healthcarereimagined

BY: GRACE DILLE JUN 16, 2023 10:15 AM

The Department of Veterans Affairs (VA) is looking to implement a new risk assessment framework that will bring standardization and consistency to authorization decisions.

The move comes in response to a repeat recommendation from the VA Office of Inspector General (OIG). In the VA OIG’s Federal Information Security Modernization Act Audit for Fiscal Year 2022, the OIG made 26 recommendations for the VA to improve its information security program – the same number of recommendations from fiscal year (FY) 2021.

Despite the VA’s efforts to close the recommendations, the OIG said some have been repeated for multiple years.

Nevertheless, Kurt DelBene, VA’s chief information officer (CIO) and assistant secretary for information and technology, pledged his commitment to addressing these recommendations.

Specifically, the OIG recommended that DelBene consistently implement an improved continuous monitoring program in accordance with the National Institute of Standards and Technology (NIST) Risk Management Framework. The OIG called on the CIO to implement an independent security control assessment process to “evaluate the effectiveness of security controls prior to granting authorization decisions.”

“The assistant secretary reported that the Office of Information Security will implement a new assessment framework, which brings standardization and consistency to the Authorizing Official (AO) reviews and aligns with the NIST framework,” the report says. “To improve the tracking process further, the development of enterprise dashboards to bring visibility to executive leadership of those critical systems that are not meeting cyber security standards will continue.”

DelBene explained that the scale of VA systems is quite large – nearly 1,000 VA systems require an Authority to Operate (ATO), which he said would benefit from an independent control assessment.

However, the CIO noted that “the resources and costs to do so for all our systems are a barrier.”

“The varying risks for the more than 1,000 systems also suggests that we take a more balanced approach, leveraging internal resources for lower risk systems,” DelBene said. “VA OIT will implement specific policy changes that incorporate a prioritization model, based on risk, to assess information security controls in a prudent and rational way. Improving our capacity to conduct independent assessments for our highest risk systems will remain a high priority for OIT.”

The VA’s target completion date to complete this recommendation is Sept. 30.

Article link: https://www.meritalk.com/articles/va-looks-to-implement-new-risk-assessment-framework/

Experts at RightsCon want us to focus less on existential threats, and more on the harms here and now.

By Tate Ryan-Mosley June 12, 2023

This article is from The Technocrat, MIT Technology Review’s weekly tech policy newsletter about power, politics, and Silicon Valley. To receive it in your inbox every Friday, sign up here.

This week, I tuned into a bunch of sessions at RightsCon while recovering. The event is the world’s biggest digital rights conference, and after several years of only virtual sessions, the top internet ethicists, activists, and policymakers were back in person in Costa Rica.

Unsurprisingly, everyone was talking about AI and the recent rush to deploy large language models. Ahead of the conference, the United Nations put out a statement, encouraging RightsCon attendees to focus on AI oversight and transparency.

I was surprised, however, by how different the conversations about the risks of generative AI were at RightsCon from all the warnings from big Silicon Valley voices that I’ve been reading in the news.

Throughout the last few weeks, tech luminaries like OpenAI CEO Sam Altman, ex-Googler Geoff Hinton, top AI researcher Yoshua Bengio, Elon Musk, and many others have been calling for regulation and urgent action to address the “existential risks”—even including extinction—that AI poses to humanity. 

Certainly, the rapid deployment of large language models without risk assessments, disclosures about training data and processes, or seemingly much attention paid to how the tech could be misused is concerning. But speakers in several sessions at RightsCon reiterated that this AI gold rush is a product of company profit-seeking, not necessarily regulatory ineptitude or technological inevitability.

In the very first session, Gideon Lichfield, the top editor at Wired (and the ex–editor in chief of Tech Review), and Urvashi Aneja, founder of the Digital Futures Lab, went toe to toe with Google’s Kent Walker.

“Satya Nadella of Microsoft said he wanted to make Google dance. And Google danced,” said Lichfield. “We are now, all of us, jumping into the void holding our noses because these two companies are out there trying to beat each other.” Walker, in response, emphasized the social benefits that advances in artificial intelligence could bring in areas like drug discovery, and restated Google’s commitment to human rights. 

The following day, AI researcher Timnit Gebru directly addressed the talk of existential risks posed by AI: “Ascribing agency to a tool is a mistake, and that is a diversion tactic. And if you see who talks like that, it’s literally the same people who have poured billions of dollars into these companies.”

She said, “Just a few months ago, Geoff Hinton was talking about GPT-4 and how it’s the world’s butterfly. Oh, it’s like a caterpillar that takes data and then flies into a beautiful butterfly, and now all of a sudden it’s an existential risk. I mean, why are people taking these people seriously?”

Frustrated with the narratives around AI, experts like Human Right Watch’s tech and human rights director, Frederike Kaltheuner, suggest grounding ourselves in the risks we already know plague AI rather than speculating about what might come. 

And there are some clear, well-documented harms posed by the use of AI. They include:

• Increased and amplified misinformation. Recommendation algorithms on social media platforms like Instagram, Twitter, and YouTube have been shown to prioritize extreme and emotionally compelling content, regardless of accuracy. LLMs contribute to this problem by producing convincing misinformation known as “hallucinations.” (More on that below)
• Biased training data and outputs. AI models tend to be trained on biased data sets, which can lead to biased outputs. That can reinforce existing social inequities, as in the case of algorithms that discriminate when assigning people risk scores for committing welfare fraud, or facial recognition systems known to be less accurate on darker-skinned women than white men. Instances of ChatGPT spewing racist content have also been documented.
• Erosion of user privacy. Training AI models require massive amounts of data, which is often scraped from the web or purchased, raising questions about consent and privacy. Companies that developed large language models like ChatGPT and Bard have not yet released much information about the data sets used to train them, though they certainly contain a lot of data from the internet. 

Kaltheuner says she’s especially concerned generative AI chatbots will be deployed in risky contexts such as mental health therapy: “I’m worried about absolutely reckless use cases of generative AI for things that the technology is simply not designed for or fit for purpose.” 

Gebru reiterated concerns about the environmental impacts resulting from the large amounts of computing power required to run sophisticated large language models. (She says she was fired from Google for raising these and other concerns in internal research.) Moderators of ChatGPT, who work for low wages, have also experienced PTSD in their efforts to make model outputs less toxic, she noted. 

Regarding concerns about humanity’s future, Kaltheuner asks “Whose extinction? Extinction of the entire human race? We are already seeing people who are historically marginalized being harmed at the moment. That’s why I find it a bit cynical.”

What else I’m reading

• US government agencies are deploying GPT-4, according to an announcement from Microsoft reported by Bloomberg. OpenAI might want regulation for its chatbot, but in the meantime, it also wants to sell it to the US government.
• ChatGPT’s hallucination problem might not be fixable. According to researchers at MIT, large language models get more accurate when they debate each other, but factual accuracy is not built into their capacity, as broken down in this really handy story from the Washington Post. If hallucinations are unfixable, we may only be able to reliably use tools like ChatGPT in limited situations. 
• According to an investigation by the Wall Street Journal, Stanford University, and the University of Massachusetts, Amherst, Instagram has been hosting large networks of accounts posting child sexual abuse content. The platform responded by forming a task force to investigate the problem. It’s pretty shocking that such a significant problem could go unnoticed by the platform’s content moderators and automated moderation algorithms.

