AI Ethics, Governance, Responsible AI: Views from the CIA's Deputy Privacy Officer | #863
CXOTalk · 16 Dec 2024
Source: https://podcasters.spotify.com/pod/show/cxotalk/episodes/AI-Ethics--Governance--Responsible-AI-Views-from-the-CIAs-Deputy-Privacy-Officer--863-e2scaks
Transcript: https://podcasts.opennash.com/shows/cxotalk/ai-ethics-governance-responsible-ai-views-from-the-cias-deputy-privacy-officer-8-c22f17/ (via OpenNash Podcasts, machine-generated)

Welcome to CXOTalk, episode 863. I'm Michael Krigsman, and today we're discussing AI governance and ethics. Our guest is Jacqueline Acker, who is a deputy privacy and civil liberties officer with the CIA. She will share her personal perspectives on these topics. I think we all know the CIA, the Central Intelligence Agency, but we're on the outside. So tell us about the CIA and tell us about your role and and what you do.

We work on issues ranging from running a traditional privacy program, like every federal agency has, to implementing statutory requirements. Uh, some of those include making sure that the public has the ability to submit complaints that their rights have been violated, uh, we're protecting Americans information under executive orders, as well as developing AI governance. Um, that is with, you know, the intelligence community, but also with the wider, um, federal government requirements. And we also support CIA's chief transparency officer.

So the goal there is to make sure that the public understands our mission, our authorities, and our oversight. And then we also work with executive branch oversight and congressional oversight and publish reports for the public. So that's just a piece of what we do. Um, there's so much more to it, and I'm so proud of my team. Uh, some of the other work that I do includes being a faculty member at the International Association of Privacy Professionals, which has actually been re rebranded recently as IAPP because the scope has expanded.

Um, as you've probably heard from many of your guests, you know, privacy work is getting so much more integral into other aspects, such as cybersecurity and, of course, even AI governance. So they're trying to tackle a lot of those intersecting issues. Uh, and then I just wrapped up my 6th semester teaching at American University for their Washington College of Law, um, their master of legal studies program. So I was really happy to to be able to do that, um, and also just likewise very proud of all of my students.

We all like these spy shows about the CIA and conspiracies. Do you folks in the CIA watch these shows, and what do you think about these shows?

Well, I can't speak for everybody, the whole CIA, uh, but I am so, and I, you know, I don't, I haven't seen every show there is out there, uh, but there's a few that I follow pretty closely. I've really enjoyed the new Jack Ryan series with R- um, John Krasinski. I love the Americans. I watched every episode of that, uh, and then kind of followed Keri Russell on her journey through The Diplomat. Uh, but I think lately my favorite has just been Slow Horses because I it just cannot get any better than Gary Oldman, a longtime favorite of mine.

So

So when you watch these shows, do you say to yourself, Oh, that's a close reflection of what we really do in the CIA, or do you say that is total science fiction fantasy? Like, how do you relate to these things?

I would say more grains of truth in them than others. Like, I'm not running around, you know, in foreign countries, like, I am definitely sit at a desk most of the day. So for me, it's always just a different, uh, a different perspective, maybe. Uh, but I think it is amazing seeing how Hollywood has always portrayed a lot of what we do. And and same thing with, like, our, you know, the counterparts in Britain and some of the amazing, you know, movies, James Bond and things like that.

I personally don't see myself as one of those, uh, but I do enjoy watching them, especially when, you know, every once in a while, there is something where you're like, Oh, that has a grain of truth in it. Um, and for me, those those moments are usually like how amazing the coworkers are and how much they take care of each other and things like that. That there's kind of a saying that at CIA we're family, and I think that's the part that I like seeing in these Hollywood portrayals.

So that sense of taking care of each other that resonates with you as being real.

That part, yeah, absolutely. Uh, I've been at CIA for over eleven years now, and I think that's, you know, I when I started there, I didn't know how long I'd be there. I was like, Oh, it sounds like a cool job. Um, I had a friend who was like, Hey, we're hiring lawyers, you should come over. And, um, and I was like, Yeah, uh, of course, I'm gonna go do that. That sounds so cool. And then I got there and I was like, Well, we'll see how it goes.

You know, I'm, you know, fresh out of law school, trying to figure out, you know, how I wanna spend my career. And I just came from a really wonderful firm, um, out in Oklahoma. So it was kind of a big leap for me to try something so drastically different. But the people are are why I've stayed and the mission, um, that I've been able to to work on as well.

Why is AI ethics important to the CIA?

For us, what's special is it's about the trust of the American people. So if we don't continue to use AI responsibly and ethically, then we could lose that trust and lose the trust of our partners around the globe, around the country and industry and things like that. So, at you know, at the very bottom line, it's really all about trust.

Trust in the agency and the the role of AI ethics is ultimately to maintain that trust.

