The report, titled “The 2019 Federal Scorecard,” was released in July.

“What we’re seeing is an overall reduction in science and technology investments on the federal side, but within the budget that does exist you’re seeing an increase in the kinds of technologies that are critically important for what those departments do and how they fit into DoD,” said Kathryn Harris, senior vice president strategy and growth at Govini.

These cuts are seen most dramatically in agencies such as the Department of Energy and the National Institute of Standards and Technology, according to Govini’s findings. NIST’s budget would shrink about $300 million in the fiscal 2020 budget request.

However, while federal agencies are facing overall cuts for technology, some specific programs within these agencies are slated to receive funding increases, such as the Energy Department’s Office of Science, which has requested a $5.5 billion request for funding to advance artificial intelligence, machine learning and quantum information science. These increases will add $10 million to quantum, bringing the total to $169 million, $8 million for artificial intelligence, bringing their total to $71 million, and $10 million for microelectronics, bringing their total to $25 million, according to Govini and the fiscal year 2020 budget request.

“It’s sort of a mixed bag. You see the overall top line reduction for technology, but nonetheless small good trend that there is a slight increase in the kinds of technology that are most highly relevant for great power competition,” Harris said.

Funding for cybersecurity in the president’s budget request for fiscal 2020 also falls under the characterization of “a mixed bag,” Harris said.

The Energy Department’s Office of Cybersecurity, Energy Security, and Emergency Response is slated to receive at 30.4 percent increase from fiscal 2019 levels. In addition, the FBI requested an increase of $70.5 million to target cyber actors, according to Govini’s findings.

“It seems to me that the FBI is trying to make a shift from a counterterrorism mission that they have had for the last almost two decades to more of a sort of modern global competitor mission,” Harris said. “This increase in cybersecurity and targeting cyber actors that threaten U.S. interests in the homeland is critically important.”

However, funding for DHS’s Cybersecurity and Infrastructure Security Agency, one of the biggest civilian federal investments, has decreased by 5.6 percent, a fact Harris calls concerning.

“They list cybersecurity as one of their top priorities, yet it is still cut by 5 percent,” Harris said. “Across the interagency, DHS has the overall lead for cybersecurity as well. So there is a little bit of inconsistency, I think, with what they say is their priority, what their role is, and the importance of their role in the interagency.”

IoT devices can create cybersecurity vulnerabilities for government agencies by exposing private data, the accuracy of data or data availability and may compromise personally identifiable information. As the popularity of the devices grows, so too does scrutiny. In March, a bipartisan group in Congress proposed the “Internet of Things (IoT) Cybersecurity Improvement Act of 2019” that would require that devices purchased by the U.S. government meet certain minimum security requirements.

Here are three ways the report, titled “Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks,” can compromise security:

They are vulnerable to the physical world

IoT devices are particularly vulnerable because they interact with the physical world differently than IT devices. For example, IoT devices can manage items such as heating coils, cardiac electric shock delivery, electronic door locks, unmanned aerial vehicle operation, servo motors, and robotic arms, the report said. This gives them ability to make physical changes to their environment and potentially endangering human safety.

They can be difficult to manage

IoT devices are often accessed, managed, and monitored differently than traditional devices. The report refers to IoT devices as “black boxes” that offer little visibility into their composition, software, and configuration. IoT devices commonly lack management features and interfaces, which can make it difficult to manage them.

They can require excessive management

IoT devices often have different cybersecurity capabilities than traditional IT devices. The report stated that managing cybersecurity on IoT devices can be difficult and even excessive. This is a result of how built-in cybersecurity measures and after-market security measures differ from IT devices.

The report recommended adjusting policies and processes as a way to mitigate these risks.

New research reveals that 73 percent of respondents in a recent study have experienced a cloud-related security incident due to inadequate security practices. Symantec’s Cloud Security Threat Report (CSTR), released June 24, finds that while 53 percent of respondents reported workloads moving to cloud applications, 54 percent said their security practices have not kept up at the same rate.

The study covered around 1,250 different IT decision makers in about 11 different countries with about 10 percent coming from global government respondents, said George Teas, senior director of Systems Engineering at Symantec.

