Can a civil servant tap ChatGPT’s smarts?

It depends on which government agency or department they work for.

Back in June, The Ministry of Business, Innovation and Employment banned staff from using OpenAI’s ChatGPT and
other generative AI tools – citing data and privacy risks.

ChatGPT and its peers come in free or low-cost versions, but you do so at a price in that any information you input – each time you ask a question or, say, ask the AI (artificial intelligence) to quickly summarise a long document – can then go into the ocean of data used to train artificial intelligence, and could emerge as a response to another user’s question. As ChatGPT says on its site, “Chat history may be reviewed or used to improve our services.”

ChatGPT’s terms and conditions for paying business customers are tighter, but it also makes it clear they don’t cover third parties that use its API (application programming interface), allowing them to incorporate ChatGPT features into their own products.

The ministry was worried staff could put sensitive information into the technology which could later resurface. “MBIE has a fundamental responsibility as a government agency to protect the information provided to us by the people we support,” MBIE chief information security officer David Habershon told the Herald.

The ban was billed as a temporary pause while guidelines were developed. And it wasn’t out of line with what was happening in parts of the private sector, here and offshore. A number of large banks and technology companies, including Amazon, Apple and Samsung, put ChatGPT bans in place around the same time.

But five months on, it’s still in place.

“MBIE continues to block access to the ChatGPT website as well as other similar sites until we can ensure we have the appropriate security and privacy measures in place to protect our data and systems,” Habershon told the Herald this week.

“MBIE cannot give a timeframe at this stage for when the appropriate security and privacy measures will be in place.”

Already public service advice, of sorts

MBIE’s position is a little surprising given the publication only a couple of months ago of tactical guidance on the appropriate use of GenAI by the public service, as well as generative AI guidance from the Privacy Commissioner,” said Simply Privacy principal Frith Tweedie, who specialises in AI governance and privacy.

“I agree that it’s important that government agencies are especially conservative in how they look at privacy implications of generative AI use. They face unique risks with the sensitive data they hold, said Matt Ensor, who chairs the AI Forum NZ’s working group on generative AI.

“But as generative AI’s capabilities and customer expectations rise, every day without AI adoption leads to more missed opportunities for improving sector performance.”

At least three different approaches

No AI laws have been passed in NZ, in contrast to the AI Act due to come into force in the European Union by the end of this year, or President Joe Biden’s executive orders on AI protections. And none is on the immediate horizon. Neither major party had an AI policy going into the election.

In the absence of legislation, government departments have taken at least three different approaches. Super ministry MBIE has its ban; others have adopted the public service guidelines issued by the GCSB, while others like the Parliamentary Service and Te Whatu Ora Health NZ have adopted their own protocols.

‘We strongly recommend’

In July, the GCSB’s National Cyber Security Centre and Statistics NZ teamed up to create a document billed as “Joint guidance … on responsible and trustworthy use of Generative Artificial intelligence across the New Zealand Public Service.

The document (online here) says AI “could offer many benefits for the public service” which could include productivity and efficiency gains, “innovation from access to ‘big-data’ based insight and improved policy development” through “fuller data insight” and “improved service design and delivery through targeting and personalisation”.

The guidance also says “We strongly recommend that you don’t use GenAI tools for data classified at “sensitive” or above. The risks for security and potential impacts if sensitive or above datasets were to be compromised could be catastrophic for our society, economy and public services.”

And: “We also strongly recommend that you avoid inputting personal data, including client data, into GenAI data, and exercise extreme caution if personal information is involved.”

It also recommends public servants “avoid inputting information into GenAI tools that would be withheld under an Official Information Act request” or using GenAI as a “shadow” helpdesk for IT problems.

MPs and parliamentary staff

Those in the Beehive are allowed to use ChatGPT but are asked to “refrain” from various activities.

Parliamentary Service chief executive Rafael Gonzalez-Montero said GenAI guidance for MPs and staff included:

“Members and staff are encouraged to approach our cyber-security team for any advice relating to ChatGPT and other generative AI systems.”

Hospital staff and clinicians

Te Whatu Ora Health New Zealand, which took over the running of our hospitals and other public health services after the shift from 20 district health boards, says its AI policy is a work in progress.

“The message to our kaimahi [workers] is to only use ChatGPT and other generative AI systems with caution,” the group manager, of emerging health technology, Jon Herries said.

“Our data is taonga – so we encourage them to treasure it and protect it. That means don’t feed private or unpublished information to public artificial intelligence tools like ChatGPT. And definitely don’t trust them for clinical decisions, patient care or advice, or documentation.

“We recognise the speed with which AI is moving and the potential for its use in the health sector, both good and bad. Te Whatu Ora is still identifying how to best use these platforms safely.

“To this end, we are working with our AI expert advisory group to understand how we best manage access to AI in ways that align with our strategic intent and values, as well as evolving legal and community standards.”

Te Whatu Ora’s full policy is online here.

Chris Keall is an Auckland-based member of the Herald’s business team. He joined the Herald in 2018 and is the technology editor and a senior business writer.