Trust is a lot of things, but, you know, part of it is getting it right. Um, part of it is making sure we're protecting those American values, you know, privacy, civil liberties, things like that. And when we don't, you know, if we don't maintain that trust, then the consequences could include things like losing our authorities, um, our authorities to collect data and things like that. And that would make our mission of protecting the public that much harder.

So I think, you know, trust is, it's almost a fundamental, uh, part of what we have to do.

When you think about AI ethics, can you describe what that encompasses for you?

I think you that can change from organization to organization, from person to person. Um, so in addition to trust, I think it's also making sure that you others understand what you're doing, so that, you know, is part of transparency and making sure people understand that your product is trustworthy. Uh, making sure they understand you how it was created, what were the rules that you were following, uh, when you made it. And, you know, for the people I talk to in industry, you know, that can also mean, you know, explaining that to a consumer, explaining that to, uh, your insurance carrier even.

So, you being able to make those guarantees, uh, whether it's for sales or to, you know, government oversight. I think, you know, the transparency piece is a big part of the ethics. Um, it's also, I think, you, there's so much more to to ethics and creating responsible AI. But I would say, uh, having a good program in place, having processes, having, you know, some sort of governance and oversight mechanism. Um, those are all really, really key pieces to it.

So, in terms of having a a program in place, can you describe what are the components of an effective AI ethics initiative?

It really does depend on the organization. So, you know, factors could include, you know, what context you're working in. Are you in healthcare? Are you in education? Um, where are you located? Are you in the EU, for example? Um, your organization's opinion. Um, what do they value? And and all of those things play into building your program, uh, because you have to really define first, like, what do does your organization mean by AI ethics? So, for example, in the intelligence community, starting in about 2019, we wrote the principles for intelligence transparency, and those principles were based on, you know, general, uh, principles for ethical intelligence that had been around for a while.

But we used that and lifted it and shifted it for artificial intelligence. So we built on something that already existed, this kind of ethos that we already had. And then we said, Okay, well, that's great, but how do you actually do that? And so, we worked really hard with data scientists, lawyers, and people from, eh, at the time, I think it was 17 different intelligence community agencies. I don't think Space Force was, uh, was there yet.

But we worked with people across the entire community to create a framework that is basically a set of questions meant to work with any agency's authorities, um, and be very flexible even with what kind of technology it's about. So that everybody has a common script to go through for, okay, well, how do we make sure that we're upholding these values? Like, what do we mean by, you know, what is ethics? What to, um, what are our data requirements and things like that?

So, you know, that was a a really key piece for us in the intelligence community. It got signed in 2020, um, in June, which was a kind of a crazy time. But it was really important that even in the midst of, um, all of the big changes, we were setting that foundation. Because having a governance framework out early, um, and also having one that it it's, you know, it was created by so many people and and therefore can be adopted, um, writ large was really key to us.

Cause we we knew we were gonna have to use this technology. And if you set, you know, some minimum guardrails, you can go faster, right? So, like, cars originally, you didn't have brakes, and so they couldn't go very fast, but once they had brakes, they could go faster. Um, and for us, a lot of that's also still about that trust and, you know, making sure things were safe and everything.

Uh, an organization like the CIA, when you say that it's, uh, signed or or adopted, where does that adoption or authority to adopt, uh, sit inside the organization?

For the ethics framework, that was signed by, um, the then director of National Intelligence. So that was at, um, the director of National Intelligence is part of the DNI. And they kind of they're, I would say, like the integrator across all of the IC. So for IC-wide policy, uh, that's really the appropriate place there. It that's not gonna be the same at, you know, a lot of different, you know, organizations, maybe large companies have subsidiaries and things like that.

But but for governance and for ethics, even, like, within the federal community, there's a lot of different ways to do it. You can have that be more centralized, or you can have it be decentralized. Um, you could have kind of hybrid approaches where there's, you know, one group that creates the, you know, the overall policy. And then the people who actually carry it out are maybe integrated into different, you know, parts of your organization or, um, or agency.

So you've this framework, we had to write it to be able to work in all of those different environments, which was a a really fun challenge. But I think, you know, we're we're here, you know, four and a half years later, and it still works really well. So very proud of that.

Please subscribe to our newsletter. Check out CXOTalk dot com. We have excellent shows coming up. Subscribe to our YouTube channel. We have an interesting question that has come in from Twitter, and this is from Arsalon Khan, who's a regular listener. He asks great questions, and he says, Who defines the ethical boundaries, who should or shouldn't define these ethical boundaries?

At every organization, that's gonna be different. I, you know, I talked earlier about how the organization's culture matters, but also, you know, things like, what about you know, where are you located? So geography, for example. Um, I think some ethical boundaries are just built into the laws where you are. So we've seen a lot of that in the United States with different state, uh, level rules on AI. Of course, you know, with the EU, there's the EU AI Act, so you have it at, you know, for AI specifically at those kind of levels.

But I would say, even, you know, even more granularly, you know, there are rules that, you know, maintain data requirements, right? So, you know, a lot of AI, I would say ethics is actually just data ethics. Um, you know, what data are you allowed to have? You know, how long are you allowed to have it? What protections does it have to have? So some of that is just, you know, your baseline legal requirements. Some organizations, you go a little further, they take things like, uh, making sure that you have the minimum amount of data necessary to complete your job very seriously.