According to the report, cloud technology is not responsible for data breaches. Instead, the authors point to three causes. They are:

– Slow security modernization on cloud applications. “Our research shows that 69 percent of organizations believe their data is already on the Dark Web for sale and fear an increased risk of data breaches due to their move to cloud,” said Nico Popp, Symantec’s senior vice president of cloud & information protection.

– Complex IT systems. According to the report, 64 percent of security threats are tied to the cloud and 25 percent of cloud security alerts go unaddressed. “A data breach on information using a cloud application or taking an application that doesn’t have the right security controls into it is a vulnerability of the entire network,” Teas said.

– Risky behaviors. These behaviors run contrary to recommended security practices and expose data on the network to breach. The report cited oversharing as one of the most common risky behaviors, with 93 percent of respondents reporting oversharing as a problem on their networks. Teas refers to this data as “shadow data.”

“It is basically customers putting data into cloud applications that are either overshared, i.e., they let too many people see the data, or the data should never reside in there.”

Embracing a zero trust model

One solution the report suggests as a solution is a zero-trust model.

“The idea behind zero trust is to have complete visibility into the data flow and the user traffic that is going to cross in accessing the application,” Teas said.

These security measures are especially important to federal government officials as they transition to the cloud, Teas said.

“They are going to need the same policies regardless of if their data is on the premise or whether or not their data is on the cloud,” Teas said. “They need to have a holistic visibility approach.”

For federal governments, data security on cloud networks can have significant implications for national security, Teas said.

“For national security we have to know what the data is, where the data is at, and who is it being shared with so that you can understand your risk exposure and who you are allowing to have access to that data,” Teas said.

To implement these practices, Teas said organizations need to change how they view security using what he calls development security operations.

“They are building the application and then bolting security on top of that. What they need to start doing to get in front of this is actually building security into these applications so it is a foundational part, anytime they develop,” Teas said.

NASA has previously used AI in human spaceflight, scientific analysis and autonomous systems. It currently has multiple programs that use AI/ML: CIMON, which is “Alexa for space”; ExMC, medical care AI assistance; ASE, autonomy for scheduling in space; Multi-temporal Anomaly Detection for SAR Earth Observations; FDL, partnership between industry and NASA through AIMs; and robots, and rovers.

In a June 26 presentation at the AI World Government Conference in Washington, D.C., Brian Thomas, a NASA agency data scientist and program manager for Open Innovation, spoke about how to get the best results for AI/ML while considering important policy and culture implications at the agency.

Machine learning has been with us for 60 years, Thomas said, “so really the question is, why haven’t we been using this all along?”

“We’ve already seen the value in these technologies,” Thomas said. “They are enabling NASA’s mission now. The problem is that we’re being held back, believe it or not, and so how can we do better.”

Whereas NASA was once held back by insufficient means to collect and process data, “we are now getting to the point where we have collected enough data that data is accessible … and having enough of it to make that [AI/ML] happen,” Thomas said.

The agency still faces a challenge when it comes to processing power of these volumes of data, however, which is crucial to being able to train your solution.

“Many of these things can not be trained on your laptop. We’re not at that point anymore. We moved away from that probably a decade ago.”

After addressing how to handle the data, the next question to answer is why.

“What is our ultimate goal here? The goal is to apply value, right? We’re not here to do science fiction. We’re not here to say, ‘oh wow, that’s really cool.’ We’re here to apply this to NASA’s mission and make things actually happen.”

In this regard, Thomas said the four categories where NASA is currently looking to utilize AI/NL are: aeronautics, operations, human capital and IT support.

When it comes to aeronautics, the belief is using AI/ML could allow NASA to build better vessels and equipment.

“The last thing we want is to have that tested wing or model blow up in a wind tunnel,” Thomas said. “So, can we model a very complex engineering structure to understand when we are getting really close, because we can’t do it now with the traditional model and technique.”

In terms of operations, NASA could use AI/ML technologies to assist in antenna positioning to make maximum contact with satellites, Thomas said.

Workforce uses of AI/ML are a top concern for most agencies, and NASA hopes to use these new technologies to learn more about who is working for them.

“Can we look at our position descriptions and analyze those using text analytics and try to classify that out and then make predictions about what we need to do or where our workforce is at,” Thomas said.

NASA is also looking to AI/ML to help understand network intrusions and how to avoid them, Thomas said.

As it moves forward with AI/ML innovations, Thomas said, NASA is looking at the possible implications of these new technologies.

“Machine learning, every solution we create is bespoke, particularity in supervised learning; it’s all tied to the data.”

“[It’s] a way of thinking about how health information flows across the country and the first step is getting it in digital format,” Paula Braun, entrepreneur-in-residence at the Centers for Disease Control and Prevention, said.

Using AI to collect and analyze mortality data, Braun was able to create coherent information that made systemwide improvements possible.

Data and AI is also being used to track the effects of policy changes in Medicare and Medicaid and how those changes impact program spending, program utilization and the health of beneficiaries, said Alison Oelschlaeger, director and chief data officer, Centers for Medicare and Medicaid Services. Oelschlaeger also tracks how CMS is sharing data to researchers, providers, and the patients themselves.

As certain medical services moved from hospitals to community-based care, data had to be collected and shared with public officials on where electricity would be essential to deliver medical care in the case of an emergency, said Kristen Finne, director, HHS emPOWER program and senior analysis, Office of Emergency Management & Medical Operations, ASPR.

“We realized how we can actually take federal health data, using machine learning and data analytics, and bring it to our public health authorities,” Finne said.

Finne said through this process they have been able to locate all 4.1 million beneficiaries so that in an emergency situation public health officials can provide them with the assistance they may need.

To spur these changes, however, there needs to be investment in new technologies, said Lisa Bari, senior technical adviser, Value-Based Transformation Initiative, U.S. Department of Health and Human Services.

To create incentives, Bari said, they ran an innovation contest — the CMS AI Health Outcomes Challenge — with a $1.6 million prize. The goal is to get people to use CMS data to help predict health outcomes and address how to create new ways to pay for and deliver care that allows for providers and suppliers to invest in new technology.

Using these innovations is changing the current health care system, Bari said.

“The way that we surveil and treat disease in our country is becoming more and more autonomous small parts that are paying attention to signals that would be very difficult for humans to decipher and having information streams that are delivered to individuals in a way that they can readily interpret it and take action on it.”

However, these innovations must be accompanied by a change in perspective as well, Bari said.

“We are in the early days of value-based care. We just don’t have enough adoption and until we can break free from the fee-for-service structure where everyone who develops new technology to sell to providers, suppliers, the government, or anyone is looking for a billing code … Until we get away from that mentality and that business model we are going to have a hard time scaling new technology.”

The White House plans to approach AI as a means to improve manual tasks and free federal workers to do higher value work, said Federal Chief Information Officer Suzette Kent at the June 25 AI World Government Conference held in Washington, D.C.

Benefits could include insights for policy development, first responders and self-driving vehicles, an improvement in the overall customer experience, and much more.

“What are the capabilities of the individual technologies as well as, from a workforce perspective, how it can fit in the environment that they are operating in against the mission they are trying to serve,” said Kent, explaining that four ingredients must be present for success: high-quality data, modern networks, advanced computing systems, and ethics and security.

According to Kent, the White House action plan aims to harness the power of AI using federal data. But first agencies must make sure that the data collected is in a form that can actually be used by the federal government.

“Consider this initial policy step something like guard rails,” Kent said. “We are purposely defining it in that way so that we can support agencies in their exploration and application of our technologies so that their journey is matched with the appropriate level of control and discipline based on the expected outcome and the consequence of that activity.”

AI has already featured prominently in recent policy and legislative documents, including the March 2018 President’s Management Agenda’s data cross-agency priority goals, as well as executive orders, the formation of the President’s Select Committees on AI, defined priorities in the budget process, components of the national cyber strategy, strategies from specific agencies and congressional attention in both the House and Senate.

“The whole of government has a focus on AI capabilities and federal leadership is united in making this a priority,” Kent said.

However, there are concerns about the unintended implications of such a complex technology on both the public and the federal workforce; for instance, whether there are ethical implications of using AI in federal networks and could federal employees see their jobs replaced by new technology.

“Yes, there are some manual jobs where we have opportunities to do it better, lower margin of error, less time, more efficient outcomes, but it also creates new jobs,” said Kent, who added that making sure the federal workforce has the necessary skills to fill these jobs will be a concern that will have to be addressed through the education system and will force a reconsideration of how all American workers are trained.

Kent characterized it as a meeting of both federal and national workforce priorities.

And, to ensure the security of data collected by agencies, the government is also focusing on identity, credentials, and access management on federal networks by understanding who is accessing these networks, Kent said.

Expanding this AI-focused IT modernization will make the role of chief data officers increasingly important, according to Kent, but the first step is to get more agencies working with the technology.

“Our goal is to just get them to start,” Kent said.

A survey, conducted by TRUE Global Intelligence, looked at global business and IT executives and managers from the US, UK, Germany, France, China, Japan and Australia and found 60 percent of respondents reported half of their data was “dark” (how the report describes unknown and untapped data).

“In an era when every organization says it’s trying to collect, manage and leverage more data than ever before, and every analyst, author and consultant evangelizes the necessity of analytics, it is surprising how much data is missing in action,” the report states.

Of the respondents, only 12 percent currently use AI in their businesses; however, 63 percent said they will do so in the next five years, according to the report.

One reason AI is not currently implemented in these businesses, according to the report, is a lack of knowledge. The report states that 81 percent of organizations lacked trained AI experts and 80 percent lacked an understanding of AI.

“A better, more complete understanding of an organization’s data will continue improvements in analytics-based decision-making, a key reason to surface dark data,” the report states. “This untapped data represents a world of potential to understand customer behavior and other metrics, propelling business forward.”

Sens. Mark Warner, D-Va., and Marco Rubio, R-Fla., filed amendments to the annual defense policy bill that would create an Office of Critical Technologies within the executive branch aimed at protecting the United States from state-sponsored technology theft.

The office would focus on creating coordination throughout the government on cybersecurity-related issues and its director would act as chief policy spokesperson for the federal government for cybersecurity and technology issues.

As an executive office, it would have a director appointed by and reporting directly to the president.

According to the proposed legislation, the director of this office would also be a deputy national security adviser for the National Security Council and serve on the council, be a deputy director for the National Economic Council and serve on the council, and serve as the chairperson of the Council on Critical Technologies and Security, which the bill is also proposing be created.

The council would have 21 heads of federal agencies, plus anyone else the chair finds appropriate, and would function as an adviser to the president on technological challenges created by foreign powers.

The legislation also proposes this office further educate U.S. public and business leaders on national security threats proposed by technologies.

The amendment is based off bipartisan legislation proposed earlier in 2019 by Warner and Rubio that would combat threats from China, according to a news release.

“In the 20th century, the U.S. pioneered many groundbreaking technological advancements, and today, countries like China are using every tool in their arsenal to try to diminish U.S. leadership, set the standards for technologies like 5G, and dominate key technologies,” Warner said in a statement.

“In order to confront this challenge, the United States must push forward a coherent strategy to protect our technological edge and preserve American leadership.”

“The sheer size and complexity of the global DoD supply chain is a source of significant risk,” said John DeSimone, vice president of cybersecurity, Raytheon Intelligence, Information and Services, in response to the amendment.

“With thousands of suppliers supporting the industrial complex, it is a monumental challenge to ensure all of them have adopted an effective security posture, have the right tools and updated software and maintain trained staff on how to spot potential threats. Not to mention, the amount of data that is being collected and transmitted on a daily basis. The implementation of a security framework that provides one, unified approach to control the visibility of system data will create necessary resiliency.”

Recognizing that a whole-of-government approach to protecting technology requires a properly vetted workforce, Warner also introduced amendments based on previous legislation he proposed in the Intelligence Authorization Act for fiscal years 2018-2020 that would reform the security clearance process.

“To ensure the U.S. can hire trusted professionals to tackle the emerging threats in cyber and technology, we must modernize our outdated security clearance system,” Warner said in a news release.

The proposed amendment would analyze the time and speed of intrusions into Defense Department networks by adversaries to create better detection methods.

Deepfakes, which are created to manipulate audio and video in a way that is indistinguishable to most people, have become a topic of national discussion after a manipulated video of Nancy Pelosi appearing to slur her speech went viral. The House Intelligence Committee held hearings June 13 on deepfake technology. Rep Adam Schiff, D-Calif., the chairman of the House Permanent Select Committee on Intelligence, warned of a “technical revolution that could enable even more sinister forms of deception and disinformation by malign actors, foreign or domestic.”