What I learned this week

A new report by the South Korea–based human rights group PSCORE details the days-long application process required to access the internet in North Korea. Just a few dozen families connected to Kim Jong-Un have unrestricted access to the internet, and only a “few thousand” government employees, researchers, and students can access a version that is subject to heavy surveillance. As Matt Burgess reports in Wired, Russia and China likely supply North Korea with its highly controlled web infrastructure.

Article link: https://www-technologyreview-com.cdn.ampproject.org/c/s/www.technologyreview.com/2023/06/12/1074449/real-ai-risks/amp/

By Tia Ghose published 3 days ago

A new experiment by IBM computers shows that quantum computers could soon outperform classical digital computers at practical tasks in the next two years.

Quantum computers could beat classical ones at answering practical questions within two years, a new experiment from IBM computers shows. The demonstration hints that true quantum supremacy, in which quantum computers overtake classical digital ones, could be here surprisingly soon.

“These machines are coming,” Sabrina Maniscalco, CEO of Helsinki-based quantum-computing startup Algorithmiq, told Nature News.

In the new study, described Wednesday (June 14) in the journal Nature, scientists used IBM’s quantum computer, known as Eagle, to simulate the magnetic properties of a real material faster than a classical computer could. It achieved this feat because it used a special error-mitigating process that compensated for noise, a fundamental weakness of quantum computers.f

Traditional silicon-chip-based computers rely on “bits” that can take just one of two values: 0 or 1. 

By contrast, quantum computers employ quantum bits, or qubits, that can take on many states at once. Qubits rely on quantum phenomena such as superposition, in which a particle can exist in multiple states simultaneously, and on quantum entanglement, in which the states of distant particles can be linked so that changing one instantaneously changes the other. In theory, this allows qubits to make calculations much faster, and in parallel, that digital bits would do slowly and in sequence.

But historically, quantum computers have had an Achilles’ heel: The quantum states of qubits are incredibly delicate, and even the tiniest disruption from the outside environment can mess with their states — and thereby the information they carry — forever. That makes quantum computers very error-prone or “noisy.”

In the new proof-of-principle experiment, the 127-qubit Eagle supercomputer, which uses qubits built on superconducting circuits, calculated the complete magnetic state of a two-dimensional solid. The researchers then carefully measured the noise produced by each of the qubits. It turned out that certain factors, such as defects in the supercomputing material, could reliably predict the noise generated in each qubit. The team then used these predictions to model what the results would have looked like without that noise, Nature News reported.

Claims of quantum supremacy have surfaced before: In 2019, Google scientists claimed that the company’s quantum computer, known as Sycamore, had solved a problem in 200 seconds that an ordinary computer would take 10,000 years to crack. But the problem it solved — essentially spitting out a huge list of random numbers and then checking their accuracy, had no practical use.

By contrast, the new IBM demonstration applies to a real — albeit highly simplified — physical problem. 

“It makes you optimistic that this will work in other systems and more complicated algorithms,” John Martinis, a physicist at the University of California, Santa Barbara, who achieved the 2019 Google result, told Nature News.

Article link: https://www.livescience.com/technology/computing/quantum-computers-could-overtake-classical-ones-within-2-years-ibm-benchmark-experiment-shows

You can read more about the quantum computing milestone at Nature News.

June 14, 2023. Jennifer Abbasi

Article Information

JAMA. Published online June 14, 2023. doi:10.1001/jama.2023.10262

A year and a half after US Surgeon General Vivek Murthy, MD, MBA, called attention to increasing symptoms of depression, anxiety, and suicidal ideation among children and adolescents, the Nation’s Doctor is now sounding the alarm on a likely driver of the youth mental health crisis: social media use.

“The most common question parents ask me is, ‘Is social media safe for my kids?’ The answer is that we don’t have enough evidence to say it’s safe, and in fact, there is growing evidence that social media use is associated with harm to young people’s mental health,” Murthy said in a recent statement announcing a new US Surgeon General’s Advisory.

Such advisories are reserved for major public health issues that warrant more awareness and action. Released in late May, the new advisory highlighted increasing concerns about social media’s effects on the mental health of the nation’s youth. It pointed out that nearly all teenagers report using a social media platform and that more than a third say they use at least 1 platform “almost constantly.”Younger children are also active online. Despite a minimum age requirement of 13 years on most US social media platforms, nearly 40% of 8- to 12-year-olds report social media use.

“Children are exposed to harmful content on social media, ranging from violent and sexual content, to bullying and harassment,” Murthy cautioned in the announcement. “And for too many children, social media use is compromising their sleep and valuable in-person time with family and friends. We are in the middle of a national youth mental health crisis, and I am concerned that social media is an important driver of that crisis—one that we must urgently address.”

Although evidence is growing that problematic social media use can negatively affect youth mental health and well-being, the advisory also emphasized that more research is needed to understand the “full scope and scale” of effects on young people—both negative and positive. In the meantime, the burden of protecting children and adolescents should fall not only to their families, but also to technology companies, policy makers, and researchers, the advisory said.

A Wholesale Shift

Leaders of several major medical organizations, including the American Academy of Pediatrics, the American Academy of Family Physicians, and the American Psychiatric Association, welcomed the advisory. “As physicians, we see firsthand the impact of social media, particularly during adolescence—a critical period of brain development,” Jack Resneck Jr, MD, president of the American Medical Association, the publisher of JAMA, said in the announcement.

In emails with JAMA, child and adolescent mental health experts also agreed with the Surgeon General’s message.

“This advisory maps onto what I am concerned about as a clinician, as a researcher, and as a parent,” said Jeremy Veenstra-VanderWeele, MD, a professor of child and adolescent psychiatry at the Columbia University Irving Medical Center and a JAMA Psychiatryeditorial board member.

“We have seen a wholesale shift in how youth are interacting with each other,” he continued. “We see what we think are the impacts of this shift, but we need much more research to understand what we are seeing.” Circumstantially, he said, clinicians have observed “a marked rise in youth anxiety and depression over the same period of time when social media has become so widely used.”

Veenstra-VanderWeele and other experts said the advisory struck the right balance between highlighting the potential harms and benefits of social media for youth. Social media use affects different children in different ways, based on their individual characteristics, as well as on cultural, historical, and socioeconomic factors, the advisory noted. For some young people, social media can offer positive connections and support they may not have in their homes, schools, or neighborhoods. These benefits can be especially important for youth who belong to marginalized groups.

