Fix the Systemic Catastrophe Omitted in AI Safety Laws

The terrorist attacks on the United States on September 11, 2001, took two years of planning and preparing. Nineteen hijackers lived in the United States for up to a year before the attacks, and those of us in the Intelligence Community and law enforcement were unable to detect enough of their activity to prevent the attacks. The planning and preparation occirred before Google was even considered a major search engine.

‍

^{Criminals of all kinds can now plan much faster while vastly lowering their profile with AI. The danger is greatest for complex, high-impact attacks that used to take expertise, time, and steps defenders could catch: recruiting, casing sites for attacks, stalking and assessing unwitting help, acquiring material support, meeting locals, and making mistakes along the way. Those were the chances to step in. Thus, AI is both speeding up planning and removing activities that have been key opportunities to intervene and prevent attacks.}

‍

THE LEGISLATIVE GAP

AI safety laws in Illinois, California, and New York (so far) describe "catastrophic risk" as a "foreseeable and material risk" that a frontier developer's development, storage, use or deployment of a frontier model will materially contribute to the death of, or serious injury to, more than 50-100 people (depending on which state), or more than $1 billion in damage to or loss of property, arising from a single incident. In other words, for the loss to be "catastrophic" in nature, it must occur all at once. While that risk exists, the greater concern is the cumulative deaths, serious injury, and destruction of millions of people, more quickly, effectively, and secretly enabled by AI.

The undisclosed burden of reducing this risk falls to law enforcement, Intelligence, and security services. Their inability to do so in any given instance results in more crime, and more victims at scales no one has stopped to comprehend (see below).

‍

THE CURRENT CONTEXT

Based on the FBI's reported nationwide totals, approximately 1.12 million violent crimes are committed annually. "Major violent crimes" include murder/non-negligent manslaughter, aggravated assault, robbery, and rape. The monthly and daily frequency breaks down as follows:

Law enforcement threat management relies on catching indicators of violent crimes mainly during the mid-to-late planning phase, before the attack moves into the final execution window. This is precisely the phase being collapsed by the use of generative AI.¹

• For domestic and international terrorism, the average timeline has been 3 to 7 months of active planning and logistics activity for terrorist cells or complex lone-actor attacks.² Operational security requirements (the terrorist’s efforts to operate undetected) have usually forced plotters to spread these activities over several months, increasing the likelihood of digital or physical detection. The accelerated expertise and reduced footprint required by using AI is thus a boon to malign actors’ operational security.

• For targeted violence and active shooters, 77% of these attackers spend a week or longer in planning. An AI-accelerated and assisted planning cycle for more than three quarters of these attacks could leave almost no time or surface opportunity for detection and intervention.

• Studies on targeted homicides and violence indicate that physical escalation builds over weeks to months. The discrete logistics phase that is the window for interdiction is already short, 2 to 14 days prior to execution. AI assistance can reduce that window further, making these crimes even harder to stop.

‍

POST-SEARCH ENGINE, PRE-AI CONTEXT

Studies conducted prior to 2020 and the introduction of AI already provided evidence that access to the Internet reduced the timeline of detection and opportunities for interdiction of major crimes.^{3 4 5} Some researchers focused on the length of time between a subject's first recorded radicalization/grievance event and their first physical preparatory step:

• For example, historically, moving from radicalization to capability required joining an established cell, finding an expert mentor, or obtaining scarce physical manuals. This operational timeline was roughly 1-3 years.

• Search engines eliminated the requirement for physical intermediaries. The timeline from initial interest/ideation to obtaining actionable tactical instructions (bomb-making schematics, soft-target vulnerabilities) dropped from years to weeks or days

‍

POST-AI MAJOR CRIMES FORECAST

There hasn't been much appetite for forecasting how AI will inevitably accelerate criminal planning cycles and reduce opportunities for detecting them. Moreover, while AI does make mistakes, reducing them is part of "safety" requirements, which means malicious actors will also benefit from improved AI.

Without further study, one might consider comparing the expected results of AI-assisted major crimes to other industries' results when they integrate AI. Here there is a growing body of empirical research, though the metrics and methods may not map precisely to crime. Studies from Harvard, MIT, Stanford, and Wharton have served to quantify, among other things, how much faster entrepreneurs can move from concept to market. ^{6 7 8 9} The research suggests that AI both accelerates the usual processes and shifts the paradigm from using a search engine for mere information gathering to leveraging generative AI for instantaneous operationalization of an idea.

• Generative AI usage has reduced the time it takes to prototype and build a Minimum Viable Product (MVP) by 50-60%.

• Ideation occurs 40 x faster and at the fraction of the cost.

• In the study, Generative AI at Work, the least experienced, lowest-skilled customer-support agents who worked with an AI assistant improved by about 34 to 35%; not surprisingly since generative AI is built to provide the most relevant lessons learned and best practices to the prompter.

The final point underscores the added danger of the quality of the work AI can provide to malign actors. How much more improved will their assaults and operations become as AI models improve with time and use? What is the plan for helping law enforcement, Intelligence, and security services, who face 1.12 million violent crimes per year already, when AI-assisted criminals can plan their attacks more quickly, with more accuracy, and with fewer operational security risks?

‍

SYSTEMIC CATASTROPHE IS A CATASTROPHIC RISK DESERVING OF ACTION

In the aftermath of the 9/11 terrorist attacks, former President George W. Bush established an entirely new cabinet member, the Department of Homeland Security, to ensure the United States could defend itself from adversaries working within US territory. The 2004 Intelligence Reform and Terrorism Prevention Act (IRTPA) restructured the entire US Intelligence Community, created the Office of the Director of National Intelligence to coordinate across collectors, and established the National Counterterrorism Center, among other changes in procedures and authorities. All of these fixes were made after a failure to prevent attacks by a group that had been the subject of years of intense warnings. That failure stemmed from a narrow conceptualization of threat and a limited definition of a terrorist entity.

If the United States wishes to avoid the same mistake, it starts with recognizing that the definition of AI safety being adopted into legislation needs serious reconceptualizing now. Transparency and embracing ugly truths is a good start. At a minimum, the following deserve immediate attention: