The Internet of Artificially Intelligent Bodies Presented by: Prof. Matwyshyn Date: 6 March 2023 TL;D Listen - - The Internet of Things is extending to bodies - The Internet of Bodies • Three generations: External, embedded, melded • Internet of Bodies devices suffer the same types of flaws as IoT IoB will evolve in response to other technology trends – such as the push for "AI" inclusion such • - What model of (techno) humanity and "progress" do we espouse? Security, privacy, and bodily safety are at the heart of these IoB and AI legal concerns, but so is (corporate and social) governance • Legal consideration is warranted and necessary in light of emerging market realities • - Differentiation, Substantiation, Anticipation, Verification, Remediation CYBER!, 2017 BYU Law Review 101(2018) • Anything connected is vulnerable; privacy and security should be crafted as legally distinct constructs • The problem of "reciprocal security vulnerability" across public and private sector(and offering a framework inspired by Michael Polanyi) - Internet of Bodies, 60 William & Mary L. Rev._(2019) • Internet of Things (IoT) → Internet of Bodies (IoB); three generations • IoB means software will cause physical harm to security of bodies ← new (for law) - Internet of Latour's Things (in progress) • How do we govern a world of IoB (and sensing environments)? • IoB will trigger uncomfortable social questions about what it means to be "human" (offering a framework inspired by Bruno Latour) - Artifice and Intelligence (in progress) • What types of "AI" governance mistakes will lead to social policy disasters (and proposing short term legal approaches) The Internet of (Current) Things - Defining features: • "Better with Bacon" problem (Often gratuitous) Internet reliance and interconnection • "Builder Bias" problem Extreme levels of known security vulnerabilities (already causing harm) • "Magic Gadget" problem - Over trusting + new data collection, aggregation, and repurposing (leading to privacy problems and increased attack surface for security) • "Mandatory Soup" problem - Diminishing consumer ability to "opt out" of IoT technology - hidden price terms and self-help limited A brief definitional aside... - Security • Does the system (as implemented through hardware, software, and humans) successfully defend against third party attacks on confidentiality, integrity, and availability of code and information? • Can Alice's system successfully defend against Eve's attack? • If not, was the failure foreseeable? • What are Alice's legal duties of mitigation/harm remediation to various parties, including Bob whose information was disclosed? - Privacy • Can a particular human using the system be personally identified from e.g. traffic analysis or metadata analysis? • What did Bob reasonably expect about Alice's information collection and intended uses (and what did she promise at the point of collection)? • What information did Alice actually collect and how did she use it? • If not aligned, what remedy should Bob be afforded? Why does this matter? The first three IoT problems - Unlike privacy, security - when properly defined - offers many easy win-wins. - Addressing the current rampant security inadequacy in both the public and private sector requires addressing the problem of reciprocal security vulnerability - The same types of vulnerabilities and compromises impact both the public and private sector - follow the vulnerable code - Attackers are increasingly harnessing vulnerable consumer products to cause harm -> - The Internet of Things is becoming a weapon against both consumers and national security > - THE INTERNET OF THINGS ("IoT") (and botnets of baby cams) - THE INTERNET OF BODIES ("IoB") (botnets of body parts) What is the Internet of Bodies? - The (creeping) technological reliance (and vulnerability) of human bodies on software, hardware and the internet for their integrity and functionality - Unfixed technical/legal problems of IoT, the internet, and software - + - Unresolved legal and ethical problems from prior body/med tech Three generations of IOB - Body External: "Quantified Self" movement and externally connected monitoring devices - Fitbits, Apple watches, Google glasses • Optional, risks of data repurposing/privacy and security harms (but not physical) - Body Internal: digital pills, early medical devices (pacemakers, cochlear implants, digital limb prosthetics, artificial pancreases), Internet-connected hospital equipment - • Less optional; physical harms; bodily integrity implicated • Stage 2.5? Brain prosthetics with remote doctor control Body melded: "Wetware" hardwired tech where brain and external machines meld – e.g. "neural lace" <- we're not there yet (but R&D is well underway) Where are we now? - Body External - Body Internal - **WE Are HERE** - Body Melded • (Buggy) bits + (buggy) bodies = physical harm • Imagine Mirai using injected IoB contacts or brain prosthetics • Imagine WannaCry on artificial pancreases - First generation/body external: privacy and security harms - Second generation/body internal: + physical harm - Third generation/body melded: + autonomy concerns and Kantian he autonomy concerns.... - Autonomy (and self-governance) can't be exercised meaningfully without the cognitive disconnect from inputs to allow for processing (self-self- governance) of information and response. - He autonomy is a necessary precursor for autonomy, and third generation IoB threatens it. Some Open Legal Questions on IoB - Regulatory issues GDPR; US FTC, FDA, FCC - Contract - contractual rights of IoB forced removal? - IPIOB patents and PAES? (Note: § 616 in the 1997 Omnibus Consolidated Appropriations Act - re: med process patents); Copyright over live thought "database" creative arrangement from brain IoB? - Security harms and tort recourse - data breach harms from literal brain dumps? - Secured transactions and bankruptcy - contract rights to live in-body feeds as corporate assets? But the tougher questions are actually social. - What is augmentation v. medical correction? • - Case study: cochlear implants What is the new tech baseline? • Glasses used to be an optional augmentation • Can you be forced to "upgrade" your body? - Who are the winners and Losers? • The over-teched may be the most vulnerable to attack (..and how do we handle compromised brains?) Five concerns as IOB "AI" IoB/ The "Intelligent" Society - Differentiation - Substantiation - Anticipation - Verification - Remediation Differentiation - What people mean by “AI” varies. Choices in builds and governance matter. - For example, • General v. specific intelligence • Supervised v. unsupervised machine learning (and specific design choices/ training data) • Hardware and other implementation choices • .... Or maybe it's just plain old regression analysis in a shiny buzzword bingo wrapper! Substantiation - AI marketing hype sometimes currently oversells capability and misrepresents functionality, particularly the 'humanness' of its processing. Anticipation - Short term 'wins' from deployment of "AI" could result in long term unanticipated harms that are potentially permanent and difficult to address. - This is particularly true where human bodies are implicated. Verification - 'Identical' AI systems are never truly identical; even small variation (or error) in implementation and deployment can result in disastrous unintended consequences. Remediation - There will always be flaws, errors, and system vulnerabilities in both physical space and in code. There will always be attackers who exploit these vulnerabilities both known and unknown.