Lawfare Daily: How Terrorist Groups are Using Artificial Intelligence

[Intro]

Antonia Juelich: Respondent said that Boko Haram got in-person training from ISIS-linked operatives and everyday online assistance on prompt engineering and jailbreaking. So these companies don't just face isolated users, but really, like, trained network and organized adversaries that share the latest ways to, to jailbreak models.

Daniel Byman: It's the Lawfare Podcast. I'm Daniel Byman, the foreign policy editor of Lawfare, and I'm here with Antonia Juelich of Cambridge and Tricia Bacon of American University.

Tricia Bacon: What I am really interested in seeing whether it's revolutionary are new organizations that are born in the AI era, right? Organizations that develop processes with AI as a pillar in what they develop. Are we going to see them develop capabilities more quickly, more effectively, more innovatively? Like, how will this affect that tier of terrorist organizations?

Daniel Byman: Today, we're talking about how terrorist groups use artificial intelligence and how governments are using it to fight them.

[Main Podcast]

Antonia, I want to begin with you. You just released a major report on how Boko Haram and Nigerian groups in general are using artificial intelligence. For our listeners who haven't read it, it's really fantastic. It's, it's groundbreaking research. Let me start by just asking you a few basic questions. Where and how are these groups using it? What problems are they having? Start with that, please.

Antonia Juelich: What I found was that AI has become embedded really as a general purpose technology that can provide information across the full insurgent cycle. So by that I mean from assisting with how to prepare attacks, to how to execute them, to how to analyze failures afterwards and learn from them. Yeah, one could really say it serves as a 24/7 operational assistant to Boko Haram, and there were a couple of domains and specific examples that respondents have given me.

One, for example, is getting weapons advice. So how, as many of you know, a lot of these groups seize their weaponry, military equipment generally is by- yeah, seizing it from, from soldiers and by raiding military bases. And so in the past, whenever they got ahold of weapons they were not familiar with, they had to reach out to people in the network, had to wait to hear back from ISIS and other operatives to receive online assistance or to wait for in-person trainers to come help them. Now, the new rule is that whatever you get, you bring it back to the camp. Commanders type in the serial number the model, and this way they learn what type of weapons they have and how to service and troubleshoot. That, of course, makes life much easier. There's less of a delay, and just provides instant help.

Another area is getting advice on, like, tactical and strategic questions that they have, and that ranges from- brainstorming new ideas on how to respond to new counter-terrorism measures, to getting specific technical input on how to best implement tactics. They said, for example, that they learned how to carry out more effective and better coordinated attacks by deploying smaller units. And also one example that has gotten quite a bit of attention is that, for example, they learned how to jump over defensive trenches that the Nigerian military built around their own bases and towns with motorcycles, and that was an obstacle in the past, but then not anymore.

Yeah, and one other area that I found quite concerning is that they get a lot of help with how to improve the design of their explosives, so that includes learning what additional chemicals to include that make their own IEDs more powerful, on how to defuse unexploded bombs to extract the military-grade explosive material and repurpose it in their own IEDs. Yeah, as one commander put it, "Trial and error can kill you. AI gives you accuracy," so it really helps them to bridge a lot of the technical gaps that they have encountered in the past.

And yeah, what I found quite striking about these use cases was that, while we were still discussing the risk of AI-generated propaganda and misinformation, Boko Haram already moved way past that and understood that AI can do so much more than that.

Daniel Byman: You know, what your report makes very clear is the kind of wide and very different ways that Boko Haram is using it. It's however a, it's a big organization, and, you know, I'm a professor at Georgetown University, I work at a think tank, I'm here at Lawfare; and every organization, I'm gonna be polite, has its own distinct way of doing things. And often that gets in the way of new technology and innovation, and I think really every organization is wrestling with the question of how to use AI effectively. What sort of problems is Boko Haram having with all this?

Antonia Juelich: Yeah, that's a good question, and I do think, generally, Boko Haram, as you say, has other organizations struggle with AI adoption, but also, like, a lot of, like, messy in-person dynamics that surround any use of, of technology.

They do have a rank-based access policy, which means that only mid-ranking commander and further up are allowed to, to use these models. And to be clear, that is not inconsistent with other policies in terms of accessing the internet or even having phones. So they, since they rely still a lot of a lot on coercion they don't really trust their foot soldiers, so kn- knowing how capable these models are, they only entrust certain people with access to AI. Some of the problems that I saw were less organizational. So they do have AI units that are in, in charge of prompting, of jailbreaking. They're also in charge of cascading that knowledge down the, the hierarchy to, to train other people.