During the hearing, the committee heard testimony on the national security implications of deepfakes and the challenges lawmakers will face in combating them before the 2020 election.

Clint Watts, distinguished research fellow at the Foreign Policy Research Institute, said that not only does the government need to have a plan to combat deepfakes, but they also must deploy that plan in a quick fashion.

“It comes down to who’s there first and who’s there the most and that’s the danger of social media computational propaganda,” he said.

This same sentiment was echoed from other witnesses as well.

“Let there be no question that this is a race,” said David Doermann, a professor at the University of Buffalo and expert on artificial intelligence. “The better manipulators get, the better detectors need to be and there are certainly orders of magnitude more manipulators than there are detectors.”

Doermann previous worked with the Defense Advanced Research Projects Agency, as a program manager, starting the media forensics program, Medifor. Medifor was created as a government response to address issues related to manipulated media, such as deepfakes. He discribes the solution as more of a marathon than a sprint.

“The program was assigned to address both current and future manipulation capabilities, not with a single point solution, but with a comprehensive approach,” Doermann said. “What was not expected, however, was the speed at which this technology would evolve.”

Adobe and UC Berkeley researchers announced a partnership June 14 with the sponsorship of the DARPA Medifor program that allows for image manipulation detection of images edited with Photoshop’s Face Aware Liquify feature, which allows users to adjust and exaggerate facial features.

One of the problems Congress can address with this issue is enforcing liability for publishing this content. Witnesses said it is often difficult to prosecute publishers of deepfakes because there is no law that assigns them this liability.

“It’s called ‘Good Samaritan blocking and filtering of offensive content’ and it’s been interpreted really broadly to say that if you under filter content, if you don’t engage in any self-monitoring at all, even if you encourage abuse, you’re immune from liability for user-generated content,” said Danielle Citron, professor at the University of Maryland’s Francis King Carey School of Law.

However, even if Congress could help eliminate the artificial intelligence that creates deepfakes, it could cause problems for researchers.

“Similar technologies used in the production of synthetic media or deepfakes are also likely to be used in valuable scientific research,” said Jack Clark, the policy director at the research organization OpenAI. “They’re used by scientists to allow people with hearing issues to understand what other people are saying to them or they’re used in molecular assay or other things which may revolutionize medicine.”

Witnesses also explained how the accessibility of technology is also accelerating the issue.

“You used to have to go out and buy Photoshop or you know have some of these desktop editors. Now a high school student with a good computer, and if they’re a gamer they already have a good [graphics] card, can download this, can download data, and train this type of thing overnight with software that’s open and freely available,” said Doermann. “It is not something that you have to an AI expert to run. A novice can run these types of things.”

The committee and witnesses also expressed concern that deepfakes were thriving in the current media environment.

“There is license to call things fake that are true but are critical and it seems that that’s a pretty fertile ground for the proliferation of information that is truly fake,” Schiff said.

Besides portraying situations that did not actually happened, Citron expressed concern that people will start to claim real videos that do not reflect well on someone are deepfakes, a characteristic she calls the “liar’s dividend.”

“I think it’s worth noting too that when President Trump referred to the Access Hollywood tape, he said well that never really happened,” said Citron. “We’ve already seen the liar’s dividend in practice from the highest of the bully pulpits, so I think we’ve got a real problem on our hands.”

Forescout relied on a crowdsourced repository that shares anonymized device insights and discovered that 2,712 Huawei devices and 1,374 ZTE devices are being used by government employees. Both company’s devices are part of the previous ban by the White House.

The ban on Huawei equipment came in the form of an executive order from the president because of a perceived national security risk. But the issue that Forescout leaders discovered is that while the administration can sign executive agreements banning these products, eliminating them is another, more difficult task.

“You can’t just turn off a whole enclave of devices if they are serving a purpose,” said Katherine Gronberg, Forescout’s vice president of government affairs.

However, Gronberg also said, if agencies do find an effective way to remove banned devices, it might solve two of their problems.

“It dovetails rather well with government efforts to modernize anyway,” Gronberg said.