Bridging the Gap: AI Risks, Corporate Silos, and Test-Driven Law with Dr. Steven A. Wright

Welcome to Studying Law Around the World. I'm Claudio Claus. In each episode, I talk with lawyers, law students, and professors from different parts of the world to talk about legal education, careers, and what the profession looks like in real life. We talk about the hard parts, the surprises, and the decisions that shaped their paths. Whether you're planning to study abroad, thinking about working in another legal system, or just curious about how law works around the world, this podcast is for you. This evening I have the privilege of interviewing Dr. Stephen A. Wright. He's a recognized cybersecurity attorney, an author, and a professor who bridges the gap between technology, business, and the law. He holds a PhD in computer engineering, an MBA, and a JD degree as well. Thank you so much for making the time to be here with us this evening, Dr. Wright. Well, happy to be here. Always good to chat. Absolutely. And I'd love to start by asking you a little bit more about your career, if you could introduce yourself a little bit more to our listeners here who might have not heard about you just yet. Okay. So I started on the technology side. So my undergraduate degree was in electrical engineering from a university in Australia. And I've been working my way around the world and up the protocol stack ever since. So I worked in the UK, and in Belgium, and in Australia, of course, and now in the US, and along the way collected the MBA, a master's in computer information systems, the PhD in computer engineering, and then ended up going to law school, completing the JD there. So yeah, it's been interesting journey, not a typical background for most lawyers, I think. And your career sits then at this interesting intersection, right? Engineering, business, law, technology. So I'm curious, you know, what originally pushed you to move from, you know, the technical work in technology to go into then, you know, the legal, the governance questions around technology? Well, to start out in technology, you're typically doing very heads down things, you're given a task you need to be completing, and you're not asking questions around, well, is this really the right thing to do or not? It's all sort of given to you by the rest of the team around you. But then as I worked through my career, I just kept going up the protocol stack and asking, well, is this really the ultimate value to do this, or is this the right thing we should be doing? And in particular, that path led me to doing some work in industry standards and other trade associations, industry collaborations, that kind of thing. And if you think about it, those industry organizations are, you're trying to negotiate a document with other folks that don't work for the same company as you, they may not be in the same country as you. So I certainly don't have the same business objectives as you, and so how can you navigate your way through that minefield and come up with something that's generally useful to everybody without tripping over the business and legal minefields along the way? What do you think companies assume is understand when it comes about the legal risks involved with digital transformation and also AI adaption these days? I think there is certainly plenty of risks in that place, in that space, because much of the visual innovation is driven by the technology side of companies. Typically the engineering department, the IT department gets very excited about some new technology like AI and agitates to their management to say, Hey, we've got to be able to go do something with this. It's really cool. It'll be great. Yada, yada. It doesn't always work out so well, depending on what exactly your, your technology is and how you're trying to use it in the company. It could lead to all sorts of bad business outcomes with malinvestment. You could run into legal issues of various kinds, anything from intellectual property issues to antitrust type things to other regulatory or market infractions. It tends to turn into this balancing act of translating between the different parts of the company. So while the technology folks may be highly motivated and trying to do useful things, real companies have real financial constraints. They've still got to ship actual products to their customers and provide value until they get to the great new shiny object that we're trying to deal with. And along the way, your, your company's legal officers are trying to keep everybody safe and protected. And often they don't know what's coming down the pipe. They find out a little bit late, which tends to severely constrain what they can do to get you out of trouble. And so trying to build those internal bridges and get that communication in place is I guess the main advice I would give in that space. Absolutely. And in some of your recent work, you also warned about a few specific threats that data poisoning, deep fakes, algorithm mixed data suppression. So I'm curious, you know, about these emerging risks and which of these do you believe that business leaders are currently, you know, underestimating the most and that they should be, you know, a little bit more aware of? Oh, I think all three of those are things that we'll, we'll come back to by various people that are already biting some people. So the deep fakes, I guess, is the sort of sensationalist topic. And this could be audio, it could be video, it could be multimedia, and