The problems I saw were technical in some regards so, and these are the problems that we face as well. So they do encounter hallucinations, so, basically inaccurate information. That's why they said, "Oh, sometimes we still have to supplement with our brain, and we can't just take everything at face value." They also talked about incidents where they apparently followed instructions and that really backfired, where people died during experimentation with explosives. It's a bit unclear if that was actually because the information was wrong or an implementation failure. But that is something that they encounter. They also do struggle with refusals, suspension of accounts, but yeah, I mean, struggle is maybe a bit of an overstatement because there are, they do have their ways around that.

And maybe more generally, like they, they see that their main limitation and problem here is that they don't have more technical expertise and more people who are more proficient in, in, in using AI. And while they do, as I just mentioned, have their own internal training programs facilitated by ISIS-linked operatives, they are aware of how capable these models are, and that they could leverage and exploit them even more effectively if they had the expertise in-house.

Daniel Byman: Tricia, let me turn to you. You've looked at the Islamic State's branch in Afghanistan. You've just returned from work in Somalia. You've assessed a, a wide range of terrorist groups. What are you seeing with regard to artificial intelligence?

Tricia Bacon: One of the interesting parts of my trip to Mogadishu recently is it's sort of the inverse of what a lot of terrorism analysts are talking about, in that it's the government that's gaining an advantage through AI. It's happening for some reasons that may be sort of idiosyncratic or unique to Somalia, but it's still an interesting theater to watch for that reason.

So the government has really integrated AI into security in Mogadishu, in particular. So they've set up these cameras all throughout the city that are able to monitor vehicles, license plates, drivers, and of course, because Al-Shabaab uses vehicle-borne explosive devices a lot in Mogadishu, that has really suppressed its ability to do that. They've installed cameras in businesses where Al-Shabaab taxes or extorts people. And finally, they have developed and are about to deploy a Somali language monitoring through AI of social media. And of course, 'cause Somali is like a low penetration language, most content moderation doesn't reach Somali. So the government has been able to develop this, and they showed me a demonstration of it, which will also allow them to monitor more of what Al-Shabaab is putting online in social media.  So at the moment, I would say the government is sort of that jump ahead on the counter-terrorism front versus Al-Shabaab.

And of course, there's some of it that I don't know all of what Al-Shabaab is doing. But I think there's two dimensions of this that are making it more difficult for Al-Shabaab.

The first is that the U.S. is engaging in a not very often talked about extensive air campaign in Somalia, and the, the pace of strikes against Al-Shabaab is unprecedented. And this is a group the U.S. has con- been conducting strikes against for many years. But that air pressure has a suppression effect on technology because the group doesn't wanna be detected. So there is, they're, they're monitoring use of phones and internet. Of course, that's gonna be an issue for AI as well. So there is sort of this confluence of the government gaining this capability while Al-Shabaab is in sort of a more suppressed situation. Though that pressure may also cause the group to innovate in ways that it will turn to AI, and I think that remains to be seen.

And I think the second idiosyncratic part of this, which is something you alluded to earlier, Dan, is that like new technologies for mature organizations are not always easy to internalize. And Al-Shabaab is simultaneously trying to develop a drone capability that they've learned from the Houthis in the re- recent years. And my understanding is Al-Shabaab is undertaking sort of a training process to disperse the “train the trainer” model, if you will, that the people who got instruction in Yemen from the Houthis are now training other parts of Al-Shabaab. And it's really hard to integrate two new technologies at the same time, quite frankly, for any organization.

So right now, Al-Shabaab is sort- seems like it's a little bit behind what Antonia described as what is happening in Nigeria. But as I say, I wouldn't bet that that will remain that way. But that's sort of the current snapshot that, that is a really different picture than I think some of the other places we've looked at.

Daniel Byman: Antonia, let me ask you, but Tricia, please chime in. When you, you know, listen to the statements of different AI companies, you know, they talk about the extensive efforts to put guardrails in to make sure that, you know, you can't just type in, "How do I build a super virus to wipe out humanity?" And five minutes later, you know, we're all dead, right? Yet, you know, reading your report, listening to what you've said, here you have a very well-known, recognized terrorist group using AI, not just for propaganda, as you said, but extensively to improve its ability to use violence. Why aren't the guardrails working?

