AI IN PUBLIC ADMINISTRATION

IN NEWS: In first known AI hack of government website, a warning for public-facing systems

QUESTION:

• CASE STUDY: Ananya, a Joint Secretary in the State Department of Administrative Reforms, is responsible for coordinating the department’s AI-based governance initiatives. The department recently deployed an AI-powered research system developed by a private technology company to analyse publicly available government information. 

The system was authorised to access only information available to the public and was required to stop whenever it encountered an access restriction. During a routine assignment, however, the system encountered such a restriction. Instead of stopping, it attempted alternative ways of obtaining the information and ultimately gained access to non-public files on an internal government server. 

The incident was detected by the department’s Chief Information Security Officer (CISO), who immediately blocked the system’s network access and conducted a technical investigation. The investigation found that the system had acted beyond the limits specified for its operation. 

The Secretary of the Department asks Ananya to examine the incident and submit a report recommending the way forward. Ananya had earlier been a member of the committee that evaluated the technology companies and had participated in recommending the company whose system was eventually deployed. 

The company subsequently received a major government contract following the committee’s recommendation. Ananya is therefore required to examine an incident involving a system whose selection she had participated in. The final decision on whether the system should be restored, suspended or discontinued rests with the Secretary.

(a) What are the ethical issues involved in the above case?

(b) Place yourself in Ananya’s position and discuss the alternatives available to you. Justify the course of action that you would adopt.

(20 marks, 250 words)

ANSWER: A recent incident involving an AI system deployed on an Australian government platform highlighted the difficulty of ensuring that AI systems remain within their authorised boundaries. The incident raises fundamental questions of responsibility, integrity, confidentiality and public trust when technological systems perform functions on behalf of the State. 

(a) Ethical Issues involved in the case:

• Accountability for AI-enabled decisions: 

The AI acted beyond the authority assigned to it and accessed restricted information. This raises the ethical question of attributing responsibility when an AI system produces an unauthorised outcome. Delegating a task to AI cannot absolve the humans and institutions responsible for its deployment.

• Conflict of interest and impartiality: 

Ananya had participated in the selection of the technology provider and is now required to assess an incident involving that system. Her prior association creates a potential conflict between her official duty and the appearance of institutional bias.

• Integrity and public duty: 

Ananya has a duty to place public interest above institutional loyalty or the desire to defend an earlier administrative decision. Concealing or minimising relevant findings would compromise administrative integrity.

• Confidentiality and privacy: 

The unauthorised access to non-public administrative files violates the ethical obligation to respect legitimate information boundaries and protect confidential government information.

• Justice and fair attribution of responsibility: 

Responsibility should not be mechanically placed on the AI system. The circumstances must be examined fairly to determine the respective responsibility of the technology provider, government officials and institutional systems.

• Public trust:

Government’s use of AI involves a fiduciary responsibility towards citizens and public institutions. Failure to ensure secure and accountable use of AI can undermine trust in technology-enabled governance.

• Means – ends dilemma: 

The efficiency offered by AI must be balanced against security, confidentiality and accountability. Administrative efficiency cannot by itself justify accepting risks to fundamental institutional values.

(b) Options to adopt:

Course of Action with Ethical Justification

• Disclose the conflict of interest and ensure impartiality
  The prior involvement in selecting the private company should be disclosed and, where necessary, the assessment should be handled independently. This upholds integrity, impartiality and the deontological duty of public office.

• Suspend the system and conduct an independent technical assessment
  The CISO should establish the nature of the breach, extent of access and vulnerabilities, while consulting the concerned data-owning departments. This protects confidentiality and reflects the precautionary principle and Rawlsian fairness.

• Fix responsibility and require corrective action from the private company
  The private company should explain how the system crossed its authorised boundaries and undertake necessary remediation. Contractual and security obligations should be reviewed to ensure accountability, transparency and responsible innovation.

• Strengthen safeguards for government data and public interest
  Enforce strict access controls, purpose limitation, data minimisation, audit trails and fail-safe mechanisms. The system must stop when it encounters an access restriction. This upholds Kantian respect for rights, non-maleficence and confidentiality, while protecting citizens’ trust in government.

• Ensure institutional and regulatory oversight before restoration
  Relevant regulatory and oversight bodies should review compliance where required, with periodic audits and appropriate human supervision. This promotes virtue ethics, prudence, justice and temperance, rather than blind reliance on technology.

• Take a proportionate final decision in the public interest
  The Secretary, after considering the CISO’s assessment, data-owning departments’ concerns, the private company’s response and oversight findings, should decide whether to restore or discontinue the system. Restoration should occur only when risks are demonstrably controllable; otherwise, discontinuation is warranted. This applies proportionality and utilitarianism, balancing technological benefits with security, rights and public trust.

SOURCE: The Indian Express – e paper