Artificial intelligence has become increasingly important to the federal government, with rapid adoption across the private sector and federal agencies. However, this growth has also prompted calls for stronger federal oversight to manage emerging threats.
The Push for AI as Critical Infrastructure
A new report from the nonprofit Americans for Responsible Innovation calls for the federal government to declare key AI models, companies, and supporting industries as critical infrastructure. This designation would recognize the AI sector as a critical component of national infrastructure, similar to existing sectors such as energy and finance.
Definition of the AI Sector
The report defines the AI sector as organizations, facilities, technologies, and industries whose primary purpose is the development, training, deployment, and operation of AI systems. This includes frontier model designs, model weights, evaluation and alignment systems, data centers, and AI-specific hardware.
The authors of the report, Terrence Kelly and Jessica Maksimov, argue that the AI sector already bears the hallmarks of critical infrastructure, being interwoven with public and private services, concentrated among a handful of foundation models, and increasingly interdependent with other critical infrastructure sectors.
CISA as the Lead Agency
Maksimov believes that the Cybersecurity and Infrastructure Security Agency (CISA) makes the most sense to lead the sector's cybersecurity efforts due to its statutory mission, experience managing eight other critical infrastructure sectors, and background dealing with cybersecurity problems that cross different sectors and industries.
CISA's coordination authority across all other departments would allow it to effectively manage the AI sector's cybersecurity efforts, which are likely to impact multiple sectors, including finance, energy, and government services.
Vulnerability to Disruptions
The US is particularly susceptible to AI supply chain disruptions, with many frontier AI companies and computing resources based in the country. A major disruption could have outsized economic consequences, and experts warn that the infrastructure supporting AI capabilities is vulnerable to both physical and cyber attacks.
Recent events, such as Iranian drones attacking Amazon-owned data centers and Ukrainian drones striking Russian e-commerce giant Wildberries, have demonstrated the potential for disruptions to critical internet services.
Designation as Critical Infrastructure
Designating the AI sector as critical infrastructure would carry significant weight in terms of how departments and agencies prioritize their limited resources. It would unlock a wide range of federal tools and resources, including operational continuity and incident response services, cybersecurity software, and access to federal systems like Continuous Diagnostics and Mitigation (CDM).
Former assistant secretary of homeland security for cyber infrastructure risk and resilience, Matt Hayden, believes that designating a sector or industry as critical infrastructure means the government puts it in a special category where it's identified as being a component of a national critical function that the US population and economy depend on.
Challenges and Coordination Issues
However, Hayden notes that other sectors, such as space or cloud computing, have similarly argued for a critical infrastructure designation, and that any effort to formalize a federal lead for AI security would result in a bureaucratic turf war.
Bob Kolasky, former director of the National Risk Management Center at CISA, believes that companies like OpenAI and Anthropic, as well as data center operators, will eventually be designated as critical infrastructure. However, he notes that it's still an open question whether new programs like ANCHOR-CI will be an improvement over existing processes.
Kolasky emphasizes that every sector will rely on artificial intelligence, and making more resilient the sectors themselves and understanding how they use AI and the dependencies will still be an important task.
Source: CyberScoop