Artificial intelligence (AI) is poised to become pervasive in military operations worldwide. In the coming decades, AI-based systems will revolutionize logistics, dramatically change targeting, and ultimately power autonomous weapons systems. Unfortunately, many of the most potent AI-based systems are unintelligible to their developers and offer unexplained outputs to their users-a phenomenon called the “black-box problem.” This paper first describes the basic AI architecture that is giving rise to the black-box problem. It then shifts to consider the unexplored question of whether black-box models comport with the international humanitarian law (IHL) principles of distinction, proportionality, and precaution, which are fundamentally rooted in nuanced context and subjective judgment. After describing the mismatch between black-box models and existing IHL principles, the paper compares existing NATO doctrine with emerging “soft law” embraced by NATO member States. Identifying a nascent movement away from explainable AI, the paper concludes by setting out the importance of interpretability and the aspects therein that should be considered by policymakers in constructing future legal norms and by military officials in assessing AI models to be used in future operations.
Outer space represents an emerging and rapidly evolving domain that, until now, has remained free from armed conflicts. However, the stark reality is that the prospect of an arms race in space is no longer confined to dystopian imagination. This change in the environmental factual circumstances is substantiated by NATO's formal recognition of space as an operational domain and the renewed calls for a Treaty to Prevent an Arms Race in Space. Additionally, the symbolic characterization of space as the ‘final frontier’, as numerous scholars have described it, highlights the urgent need for analysis of the potential weaponization of the outer space domain. Various potential weapons could be deployed in outer space. However, the primary objective of this paper is to investigate whether space debris in the highly commercialized and overpopulated Low Earth Orbit (LEO) could be weaponized. The example we focus on relates to the Kessler Syndrome and space debris generated by the use of (cyber) weapons. The central message of this paper is that the potential triggering of Kessler Syndrome by creating space debris using space weapons should be considered an internationally wrongful act. Therefore, it should be taken into account during weapons reviews under Article 36 of Additional Protocol I to the Geneva Conventions (AP I). Moreover, the paper concludes that, in the context of the examined scenario and the rise of private entities within the space sector, it is also necessary to re-evaluate the legal framework regarding liability and responsibility in outer space as it relates to the triggering of the Kessler Syndrome.
The rapid uptake of artificial intelligence (AI) systems requires similar advances in their governance. Public and private sector institutions want to adopt new AI tools as they perceive potential efficiency gains and value from them. As with every technological advance, the uptake phase of AI is the ideal time to improve the governance, cybersecurity and safety of these systems. The cybersecurity risks in AI systems are similar to the ones in other information technology systems. However, the regulation of AI systems is changing, so new governance tools are needed. Furthermore, the safety and societal impact of AI depends on the technological choices made when building the systems (e.g., biased training data, overfitted machine learning models, model poisoning attacks or needlessly computation-heavy algorithms). AI tools built with large language model technology seem to speak our languages and therefore appear deceptively easy to adopt. The goal of our research is to provide risk management tools that are similarly easy to use, even if they later lead the adopter into setting up a full technical quality management system. We have created three blueprints of AI system deployments to which an organization deploying AI can match their use case. For each blueprint, we have created high-level guidance on which cybersecurity, data rights and ethical aspects the deploying organization needs to consider. Those building AI systems can quickly match their use cases against the blueprints and speed up the secure and ethical adoption of AI.
As artificial intelligence (AI) technology advances rapidly, integrating AI into cybersecurity practices poses new challenges for professionals. This paper focuses on the legal and policy implications of employing AI tools in penetration testing (PT). Key issues explored include liability in cases where AI tools cause damage and legal compliance challenges for organizations mandated to conduct PT. This paper argues that in the case of Taiwan, a comprehensive consideration of relevant laws, such as the Code of Civil Procedure, will be needed as AI products and tools become more widespread. The other issue concerns defining qualified PT, using Taiwan's Cybersecurity Management Act as an example. This paper concludes that, in addition to proper AI governance, governments should consider the legal frameworks necessary for the practical application of AI products or systems and develop appropriate AI safety testing methods to offer reference guidelines for public agencies to introduce risk-controllable AI tools, thus preparing for the transition into the AI era.
Sea drones are unmanned vessels that operate on or below the water's surface. During the military conflict between the Russian Federation and Ukraine, the latter has demonstrated how to use sea drones to attack Russian targets efficiently. However, as Russia's defences against drone attacks are continuously increasing, the cyber resilience of sea drones is becoming increasingly important. Technological developments in shipping have brought new cybersecurity challenges. This paper contributes to the knowledge on augmenting the cyber robustness of maritime autonomous surface-floating and subaqueous drones. Firstly, we aim to support manufacturers in building affordable sea drones that reduce the cyberattack surface of commercial drones. Secondly, we offer guidance for tactical military commanders on the potential cyber weaknesses in a sea drone's specific operational environments and its reliance on particular technologies. We propose eight distinctive threat categories for cyberattacks against autonomous vessels: attacks to disrupt radio frequency signals; attacks to deceive or degrade sensors; attacks to intercept or modify communications; attacks on operational technology systems; attacks on information technology systems; attacks on artificial intelligence (AI) used for autonomous operations; attacks through supply chains; and attacks through physical access. We use the STRIDE (spoofing, tampering, repudiation, denial of service, elevation of privilege) [1] methodology in the context of each threat scenario, formulate mitigation measures to reduce the risk for each category, and link methods of cyberattack to each category.