Antonia Juelich: Yeah, that's a good question, and that was also one of the pushbacks by companies in response to my report saying, "Oh, since the period that you studied," and to be clear, my, my interviews cover 2023 throughout 2024 into, like, early mid-2025, "our safeguards have improved." And I'm really glad that some AI companies have really invested in AI safety and have made their systems and their safeguards better.

But there is also, not just my report, but a lot of evidence showing that even the latest models can be jailbroken. So there are some basic approaches, like writing prompts in the form of poetry to more sophisticated ways like finding universal jailbreaks, which are reusable keys that succeed on most harmful requests within an entire domain and that can be shared. And jailbreaking techniques are shared. That's one of the findings of my report where respondents said that program got in-person training from ISIS-linked operatives and everyday online assistance on prompt engineering and jailbreaking. So these companies don't just face isolated users, but really, like, trained network and organized adversaries that share the latest ways to, to jailbreak models.

Another area that I think is not sufficiently talked about is that they exploit differences in safety enforcements across AI models and providers. That means that some systems have more rigorous safeguards than others, and from that follows that if your request gets refused, you can just pivot to a different model or system, and that's what they are doing. That's why they have multiple accounts across providers and, and this way they can piece together the, the information that they need and also compare answers and see which one is most useful. And another way is that they can decompose tasks, so that's a method that breaks a harmful request into smaller, harmless-looking pieces to trick a model's safety failure.

So yeah, again, while I'm glad that safeguards have improved and at least some companies are really looking into this, there is still a lot of variation and also, unfortunately, enough evidence that shows that models are still not safe enough safeguards can still be broken, and so that's also why the findings, although they don't cover, like, 2026, are still very relevant.

Daniel Byman: Trisha, what are you seeing on that front? But I realize a lot of what you've told us is really about the counterterrorism side of things, where the safeguards would apply in very different ways.

Tricia Bacon: I think that's true. And what's interesting, and that's perhaps a different concern when you look at the counterterrorism piece of it, is that when a government is gaining this kind of AI capability for counterterrorism purposes, it doesn't stay counterterrorism purposes. It becomes a tool of broader political oppression, and that's in fact what's, what's happening.

When you can monitor all of these especially in a low resource language like Somali, if you can monitor social media, that doesn't mean you only monitor Al-Shabaab. If you're tracking cars in Mogadishu, that doesn't mean you're only looking for Al-Shabaab. And so it also in, in the counterterrorism sense, governments that gain this kind of capability to modern- to monitor, have incentives to use them in the political sphere as well. And there's not gonna be any guardrails for that on the government side, especially when you have something like its own social monitoring platform that Somali, there's no, there's no companies that are gonna be interceding on something like that.

So I think on the government side, the, the danger is a little bit different, but is perhaps just as, as serious in a lot of ways in terms of authoritarianism or repression of democracy in places that are gaining AI capability, but don't have mature political systems.

Daniel Byman: What, one of the ironies to me is, you know, one of the amazing things about AI is, of course, its language translation, and that, you know, you can, you know, draw data from, you know, the world's languages, and obviously there are gonna be some glitches on translation, but it's, in my view, it's actually quite striking how good it is, and it's, it's frankly only gonna get better.

But as you say, Tricia, that, that hasn't led to guardrails, you know, being quickly translated from one language to another, right? I don't know what the percentages are for AI companies, but I know back in the day for social media companies, you know, an overwhelming percentage of their kind of guardrails and content moderation was in English. And you had languages like Urdu where, you know, you have huge numbers of speakers that had basically no content moderation, right? It was really, really remarkable.

Tricia Bacon: And there's interestingly some initial research that there's much lower levels of refusal in Somali, in part because it is sort of a low-resource language. So some of the guardrails that we hear about may not be occurring in, in, in languages that are not as dominant like English.

Daniel Byman: Interesting. And I could imagine for, you know, countries where there are, you know, numerous languages spoken by small communities, you could imagine that problem getting b- getting bigger and bigger.

Antonia Juelich: And also interesting enough, at the same time, when you look at language benchmarks, these models perform really well across a lot of languages. So the case of Boko Haram, they're mostly prompted apparently in English and Arabic. But when I checked, even Hausa scores fairly high, especially on, on accuracy. So, while guardrails might not work in the same way, these models are still very capable even if you prompt in, in a different language.