And others are kind of like, we need all the data. So, you know, that organizational culture is really a critical piece of that on top of, you know, what is your baseline? Like, what can you do under the law? What ha- do you have to do? Um, I think the more fun area to be is in that, you know, in between. So, you know, what should we be doing? Um, what, you know, what are ways where we can be ethical, um, but also meet our mission.

So, y- that is a harder thing to figure out who decides that. Um, and again, you know, for your organization, it might be your shareholders, it might be your CEO, it might be somebody else. Um, we're seeing a lot of organizations start to have chief ethics officers, um, even chief AI ethics officers. So it I think, like, there's still kind of some norms forming around that in the AI space. But I don't think of it as being really all that different from where we were, um, you know, previously, where we already had these data issues, ethics issues about technology, you know, who should have access to it, um, and all of those things.

So, you know, AI, I think the big change has obviously been with generative AI and kind of the focus on that. Um, and so there's been a a bigger shift towards formalizing some of those, uh, choices on who is a decision maker. But, you know, even one person in an organization should be working with stakeholders across that organization, um, to to try to make those chances. And and paying attention too to just, like, what's happening in the world.

Um, you know, what are where are ethics norms forming? Um, you know, around wherever your organization is, or, you know, maybe maybe where your clients are, things like that.

Are there unique aspects of this that are specific to intelligence organizations that might be different from what we're used to in the private sector?

There's some pieces that are unique. I would actually say there's some pieces that, you know, could be borrowed, uh, by the private sector. So, the intelligence community, you know, were part of the federal government, and for over fifty years, we have been doing privacy, um, thanks to the Privacy Act of 1974. So, there's, eh, there's a lot of requirements in that, but a lot a lot of the basic requirements include making sure that, you know, information about US.

citizens and lawful permanent residents is protected appropriately. And what does that mean? So, it means in certain systems, if you're able to retrieve information by a unique identifier, you have to have transparency to the public about, you know, what that system is, why does it exist, what protections are on that. Um, and you have to publish that on your federal agency's website so that the public can go request records about themselves, um, and they basically have this right to access their records and then amend them if they're wrong.

So there's been a big check on the federal government for fifty years, and that requires a lot of of work to make sure that, you know, data is protected appropriately. Um, and there's a lot of accountability there. So I think there's a a good chunk of that piece that, you know, companies can learn from. Um, you can go to any federal agency website and see examples of that. Um, Department of Justice, of course, has, um, has some amazing resources as well.

But even things like a privacy impact assessment, you know, a lot of organizations are looking at the federal government's privacy impact assessments and saying, Oh, we can shift this into an AI impact assessment. Um, it meets a lot of the standards, or, you know, or they're using those already for their internal privacy programs and then just, like, building on that. So, yeah, the there's that piece that's kind of special to the federal government that I think can be borrowed from.

But the other pieces that are, I think, challenging are, you know, in the intelligence community, we can't always be as transparent as we would like because we have to keep sources and methods safe. So, we can't always share the ways that we got information or who we got it from, um, and and things like that, or, like, the technology that we're using with the general public, because then, you know, we wouldn't be able to continue using those.

So, instead, you know, we have this really robust system of governance and oversight, um, with people who are cleared. So, there's cleared members of Congress, there is the Privacy and Civil Liberties Oversight Board, there's even my office, so we have our own internal oversight requirements. So that is a little bit different, but, although I say it's different, I actually see a lot of that in private companies as well. Um, you may wanna have, uh, you your own kind of internal auditing or internal oversight so that you're not, um, sharing trade secrets and things like that.

So, there's actually a lot of parallels, even though, you know, I think it, I'd like to say that, you know, it's all, um, very unique and very special, and we're the only people who do this. But, uh, but at the end of the day, I I think that there's a lot of great ideas, um, that the private sector can and has borrowed, uh, from those processes.

And, of course, what you're doing, uh, the CIA has a lot of maturity, and so there are lessons, I'm sure, that the private sector can learn from that.

Yeah, absolutely. I mean, after fifty years of doing, uh, the Privacy Act, uh, federal agencies really have some some great experience there. And it's not always been perfect. There's, you know, definitely, with any new rules and any new technology, there's challenges and there's growth. Um, but I think that, you've I always think about this actually, how, like, the Privacy Act is older than most tech companies by, like, quite a bit. So, the maturity of the federal government is something that should definitely be lifted and shifted and, um, and used where it can be.

Because the the experiences are, you know, in many ways, universal. Uh, but you're right, the maturity level is is certainly there. And you can see that in the, um, just in the documentation that exists and also just in how the transparency has worked. And there's also, you know, been this accountability, um, not just with the public, but, you know, with Congress and and other oversight through that. So, you know, for any organization that is, you know, going to potentially, you know, be have that kind of scrutiny, like, they should absolutely be be looking at the mature, uh, programs from the federal government as a starting place.

