Person
3 episodes · 37 quoted claims
David Bray says that about fifteen years before the episode he advocated a public-health-style approach to cybersecurity, in which organizations share what they are seeing without sharing specifics.
“I can remember about fifteen years ago, I was pushing for, um, almost a public health approach to cybersecurity”
David Bray describes federated learning as a method in which the algorithm travels to each organization's data and learns there, so the data is not shipped elsewhere.
“instead of having the data be shipped somewhere, the algorithm comes and learns there”
David Bray says enterprises are not yet mature enough with digital twins to run fast simulations of the second- and third-order consequences of a security tool's actions.
“despite all this talk about digital twins or or whatever, we're really not that mature in terms of enterprises.”
David Bray suggests a sophisticated attacker could trick a company's security tools into taking its own systems offline, which would also demoralize the security team.
“if I was a really sophisticated hacker, I would make it so that you did it to yourself.”
David Bray says there are indications that bad actors found code libraries that AI tools reliably hallucinate and then wrote real open-source libraries under those names.
“some bad actors have identified when AI is being used for coding, for vibe coding, reliably hallucinates, and they have identified those reliable hallucinations and gone out and written a code library for the very hallucination”
David Bray says chief information officers and chief information security officers originally reported to chief financial officers and later to chief operating officers, which framed cybersecurity as prevention.
“both CIOs and CISOs initially reported to chief financial officers, then later chief operating officers.”
David Bray says a smartphone gives its owner capabilities comparable to the CIA of the late 1970s and early 1980s, and about 2 billion people have one.
“You have the CIA in your pocket, circa the late nineteen seventies, early nineteen eighties, and 2 billion people on the planet have it.”
David Bray cites anarchists' use of TNT in the 1910s and 1920s as a past threat that society handled with defense in depth, not by locking down.
“In the nineteen tens, nineteen twenties, there was this thing called TNT. TNT was being used by anarchists to do bad things, but we didn't go into lockdown mode.”
David Bray says an unnamed big tech company first tried replacing cybersecurity staff with AI, then found that humans looking for new exploits while AI handled known vulnerabilities outperformed.
“Unfortunately, they initially went down the path of replacing their cybersecurity people with AI, which I do not recommend, do not do, but they tried that.”
David Bray says safety filters applied after an AI computes are unlikely to be fully safe, and he prefers rules applied before computation.
“If something has a filter or a safety applied after compute, so post compute, I get very nervous about post compute agentic AI ever being 100% safe.”
David Bray says some US Navy vessels have a defense system that becomes fully autonomous when the captain flips a switch.
“we do have US. naval vessels where if the captain of the ship flips the switch, there is no human in the loop.”
David Bray says Waymo vehicles stopped when a power outage occurred, which he cites to show that interconnected AI systems can fail without any cyberattack.
“We saw when the power went out, they stopped, and that was not a cyber attack, it was just the power went out.”
David Bray says foreign jammers can block communications and geolocation signals within a three-kilometer radius.
“I've also seen where there are foreign jammers that can basically squelch any comms, any geolocation within a three kilometer radius.”
David Bray defines trust as the willingness to be vulnerable to the actions of an actor you cannot directly control, whether a human, organization or AI.
“I define trust as the willingness to be vulnerable to the actions of an actor you cannot directly control.”
David Bray recommends Ellen McCarthy's Trust and Media Cooperative, which aims to give people tools to assess information themselves or in communities.
“I will give a shout out to Ellen McCarthy's Trust and Media Cooperative, which is trying to give people the tools to do this themselves or in communities.”
David Bray holds a role with the Stimson Center, specifically its Stimson Accelerator.
“One of the roles is with the Stimson Center, specifically the Stimson Accelerator.”
Bray says an unnamed AI model around 2023 gave a population for the US state of Georgia of about 350 million, because it had learned from a source with a typo.
“it would confidently tell you that the answer was something around 350,000, sorry, 350 million people, as opposed to a more realistic answer.”
Bray says some COVID vaccine sites were placed where people live rather than where they work, which made workers with long hours look reluctant to get vaccinated.
“we know there's been cases where COVID vaccines were placed where people live as opposed to where they work.”