it could be just plain text, even in some cases. But generally you have something that is a relatively convincing fake that is impersonating some real person for some nefarious purpose. It could be probably the more common example is something like political satire where you see some fake image of your favorite politician that you want to hate in some, out of, out of the normal context and everybody can laugh at that. But there are more serious applications of these deep fakes that have had significant consequences. Whether that's things like revenge porn, for example, can have all sorts of personal and financial consequences, and you can have executives being impersonated, which can have consequences for their companies. There have been cases where people have been fooled in video conferences where they were the only human, everybody else was an AI chatbot fake. They thought they had a new customer and they're wiring money to somebody they never actually met. So you need to have your business processes in place to make sure those things don't get out of hand. And also to make sure that your, that the materials you and your company are producing can't be easily repurposed by other people in ways that, that could be misleading, right? The, the sort of data poisoning and data suppression are less sensational, but I think they are still very important because the age of AI where everybody's using chatbots, these chat systems become your interface to the world. And how do you evaluate the information that's coming back? If somebody has, yeah, if somebody has broken the internet and you're, you're, the web software session floor is no longer reachable, at least you have some visibility into that sort of data suppression. But when things are hidden behind a layer of AI, you don't really know what's being suppressed on the other side and whether it was suppression in the sense of just blocking access to something or whether it was a more nefarious effort at data poisoning. So there are folks that take the more, I don't know if the right phrase is civil disobedience approach of maybe it would be advantageous for some individuals to poison their own data into the system so that they weren't tracked quite so comprehensively by all of the other surveillance technologies out there. So maybe it's not, maybe these things are purely a black and white type scenario and maybe there's reasons why you want to obfuscate some of your data or poison some of it in various databases just to retain some degree of control. Absolutely. No, that's very, very interesting point. As I'm thinking about it here, as you share that as well, there's a, there's an interesting point that, that I'm sure, you know, kind of might be something that people who are listening here might, might notice or think about, and also something that I noticed that you write about that different professions oftentimes will really operate in silos and will be kind of very, you know, separated from one end to the other. How did you feel like, you know, having these backgrounds that, that has both, you know, the legal training and this engineering technical training brings you some approaches even about problem solving and all that is different than, than just of those counterparts that you've interacted with who just have a legal training as a background. And then on the, on the other hand, you know, as kind of a question B here, thinking about this theme of executives, engineers, legal teams, all operating in silos, why is the communication between these groups is still so difficult? Yeah. So we start with the, the first part of that before I get what I was talking about. If you start with the legal profession and think about how, how many lawyers have a undergraduate background in some sort of technology. And it's certainly not the majority of lawyers, I would guess it's near less than 10 or 20%. And even though those who come to the law with a background in technology, they tend to get drafted very quickly into intellectual property and patent law and areas like this. That seems to be the main focus of technology folks in the legal background. As, as technology becomes more important to society and the business and everyday life becomes digitally transformed, there's so much of everyday life that has to happen online these days. It started as a convenience and it was in fact promoted by various internet companies to build internet adoption. But now it's actually difficult to survive without doing things online. Your identity, for example, is often conflated with your email address online. And if you don't provide an email address or can't provide an email address or your email address is blocked when you're out of the country, how do you manage your ID? How do you manage your identity, right? So that's sort of one example of the, this relentless sort of march towards the use of technology on the trailing edge of that, how do you keep doing what you were able to do before without being forced to use the new technologies is kind of a, kind of an ongoing challenge. And what was the second part of your question again? Yeah, I was asking a little bit about, you know, the, the difficulties of communicating in a team when you have, you know, different departments that are, you know, very, very different professionals in each of them and, and why is that communication difficult? How do you see that? It's kind of endemic to the, the, the, the nature of the firm or the enterprise. If you've got a