How federal IT officials are navigating the post-AI executive order ‘hype cycle’

HERSHEY, Pa. — A year ago, all anyone could talk about at ACT-IAC’s Imagine Nation ELC conference was President Joe Biden’s artificial intelligence executive order and how agency staffers had already begun embracing the emerging technology. This year, there was decidedly less fanfare as federal tech officials discussed their experiences with AI and the “hype cycle” that has ensued since the issuing of the White House’s order.

At the Federal Deposit Insurance Corp., Zach Brown, the agency’s chief information security officer, said the approach to AI internally has focused on “fundamentals” and “the basics.” That means the FDIC is “able to do some things a little bit quicker” with the technology, but a “human in the loop” is even more necessary to provide “the reasonability and the transparency and the explainability,” he said.

For example, the FDIC’s use of an AI coding assistant — a generative AI tool that can create and analyze code — is undeniably a time saver. But Brown said tools of that kind are only as good as the developers or programmers who can assess the outputs and explain to the workforce what is being accomplished.

“It’s not magic. Yeah, there’s a lot of black box going on, but you still have to be able to … talk it through,” Brown said. “I think we’re also up against a hype curve [or] hype cycle, depending on which consultants you go with. But I think there’s going to be a period … where the hype kind of corrects itself. The market corrects itself.”

The market is currently giving buyers all sorts of AI tools; Brown said “every single product” the FDIC buys now “has AI embedded somewhere.” Shelly Hartsook, acting associate director of the Cybersecurity and Infrastructure Security Agency’s Cyber Capacity Building Subdivision, said she’s also observed a trend in products with AI “a little bit more baked in that becomes plug and play.” Simply put, the newfound ubiquity of AI tools has set the table for “genuinely unique use cases.”

“In essence,” Hartsook said, “we’ve kind of set up a kitchen with the best, freshest ingredients you can source globally, the sharpest chef knives that you can possibly find. And it’s like everyone [can] be a master chef and come in and build something and make it responsible.”

The increasing availability of AI tools will certainly lead to “really cool innovation,” Hartsook added, but from an agency perspective, it’s a reminder that “we shouldn’t all be building them independently.” The CISA official called on vendors to move beyond “the raw ingredients” and strive for AI tools that can be “a little bit more turnkey.”

More AI tools of that kind would likely be of interest to the State Department’s Directorate of Defense Trade Controls, where CIO Karen Wrege is eyeing Microsoft Copilot in Azure and Github Copilot once her team clears out some cybersecurity requirements higher in the queue.

Pursuing those AI chatbot and coding pilots hasn’t taken precedence over the Directorate of Defense Trade Controls’ cyber mandates, but Wrege said it’s important to start experimenting with the tools so that her office can “automate as much as possible.”

“A lot of these things we’re doing, we’re doing manually,” she said. “And I think that’s really the promise of AI, is being able to build better code from the beginning.”

Paul Blahusch, the Department of Labor’s CISO, made clear that he is “not the AI expert” at his agency but noted that there is plenty of DOL activity with the technology, pointing specifically to the use of a chatbot, a coding assistant and a tool to summarize large documents.

He’s also making sure that his cyber colleagues are thinking clearly about the technology, issuing a challenge to his staff to come to him with one generative AI idea that can help their work.

“Maybe there’s a new executive order, OMB memo [or] a new NIST document. Is there a way you can use generative AI to take that first cut at updating our internal policies to match that?” Blahusch asked. “That’s a labor-intensive exercise right now. You need to get people sitting down there, reading and comparing. Is there a way gen AI can help? I would think so.”

As the country’s first federal CISO, Greg Touhill has a particularly unique vantage point on AI and how the U.S. government has grappled with the technology’s potential through the years. Though Biden’s executive order last year ratcheted up the collective awareness of and federal workforce experience with the tech, Touhill said what’s happening now with AI is something “we’ve been planning for for decades.”

“AI is an overnight sensation — over 65 years in the making,” said Touhill, who now directs the CERT Division of Carnegie Mellon’s Software Engineering Institute. “I think AI is here to stay, but there’s lots of different flavors of AI.

“We need to invest more into our workforce to apply the right type of AI to the right mission,” he added, “to make sure that we securely and effectively serve the people of the United States and enhance national security and prosperity.”