But there can be substantial downsides. “It is staggering how much time youth spend on social media,” Veenstra-VanderWeele said. “It really seems all-consuming for some use, with incredible distress if it is taken away.”

n fact, according to the advisory, teenagers in the University of Michigan’s ongoing Monitoring the Future survey spent an average of 3.5 hours on social media per day in 2021. One in 4 teens reported spending 5 or more hours on the platforms daily. Research published in JAMA Psychiatry found that adolescents who spent more than 3 hours on social media per day had an increased risk of poor mental health outcomes such as depression and anxiety symptoms. And perhaps unsurprisingly, excessive social media use has also been strongly tied to sleep problems in youth.

The hours spent scrolling aren’t the only concern, the advisory noted. There’s also the exposure to harmful messages and behaviors, cyberbullying, and hate-based content. These exposures appear to be taking a toll on the nation’s youth. Nearly half of teenagers—46%—said social media made them feel worse about their body image in a 2022 survey conducted by the Boston Children’s Hospital Digital Wellness Lab. Girls appear to be especially vulnerable to comparing themselves with others on social media, which has been linked with body dissatisfaction, eating disorders, and symptoms of depression.

The advisory acknowledged that the interplay between social media use and youth mental health may be bidirectional and noted that untangling these complex relationships will require more data and transparency than technology companies have been willing to provide so far. It urged these companies to share their data with independent researchers.

Technology companies should also tailor their platforms for children’s developmental capabilities, the American Psychological Association (APA) said in its own health advisory, released in May. Features designed to maximize user engagement—such as displayed “likes,” autoplay content, and infinite scrolling—may not be appropriate for kids.

The Surgeon General’s advisory also outlined actions policy makers, researchers, parents and caregivers, and young people themselves can take immediately. Policy makers can, for example, fund additional research, better protect kids’ privacy, and work to strengthen safety standards, while researchers can prioritize studies that inform those standards. Parents and caregivers, the advisory recommended, can establish technology-free zones in the house to protect sleep and encourage in-person socializing. And young people can aim to adopt healthy practices, such as limiting their social media time.

The Physician’s Role

For Kara Bagot, MD, a New York–based child and adolescent psychiatrist, the advisory is a positive step forward. But she said it falls short in providing a full mitigation plan with resources allocated to address the recommendations.

“This is particularly important as these recommendations are not novel; researchers and clinicians in the field have been urging more action from technology companies, pediatrics and family medicine practitioners, and funding agencies but lack the power or resources to facilitate the changes needed,” said Bagot, who is also an editor at JAMA Psychiatry.

Going forward, “we urgently need to think about testing different approaches to evaluate and potentially mitigate the risks that may be associated with social media use,” Veenstra-VanderWeele said.

Youth should be at the center of addressing the issue of their own social media use, advised Tammy Chang, MD, MPH, an associate professor in the Department of Family Medicine at the University of Michigan and director of the MyVoice National Poll of Youth. The poll has found that many young people already know that social media use has negative impacts and are trying to modulate their use.

“When youth have input and buy-in on initiatives meant to change their behaviors, those initiatives are more likely to succeed,” Chang said, noting that this approach could be critical to the advisory’s success. “Meaningfully partnering with youth now could change the energy around the advisory from something that adults are worried about for youth to a partnership between youth and experts to address something everyone is working on together.”

Pediatricians and family physicians also have an important role. Veenstra-VanderWeele said he believes primary care physicians have a responsibility to discuss safe and balanced use of social media with youth and their parents. These conversations should include setting limits, particularly around sleep.

“In discussions with physicians, youth are often able to describe how they would like to change their use of social media,” he said. “Discussing their desire to change their social media use together with their parents allows collaborative limit-setting, which is an ideal way for youth to align with their parents, rather than generating conflict.”

In their one-on-one discussions with young patients, physicians should also ask about exposure to harmful content or potentially dangerous online interactions, “in the same way that we ask about substance use or sexual activity,” Veenstra-VanderWeele said.

Health professionals can educate families about social media settings that can be adjusted to better customize the platforms for children, such as hiding “like” and “view” counts and restricting time on Instagram, turning off comments and scheduling reminders for “screen time breaks” on TikTok, and toggling off “autoplay” on YouTube.

Physicians can also discuss parents’ screen-related behaviors and how these habits may be affecting their children. “Youth are active observers of their caregivers,” Bagot said. “As such, modeling balanced online behaviors for one’s children is important. Parents need to be educated on [this] and also on what balanced, appropriate behaviors are.”

Ultimately, experts say, efforts to protect youth well-being should not discount the positive interactions that can happen when kids connect on social media. Veenstra-VanderWeele has heard from teens about how important their online community is to them, particularly for those who may not fit in easily with peers at school or in their neighborhood. “We need to figure out how to harness the potential benefits of online social connections while decreasing the potential harms,” he said.

Article link: https://jamanetwork.com/journals/jama/fullarticle/2806277?

Back to top

Article Information

Published Online: June 14, 2023. doi:10.1001/jama.2023.10262

Conflict of Interest Disclosures: Dr Chang reported serving as a committee member of the Board on Children, Youth, and Families at the National Academies of Sciences, Engineering, and Medicine; directing MyVoice, a national poll of youth that has received internal funding from the University of Michigan. No other disclosures were reported.

See More About 

Adolescent MedicineMedia and YouthPsychiatry and Behavioral HealthPediatrics

The U.S. has committed to keeping humans in the chain of command. It’s time for China to do the same.

Opinion by KATHLEEN HICKS

06/15/2023 04:30 AM EDT

Kathleen H. Hicks is the U.S. Deputy Secretary of Defense.

Artificial intelligence may transform many aspects of the human condition, nowhere more than in the military sphere. Although many Americans may only now be focusing on AI’s potential promise and peril, the U.S. Defense Department has worked for over a decade to ensure its responsible use. The challenge now is to convince other nations, including the People’s Republic of China, to join the United States in committing to norms of responsible AI behavior.

The Pentagon first issued a responsible use policy for autonomous systems and AI in 2012. Since that time, we’ve maintained our commitment even as technology has evolved. In recent years, we’ve adopted ethical principles for using AI, and issued a responsible AI strategy and implementation pathway. This January, we also updated our original 2012 directive on autonomy in weapon systems, to help ensure we remain the global leader of not just development and deployment, but also safety.

Where the Defense Department is investing in AI, we’re doing so in areas that provide us with the most strategic benefit and capitalize on our existing advantages. We also draw a bright line when it comes to nuclear weapons. The policy of the United States is to maintain a human “in the loop” for all actions critical to informing and executing decisions by the president to initiate and terminate the use of nuclear weapons.

Although we are swiftly embedding AI in many other aspects of our mission — from battlespace awareness, cyber and reconnaissance, to logistics, force support and other back-office functions — we do so mindful of AI’s potential dangers, which we’re determined to avoid. We don’t use AI to censor, constrain, repress or disempower people. By putting our values first and playing to our strengths, the greatest of which is our people, we’ve taken a responsible approach to AI that will ensure America continues to come out ahead.

