Attacks . Yes, that isa great question, we have actually seen a great increase in Cyber Attacks. The number of attacks we are stopping across all of our customers was 65,000 customers is in the billions. It still gives you a sense of how many new attacks are going on and then we see the cadence of Ransomware Attacks and extortion continuing to increase as all of these have evolved. This company also told me that not only are the numbers of attacks on a daily basis increasing drastically, but they also said the brazenness of some of these foreign actors is becoming more and more hostile and increased as well, is that something that you all can verify that you are seeing as well . Yes. The days of Ransomware Attack where they just encrypt files and you are just paying for a key, we actually miss those days because now they are stealing the data and harassing our customers to get ransomware payments. They are taking the data which has the customer information and really going to a dark place of the level of harassment there willing to go to. Sending flowers to executives and even going after companies customers pertaining to spam them as a company when in fact they are the threat actor harassing their customers and leading to getting the payment that thereafter. What do you attribute this drastic rise in aggression in the amount of Cyber Attacks that we are now seeing against our own corporations and our infrastructure . Mr. Demmer, i will start with you. Thank you congressman for the question, my expertise really lies on the physical infrastructure, the critical assets that we help maintain and protect, i cant say that the threats are rising on our Critical Energy systems on our infrastructures like bridges and roadways and dams, although we havent seen the pace of attacks that we are seeing on the cyber side, it is a real vulnerability and risk as our infrastructure has more vulnerabilities. What about you, mr. Sikorski . I think the threat actors when we talk about ransomware have become a business where it is actually not the same hacker is breaking in and doing the ransomware and everything else, it is actually one group breaks in and then they sell the access on the dark web to ransomware gangs. Almost like franchises like mcdonalds, they pop up and have a reputation score about how likely they are going to do what they say theyre going to do and that enables them to be able to build the relationships and get the access that they need. It is operated like a nine to five job. Let me ask you something, do you believe that some of these nationstates and some of these, do you think that they sense weakness here in the United States . Do you think that has anything to do with it . I dont think that i could speak to if they sense weakness or not. It is more an opportunistic thing from what i see. We have seen them leverage vulnerabilities. We have started those opportunities, were they not present a couple of years ago . I wouldnt say i would say those opportunities have always been present. However, the availability and opportunity for them to figure out how to get in has increased , they are better enabled and now that theyre operating in this model and makes them more efficient and able to pull out over attacks. Do you think we are doing enough offensively to make sure that individuals that would utilize these types of technologies. If theyre going to carry out these types of attacks against our country when i think about, im not a policymaker as far as thinking about what the best stick is to have as far as dealing with the cyber threat, one of the things that i always focused on is on the defensive side and had we make sure we are doing everything we can to secure. Big steps we have made in recent years the last few years, all of this collaboration that is happening is moving the needle and i think that will help a lot. That being said, we are in an arms race right now. The defenders need to win here. One opportunity we could have is remove the vulnerabilities i was talking about. Thank you for the extension. Some extra graces, i now recognize mr. Kennedy from new york. Thank you, chairman and thank you to the panel today for your testimony. We are hearing a lot about advancements in ai and the upcoming elections. We want to make sure that it is secure and as november approaches there is more and more concerned about those that seek to undermine our election. Just last week, a report from the department of Homeland Security and progressives, generative ai tools. Aggravating emerging events, disrupting disruption processes, we are attacking infrastructure. I worry about the Rapid Advances as we are discussing here today, the Cyber Security and Infrastructure Security Agency is responsible for Election Security. How can this agency best support Election Officials and United States voters so that they can discuss the authenticity so that they see Information Online . This is an area that we can learn a lot of lessons through Cyber Security space over the last five to 10 years using these type of federal agencies to distribute information out to a huge range as well as the public and that comes from both providing education about how these technologies work, what to be aware of. Also as well as information about specific threats if there is something deep fake techniques, some sort of new type of attack providing information. Its something where because our election system is so decentralized, because there is a lot of information out there acting as that hub of getting out good information can be very important. What you see is a role for the Cyber Security and Security Agency in authenticating content online in regards to the upcoming election . I think that will be a much more challenging question if were talking