We have a couple of more questions that have come in, and interestingly, both of these questions now relate to international relationships and boundaries. So let's try these. And this first one is from Greg Walters on LinkedIn. And he says it's his contention that the AI revolution, including privacy, is being led by the US, and that the US is the best hope for an ethical and free deployment and use of AI. I'm just reading his question. And he says this, what, or he asks this, what real threats to freedom and liberty can our adversaries implement with AI, aside from drones?

There's a values challenge internationally right now, and, yeah, the US. has definitely been trying to lead on this. We saw this even with the National Security Commission on AI report. It was, like, 700 and something pages long. It came out a few years ago before, again, the generative AI boom. Um, but that report talks a lot about how this is a values competition and how, you know, there are so many different threats to values. And one of the things that I personally find interesting about all of this is, you know, the the need to protect American values.

That's, you know, obviously part of what my office does. Um, but the intersection of that need with also the need for the United States companies to be successful. Um, I think there's a lot of there there you can read eight different news stations articles and get eight different answers about, like, what part of that is important and who should win out and and you know, what that means for the international community. Uh, but I really like that.

I think that report is, um, something that still stands pretty well on explaining, you know, why some of those values, um, systems could be, uh, you know, I don't wanna say, like, in peril, but what those competitions really are at that international stage. And a a lot of the kind of predictions that it had, I think, have been playing out. So so if if you don't have 700, you know, or trying to read 700 something pages, uh, I'm sure you can find a an overview somewhere or just read the executive summary.

It's very interesting to hear you talk about this values competition and then the relationship between that and the need to maintain an ethical stance. Is there is there a a tension or or conflict, but between these two different goals?

I think there's so much alignment here. Uh, I, I strongly believe that creating technology, using technology, and doing that in alignment with your values actually helps, you know, because it helps maintain that trust. Um, it helps create an ecosystem where you can work with, you know, partners, whether that's in the private sector or sector or overseas. And and that really helps bring these kind of like alliances together of, hey, we all have the similar value structure.

So, like, let's work together. I think that's a huge strength. Um, I think that's a huge American strength. Uh, but, you know, that is that's part of why it's so important to get it right. Um, and that report really does a fabulous job of of kind of explaining, you know, all of those things. And and, you know, but personally, I I really do believe that there's alignment there. Um, I think that values are a big part of our strength.

And we have another question, uh, again, from Arsalon Khan relating to this international set of issues. And he says, When data is shared across organizations or countries, whose ethical boundaries should be followed?

It's so important to have these frameworks, these international frameworks that basically say, Hey, here's our shared set of values. And we've seen a lot of these, you know, OECD, um, definitely has several. Uh, we're seeing things out of the UN and otherwise. But but yeah, I mean, I think that the the best way is to have those standards and have people adopt them and say, like, yes, we're signing on to that. Um, because that it shouldn't necessarily be like, who, you know, whose standards are winning, it should be an agreement.

Um, and those agreements are important because it says, hey, like, my, um, my values align with your values. Now we can work together. And we've s you know, seen that anywhere from people adopting NIST, um, internationally to ISO standards. So so yeah, I mean, that's that's kind of how I would approach that instead of thinking about it as, like, a who's who's winning scenario.

What steps do intelligence organizations take to mitigate, uh, bias in AI, uh, systems for intelligence gatherings or threat assessments?

Any part of just the data life cycle, not even getting to AI, you know, there's pieces that, um, that are important. So we have strict authorities about what data we're allowed to get in the first place. So that's kind of one area where that, you know, bias could be introduced or it can be reduced. But typically, you know, what we're looking at is something that is a bias to, you know, it's very biased towards what we're allowed to do, um, which is actually pretty narrow.

So so there is some bias there. But then when we're looking at AI and developing AI, there's a million different questions that have to be asked because you you know, bias can actually be something that's helpful. So if you need to be able to find, um, s you know, s X, you know, X topic, you know, say, like, I don't know, widgets or something. Um, and you need to be able to find those widgets in pictures from anywhere, you kind of want an AI that's biased towards finding those widgets really well.

Um, so the first question I think you have to ask is, okay, well, b- what kind of bias are we concerned about? So there's bias that can be good, and then there's a lot, there's obviously bias that we really don't want. So bias that could harm, um, you know, that could harm individuals or harm civil liberties or privacy or, um, or maybe harm a specific group, um, or not have equal, um, application. But but yeah, I mean, we have, uh, our IC AI ethics framework, um, has an entire section on mitigating undesired bias, uh, and has a set of questions there.

And that's a that's a really good starting place, um, for AI. But also, I mentioned earlier, it applies to a lot of different technologies. Um, and so anytime you're using a lot of data, I think those are great baseline questions to start from. And then, of course, you know, the NIST standards are are always fantastic.

What about the internal processes when it comes to ensuring that, uh, that data algorithms don't have undesirable bias? Uh, can you talk at all about how the intelligence community manages that?

