National Security & Surveillance In The Age Of AI

Engaging in open debate will be crucial for the UK Intelligence Community to gain public trust regarding the use of Artificial Intelligence for national security purposes.

Speaking on the record to an invited audience at RUSI on 21 January 2019, GCHQ Deputy Director for Strategic Policy Paul Killworth described how Artificial Intelligence (AI) and Machine Learning (ML) have the potential to improve the effectiveness and efficiency of various intelligence functions.

However, these capabilities bring with them complex legal and ethical considerations, and there is a strong public expectation that the UK’s intelligence agencies will act in a way that protects citizens’ rights and freedoms.

The national security community has expressed a desire to engage in a more open dialogue on these issues, with Killworth stressing that ‘it is absolutely essential that we have the debates around AI and machine learning in the national security space that will deliver the answers and approaches that will give us public consent’.

However, it may prove difficult to provide sufficient reassurances to the public concerning national security uses of AI, due to understandably high levels of sensitivity.  

Public acceptance of intelligence agencies’ use of technology is driven by two conflicting sentiments. On the one hand, there is a high expectation that the national security community will protect citizens from threats to their safety, and adopt new methods that may allow them to do this more effectively.

On the other hand, the public expects the agencies to adapt and innovate while protecting citizens’ rights and freedoms. Achieving this balance is a major challenge for those in the national security community, particularly at a time of such considerable technological change.

Obligation to Innovate

It is clear why AI is an attractive prospect for a signals intelligence (SIGINT) agency. Machine learning has already revolutionised many sectors of the economy, and for many organisations the use of algorithms has become essential for the efficient extraction of meaningful insights from ever-expanding, disparate data sets.

Similarly, the volume, velocity and complexity of digital data that the UK’s security and intelligence agencies (SIAs) are now required to process is far beyond the capacity of human analysts alone.  

Moreover, the SIAs have a legal and societal duty to protect the public from national security threats, and a reluctance to adopt new methods that may allow them to do this more effectively could be perceived to be a failure to fulfil this duty. As Killworth said at the RUSI event, ‘either we adapt to start using new techniques, or we become irrelevant’.

This ‘obligation to innovate’ is driven by two main factors. First, SIGINT agencies face a problem of ‘information overload’: while intelligence gathering capabilities have progressed considerably in recent years, technology to effectively process and analyse collected data has arguably failed to keep pace.

The second consideration is the rapidly evolving nature of the threat landscape. The UK continues to face serious national security threats from a range of sources, and the SIAs’ use of new technology will be crucial to ensure they are able to keep pace with innovation in their adversaries’ capabilities.

Killworth explained that ‘within an organisation like GCHQ, there is a potential to use machine learning and AI to improve our operational outcomes. We can tackle these large problems and potentially deliver intelligence and security solutions to help keep the UK safe, in ways which we couldn’t do before’.

Drawing on the example of the UK’s ‘active cyber defence’ system, he explained how ‘defending UK cyber security systems can be done in new ways using AI and machine learning, and in the future we will almost certainly have to do this, to keep up with the challenges we face. I can’t believe that we will be doing the active cyber defence work we do today in the future, without greater use of AI.’

The challenge ahead lies in ensuring that future technological innovation takes place within a clearly defined regulatory framework that gives the public reassurances that individual rights are being respected, while acknowledging that specific capabilities must remain secret.

Public Expectations of Privacy

Public attention is increasingly focused on the governance and regulation of data analytics. With the implementation of the Data Protection Act 2018 (which transposes into UK law the EU General Data Protection Regulation [GDPR]), consumers are now more aware than ever before of how personal data is collected and processed.

The use of AI for national security purposes is likely to prove particularly controversial, given the potential intrusions of privacy and violations of civil liberties. Existing surveillance legislation, such as the Investigatory Powers Act 2016, does not impose AI-specific restrictions or safeguards, and many will likely question whether existing regulation is sufficient to account for the agencies’ use of AI.

This shift in public expectations is well recognised by GCHQ, with Killworth explaining how ‘we’ve got a society that has more robust expectations around human rights, public safety, transparency, scrutiny. There’s a challenge for intelligence officers like myself to explain and justify how we’re doing that in a way that perhaps previous generations never had to.’