Our current level of funding for AI reflects our present needs: the latest U.S. defense budget, for fiscal year 2024, invests $1.8 billion in artificial intelligence and machine learning capabilities, to continue our progress in modernization and innovation. That will change over time as we incorporate the technology effectively into how we operate — while also staying true to the principles that make ours the world’s finest fighting force.

Even as our use of AI reflects our ethics and our democratic values, we don’t seek to control innovation. America’s vibrant innovation ecosystem is second-to-none because it’s powered by a free and open society of imaginative inventers, doers and problem-solvers. While that makes me choose our free-market system over China’s statist system any day of the week, it doesn’t mean the two systems cannot coexist.

Chinese diplomats have said that the PRC “‘takes very seriously the need to prevent and manage AI-related risks and challenges,’” according to news reports. Those are good words; actions matter more. If China is indeed “ready to step up exchanges and cooperation ‘with all parties,’” the Pentagon would welcome such direct engagement.

Our commitment to values is one reason why the United States and its military have so many capable allies and partners around the world, and growing numbers of commercial technology innovators who want to work with us: because they share our values.

Such values are owned by no country or company; others are welcome to embrace them. For example, if the PRC credibly and verifiably committed to maintaining human involvement for all actions critical to informing and executing sovereign decisions to use nuclear weapons, it might find that commitment warmly received by its neighbors and others in the international community. And rightfully so.

The United States does not seek an AI arms race, or any arms race, with China, just as we do not seek conflict, either. With AI and all our capabilities, we seek only to deter aggression and defend our country, our allies and partners, and our interests.

America and China are competing to shape the future of the 21st century, technologically and otherwise. That competition is one which we intend to win — not in spite of our values, but because of them.

Article link: https://www.politico.com/news/magazine/2023/06/15/pentagon-artificial-intelligence-china-00101751

June 15, 2023 By Atlantic Council experts

The humans are still in charge—for now. The European Parliament, the legislative branch of the European Union (EU), passed a draft law on Wednesday intended to restrict and add transparency requirements to the use of artificial intelligence (AI) in the twenty-seven-member bloc. In the AI Act, lawmakers zeroed in on concerns about biometric surveillance and disclosures for generative AI such as ChatGPT. The legislation is not final. But it could have far-reaching implications since the EU’s large size and single market can affect business decisions for companies based elsewhere—a phenomenon known as “the Brussels effect.”

Below, Atlantic Council experts share their genuine intelligence by answering the pressing questions about what’s in the legislation and what’s next. 

1. What are the most significant aspects of this draft law? 

The European Parliament’s version of the AI Act would prohibit use of the technology within the EU for controversial purposes like real-time remote biometric identification in public places and predictive policing. Member state law enforcement agencies are sure to push back against aspects of these bans, since some of them are already using these technologies for public security reasons. The final version could well be more accommodating of member states’ security interests.

—Kenneth Propp is a nonresident senior fellow with the Atlantic Council’s Europe Center and former legal counselor at the US Mission to the European Union in Brussels.

The most significant aspect of the draft AI Act is that it exists and has been voted on positively by the European Parliament. This is the only serious legislative attempt to date to deal with the rapidly evolving technology of AI and specifically to address some of the anticipated risks, both due to the technology itself and to the ways people use it. For example, a government agency might use AI to identify wrongdoing among welfare recipients, but due to learned bias it misidentifies thousands of people as participating in welfare fraud (this happened in the Netherlands in 2020). Or a fake video showing a political candidate in a compromising position is released just prior to the election. Or a government uses AI to track citizens and determine whether they exhibit “disloyal” behavior.

To address these concerns, EU policymakers have designed a risk-management framework, in which higher-risk applications would receive more scrutiny. A few uses of AI—social scoring, real-time facial recognition surveillance—would be banned, but most companies deploying AI, even the higher-risk cases, would have to file extensive records on training and uses. Above all, this is a law about transparency and redress: humans should know when they are interacting with AI, and if AI makes decisions about them, they should have a right of redress to a fellow human. In the case of generative AI, such as ChatGPT, the act requires that images be marked as coming from AI and the AI developer should list the copyrighted works on which the AI trained.

Of course, the act is not yet finished. Next, there will be negotiations between parliament and the EU member states, and we can expect significant opposition to certain bans from European law enforcement institutions. Implementation will bring other challenges, especially in protecting trade secrets while examining how algorithms might steer users toward extreme views or criminal fraudsters. But if expectations hold, by the end of 2023 Europe will have the first substantive law on AI in the world.

—Frances Burwell is a distinguished fellow at the Atlantic Council’s Europe Center and a senior director at McLarty Associates.

There are numerous significant aspects of this law, but there are two and a half that really stand out. The first is establishing a risk-based policy where lawmakers identify certain uses as presenting unacceptable risk (for example, social scoring, behavioral manipulation of certain groups, and biometric identification by groups including police). Second, generative AI systems would be regulated and required to disclose any copyrighted data that was used to train the generative model, and any content AI outputs would need to carry a notice or label that it was created with AI. It’s also interesting what’s included as guidance for parliament to “ensure that AI systems are overseen by people, are safe, transparent, traceable, non-discriminatory, and environmentally friendly.” This gives parliament a wide mandate that could see everything from data provenance to data center energy use be regulated under this draft law.

—Steven Tiell is a nonresident senior fellow with the Atlantic Council’s GeoTech Center. He is a strategy executive with wide technology expertise and particular depth in data ethics and responsible innovation for artificial intelligence.

2. What impact would it have on the industry?

Much as the EU’s General Data Protection Regulation (GDPR) became a globally motivating force in the business community, this law will do the same. The burden on companies to maintain and keep separate infrastructure exclusively for the EU is much higher than the cost of compliance. And the cost (and range) of noncompliance for companies (and individuals) has risen—prohibited uses, those deemed to have unacceptable risk, will incur a fine up to forty million euros or 7 percent of worldwide annual turnover (total global revenue) for the preceding financial year, whichever is greater. Violations of human-rights laws or any type of discrimination perpetrated by an AI will incur fines up to twenty million euros or 4 percent of worldwide turnover. Other noncompliance offenses, including from foundational models (again, the draft regulation affects generative AI), are subjected to fines of up to ten million euros or 2 percent of worldwide annual turnover. And those supplying false, incomplete, or misleading information to regulators can be fined up to five million euros or 1 percent of worldwide annual turnover. These fines are a big stick to encourage compliance. 

—Steven Tiell 

As I wrote for Lawfare when the European Commission proposed the AI Act two years ago, the proposed AI regulation is “a direct challenge to Silicon Valley’s common view that law should leave emerging technology alone.” At the same time, though the legislation is lengthy and complex, it is far from the traditional caricature of EU measures as heavy-handed, top-down enactments. Rather, as I wrote then, the proposal “sets out a nuanced regulatory structure that bans some uses of AI, heavily regulates high-risk uses, and lightly regulates less risky AI systems.” The European Parliament has added some onerous requirements, such as a murky human-rights impact assessment of AI systems, but my earlier assessment remains generally true.