Couple of different things coming together. So organizations are different sizes, they need to be able to work within, you know, the existing programs that they already have. So, some for some organizations, they're gonna be working those issues through their existing, like, accreditation process. Or, you know, sometimes it's under a CIO's office. Some of that, um, you know, it can be woven into, you know, with the data scientists who are working on the cybersecurity side. Sometimes they're the ones thinking through, Okay, well, what are what are you know?

But is this data set even complete? Like, what do we really need this data set to be? And then how do we need to protect that data? Um, how do we need to protect that algorithm? What are different potential injection points into that? So, sometimes it's kind of done by, Okay, well, we have the experts and they're already over here, so that's who's gonna do it. Um, but it really does depend based on, you know, I would say if you ask again, like, if you ask eight different organizations, you're gonna get eight different answers.

Uh, but we are seeing more, uh, coalescing of some of those and some more, uh, professionalization and formalization in organizations, um, you know, around that. So you might have more of a process for, okay, an AI is gonna be created. Um, you know, we're gonna document what the purpose is and, you know, what the potential risks are, what the potential biases are, what the mitigations are. Um, and then have kind of different people who are responsible for each piece of that, um, including the documentation piece.

So it's getting, I think it's getting a little bit more formalized, but I would say it's still very much, um, organization dependent.

Arsalon Khan comes back yet again, he's really on a roll. And on this point, he says, if a handful of countries develop AI ethical standards, then that itself creates an a, uh, creates a bias since other countries' perspectives might not be included. And is the UN a better place for AI standards to be developed for that reason?

I honestly have not put much thought into that, so I would like to defer that one. Um, but I will, I don't know. I I think it's a really good question. It's one that I should have asked myself. Um, so I'm gonna be thinking about that probably all weekend.

Last week on this show, we had as a guest the assistant secretary general of the UN for technology. His t his actual title is chief information technology officer. And I would imagine that he would argue that the UN is the right place to do that, but it's a it. It is an interesting question because so many different countries have, uh, different levels of maturity when it comes to the development of privacy regulations and issues around AI ethics.

But, as you mentioned earlier, there is also, uh, divergence in terms of their goals and their, uh, there is competition for for perspectives here.

It's been on my to-do list to watch last Friday's episode, so I'm a little behind.

For an organization that wants to start implementing a program of AI ethics, where should they begin? And I mean implementing it in a serious way, not just not just giving it lip service.

That means having your C-suite being involved, uh, first of all, making sure that there's executive backing. Um, it doesn't always mean having, you know, somebody whose entire job is to be the chief AI officer. Uh, we've seen a lot of that at some organizations, particularly bigger organizations, but sometimes that that title is added on to, like, the chief data officer or the chief privacy officer. So depending on the size of your organization, i it's really gonna depend.

Um, but the important thing is having somebody in the C-suite who is backing that. Um, and I've seen a lot of success for the models that are doing, you know, having somebody who's a chief AI officer to coalesce everybody. Um, but a the success of an AI governance program is really built by so many more people than that. So you have to get your CISO on board, your CIO, your chief data officer. Um, you know, if those are all the same person, then congratulations, you're probably also the AI ethics officer as well now.

Um, but really figuring out, just at a baseline, what do you already have in place? Um, I mentioned earlier, like assessment and authorization processes, any sort of, like, data, um, you know, data impact assessments that you already have. What are your privacy requirements? Uh, so you really have to figure out at a baseline, what do you have? And then what do you need to add to that, um, to be able to do AI governance? So, kind of, what's the, what's the gap analysis that you need to do?

And for some organizations, that that really is enough. Um, hey, we're gonna add a few questions to our privacy impact assessment. Now it's an AI impact assessment. Uh, we need somebody to sign off on the cybersecurity aspects of AI and the data and make sure that that is, um, you know, that part's being considered a little bit differently. But one of the big changes I think that we see with, um, AI is that you can't, and not that you should be doing this for regular systems anyway, but you can't just, like, set it and forget it and come back to a system, like, once every year or something.

How often you come back to that is gonna be periodic, and it's gonna depend on a lot of factors, including, like, what is the purpose of the AI? How often is that algorithm changing? Is it machine learning, and it's changing some every day? Um, and what are the consequences? So, if, you know, the consequences are are really significant, you can't just, like, look at it once a year and see if it's still working. So that, I think, is gonna be one of the pieces that has to change the most for a lot of organizations, is having enough of a process in place to go back and look at your AI on a periodic basis that's appropriate for that exact use

case.

I have to imagine that will be a significant change for some organizations. Because if you're used to dealing with older, non-AI technologies, you put them in place, and, of course, it's basically static. But with AI, and especially generative AI, as the models change and as the prompts change, the results can be very, very drastically different.