However, while surveillance technology is often presented in dystopian terms, many national security uses of AI may not be as controversial as some might expect. In particular, it is important to note that AI has the potential to minimise potential privacy intrusions, by reducing the volume of personal data that needs to be reviewed by human analysts.

Either way, engaging in open debate will be essential for GCHQ to maintain public trust. Killworth described how ‘what we learned from Edward Snowden as an organisation was that when we’re dealing with technology, when we’re dealing with new ways of carrying out operations, it is absolutely essential that we engage with wider society, civil society, academia, interest groups, technologists’.

He added that ‘if we don’t have those debates we don’t have trust. If we don’t have trust, ultimately we won’t have the laws and powers that enable us to conduct our business’.

This sentiment was echoed by Lord Evans, former Director General of the Security Service (MI5), who re-iterated at the RUSI event that ‘ultimately our national security depends upon the ability of the agencies and the police to win the operational battles with the terrorists and spies, but they can only do that with political and public consent.’

It is inevitable that certain groups and demographics will oppose all surveillance policy ‘by default’, due to differences in political or ideological beliefs. But by engaging in a more transparent and open dialogue regarding uses of new technology and expectations of privacy, the national security community may be able to gain the trust and consent necessary to enable them to continue operating effectively in a rapidly changing world.
 
Alexander Babuta is a Research Fellow in National Security Studies at RUSI. His research focuses on policing, intelligence and technology.

RUSI

You Might Also Read: 

Trial Facial Recognition Technology In London:

 

« NATO Agrees Collaboration On Cyber Security
AI Will Not Replace Soldiers »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

IONU Security

IONU Security

IONU offer a security platform focused specifically on providing Data-centric Security.

Academic Centres of Excellence in Cyber Security Research

Academic Centres of Excellence in Cyber Security Research

The ACE-CSRs scheme is part of the UK Government’s National Cyber Security Strategy, working with academia and industry to make the UK more resilient to cyber attacks.

Markel International

Markel International

Markel International is an international insurance company which looks after the commercial insurance needs of businesses. Specialist services include Cyber Risk insurance.

Orange Cyberdefense

Orange Cyberdefense

Orange Cyberdefense is the expert cybersecurity business unit of the Orange Group, providing managed security, managed threat detection & response services to organizations around the globe.

SISA

SISA

SISA is a global forensics-driven cybersecurity solutions company, trusted by leading organizations for securing their businesses with robust preventive and corrective cybersecurity solutions.

Phew

Phew

Phew are New Zealand cyber security specialists with expertise and experience forged in global financial markets, IT&T, management consulting and SME business management.

MyCyberSecurity Clinic (MyCSC)

MyCyberSecurity Clinic (MyCSC)

MyCyberSecurity Clinic's main goal is toward establishing an international reference centre for excellence in the field of digital forensics and data recovery services.

Evanston Technology Partners (ETP)

Evanston Technology Partners (ETP)

ETP provides services and solutions to enable and transform businesses in the areas of cybersecurity, data protection, and efficient operations practices.

TechDemocracy

TechDemocracy

TechDemocracy are a trusted, global cyber risk assurance solutions provider whose DNA is rooted in cyber advisory, managed and implementation services.

Appalachia Technologies

Appalachia Technologies

Appalachia is a full service Managed Services Provider with a focus on cybersecurity, backed by the best engineers.

Ostrich Cyber-Risk

Ostrich Cyber-Risk

Ostrich Cyber-Risk is a risk management company that helps organizations reduce the complexity of identifying financial and operational risks related to your cybersecurity posture.

Schillings

Schillings

Shillings defends your rights to privacy, reuptation and security. We fight passionately against breaches of your privacy, attacks on your reputation and threats to your security.

Cranium

Cranium

AI is being implemented into every business process, but nobody knows whether their AI is secure. Our mission is to deliver security and trust to the AI revolution.

Circle Security

Circle Security

Circle’s breakthrough security API unifies solutions for identity and data security into one architecture and empowers organizations to secure their identity, data and privacy in their applications.

Geobridge

Geobridge

Geobridge was one of the first information security solutions providers to support cryptography and payment applications for payment processors, financial institutions and retail organizations.

C/side (cside)

C/side (cside)

At c/side, we're creating the ultimate delivery, performance and detection mechanism for browser-side fetched 3rd party Javascript.