It’s also worth noting that other EU laws, such as the GDPR adopted in 2016, will have an important and still-evolving impact on the deployment of AI within EU territory. For example, earlier this week Ireland’s data protection commission delayed Google’s request to deploy Bard, its AI chatbot, because the company had failed to file a data protection impact assessment, as required by the GDPR. Scrutiny of AI products by multiple European regulatory authorities employing precautionary approaches likely will mean that Europe will lag in seeing some new AI products.

—Kenneth Propp

3. How might this process shape how the rest of the world regulates AI?

It will have an impact on the rest of the world, but not simply by becoming the foundation for other AI acts. Most significantly, the EU act puts certain restrictions on governmental use of AI in order to protect democracy and a citizen’s fundamental rights. Authoritarian regimes will not follow this path. The AI Act is thus likely to become a marker, differentiating between those governments that value democracy more than technology, versus those that seek to use technology to control their publics.

—Frances Burwell

Major countries across the globe from Brazil to South Korea are in the process of developing their own AI legislation. The US Congress is slowly moving in the same direction with a forthcoming bill being developed by Senate Majority Leader Chuck Schumer likely to have important influence. If the EU sticks to its timetable of adopting the AI Act by the end of the year, its legislation could shape other countries’ efforts significantly by virtue of being early out of the gate and comprehensive in nature. Countries more concerned with promoting AI innovation, such as the United Kingdom, may stake out a lighter-touch approach than the EU, however.

—Kenneth Propp

The world’s businesses will comply with the EU’s AI Act if they have any meaningful amount of business in the EU and governments in the rest of the world are aware of this. Compliance with the EU’s AI Act will be table stakes. It can be assumed that many future regulations will mimic many components, big and small, of the EU’s AI Act, but where they deviate will be interesting. Expect to see other regulators emboldened by the fines and seek commensurate remuneration for violations in their countries. Other countries might extend more of the auditing requirements to things such as maintaining outputs from generative models. Consumer protections in different countries will be more variable as well. And it will be interesting to see if countries such as the United States and United Kingdom pivot their legislation toward being more risk-based as opposed to principles-based.

—Steven Tiell 

4. What are the chances of this becoming law, and how long will it take? 

Unlike in the United States, where congressional passage of legislation is typically the decisive step, the European Parliament’s adoption on Wednesday of the AI Act only prepares the way for a negotiation with the EU’s member states to arrive at the final text. Legislative proposals can shift substantially during such closed-door “trilogues” (so named because the European Commission as well as the Council of the European Union also participate). The institutions aim for a final result by the end of 2023, during Spain’s presidency of the Council, but legislation of this complexity and impact easily could take longer to finalize.

—Kenneth Propp

Based on this week’s vote, there are strong signals of overwhelming support for this draft law. The next step is trilogue negotiations among the parliament, the Council of the European Union, and the European Commission, and these negotiations will determine the law’s final form. There are strong odds these negotiations will finish by the end of the year. At that point, the act will take about two years to transpose to EU member states for implementation, similar to what happened with GDPR. Also similar to GDPR, it could take at least that long for member states to develop the expertise to assume their role as market regulators. 

—Steven Tiell 

5. What are some alternative visions for regulating AI that we may see?

In general, we see principles-based, risk-based, and rights-based legislation. Depending on the government and significance of the law, different approaches might be applied. The EU’s AI Act is somewhat unique and interesting as it started life as a principles-based approach, but through its evolution became primarily risk-based. Draft legislation in the United States and the United Kingdom is principles-based today. Time will tell if these governments are influenced by the EU’s approach.

—Steven Tiell

Article link: https://www.atlanticcouncil.org/blogs/new-atlanticist/the-worlds-regulatory-superpower-is-taking-on-a-regulatory-nightmare-artificial-intelligence/

NICHOLAS JORDAN AND JENNIFER MAPP

JUNE 14, 2023 COMMENTARY

If logistics wins or loses wars, what wins or loses logistics? U.S. military doctrine has the answer: “The U.S. military supply chain (to include the defense industrial base) represents a major competitive advantage that underpins deterrence and allows the United States to project power.” Despite being established in doctrine, it took a global pandemic for the Department of Defense to take notice of the fragility of its supply chains and the full impact of China’s global economic expansion. However, acknowledging vulnerability, understanding it, and doing something about it are not mutually inclusive. While awareness in the Department of Defense is rising, the lack of visibility into defense supply chains makes easy targets for adversaries seeking to insert undetected risks into supply chains — silently biding time until they choose to exploit them. It is difficult to fix what you can’t see. It is time for the Department of Defense to take bold steps to gain full visibility into defense supply chains to help mitigate the risk of acquiring U.S. equipment from foreign adversaries and/or shoddy suppliers.

Supply chains underpin the global market. Every product has a network of interconnected companies that must come together at the right time and place to deliver a timely product. The more complex the product, the more nodes the network has. Each node has its own material, logistics, personnel, processes and stakeholder challenges. A disruption in one node will sweep quickly throughout the entire system and upend the supply chain.

The military supply chain is a complex system comprised of a network of suppliers, expanding beyond the known large defense contractors out to thousands of low-tier suppliers. Each tier of the network is critical to the success of the tiers above and below it. Within these networks, there are nexus suppliers critical to the success of the entire system. We argue that it is not too hard and not too expensive to gain full visibility over all of these supply chain nodes. To do so, the Department of Defense should capitalize on proven commercial supply chain software suites, work with Congress to set visibility mandates and reimagine its approach to supply chain management in the 21st century.

The Department of Defense’s Supply Chain Crisis

The Department of Defense has an incentive to map and fully understand its supply chain — and the suppliers that support it. It is currently facing two issues. The first, and most critical, is that the department does not know who provides parts for suppliers below a certain supplier threshold. An example from the private sector is illustrative of the supply chain and its nodes. The Center for Advanced Purchasing Studies mapped the American Honda Motor Company’s supply network. The supply chain included 10,832 suppliers: 245 first tier, 1,643 second tier, 4,605 third tier and 4,330 fourth tier. For Honda, over 97 percent of its suppliers were below tier one. This is the level of supplier visibility the Department of Defense admitted it was unable to attain in a 2022 report to the president.

The second challenge is that the suppliers the Department of Defense depends on may be clustered together in similar geographic regions. This makes them vulnerable to “kill shots,” a metaphor used for military targets that, if attacked, can render an adversary crippled and unable to respond. For example, the Living Supply Chain, a 2017 book on supply chain management written by Robert Handfield and Tom Linton, offers an illustration. Elementum mapped a client’s revenue streams to supplier locations, determining that 86 percent of the company’s revenues were tied to suppliers in one small geographic area. A single major disaster could ultimately impact 86 percent of the company’s revenues. Imagine if a similar geographic risk resides within the U.S. defense supply chain and how the clustering of a vital industry makes the United States vulnerable to attack.