They can be completely different. And then, you know, the other thing that's changing almost as quickly, it feels like, is the the legal compliance regimes around this. So the the there are new laws coming out, it feels like every day, um, new standards, you know, being created, it feels like every day. Um, and then boom, you know, suddenly there's a text to video generator, and you have to rethink everything. Um, so making sure that there are people who have the time and space to be focusing on, okay, well, what are the new technologies that are coming down the line and can build something that's flexible enough to anticipate, you know, significant change that might happen short term.

But things that probably aren't gonna change are things like, okay, well, we need to have some sort of data impact assessment. Or if we're procuring things, like, we need to have, you know, some baseline procurement processes. And there's been some great work being done on procurement, um, by a number of different organizations. So I think those are those are really critical pieces for a lot of organizations. Making sure that you have your lawyers involved, obviously, um, especially in that procurement, or if you're selling something.

But yeah, also having people who have the space to focus on, okay, so what laws might be coming down the pike? Um, because if you are working on creating a governance program, but you know, there's gonna be a big compliance regime, you know, being implemented, you just build towards it now. Um, and think through to, you know, it's it's easy for me to say all of this, right? But nobody has nobody has time to do this for every single AI.

So really being able to rack and stack, like, where that risk is the highest and focusing your energies on that.

You've raised a really interesting point. With AI in particular, you can't, as you said, take a a static view, because it is changing so rapidly, which places an additional burden on folks who are dealing with these issues. To not only, uh, manage and lead what's inside their organization and the ethical issues around that, but to a very large extent, also be looking outside into the environment, into the changing legal environment, the social culture environment and the expectations.

So that's that's it's like a very large it becomes a large mandate.

That's part of why we're seeing more organizations have, you know, somebody who is a chief ethics f- you know, AI ethics officer, or, you know, why we're seeing some expansion. And I, you know, I I don't wanna put words in their mouth, but I think that this is one of the things I've really liked about how IAPP has been expanding their offerings, is understanding that a lot of this has been falling on, you know, privacy and compliance officers.

So they need to know more about AI, they need to know more about cybersecurity, um, they need to know more about these different areas. So, you know, I actually helped them develop the AI governance professional certification over the last couple of years, and I help teach that class, uh, to make sure that, you know, we're kind of bringing up the next generation of AI governance professionals. And the people I've had in my class hail from far beyond privacy.

Um, and I so it it really is expanding, but kind of flexibility and and anticipation are the new nature of the game. Like you said, it's not static anymore. You can't do, like, a waterfall development process. Um, you really have to be more elastic.

And it's so interesting that if you're if you're not, if you don't have your ear to the ground. When it comes to likely potential regulations and social or cultural expectations, you can really be screwed right out of f- almost out of thin air. Because you weren't watching the broader view beyond your narrow domain.

That's really true. And, you know, there's there's so many pieces that, you know, there's still norms forming around too. So, you know, anticipating some of them. But also, like, if you have the ability and in your organization to be able to actually do some of this and figure out how to do things like, okay, well, what should an AI incident response program look like? Is it the same as a privacy incident response or a cyber incidents response program?

Probably not, because where an AI goes wrong could be, you know, the data was wrong. So, it you're gonna have a different set of stakeholders in place. But if you can help create processes that work, those might start becoming the norms, right? And go teach people, Hey, here's what's working for us. Um, you know, we had an incident, and now, you know, because we had this process, we knew where to go back and fix the algorithm.

We got rid of, you know, this, this errant data stream, and now it's working again. Or, you know, whatever your system is. But yeah, I think if you have time to focus on some of those more nascent issues, you may also be able to help influence, you know, what those norms are. And make sure that it actually works for an organization. Like the, and I say this as a policy person, but, like, I try to bring a data scientist along with me to every conversation I have.

Because, like, nobody wants the lawyers or just the policy people to be writing this. Like, it has to actually work at the end of the day. So I I would very much foots stomp having an interdisciplinary team on that.

And on that exact topic, we have a question from Elizabeth Shaw on Twitter, who says, What is the cross impact of the ethical use of AI on corporate or CIA ethics programs, the impact on each other? You you touched on this a little bit earlier.

There's kind of a cultural, um, aspect to this where you to enable adoption of AI, which organizations all need to do, right? You have to have an understanding of what your organization's values are, what does ethical AI mean to you, what does governance mean? Um, and that can also be like everybody. So even if you aren't somebody who is developing AI for your organization, if you were thinking about using Copilot, or you were using ChatGPT or Google Notebook or whatever you are using to help you do your work.

You need to understand what your organization's kind of ethics and requirements are around that. Um, what data might you be sharing with, you know, with OpenAI or Microsoft, or, you know, anybody? Have have an idea of what your company or organization is comfortable with for that. Um, but also, you know, what are, if any, requirements are there for double checking things, making sure that you're explaining that something was created with the help of AI. Just like cybersecurity, right?

Every organization has cybersecurity training, I'm assuming. Um, if you don't, let's let's talk afterwards. Um, but people have to take that so they know to not, like, you know, click on a certain email and, you know, and infect something. And that same sense of responsibility and same sense of, you know, shared values should be applied for AI as well. But I also think it's just important because that is part of your organization's ethos and, you know, part of your culture.

