New counterterrorism laws are needed to guard against the threat of extremism generated by chatbots powered by artificial intelligence (AI), according to Jonathan Hall KC, the British government’s Independent Reviewer of Counterterrorism Legislation.

The independent reviewer of counterterrorism legislation warned in the Daily Telegraph about the dangers of AI recruiting a new generation of extremists.

Jonathan posed as an ordinary person to test how AI-powered chatbots would respond. One chatbot Jonathan contacted “did not hold back in its glorification of the Islamic State.” However, no legal offense was committed, since the source of the statement is not human.

"Only human beings can commit terrorist offenses, and it is difficult to identify a person who could legally be held responsible for statements generated by a chatbot that encourages terrorism," said Jonathan Hall.

He added that this revelation highlights the urgent need to reassess the United Kingdom's current counterterrorism laws, and that the Online Safety Act passed in November was "commendable" but still "ill-suited to sophisticated generative AI."

Jonathan attributes this to the fact that the law did not consider content generated by chatbots to be the same as the provision of “preprogrammed responses” that are “subject to human oversight.”

"Investigating and prosecuting anonymous users is always difficult, but if malicious or misguided individuals persist in training terrorist chatbots, new laws will be necessary," Hall said.

He emphasized the need for potential new laws to impose penalties on both users who create radicalizing AI chatbots and the tech companies that host them.

Industry Leaders Weigh In on AI Laws

Suid Adeyanju, CEO of the cybersecurity firm RiverSafe, said that AI-powered chatbots pose a huge risk to national security, especially as legislation and security protocols continually struggle to keep up.

"In the wrong hands, these tools could enable hackers to train the next generation of cybercriminals, providing online guidance on data theft and triggering a wave of security breaches targeting critical national infrastructure."

"It's time to recognize the very real risks posed by AI, and for businesses and the government to take the necessary steps as a matter of urgency," Adeyanju added.

Jake Moore, global security advisor at ESET, said that the ethical risks of AI can be mitigated by incorporating the right set of principles into the algorithm.

"Most AI is still taught using the building blocks from which it was designed, so appropriate adjustments can be made to steer the results away from becoming a monster if this is done early enough. Legislation is challenging with this rapidly evolving technology, but a basic framework designed to reduce the risk of extremist recruitment need not necessarily be a problem,” Moore said.

Moore added that AI content requires ongoing attention, so the sooner the government can master the basics, the sooner it can be controlled.

Josh Boer, CEO of the technology consulting firm VeUP, said that the government must be aware of harmful AI without stifling innovation.

"To start, we need to strengthen our talent pipeline in digital skills—not only by encouraging more young people to pursue careers in the tech industry, but also by empowering the next generation of cybersecurity and AI companies so they can grow and thrive," Boer said.

Boer added that far too many businesses are cash-strapped and lack the support they need to thrive. He went on to say that failing to address this major problem will not only harm the United Kingdom’s long-term future but will also play into the hands of cybercriminals who wish to cause harm.

In November, the ISC2 2023 Cybersecurity Workforce Study highlighted a concerning gap in the workforce, with an additional 4 million professionals needed to adequately protect digital assets. This gap represents a record high.

Economic uncertainty, the rise of AI, fragmented regulation, and skills gaps were also cited as significant challenges.

A significant 75% of professionals consider the current threat landscape to be the most challenging it has been in the past five years, and only 52% believe their organization is sufficiently equipped with tools and personnel to respond to cyber incidents in the coming years.