The 2022 National Defense Strategy directs the Department of Defense to “fortify the defense industrial base, logistical systems, and relevant global supply chains” in response to the observed rise in supply chain impacts. For example, COVID-19-related supply chain disruptions caused delays in 48 major defense acquisition programs. Of those, 22 programs continue to experience delays, suggesting that things have not improved even as COVID-19-related concerns have subsided.

The U.S. Air Force’s acquisition chief has said: “Ongoing supply chain issues affecting subcontractors [sic] were largely responsible for the more than year-and-a-half delay” to the KC-46’s remote vision system. And the U.S. Navy’s Columbia-class submarine is already struggling to meet current program demands, highlighting that the “supply chain is the number 1 risk.” Beyond delays, the lack of visibility into all elements of the supply chain prevents the Department of Defense from identifying disruptions early — and planning for them proactively.

The second, and ongoing concern, is about quality control. There is a real risk of inferior or counterfeit components being injected into the Department of Defense’s supply chain. In June 2020, 1st Lt. David Schmitz was killed in an F-16 accident. In a related federal civil lawsuit, it was revealed that the Air Force identified several transistors and microchips that failed. The lawsuit alleges some of these components were counterfeit. Separately, in 2022, the Department of Justice filedcriminal charges against an individual for selling approximately $1 billion of Chinese-made counterfeit Cisco components to companies within the United States and an undisclosed list of government agencies, including the Department of Defense.

Supply Chain Risk Management: The Department of Defense’s History of Neglect 

Unfortunately, the fragility of the Department of Defense’s supply chain is not a new issue. Over five years ago, a Government Accountability Office report highlighted that the information required to effectively manage supply chain risks within the defense sector was lacking. In response to this report, the Department of Defense “completed a detailed assessment of key sectors … and identified major risks … and included discussion of gaps or vulnerabilities and mitigation strategies.” However, the growing trend of supply chain disruptions suggests the Department of Defense’s mitigation steps were either never fully implemented or that they have failed to mitigate the problems.

The F-35’s supply chain is a good example. The United States is 100 percent import-reliant on 16 minerals deemed “critical” to national security. China accounts for “63 percent of the world’s rare earth mining, 85 percent of rare earth processing, and 92 percent of rare earth magnet production.” Yet, it still took the Department of Defense 12 years to recognize “every one of the more than 825 F-35[s] … delivered contains a component made with a Chinese alloy that is prohibited by both U.S. law and Pentagon regulations.”

To address this lack of visibility, President Biden issued an executive orderdirecting the Department of Defense to “submit a report identifying risks in the supply chain [sic] and policy recommendations to address these risks.” In response, the department admitted it had limited visibility, stating it “[does] not track these vulnerabilities … As supply chains have become more global in scale, prime contractors have lost some visibility into the sub-tiers of their supply chains, especially below third-tier levels.” The Department of Defense is currently reviewing these impacts. If history repeats, the department might see measurable progress in about 10 years.

Supply Chain Risk Management: A Tale of Two Industries

Supply chain risk management is not unique to the defense sector and the need for speed, agility and resilience is just as critical to profit margins as it is to national security. While private industry has evolved, the Department of Defense continues to view it through a very logistics-focused lens. Decades ago, industry began consolidating responsibility for the end-to-end value stream, establishing senior managerial positions for procurement and supply officers. In contrast, the Department of Defense continues to silo its functions of procurement, logistics, and operations. Each functional area assesses its lens of supply chain risk (e.g., cyber, acquisition, logistics, etc.), but no one organization is considering the inherent collective risks to the entire defense industrial base.

Private industry has also embraced the importance of proactive supply chain risk management and integrated it as a critical part of operations. Handfield and Linton offer that global supply chains are living systems “subject to biological rules.” And rule number one is that firms survive by adapting to changes in the ecosystem by “embracing real-time data, velocity, transparency, and rapid response.” Certain firms utilize commercial software solutions using big data, AI and machine learning to map supply chains. Others have implemented flow-down requirements mandating the use of commercial software solutions that rely on data directly from suppliers to create verified supply chain maps. In both cases, many then employ additional software to conduct real-time monitoring of the mapped network using publicly available information. Everstream, Resilinc, Craft, BlueVoyant, Deloitte CentralSight and many more offer software solutions in this space. Becton Dickenson, one of the world’s largest medical technology firms, utilized Everstream to map a product line in three days with over 90 percent accuracy. Previous internal attempts took Becton Dickenson four years to accomplish. Using Resilinc’s software to build a validated supplier map, IBM received real-time supplier updates during the COVID-19 pandemic. This allowed IBM to proactively mitigate issues, resulting in zero missed product deliveries due to pandemic-related disruptions.

Despite the leaps made in the commercial sector, the defense sector has barely taken its first steps toward gaining real visibility into its supply chains. It has been over a year since the Department of Defense said it would apply analytical tools to identify vulnerabilities. To date, nothing of significant value has been fielded. The organic solutions being explored are not only costly but also directly conflict with the department’s own call to action to “act as a fast-follower” with regard to commercial technologies.

Recommendation and Conclusion

U.S. national security relies on the strength and resilience of its defense supply chains, and failing to understand their limits will be catastrophic in conflict with a near-peer adversary. The Russian invasion of Ukraine has already resulted in the United States struggling to meet munition needs for Ukrainian forces for a regionalized conflict. In the Pacific, the United States faces a $19-billion backlog of planned weapon transfers to the Taiwanese military, while delaying 66 new F-16V aircraftdeliveries due to supply chain disruptions. In Taiwan Strait conflict wargames, the Center for Strategic and International Studies determined that “the United States would likely run out of some munitions — such as long-range, precision-guided munitions — in less than one week.” The report also stated: “The U.S. defense industrial base is not adequately prepared for the international security environment that now exists.”

This stark performance and assessment of the U.S. industrial base should alarm policymakers in the Department of Defense and Congress. While there is growing awareness of this crisis within the Pentagon, it appears the Department is trending toward historical patterns of organizational change versus accountability. Dr. William LaPlante, the Department of Defense’s top procurement official, issued a memo in March 2023 establishing a Joint Production Accelerator Cell. It will be responsible for “building enduring industrial production capacity, resiliency, and surge capability for key defense weapon systems and supplies.” This initiative calls into question the broader effectiveness of the Department of Defense’s existing Industrial Base Policy office and should be a pause for strategic reflection. Why create a new organization when the Department of Defense has an established office already charged with sustaining “a robust, secure, and resilient industrial base”?

To drive more enduring impacts in fortifying the defense industrial base, the Department of Defense should first understand the scope of the problem it is trying to fix. We recommend the Department of Defense immediately execute an experimentation plan to test widely available commercial supply chain visibility solutions and select a common suite for the department. The Department of Defense should avoid replicating commercial applications, seeing that previous attempts by the department struggled to reach the field or later were scrapped after spending millions of dollars. Custom solutions also fail to leverage proven commercial applications already deployed at scale. Additionally, a common suite ensures the department is able to gain visibility across programs. Allowing each program to address supply chain visibility individually will answer program-specific questions, but it will not answer the broader question of the “kill shots” within the defense industrial base.