Um, and being able to say, like, he here's kind of where we're coalescing around, and here's your part of that is really strong.

We have another question from Twitter again from Arsalan Khan. Arsalan is really on a roll. And he says, Should AI be regulated? And if so, what about the impact on innovation?

I really do believe that when there's the right balance of regulation and governance, it can help, um, actually speed up some of that innovation. So, but this is it's so much harder with AI, I think, than with some other technologies. Because you have some regulations, um, are very much looking at just the AI technology that exists today and some of the AI technologies that people are building towards. Maybe you need a different type of governance altogether for.

So, I think, you know, we have to be very conscientious to get that balance right as a society. But going back to the car analogy, I mean, cars didn't have brakes, and so you could only go a few miles an hour. And then once you added brakes, you could actually speed up. Okay, well, extend that out. So, you know, if somebody said, okay, well, sh- we should have roads and we should make it where, you know, in some countries you you can take a right on red, and in others, it's, you know, not not allowed or whatever.

But, like, those things allow different cars, w- you know, with different drivers to be on the road at the same time and still move around. And I think that's where we need to be able to get. Um, is this, you know, kind of nice equilibrium that allows innovators to know, okay, well, I know it's not what I know what's legally allowed. Soon I and I know what space I have to move within that so I can move fast and not worry about somebody coming in afterwards and saying, Okay, well, you can't do any of that, your whole company is gone.

We we have to have some amount of, um, of kind of rules of the road so that they can work together. But also, I think that's gonna be important because AI is gonna have to work with AI, right? It's not all about humans anymore. Like, we're gonna have to have some standard so that, you know, we can say, okay, well, this AI is gonna be interacting with this AI, and, you know, how do they know that they can do that?

So, you know, we have to be able to build towards, like, the world that's going to exist, um, instead of just the one that we're in today. And that's a it's a huge challenge. I don't pretend to know the answer. Um, I think we're all working to get there a little bit at a time every day.

It's a very interesting point that having clarity around what's allowed, what's not allowed enables interoperability to take place and predictability as well, which is so important I in for any organization.

Yeah, and and for sales too, right? Like, if somebody's gonna I mean, I I don't know why this is what just came to mind, but I had a Furby as a kid, and I don't know if anybody even remembers those. But, um, there was a lot of controversy when, you know, cause everybody bought them and then they kind of did different things. And people were like, Okay, we didn't, we didn't know what we were getting into.

Like, I would like to return my Furby, or, like, or, like, my kid's Furby is now in a closet, buried underneath, like, a bunch of coats or something. So, like, it nobody can hear it. Um, that's not what you want, right? Like, you want your technology to be adopted and trusted. And, you know, for people to say, Hey, this is this was really well done. Like, I understand how it works. Um, I have as much transparency as I can.

There that trust is still, I think, at the, you know, at the baseline of a lot of this. And you have to have, you know, the trust has to go both ways. The technologists have to trust that the policy people aren't gonna just change their minds all of a sudden, right? So that conversation really has to have all of the parties at the table. Um, and I mentioned this earlier, like, I like to bring a data scientist with me basically everywhere.

If I could actually just bring one everywhere, that would be fantastic. But it it's, you know, we have to make sure that just because something sounds like a great solution, it will actually work. Um, and a lot of times, y- you that's a conversation. Um, and I'll be honest, like, sometimes the data scientists are the ones who come up with better policy solutions than the policy people. Cause they understand really the nitty gritty of like, okay, well, here's what's possible.

Um, or like, hey, and you know, that's not what we're we're building towards. So making sure that that is a conversation, not just happening, um, kind of as a blue sky exercise with a bunch of policy folks is really cre- critical.

That's definitely important if you s if you start making policy without having a a pretty complete understanding of the implications of the technology, the data, how it's actually being used and what the implications are, then your policy is gonna miss the mark. Can you talk about governance? You've mentioned governance a few times. Can you drill into what do we mean, or what do you mean when you talk about AI governance?

If you are still struggling to get your data governance program in place, I would say continue that work, um, but with an eye towards what you might need to do for AI as well. But, you know, governance means a lot of things. Um, it I think you at the baseline, it's processes that enable you to have responsible AI, ethical AI. Um, but, you know, some just very high level, uh, parts of governance, in my opinion, are things like, okay, define what is it that you're actually trying to do with this system?

What is the scope of it? Uh, you know, what is its operational environment and what specific tasks are its g- are it going to perform? Because if you define those, then you can then do this analysis of, does that actually work within our organization's ethical principles and our goals? Um, because sometimes things sound like a great idea, but then when you start taking, you know, taking a step back or peeling that onion back, you realize, like, well, maybe that the impact of that is actually not aligned with our goals.