startup of, you know, 10 people and everybody's sitting in the one room and you have the, the pioneer guy and the legal guy and the takes the needle sitting together, they're talking to each other every day and there's less of an issue. When you get to a larger corporation and you tend to have these functional silos developed and you may be talking multiple the time you are talking to people in your own silo and you're not talking to, if you're in IT, you're not talking to legal every day. It's a very unusual circumstance for you to do that. Maybe, maybe you'd have a regular touch point associated with some existing business processes that, okay, every time we are doing something, we're releasing some new code onto the company website. Then we always get that reviewed by legal and that's sort of a well-known process. But when you're, when you've got something new, you don't have that process in place. The first thought is not to, Hey, we need to talk to legal about it. It's that usually comes afterwards when something bad happens. And the other point also happens from the, the business side, although there they tend to at least have their checklist of when I do anything that commits the company, then they tend to want to talk to their legal folks and, and get them into the conversation at that stage. But depending on what they're doing, they may not be the first person they're talking to. So if you're in an existing operation, you're heads down following the existing processes. So you don't have that opportunity to, to engage in dialogue outside of your, outside of your side. Very interesting point. To wrap up today's episode, I wanted to ask you, you know, you, you've worked across multiple eras of technological change from telecommunications, networking to AI, blockchain, even the metaverse for a short scene. So looking ahead to the next five to 10 years, are there a few, you know, developments in AI governance or cybersecurity that you think will really be reshaping the profession when we look forward? Certainly. I think AI is going to have a profound impact on lots of professions. It particularly will impact the legal profession because these are large language models and lawyers are, in some sense, experts on language. And so being able to effectively use them in that context is going to be important. But that doesn't mean you can just throw everything into chat. There are several legal and ethical problems. Most law firms are well aware of those issues. To start with just the attorney-client privilege violations, which would be a major problem. But it's already having an impact for the software engineers in that part of the tech space because coding, for example, is yet another language and that's what large language models are very good at. And so there will be a significant adoption of AI in that space. I don't think they will completely replace creative engineers or creative lawyers. I think you still need somebody to ask the right questions in the first place and you need somebody to be evaluating the outputs and seeing whether they really deliver what you are expecting. In the software world, there is this notion of test-driven design and the idea here is that you write the test specification first, then you write the code, and then you see whether the code meets the test specification. And if you think of using AI in that way, then that will help you get to better outcomes because most people, when they use AI, throw something into a chat, you get a response and it seems plausible and you go forward. If you really have some acceptance criteria that you're looking for in terms of the output, so you make some sort of spec of what that is supposed to be before you fire your prompt in, then you've got something to evaluate against whether it really does what you wanted it to do. So there's one example of taking something from one field and using it in another to get you a better result. And I'm sure there's others we can look around and find some more. To wrap up today's episode, I wanted to ask you, you know, if we're talking here about young professionals, lawyers who are just, you know, getting out of law school and who are starting their careers, is there maybe, you know, one piece of advice that you could share with this new generation of lawyers? Shepherd all of your cases before you submit them to the, it's probably the classic. Yeah, I think the, the challenge with law school in general is, is you don't re-roll it at the time so much, but every course you're doing in law school is really a survey course. It's really, you start practicing in one field and really becoming, really becoming an expert in that area is, is really something to focus on. And while AI can help you with that, it's not going to replace the, the continuing education and the, the dialogue with others in your firm and in the field that build that expertise. Just knowing, just knowing the top floor, for example, doesn't give you a strategy on what, what your taxes, so it's, it's that how to, how to take the rules and make it useful for your clients. That's the insight that, that has to be developed over time. It's not going to come in, in one or two check queries. I really appreciate you, you making the time to share this, such interesting thoughts in the podcast and also for, for, you know, your willingness to come in the show. So thank you so much, Dr. Wright, and thank you all for tuning in and listening to today's episode. Thank you again. Thank you.