The Department of Defense should also work with Congress to implement visibility mandates for industry. This mandate should include a standard of visibility and government data access for all government contractors to give the Department of Defense the authority to hold industry accountable for supply chain risk management. This legislation already exists for rare earth elements for permanent magnets (10 U.S. Code § 857) and sensitive materials from non-allied foreign nations (10 U.S. Code § 4872). To imply the government is not able to gain visibility due to contract or cost constraints neglects to acknowledge the myriad standards the government already levies on industry. National security depends on resilient supply chains and visibility is the first step in fortifying them.

More broadly, the Pentagon should reconsider how it thinks about supply chain management. The majority of the focus on supply chain management and supply chain risk management is through the lens of logistics. This approach completely ignores what is happening in the supply chains as a system is in development or production. Too often, Department of Defense program offices relegate weapon system supply chain monitoring and oversight to logistics or to the contractor, often with little oversight or attention from program leadership until there is a problem. This is a dated approach. Supply chains impact almost every aspect of a system. The risk exposure to the defense ecosystem from horizontal integration and global diversification remains unknown.

Therefore, supply chain accountability must garner proactive attention from the earliest stages of weapon system development. For example, the full network of suppliers should be evaluated by the Department of Defense prior to codifying a weapon system design. The acquisition community must reimagine how “cost, schedule, performance” is defined. Rather than focus on obligation rates and updating baselines to bring programs back on schedule, program leaders must recognize the integrated impacts of the supply chain to all three areas if they are to remain relevant in the 21st century.

It is time for the Department of Defense to act swiftly. The CIA has said they are aware of Chinese intentions: General Secretary Xi Jinping told his army to “be ready by 2027” to invade Taiwan. One thing is certain today: Department of Defense supply chains lack the resiliency for a large-scale protracted conflict and they are not on track to be better positioned in 2027. The Department of Defense’s approach toward strengthening the defense industrial base and securing its supply chains is failing to move at the speed of relevance. As many Department of Defense leaders remain hyper-focused on exquisite technology, they should not forget that “none of this technical overmatch matters if America can’t build enough of it, sustain it, or get it to the fight in the first place.” Defense supply chains are under assault and the United States is losing. It is time for the Department of Defense to stop the studies and take immediate and real action to identify “kill shots” at risk for exploitation. Supply chain visibility across the defense industrial base is foundational for national security, and it requires a united implementation strategy.

Lt. Col. Nicholas Jordan has over 18 years of Air Force program management and acquisition experience. He is a student at the Eisenhower School of National Security and Resource Strategy at the National Defense University in Washington, D.C. 

Lt. Col. Jennifer Mapp has over 22 years of Air Force contracting and acquisition experience. She is a national defense fellow at Georgetown University in Washington, D.C.

The views expressed in this article are those of the authors and do not reflect the official policy or position of the United States Air Force, National Defense University, Department of Defense, or U.S. government.

Image: Capt. Travis Mueller

Article link: https://warontherocks.com/2023/06/in-the-dark-how-the-pentagons-limited-supplier-visibility-risks-u-s-national-security/

By CHRIS HUGHES JUNE 4, 2021

The order calls for modernizing the cloud-security program and opens the door for other frameworks to be used for authorization.

The Biden administration’s recently released cybersecurity-focused executive ordermentions a key cloud security program known as FedRAMP several times as it emphasizes the need for federal agencies to quickly but securely adopt cloud computing. 

Section 3 of the executive order, titled “Modernizing Federal Government Cybersecurity,” states that within 60 days of the order, the General Services Administration in consultation with the director of the Office of Management and Budget and heads of other agencies shall begin modernizing the Federal Risk and Authorization Management Program. This includes “identifying relevant compliance frameworks, mapping those frameworks onto requirements in the FedRAMP authorization process, and allowing those frameworks to be used as a substitute for the relevant portion of the authorization process, as appropriate.”

FedRAMP validates the security of cloud products—infrastructure, platforms, software applications—being sold to federal agencies. If a product meets FedRAMP’s controls, it gets certified with a provisional authority to operate, or P-ATO.

But it’s no secret that FedRAMP—best intentions aside—has long served as a bottleneck to getting innovative cloud service offerings to federal system/mission owners and agencies. FedRAMP began in 2011, roughly a decade ago, and currently has about 225 authorized cloud service offerings listed on its marketplace. To put this in perspective, there are roughly 15,000 software-as-a-service companies in the market. 

FedRAMP timelines vary depending on several factors—some related to the cloud service providers themselves, and others related to the FedRAMP Joint Authorization Board and program management office, or sponsoring agencies. That said, general timelines for a FedRAMP JAB P-ATO can take seven to nine months to complete. Agency authorizations can take anywhere from four to six months to complete. Some cases have taken much longer than this.

Part of the issue is that the FedRAMP JAB can only handle so many authorizations a year. On average, the JAB prioritizes 12 cloud service offerings each year. It evaluates cloud service offerings through a process called FedRAMP Connect, which they use to prioritize what cloud service offerings will be selected for the given year. 

Among other methods, the executive order opens the door for considering relevant compliance frameworks mapped to FedRAMP and allowing them to serve as a substitute for relevant portions of the FedRAMP process

With this clear challenge between the number of as-a-service offerings in the market and FedRAMP’s limited ability to scale to authorize, other compliance frameworks are being considered. But it’s yet to be determined what those alternative frameworks may be and what could be the challenges associated with them.

Some cybersecurity professionals have suggested one such alternative may be the Cloud Security Alliance’s Cloud Control Matrix (CCM), which provides 197 controls and 17 domains. It is also mapped to industry frameworks, including FedRAMP. However, some challenges associated with CCM is that it does not have the same third-party assessor rigor that FedRAMP has and allows for companies to self-attest their products meet the standards. 

There are also cascading effects of opening the door to FedRAMP alternatives within the defense industrial base. Defense companies have to deal with regulations such as the Defense Department’s vendor certification program called Cybersecurity Maturity Model Certification and acquisition rule 7012, which provides guidance to defense contractors using cloud services when dealing with covered defense information. There has been no shortage of talk of reciprocity between FedRAMP and CMMC. If FedRAMP opens the door for reciprocity with other control frameworks, this then creates a potentially transitive situation with anything FedRAMP would use as an alternative framework. In other words, if alternative frameworks are accepted in place of FedRAMP for federal cloud use, then theoretically FedRAMP alternatives would also potentially have reciprocity with CMMC. This creates a lot of questions and challenges for the Defense Department, the defense industry and CMMC that would need to be explored. 

While there are no easy answers, it is clear that the government’s consumption and utilization of cloud service offerings are only accelerating and were further exacerbated by the COVID pandemic. Given this reality, it is clear that the current model of authorization and approval of cloud services simply hasn’t—and won’t—scale to meet the demand and creates a situation to explore alternative options. That said, alternatives can’t come at the expense of the security of federal and defense data. 