Daniel Byman: Antonia, one thing that was striking about your report was your emphasis that, you know, it's not just propaganda, right? That there's a lot of weaponization in a literal sense of AI technologies in contrast to what most of the research out there was suggesting. But let's talk about propaganda. You know, how is this shaping how the different groups both of you study are designing propaganda and, you know, both in a very kind of literal sense designing, but also in trying to expand its reach?

Antonia Juelich: Yeah, I think this is one of the areas that has been picked up very quickly and early, and that's also where we saw the first analysis of how jihadist supporters use AI, and we saw it getting picked up early on to, as you just mentioned, translate propaganda materials also to, to feature synthetic presenters, for example, in, in videos. So it's an easy way to reach a wider audience and to, to target messaging more specifically to particular groups. And I think, yeah, it, it just like a, an easy tool that has therefore been adopted. However, it seemed like at least for, for a long time, and IS-K is a bit of a, an outlier I think there, that a lot of unofficial media outlets started using AI way before terrorist groups themselves, and it has been widely discussed among online supporters on online forums.

So yeah, we saw apparently controversy among online jihadist supporters where some said the use of AI is prohibited and un-Islamic because it's trained on Western voices and faces, and so that's why the, the conclusion was that adoption has been kind of slow. However, yeah, that's not overall what, what I found, and I, I think there's a big disconnect between what some of these groups present publicly, and there are reasons to conceal their use of AI that might be less of, less the case for online supporters and unofficial media outlets that post on behalf of some of these groups.

To be clear, I think automated targeted messaging of propaganda at scale to people whose psychological and social profiles suggest that they are susceptible to radicalization is obviously a big concern, and although I don't, I don't think we see this yet to the extent that it's possible, fortunately, I do feel like that topic gets somewhat, like, outsized, somewhat disproportionate attention when talking about AI risk, and I think that's because of a couple of factors.

One is just data availability because it's feasible to follow what's happening online, and also, like, fair enough it, it's good that we get as much data as possible to understand what these groups use AI for. But then I also do think that it's, AI is often a bit misconceived as, like, a very smart chatbot, an extension of social media, and I think that comparison is a bit flawed and significantly underestimates AI's capability. So while I do think it's an important area to look into, and I do think adoption has been slower than expected among terrorist groups and much more among online supporters and unofficial media outlets, there are use cases that move way beyond the digital sphere and are just not visible online.

Daniel Byman: One, one challenge always in this space is a lot of the expertise in the analytic community comes from people who have done really amazing work on looking at how terrorist groups have used social media. But of course, that's, you know, a, a different technology, and you're not gonna see social media used in the same way to, you know, improve your bomb design by ten percent, right? And so you have people who have, you know, very impressive research skills but are focused on certain issue areas, and I think that that shapes things.

And the other broader problem with, with anything technology related in, that we've seen in the last twenty years is that a lot of the expertise tends to be among younger people, and thus the more established analysts, unfortunately I put myself in this category, the old people, are less able sometimes to grasp the wide range of changes that the technology is, is bringing in. Trisha what are you seeing in this space?

Tricia Bacon: I think this is a really interesting question, though, especially when I compare and contrast two organizations. So if we think about Al-Shabaab on the propaganda front, this is a well-oiled machine, right? Th- this is an organization that was an early adopter on, on social media and using it robustly. It has basically four main languages that it does propaganda in with a specific sort of audience regionally. You know, it's got e- extensive Swahili, Somali, of course, Arabic, and English. And so i- it's not an organization that necessarily really needed AI to change what was already working quite well.

But as I say, it is under pressure. It is under extensive counterterrorism pressure from the United States on the, the airstrike side, which does expand into the, the, the media side of Al-Shabaab. So I think this is an area where, as the organization grapples with ro- losses, it may reach for AI in order to adapt, but thus far it's not entirely clear that that has occurred or the degree to which that has occurred.

When you compare that to the Islamic State in Khorasan, the Islamic State province of Afghanistan, this is a group that's trying to expand, right? It, it does have its own robust sort of propaganda machinery, but it wants to expand its reach, and so I think that for that reason you see it, it reaching for AI more often so it can have new languages that it's creating material in it, and it can be sort of building and expanding its, its footprint in that area.

So it's, it's interesting to sort of compare and contrast two relatively mature organizations and how AI might be shaping their use based on sort of the, the degree of their aims as well as their existing capability.

