The Canadian government is in the midst of overhauling its national AI Strategy which, in line with its focus on national security issues more broadly, could result in foregrounding AI security as a, or the, dominant AI policy concern. Part of that strategy could include redefining the role of the Canadian AI Safety Institute (CAISI)—the UK government recently did so, redefining their AI Safety Institute as the AI Security Institute. Narrowing oversight efforts to ensure AI is secure instead of safe would place Canadians at increased risk of AI harms; security does relatively little to ensure safety. In the absence of targeted AI regulations aimed at making AI safer, fairer, more accountable, and so on, a narrower policy focus on security would leave the public exposed to existing and emerging AI harms, most of which fall outside the narrower technical purview of security.
A policy shift from safety to security would mark a strong departure from Responsible (a.k.a. ethical) AI practices, which have historically addressed a broad set of sociotechincal AI issues. Roughly ten years ago, the world’s AI decision-makers—governments, policymakers, NGOs, academics and many companies—developed and publicly endorsed a broad conception of Responsible AI. Commensurate with a growing list of demonstrated AI risks, they proposed long lists of AI principles meant to guide Responsible AI practices, everything from engineering and computer science practices, to corporate policymaking, to education priorities, to sectoral regulations, so the world might have trustworthy AI. That list included safety and security as guiding principles, but went further, promoting alignment with such additional principles as accountability and fairness. In other words, Responsible AI emerged with an explicit focus on a much broader set of social impacts and issues than simply safety or security.
Focusing AI policy too narrowly on security would, by definition and at best, push safety issues into the background. The reason is fairly straightforward, but not obvious. Security is a well-established technical domain that focuses on a narrow set of concerns, primarily preventing unwanted access or manipulation of IT systems. By way of some examples: a secure system is one that requires user authentication—sometimes two-factor—for access to the system, that ensures data in the system came from a trusted (i.e. another secure/authenticated) source, and that generates logs or other records to support system auditing. Foregrounding security would, therefore, reduce the policy problem to a narrow set of relatively objective technical goals, bracketing out safety issues that tend to present as subjective and sociotechnically complex. Secure AI systems might also include some protections against prompt injection and other “AI hacking” techniques. But none of these security features focus directly on improving public or user safety. “Safety” and “security” are related to one another in some cases, but security violations are not, in and of themselves, safety violations.
A security-focused approach to AI policymaking, in the absence of safety-specific policy, fails to address most safety issues. In addition to falsely framing most safety issues as digital “break and enters”, it provides cover to those individuals and corporations who would (and do) regularly harm people via secure systems. A perfectly secure AI-powered social media platform, for example, could do immense harm. It could be designed to encourage people to upload stories and pictures of their friends and family members, professional lives and relationships. It could mine that data to learn more about the user’s personal life, friendships, beliefs and habits. It could deploy an LLM-powered AI chatbot to engage users in highly emotional conversations to discover ever more personal details (and store them securely in the cloud). It could then engage in subtle, powerful, manipulation techniques designed to shift the user’s beliefs, by feeding them information that is biased, or partially or entirely false. It could employ affective computing techniques (e.g. ego stroking, a sympathetic tone, an attractive avatar) to promote addictive attachments to the platform by manipulating the user’s psychological and neurological states. It could then use other sophisticated psychological manipulation techniques to discourage them from trusting people with opposing beliefs, or promote other violent, harmful or unsafe behaviours.
Manipulative. Dishonest. Physically addictive. Unsafe. Perfectly secure.
Of course, security is important. Security features help to underwrite safety where safety is threatened by unauthorized access and use of a system.
The point here is that focusing on security does not, in and of itself, improve public or user safety when it comes to AI or any other digital system. Ensuring safety requires an explicit focus on safety.
To prevent Canadians’ continued exposure to unsafe AI, policymakers need to embrace a broad set of safety objectives that include security as one among many guiding principles that can help make AI safer and more ethical. If Canada’s new AI Strategy foregrounds security as the dominant AI policy, the Canadian public will remain unsafe.