Bray cites the automatic defibrillator as a successful rules-based AI system from the era of expert systems.
“an automatic defibrillator actually is running rules-based when it tries to decide when to give you that shock.”
Bray describes a paper from a major AI company in which a model told to write insecure code secretly began producing hateful output, which he links to its internet training data.
“where they told the machine, write code that's insecure, but don't reveal it to the user.”
Bray compares early-2020s generative AI training to Napster, the 1990s music-sharing service that did not respect artists' rights.
“there was this thing called Napster. Uh, it did music sharing, but it didn't really respect any of the artists recording rights or any intellectual property.”
Bray says that in World War I the British considered Q-boats, military ships disguised as civilian vessels, ethical, a view that changed after the Lusitania was sunk.
“in World War I, the British thought these things called Q-boats, which were military boats disguised as civilian boats, were ethical.”
Bray says existing US legal frameworks already make a company responsible for harm caused by AI used to provide its service.
“even if we haven't made explicit laws, there's enough of a legal framework to say that if the organization uses AI to provide you a service, then they are responsible for what the AI provides.”
Bray says he took part as an expert witness in a public congressional hearing on AI held on September 28.
“There actually was a public hearing on AI. It was September twenty eighth, and you can find it if you do Congress dot gov.”
Bray says US states have led on AI regulation, with more than one thousand existing or pending pieces of AI legislation.
“the states have actually led the way when it comes to thinking about AI. There's more than one thousand pieces of either existing or pending AI legislation.”
Bray says the US Privacy Act of 1974 arose because mainframe computers, then called advanced data processing systems, let the government know more about individuals.
“Remember the Privacy Act of 1974? That came out because these things called advanced data processing systems, mainframes, required the federal government of the United States to think about”
Bray says Russia has run an intensive campaign aimed at teaching large language models untrue things about events, history and people.
“Russia has done a very intensive campaign focused not just in the US. but other free societies, to teach them things about events, about history, about people that actually just are just patently not true.”
Bray refers to a recent discovery of a large number of phones near the UN General Assembly, which he says could be used to fake social media engagement.
“there was a discovery of lots of phones next to the UN. General Assembly. Now, we don't know exactly what that was for,”
Bray says that during his earlier work on bioterrorism and public health response, red teams were called the B team.
“when I used to do response to bioterrorism and public health, we called them the B team.”
Bray says European nations agreed to ban chemical weapons in 1889, yet both sides in World War I had secretly researched them, which he uses to doubt an AI non-proliferation treaty.
“So in 1889, they banned them. And come World War I, guess what? Both sides had been quietly researching how to do it, and they had done it in quiet.”
Bray says Health Level Seven, a nonprofit, maintains standards that let patients request their medical records in digital form they can analyze with AI tools.
“using the tools in health level seven, which is the nonprofit that actually makes sure you can request those records and they're in a way that you can actually analyze.”
David Bray worked on a bioterrorism preparedness program that tried to connect to hospital and state systems from the early 2000s to 2005.
“In a past life, uh, I was with the bioterrorism preparedness program. This was back in the early 2000s to 2005”
David Bray says the number of CPT claim codes grew from about 12,000 to about 72,000 over roughly twenty years.
“about twenty years ago there were 12,000 CPT codes for claims, now we're up to 72,000 CPT codes for claims.”
David Bray says the UK uses data trusts, and the US can use data cooperatives, to let communities control how sensitive data is used.
“In the UK, they call them data trust, here in the United States we call them data cooperatives.”
David Bray says a Birth to Three effort used existing contract law to create a data cooperative that includes community members and bars monetizing the data.
“we used existing contract law to create a data cooperative that includes members of that community”
David Bray says ultrasound for pregnant women met early resistance before becoming standard, as a model for patient adoption of healthcare technology.
“Initially, when ultrasounds and sonograms for pregnant women were introduced, uh, there was resistance.”
David Bray says laws rarely expire, leaving healthcare rules from the 1940s to 1960s that may no longer fit.
“there's things still on the books from the nineteen forties, nineteen fifties and nineteen sixties that may have made sense then”