Daniel Byman: Thank you. I wanna kind of switch things over a little bit, just a, a conceptual issue. You know, there's talk, and I think very legitimate talk, about how AI is revolutionizing everything. But is this really revolutionary, is my question, right? Is it really that AI is making everyone in the terrorism space, you know, twenty percent better at the things they do already? So, you know, you're building an IED, your IED is better, you're better able to identify explosives to extract and design a better bomb. You're able to improve your ability to penetrate defenses because you have some, you know, greater knowledge of your adversary. Or is there something revolutionary going on here where, like, there, we're gonna talk about the “AI Era” in terrorism and counterterrorism in a way that, you know, people have looked at, say, you know, dynamite as a game changer?

Tricia Bacon: I think that it is largely an incremental shift. I, I think it could be revolutionary, but by and large, I think it's more of what you described, and it's not universal. It's 5%, 10% improvements in different spheres among some organizations. So I think that's the hard part right now is sort of really understanding that landscape where it's impro- making the improvements that Antonia found, for example, versus, you know, groups that are, are not yet effectively leveraging it in different parts of what they do.

Where I think that there's an interesting question that we can't answer yet is a lot of the organizations we're talking about and we're looking at and analyzing are established, mature organizations that already have ways of doing some of these activities, right? So that's where we talk about the 10% improvements or the ability to adapt to what is happening on the counterterrorism front.

What I am really interested in seeing whether it's revolutionary are new organizations that are born in the AI era, right? Organizations that develop processes with AI as a pillar in what they develop. Are we going to see them develop capabilities more quickly, more effectively, more innovatively? Like, how will this affect that tier of terrorist organizations is I think the, the big question for me about whether AI will truly be revolutionary.

Otherwise, I think it's, it's an important capability for groups to be able to improve and adapt and be more effective, but it's, it is more in like the 10%, maybe 20% sphere that we're talking about versus like a group going from zero to building like a nuclear weapon or something sort of really wild in the scenarios that people talk about.

Antonia Juelich: Yeah. For me the answer is probably not an either/or, but I do see in a way that a revolution/evolution as related. So as Trisha just said, and I agree, I think for now we mostly see compounding efficiency gains that these groups get across the internal and external operations that can lead to an overall more capable organization.

Some of that might not be visible even right now, so some of my interviewees said that they were able to reduce casualties within their own ranks. That is very hard for us to, to quantify. And even when we do see groups becoming more powerful, there are lots of confounding variables, so it's really hard to clearly say that it's because of AI. And as, as Tricia said it also depends on how capable a group already is and how much they are able to leverage AI. And on top of that, also AI is more helpful in, in some areas than, than in others.

But to get back to the question and my answer is that I do see that there is a gradual creeping up of capabilities that is not only in and of itself a reason for concern, but it can also get a group to an infection point where they then are able to make a bigger leap, where they then are able to solve a specific technical problem that they were not able to solve before.

For example, respondents told me that AI played a very crucial role in, in weaponizing drones, and that they experimented with it for a long time. They also used the internet. They also received foreign assistance. But it was ultimately AI that gave them, like specific answers that helped them to then actually master that capability, and that was not, that is not a genuinely new capability on the battlefield, right? But it was new to ISWAP.

So when we ask does AI enable new capabilities, the question is what our reference point is. So chemical or biological weapons are not, per se, new, but it would be a new capability for most terrorist groups fortunately. So I do worry a bit that we set the bar for what constitutes a new capability or revolution, and implicitly also for when we should be worried way too high.

Daniel Byman: Let me use that to, to jump to the doomsday scenario which is, you know, we have someone uses an, you know, advanced artificial intelligence program to design a super virus. And people have talked about terrorist groups in this context and, you know, to go into American jargon, we could talk about, you know, nihilistic violent extremists or a range of, you know, basically angry but smart individuals who wanna do horrible things.

In your view, how credible is this threat? And I'm not asking you to make a prediction. I'm just, you know, really asking… Sometimes when there's a focus on the extreme end, you miss a lot of the important in-between stuff. But conversely, like, you, you, you don't wanna be wrong about this one, right? You wanna make sure that if you're, you know, if you're dismissing it, that you're very confident just because the consequences are so big. Antonia, let me start with you on this one.

Antonia Juelich: Yeah. As you said, we are not there yet. Yeah, that's very fortunate, and what I try to cover is exactly that operational middle ground that hasn't re- received a lot of attention at the moment. However unfortunately, I think the scenario you just laid out is more credible than many would assume. It sounds like sci-fi, but so did many other scenario- scenarios that have happened recently, like models escaping controlled environments or designing new synthetic viruses.

