Just Security

Really excited to be part of @just_security 's series on Filling the Accountability Gap in AI Governance. My contribution is about the gap in anti-hacking law exposed by the OpenAI–Hugging Face incident. There’s a case for applying existing anti-hacking law, but there are challenging obstacles on whether to courts can assign intent to corporations that make these it hard to use it. (Interestingly, while the article is focused on the U.S. Computer Fraud and Abuse Act, similar issues appear to exist in UK and Australian laws—as well as state anti-hacking laws like California's CDAFA.) That’s why the article calls for amending the law to reach developers and deployers who recklessly cause unauthorized access through autonomous AI agents. An important point to keep in mind is that clearer rules can benefit both potential defendants as well as the public. A proposal like this has been put forward by @HawleyMO and @ChrisMurphyCT. While a lot of people are nervous about expanding the CFAA, it's important to keep in mind that this gap isn't going anywhere, and this approach isn't incompatible with reasonable safeguards against entrapping innocent people in CFAA violations (such as requiring that there be circumvention of technological barriers to access and keeping the standard at recklessness).