Chris Hughes is an industry consultant, an adjunct professor with the University of Maryland Global Campus and Capitol Technology University, and co-host of the Resilient Cyber podcast. He previously served in the U.S. Air Force, as a federal civilian with Naval Information Warfare Systems Atlantic, and as a member of the General Services Administration’s Joint Authorization Board for FedRAMP.

Article link: https://www.nextgov.com/ideas/2021/06/executive-order-hints-fedramp-alternatives/174505/

A quantum computer came up with better answers to a physics problem than a conventional supercomputer.

By Kenneth Chang

• June 14, 2023Updated 11:51 a.m. ET

Quantum computers today are small in computational scope — the chip inside your smartphone contains billions of transistors while the most powerful quantum computer contains a few hundred of the quantum equivalent of a transistor. They are also unreliable. If you run the same calculation over and over, they will most likely churn out different answers each time.

But with their intrinsic ability to consider many possibilities at once, quantum computers do not have to be very large to tackle certain prickly problems of computation, and on Wednesday, IBM researchers announced that they had devised a method to manage the unreliability in a way that would lead to reliable, useful answers.

“What IBM showed here is really an amazingly important step in that direction of making progress towards serious quantum algorithmic design,” said Dorit Aharonov, a professor of computer science at the Hebrew University of Jerusalem who was not involved with the research.

While researchers at Google in 2019 claimed that they had achieved “quantum supremacy” — a task performed much more quickly on a quantum computer than a conventional one — IBM’s researchers say they have achieved something new and more useful, albeit more modestly named.

“We’re entering this phase of quantum computing that I call utility,” said Jay Gambetta, a vice president of IBM Quantum. “The era of utility.”

A team of IBM scientists who work for Dr. Gambetta described their results in a paper published on Wednesday in the journal Nature.

Present-day computers are called digital, or classical, because they deal with bits of information that are either 1 or 0, on or off. A quantum computer performs calculations on quantum bits, or qubits, that capture a more complex state of information. Just as a thought experiment by the physicist Erwin Schrödinger postulated that a cat could be in a quantum state that is both dead and alive, a qubit can be both 1 and 0 simultaneously.

That allows quantum computers to make many calculations in one pass, while digital ones have to perform each calculation separately. By speeding up computation, quantum computers could potentially solve big, complex problems in fields like chemistry and materials science that are out of reach today. Quantum computers could also have a darker side by threatening privacy through algorithms that break the protections used for passwords and encrypted communications.

When Google researchers made their supremacy claim in 2019, they said their quantum computer performed a calculation in 3 minutes 20 seconds that would take about 10,000 years on a state-of-the-art conventional supercomputer.

But some other researchers, including those at IBM, discounted the claim, saying the problem was contrived. “Google’s experiment, as impressive it was, and it was really impressive, is doing something which is not interesting for any applications,” said Dr. Aharonov, who also works as the chief strategy officer of Qedma, a quantum computing company.

The Google computation also turned out to be less impressive than it first appeared. A team of Chinese researchers was able to perform the same calculation on a non-quantum supercomputer in just over five minutes, far quicker than the 10,000 years the Google team had estimated.

The IBM researchers in the new study performed a different task, one that interests physicists. They used a quantum processor with 127 qubits to simulate the behavior of 127 atom-scale bar magnets — tiny enough to be governed by the spooky rules of quantum mechanics — in a magnetic field. That is a simple system known as the Ising model, which is often used to study magnetism.

This problem is too complex for a precise answer to be calculated even on the largest, fastest supercomputers.

On the quantum computer, the calculation took less than a thousandth of a second to complete. Each quantum calculation was unreliable — fluctuations of quantum noise inevitably intrude and induce errors — but each calculation was quick, so it could be performed repeatedly.

ndeed, for many of the calculations, additional noise was deliberately added, making the answers even more unreliable. But by varying the amount of noise, the researchers could tease out the specific characteristics of the noise and its effects at each step of the calculation.

“We can amplify the noise very precisely, and then we can rerun that same circuit,” said Abhinav Kandala, the manager of quantum capabilities and demonstrations at IBM Quantum and an author of the Nature paper. “And once we have results of these different noise levels, we can extrapolate back to what the result would have been in the absence of noise.”

In essence, the researchers were able to subtract the effects of noise from the unreliable quantum calculations, a process they call error mitigation.

“You have to bypass that by inventing very clever ways to mitigate the noise,” Dr. Aharonov said. “And this is what they do.”

Altogether, the computer performed the calculation 600,000 times, converging on an answer for the overall magnetization produced by the 127 bar magnets.

But how good was the answer?

For help, the IBM team turned to physicists at the University of California, Berkeley. Although an Ising model with 127 bar magnets is too big, with far too many possible configurations, to fit in a conventional computer, classical algorithms can produce approximate answers, a technique similar to how compression in JPEG images throws away less crucial data to reduce the size of the file while preserving most of the image’s details.

Michael Zaletel, a physics professor at Berkeley and an author of the Nature paper, said that when he started working with IBM, he thought his classical algorithms would do better than the quantum ones.

“It turned out a little bit differently than I expected,” Dr. Zaletel said.

Certain configurations of the Ising model can be solved exactly, and both the classical and quantum algorithms agreed on the simpler examples. For more complex but solvable instances, the quantum and classical algorithms produced different answers, and it was the quantum one that was correct.

Thus, for other cases where the quantum and classical calculations diverged and no exact solutions are known, “there is reason to believe that the quantum result is more accurate,” said Sajant Anand, a graduate student at Berkeley who did much of the work on the classical approximations.

It is not clear that quantum computing is indisputably the winner over classical techniques for the Ising model.

Mr. Anand is currently trying to add a version of error mitigation for the classical algorithm, and it is possible that could match or surpass the performance of the quantum calculations.

“It’s not obvious that they’ve achieved quantum supremacy here,” Dr. Zaletel said.

In the long run, quantum scientists expect that a different approach, error correction, will be able to detect and correct calculation mistakes, and that will open the door for quantum computers to speed ahead for many uses.

Error correction is already used in conventional computers and data transmission to fix garbles. But for quantum computers, error correction is likely years away, requiring better processors able to process many more qubits.

Error mitigation, the IBM scientists believe, is an interim solution that can be used now for increasingly complex problems beyond the Ising model.

“This is one of the simplest natural science problems that exists,” Dr. Gambetta said. “So it’s a good one to start with. But now the question is, how do you generalize it and go to more interesting natural science problems?”

Those might include figuring out the properties of exotic materials, accelerating drug discovery and modeling fusion reactions.

Kenneth Chang has been at The Times since 2000, writing about physics, geology, chemistry, and the planets. Before becoming a science writer, he was a graduate student whose research involved the control of chaos. @kchangnyt

Article link: https://www.nytimes.com/2023/06/14/science/ibm-quantum-computing.html