And yeah, ultimately, it's a bit of it comes down to an actor's capability to actually build a bioweapon and their intent. And so many AI and biosecurity experts, and even CEOs of leading AI companies, are warning that AI systems could be misused for bioterrorist attacks, and studies show that AI already outperforms human experts on relevant virology tasks and that it could be used to design new pandemic-capable pathogens. And to be clear, to build a bioweapon, that still includes manual laboratory work. You need physical facilities. You will need the right materials and tools. But AI is clearly lowering the technical, operational, and motivational barriers that have kept bioweapon attacks out of reach for most actors.

On intent, I do feel like there is a lot of focus on apocalyptic, omnicidal cults, whereas there are apocalyptic streams in within Jihadism and Jihad Al-Qaeda and ISIS trying to build biological and chemical weapons in the past, so, I don't think that their intent has massively changed, but it is becoming easier and easier.

So I do worry sometimes that it's, people underestimate how many groups might have an incentive to at least try it, and I see chemical weapons, to be clear, as a more realistic scenario at the moment than, than bio. But even in my interviews, it came out that where bio was somewhat controversial within the leadership, that it apparently had been discussed, but it seemed out of reach. And the contentious part was not the acquisition, but the release. And so we should not underestimate the appeal of having a very powerful weapon, like a poor man's nuke, that can give you immense leverage.

And on detection and disruption, maybe because that's another factor that comes into the scenario, and it ultimately can decide of whether the attack succeeds or not. Yeah, actors must still evade detention and fly under the radar of law enforcement to do that, and there are different ways in which they might be affected by a mitigation strategy, so a lone individual with very limited resources or technical expertise may be disrupted by cutting off access to key materials and information. In contrast, a well-funded group is maybe a harder target and may be more likely to be discouraged by raising the cost of an attack or the odds of getting caught.

I'm, I'm glad that there are proposals on, on strengthening our defenses, and I really hope that government and industry start taking this more seriously, because I, I certainly do, and I worry that what I found where, like, Boko Haram already moved way beyond online propaganda, and we, I do have this time gap, right? And in my report, I mean, that covers, like, what happened basically one and a half years ago, so I, I worry not specifically about Boko Haram, but what capabilities other groups are pursuing or have been pursuing in, in the meantime.

Daniel Byman: Tricia, let me go off your earlier points about counterterrorism in Somalia and how the government's using it effectively in, in many ways against the Shabaab, but also more broadly. Can you talk about how AI might be used by other governments for counterterrorism and h- how to think about kind of where it can be productive and in, for the more mature democracies, you know, where there should be limits?

Tricia Bacon: I think that is maybe the big question that people aren't talking about enough, which is this is technology that, that can be used by government in ways that go far beyond counterterrorism alone. And I don't hear as much discussion, for example, of tech companies about limits on how governments are going to use this, especially even when we sort of talk about the spectrum, we have monitoring and the ability to, to use that, but you also have the ability to be using these systems for, for example, targeting, and targeting that may or may not have a human piece to it.

And I think that people have become concerned that that has occurred for example, in the United States or in Israel. But if you think about places with less guardrails and less capability, you, you really get into a, a sphere where the, the ability for governments to use violence in a systematic way without guardrails and nes- not necessarily requiring as much sort of human complicity, that we, we really do have sort of an, an equal and opposite problem on the government side in terms of what AI allows and for counterterrorism, for counterinsurgency, for war writ large.

And I think that's a- actually a much harder solve in some ways because at least in the sphere of like tech companies and terrorist organizations, I think of it as the cat and mouse, right? Like the, they add some guardrails, the, the non, you know, violence non-state actors show they can get around them. You add some and like this goes on in perpetuity in, in some ways, as it does in a lot of spheres. And it's a matter of who has the advantage at a given time in terms of the, the balance of their ability to use AI. But I see a lot less of that kind of discussion and ability for tech companies to try to even take stands and make demands on this sphere. So I, I, I am equally sort of concerned on the opposite end of the spectrum. And in fairness, when we think about the kinds of grievances that these groups are able to exploit, AI definitely has the ability to exacerbate some of those in terms of how governments use them.