So having, you know, governance, to me, is even just sitting down and having that conversation up front of, like, what are we trying to do here? And is that part of our, um, organization's principles? And then from there, okay, well, you know, what data do we need to do that? Are we allowed to have that data? Um, what do our stakeholders think about this? You know, whether that's internal stakeholders or external stakeholders. Um, are you in a highly regulated environment?

What rules apply? Um, what rules might apply going forward that we should plan for now? There's some really interesting, uh, work being done by various different, um, I would say, like, a lot of former government people too, where they're saying, like, Hey, if if you're trying to build something, um, if you're trying to build something that's gonna do X, you should probably figure out how to do, you know, privacy protections up front. So, you know, being able to have anonymization and and things like that.

So you have an idea of what rules might apply tomorrow, as well as what rules apply today, uh, for just your plain data requirements. So that's a big chunk of governance as well. Um, of course, bringing in your lawyers is always, uh, good advice. So making sure that that compliance is happening, not just with any of your policy folks, but also with your lawyers. Um, and then, you know, I mentioned earlier, like, common ethical principles, whether that ends up being OECD or the UN, as you talked about, uh, making sure that you're also thinking bigger than just your organization.

Okay, so what what governance do we need to have in place to have trust with, uh, people who are in this country or, you know, in this part of the world? So be thinking, like, bigger than just that as well. Um, you know, that could even include things like transparency requirements or, uh, security requirements and accountability. And then also, you know, not just doing all of this because it's like, uh, the right thing to do, but making sure it really is part of your organization's, uh, ethos and value system.

So I mentioned earlier, you having nobody has enough resources to do this for like, every single little piece of AI, because it's just it's gonna be part of a lot of what we do. But making sure you understand, like, where you really, really have to do this and you have processes in place for, um, for actually going through some of that governance. And then you you talked about bias, uh, several times, like, that's absolutely part of governance.

Um, I would say it's not just about bias, but it's also about fairness. So making sure your data sets are representative and that you understand, like, who could benefit from them, um, and who might not benefit from them. And write those down and figure out what mitigations you need to have. Um, and then have that ongoing monitoring to make sure that you're still, uh, being fair and being, um, not having undesired bias. And then having transparency, you know, whether that's with your internal stakeholders or you might be required to have that with external stakeholders.

That's a key part of governance as well, um, and then accountability. So who, like, basically, who is responsible for making sure that this use case goes the way that it should? Um, that's a really critical piece as well. You know, who's gonna continuously monitor this? Um, who's going to do the auditing? If there is an incident, what is your process for, uh, responding to that and mitigating that? And maybe even, you know, briefing it out and documenting it and remediating it and everything.

So those are all really critical pieces. Uh, I would also say just iteratively improving on something. So not just checking to make sure it doesn't go wrong. But as we have new technologies or as we have new standards, you know, how are we going to integrate that into our system? So governance can mean more than that. Um, it can again change kind of depending on the organization, but I think those are some some kind of basic, um, areas where most organizations align about what is governance.

Wow, you've just given us the PhD course on governance.

Oh, hardly. There's so much more to it.

I can see you're very passionate about this topic.

I could do it all day, every day, actually, that's kind of my job. So, um, plus, you know, plus privacy and civil liberties and all that other stuff. But no, it's, um, I've been really lucky to be able to work on this for over six years at this point. Um, I like to say I did it like before it was cool, but it it is amazing how, with the advent of generative AI, you know, so much more focus has come to, you know, come to bear on these issues.

And I think it honestly, a lot of it's just gotten more complex, and for me, that makes it more interesting. Uh, but I'm really glad that people are having this conversation. Um, I think, you know, to kind of together, we're all creating those norms and, um, helping move the world forward on it.

What advice do you have for business people? What can business people learn from government efforts?

There's so much out there that you can pick and choose from and kind of make sure that you're tailoring it to your organization. And, you know, looking at anything from okay, well, what are transparency reports looking like? Um, I mentioned data impact assessments, privacy impact assessments, um, as well as, you know, I briefly mentioned, like, system of record notices that explain to the public, here's how we protect your data, here's the requirements there. Those are all fantastic resources, uh, to get started if you're like, I don't know what to use.

But also, we I think, you know, not just because the government has experience, but they also have lessons learned. So I would I would learn a little bit about the history there. Um, but also maybe learning about, you know, what's not the same. So if we're, you know, we're working for the American public, maybe not for shareholders, you know, what is that nexus and, like, what what might you wanna do a little differently?

Very interesting. Well, a huge thank you to Jacqueline Acker, who is the deputy privacy and civil liberties officer with the CIA. Jackie, thank you so much for taking time to be with us. You're very interesting comments.

Oh, thank you. Um, no, I'm I'm glad to be here and share kind of my perspective and thanks for all the great questions too. I I know I will be thinking myself about some of those all weekend, so.

Yes, thank you to everybody who watched, you folks who asked such great questions. You guys are really smart. Before you go, please subscribe to our newsletter. Check out CXOTalk dot com. We have excellent shows coming up. Subscribe to our YouTube channel, and we'll see you again soon, everybody. Thank you so much and have a great day.