Lecture Notes on AI Governance and Cybersecurity

Introduction to AI and Cybersecurity

Importance of having a forward-looking policy framework to address future challenges (10-20 years ahead).
AI can:
- Automate routine tasks, improving efficiency.
- Analyze large datasets quickly, aiding decision-making.
The necessity of guidelines based on good Security Sector Governance (SSG) principles.

Identifying specific challenges faced by different security sector actors (armed forces, judiciary, etc.).
Recognizing and addressing biases that AI can exacerbate.
Importance of having human oversight in AI applications.
Training of security sector personnel is crucial.

National Data Center was hacked on June 20, involving multiple government institutions (e.g., Ministry of Communication).
Public services, including immigration at airports, were significantly disrupted.
Government's response included:
- Manual processing of immigration checks.
- Investigations into the root cause of the attack.
- Settlement with hackers after a ransom demand of 8 million USD.
The incident highlighted vulnerabilities in Indonesia’s cybersecurity governance.

Direct economic impacts:
- Financial losses due to ransom and recovery costs.
- Damaged reputation affecting foreign investment.
Political implications:
- Weak cybersecurity perceived domestically and internationally, influencing upcoming elections.

Emphasize a proactive approach to cybersecurity instead of reactive.
Establish alert systems to predict and prevent attacks.
Enhance training and awareness among personnel to combat issues like email phishing.
Implement Standard Operating Procedures (SOPs) and conduct regular IT audits.

Cyber Security and Resilience Bill is still pending, facing delays due to various factors:
- Public and civil society concerns about state-centric power.
- Diverging interests among stakeholders (government, private sector, civil society).
There is a need for greater public participation to ensure accountability in discussions.

One of the first comprehensive legislations on AI, aimed at ensuring safety and transparency of AI systems.
Applies not only within the EU but also affects third-country providers.
Centers around a risk-based approach:
1. Unacceptable risks (e.g., social scoring) - prohibited.
2. High risks - subject to stringent regulatory requirements.
3. Limited risks - less stringent obligations focusing on transparency and user awareness.
Compliance will involve existing structures from GDPR implementation.

More decentralized, focusing on principles like safety, transparency, and accountability.
No formal definition of AI, emphasizing the role of existing regulatory bodies.

Both the EU and UK face challenges in harmonizing AI regulations, particularly in defining AI and addressing dual-use technologies.
There is an urgent need for national cybersecurity strategies that involve comprehensive stakeholder engagement, especially in Indonesia.
Continuous education and awareness-raising are vital for future resilience in cybersecurity and AI governance.