And if I could just reach back to your, your previous question to Antonia, what I've been thinking about is select past examples. Not that this is sort of a common thing that groups try to do, but what if Aum Shinrikyo, who conducted the sarin attacks in Tokyo in 1995, had AI? What if someone like Ted Kaczynski had AI? What if al-Qaeda, when it had those camps in the '90s, and it was, you know, gassing dogs to experiment with that kind of capability, what if they had AI?

And those are three examples of, of hundreds of groups, and so I, I don't think it's a common thing to be concerned about. Where were, where individuals or organizations had the intent and had some baseline capability, they weren't going from zero, they had scientific capability, and then try having AI added on top of that, those are the scenarios that, that worry me on this doomsday piece of it. I, I'm not broadly necessarily concerned about a group like Al-Shabaab. I don't think that's the kind of capability they're seeking, that's the kind of capability they need. But when you have these select examples that we have seen in the past and, and what the damage they could have done if they had access to technology today.

Daniel Byman: I wanna close building on Trisha's points, which is kind of the “what is to be done?” question. If you were had access to the senior leadership of tech companies, Congress, the U.S. government, pick your audience, if you will, give us one or two realistic recommendations you would make about how to reduce the risk of terrorist groups using this in very dangerous ways and how governments can do better.

Antonia Juelich: Yeah. So, first of all, I do think this is a really complex problem, and governments and AI companies need to work together on that. From a technical point of view, I do think that we need minimum safety standards across providers so that a refusal in one place is not simply an invitation to try another one. The most robust safeguards offer very little practical security if highly capable and o- open weight models are freely available, right? Another point, and yeah, maybe that's also where governments have to come in because it's unclear whether companies would work together to establish and agree on these minimum standards.

Another area is that companies should test their safeguards against organized, trained networked adversaries, as I mentioned, and should think not only about risk from maybe isolated users, but also these groups that have just different capabilities to, to circumvent guardrails. Then again, I think companies and governments need to establish some information-sharing channels, such as an AI threat fusion center that combines company and government signals, so misuse scattered across these platforms is seen as one pattern rather than isolated fragments.

And ultimately, I do think that we need more evidence and that that is a role that where researchers can chip in, but also that security agencies should assess how terrorist groups use AI as well as trace which groups are being trained by whom and how that expertise spreads. So I think there is a lot more that can be done within the IC and law enforcement to, to really monitor that threat and especially when it comes to potential development of WMDs.

Daniel Byman: Tricia?

Tricia Bacon: I think at least in the U.S. government system, the, one of the key things is to have the bureaucratic structures in place. What do I mean by that? When we think about, for example, the organization of our intelligence community, we have you know, regional focuses, functional focuses, and what we need to make sure that we have in our system are people who are specifically responsible for the AI piece of this, for understanding. Because this technology is moving very, very quickly. The average terrorism analyst can't keep up with that while also keeping up on the, the current group's operations and leader, et cetera, right?

So I think we need more structures in place where we have AI expertise within, for example, our intelligence community that can be the, the focal point both for doing that analysis and for collaboration with analysts, for example, who are an- who are both analyzing terrorist organizations and, you know, hostile or governments that are more authoritarian. So I think we o- we need an integration of AI expertise into our anal- you know, our intelligence community collection analysis so that there is also then the commensurate understanding being given to policymakers of how foreign actors who are a threat to the United States are using this technology.

And I think that though, though the U.S. government, in particular, is on the cutting edge of using AI, for example, in things like warfare, we don't actually have that sort of analytic and expertise base that we need to have in our systems. So I think that's a, a really urgent need, and it's hard to do because that expertise is very valuable, right? You can make six figures, seven figures with that kind of expertise. So we're in a situation where we also need to be able to hire people like that and retain people like that, which is, is undoubtedly a challenge, but is absolutely essential for sort of this next phase of security.

Daniel Byman: Tricia Bacon, Antonia Juelich, thank you very much.

Antonia Juelich: Thank you so much.

[Outro]

Daniel Byman: You can get ad-free versions of this and other Lawfare podcasts by becoming a Lawfare material supporter at our website, lawfaremedia.org/support. You'll also get access to special events and other content available only to our supporters. Please rate and review us wherever you get your podcasts.

Look out for our other podcasts, including Rational Security, Allies, The Aftermath, and Escalation, our latest Lawfare Presents podcast series about the war in Ukraine. Check out our written work as well at lawfaremedia.org. The podcast is edited by Jen Patja, and our audio engineer this episode was Goat Rodeo. Our theme song is from Alibi Music. As always, thank you for listening.