about content from any layperson as opposed to a message being targeted at an election administrator. That is something that something from my work does a lot of research into i know what chairman greene earlier mentioned, i want to plug the university of buffalo which established the uv institute for Artificial Intelligence and data science to explore ways to combine machines, in 2021, just this past year. The new ai center. You should look at buffalo in the engineering school, how can we better harness the institutes of higher ed especially our institutions for getting at this coming Edge Technology and while there training up our youth in this new technology, how do we make sure that they are developing it in a safe way regarding ai . So, my thank you so much for your question, my son and i would love to come to buffalo. Fundamentally i think there is a level of distrust and some of the ai content and not knowing who or where the content came from. It comes down to identity. And verifying the content has not been tampered with after it was created by the initial creator. Making sure that you are able to identify the initial creator is a very important component on trusting all of this content and also for property concerns that we have already discussed here today. Using proper identification tools, things that can verify it is the right person, it is a real person and it is right now to allow that individual to have easeofuse to be able to identify themselves and the content is coming from them. Thank you, i guild my time. I now recognize myself ive minutes. For the purpose of this committee, how ai can help us be able to protect entities within the United States, thats where i want to go here initially. The ability of your company to help bolster Border Security for those of you that are representing the free market, you had alluded to, have some information here where ai powered copilots, my understanding it is a natural language assistance that can guilds, multiple operational advantages, im actually curious as to when we are doing our National Initial claims, if our Border Security officials can utilize that tool to better inform the cases of the future so that people are being coached for interviews language barrier can exist and they can be told to say certain keywords are you all aware of how you can make sure we can get to the depth of fraud to use ai to get past the language barrier, those applying helping us get to the truth of the matter. It is a great question. I will take from my experience helping to create the network, when we say copilot, what we mean is you have a human who is using technology to find new threats, thats what we sell, but its very difficult to use so we end up doing is we end up building these technologies called copilots for our products so that users can engage very quickly to ask questions and then they will process the question and give them the answer that is there so that they dont have to figure out all of the complex cities of our product. I think what you can do is you can take what weve done in our capacity and apply that to a use case like we were talking about. They are paying attention to what they are collecting, what information and the ai maybe says to them, i saw differently then you sod when i feed all of this in and put it against my model and you could put the two sidebyside and you put on the suit and you are more powerful than you were before. That is one thing i would think to go to. You do think that officials could be empowered in those moments to help the case but i am assuming there is also a defensive mechanism that someone crossing illegally could also use that technology to time delay, read the question and im assuming the technology is booming where they can get a response to help their case also ai generated. I am definitely not an expert on the border and how those policies are to figure out what the best way is on immigration and other things the thought processes the types of things that we are doing with ai to enable customers to prevent Cyber Threats could the model similar for really anybody was collecting data to make better decisions that they might not otherwise do by themselves. The rise of ai, the significant question about concerns, constitutional, election all, ai can be very dangerous. Social Credit Scores and the ability to have facial recognition and then may produce a different outcome depending upon whether you adhere to the governments positions or not, there is a real fear it is a credible fear out there for those of us that think this could be used to weapon eyes against the nations citizenry. I want to ask from your perspective the significant concerns that you have regarding ai in the future. If anybody wants to talk about Election Fraud specifically candidates that can be created to look like they are saying something that they are not actually saying, and how that can be generated, the ability for a user, were talking about government regulation here. For a user to have a fact check , something that can be encrypted where i can have the ability to determine whether or not that was created or whether that was an actual video, anyone who wants to respond to that. The identity of the creator is actually a very important component up front mr. Chairman, mr. Congressman. And i believe that right now that is not actually associated with most of the videos shared openly you can never tell who created the original video, you can have some confidence that the video itself was created originally by the initial creator, but there is some watermarking tools and other technologies being used by other companies that there is some investment in the space currently today to be able to assess it. With that i yield, ms. Clark for her five minutes. Thank you mr. Chairman, and i think a Ranking Member for holding this important hearing, let me also thank our panel of witnesses for bringing their expertise to bear today, the rapid advancements in Artificial Intelligence and Cyber Security represent significant new opportunities and challenges with respect to securing the homeland, everyday developers are creating new ai tools to better identify and respond to the increasing number of Cyber Attacks but while it is a critical tool in our Cyber Defenses, it also still created and deployed by human beings. More data sets which often replicate human biases and the bias is built into the very Technology Created to improve our lives and keep us safe. For example, ai design for Law Enforcement purposes that was trained on historical lease or crime data may serve to reproduce or expand existing inequities in policing as those are not an accurate reflection of crime but rather in Police Activity of Crime Reporting which can be fraught with bias, while Artificial Intelligence and Cyber Security will remain important elements defending the country, these are not just technological issues, but critical, civil, and human rights issues as well. I ask unanimous consent. This article written, the National Security council provides value for contacts with the societal impacts of Cyber Threats, the need for Cyber Security strategies developers and players of Artificial Intelligence in the realm of security the homeland or providing a service to consumers must be intentional in the creation and rollout of this technology similarly we as policymakers must be deliberate and meticulous in our choices as we work toward our effort in securing the homeland as well as crafting a comprehensive entered which remains foundational to our work on ai and the range of other issues. We must all take care to ensure that the civil rights and democracy are baked into this emerging technology. Once it gets out there will be no putting the genie back in the bottle. Have encourage the government to consider different standards for different use cases recognizing that certain uses of ai may not pose the same liberty concerns as others here can you elaborate on why you think such differentiation is important and how you think the federal government should identify which uses of ai should trigger heightened security while keeping American Civil Rights top of mind . That is an excellent question. I think about whenever you are applying security to something, people see it as an inconvenience and they dont want to do it. So, especially when it comes to innovation as well, people are moving very fast with this technology and we need to think about security as we do it rather than just rushing to get it out there. As he said, it is unstoppable once it is out. So, i think that when i look at Cyber Security specifically and the defense challenges we have, we spoke earlier about the amount of threats and the amount of attacks going up over time, and our adversaries we also touched upon our leveraging ai and trying to figure out how they can produce more attacks leveraging ai, its very important to stay, keep innovating very quickly on the Security Side and focus on, that data is the ones and zeros, the malware. What is happening on a system, what is vulnerable and using that as inputs to make the decisions. When it comes to things like you mentioned, policing, you could go to employment, credit, education, college application, wherever this ends up going, it is important to really take a look at those high risk cases and take an approach to regulation that has a purpose and why you are doing it. Those impacts, it is really impacting peoples lives in a way that maybe with cybersecurity, it is like we are helping peoples lives by preventing them getting attacked. Thank you. Do you agree that we should have different standards for different use cases and what use cases do you believe pose the greatest civil rights and privacy risks . Other witnesses are also welcome to chime in. There are certainly some types of oversight that should be universal. The principles i had mentioned for ensuring accurate results in advocacy, at the same time there are certain forms of ai that do create heightened risk to individual rights and liberties that we do need to have in standards and safeguards for. Any type of ai, for example that might be used to help make a designation that an individual should be a target of an investigation subject to surveillance or arrested, that is an example where there are severe right impacting ramifications to use of ai that would and heightened scrutiny and a number of extra safeguards in place to make sure that uses are efficacious and that you are not having problems such as the biases that you mentioned. With that, i want to thank the witnesses for your valuable testimony before this committee today. We would ask the witnesses to respond to any additional questions in writing pursuant to Committee Role 7d. Without objection, this committee now stands adjourned. Cspan is your unfiltered view of government, we are funded by these Television Companies and more. Including comcast. On thursday, the president of northwestern university, rutgers, and ucla testified on propalestinian protests and allegations of antisemitism on their campuses. This comes as israel hamas war continues in gaza. Watch the house education and the Workforce Committee live at 10 15 a. M. Eastern. Online at cspans Campaign Coverage continues live as they choose their partys nominee for president and Vice President , beginning friday at 3 30 p. M. Eastern. Highlights include independent president ial candidate Robert F Kennedy junior followed by a Vice President debate at 8 00 p. M. Eastern and then on saturday at 8 00 p. M