The Dark Side of AI

Over the past two years, artificial intelligence has been driving a revolution.  AI tools are advancing at an astonishing pace, increasingly integrating into various aspects of our daily lives. These tools can complete tasks in mere seconds that might take humans weeks to accomplish.  In fact, even in preparing this article, we utilized several AI tools to make the transcription, summarization, and editing process faster and easier.

However, alongside these seemingly limitless possibilities, there are also risks. While we enjoy the convenience of digital services in all areas of life, cyberattacks are becoming an escalating threat to public systems in Israel, as highlighted in a series of reports published by the State Comptroller in recent years. 

 

AI: A tool for thieves

As Gil Shwed, founder and chairman of Check Point Software Technologies Ltd., recently explained in a discussion with State Comptroller and Public Complaints Commissioner Matanyahu Englman, artificial intelligence is only making attackers' jobs easier. The conversation took place during a meeting of the Governing Board of EUROSAI – the European Organization of Supreme Audit Institutions, which comprises 51 state comptrollers from across the continent and is currently chaired by Englman. "In the past, carrying out a cyberattack required a high level of technical expertise. Today, it can be done using AI tools", Shwed said. He noted that the ability of AI tools to understand human language significantly aids cybercriminals in carrying out phishing scams, which rely on impersonation to extract sensitive information.

Regulation too soft

What is the Israeli government doing in order to mitigate the risks posed by abuse of AI tools?  According to the State Comptroller’s report from November 2024, there is significant room for improvement in this area. Daniel Jacobs, Head of the Digital Technologies and Information Systems Audit Division, explained in an interview for the "AI Simply" podcast: "The government's current approach is one of soft regulation—developing alongside the technology and gradually setting the rules". Jacobs added: "The State Comptroller’s key recommendation is first and foremost to bring the national AI regulation plan for government approval.  But that alone is not enough. The Comptroller also recommends exploring solutions that would allow enforcement authorities to intervene when necessary, ensuring that hostile actors do not exploit AI technology for malicious purposes". 

Severe security flaws

Hostile actors are not standing idle. In recent years, State Comptroller reports have exposed severe security flaws in several of Israel’s critical information systems, including those of medical centers, energy and transportation infrastructure, the Israel Land Authority, the IDF biometric database, and the Ministry of Education’s matriculation exams and grades database. Alarming vulnerabilities have also been identified in the protection of public sector databases that store sensitive information, including the health, financial, and personal data of millions of Israeli citizens. 

"We must ensure that this information is properly protected. Cyberattacks can disrupt essential services, expose personal data, and harm the public", said State Comptroller Matanyahu Englman in an interview for the "Status Report" podcast. According to Englman, "Cyberattacks are no longer a future scenario; they are an everyday reality. Every Israeli citizen has reason to be concerned".

Here are some of the most significant security flaws identified in audits over the past two years:
National Insurance Institute: as of February 2024, tens of thousands of cyberattack attempts are carried out daily against the National Insurance Institute (NII). A cyber incident could severely compromise the privacy of millions of citizens and residents who receive services from the NII and disrupt its ability to pay benefits. The State Comptroller’s report from November 2024 found that despite the risks, the NII had not updated its information security and cybersecurity policies since 2014—a full decade—even though cyber threats have evolved significantly over the years. The audit also identified gaps in detecting and responding to cyber incidents, and found that the institute's disaster recovery capabilities are insufficient. "Cyber vulnerabilities are a serious failure, especially during wartime", warned State Comptroller Matanyahu Englman. "We cannot wait for our enemies to gain access to the National Insurance Institute’s databases; these security gaps must be closed immediately".

Identification documents: According to an audit report published in may 2023, 45% of national ID holders and 37% of passport holders were still using old-format identification documents, which are easy to forge. Additionally, only 1% of biometric ID card holders had used them to securely access government services. "The audit also revealed significant security gaps in border control at Ben Gurion Airport, raising concerns that malicious actors may already be aware of these vulnerabilities", warned State Comptroller Matanyahu Englman.

The Fines Collection Center: The Fines Collection Center's databases store the personal information of approximately three million Israelis, yet the audit uncovered serious security gaps in the protection of this sensitive information. "Former employees still retain system access, exposing the database to risks", warned the May 2023 report.

Prime Minister’s Office: An audit published in July 2024 raised suspicions that former employees, including senior officials, continued to use their accounts at the Prime Minister’s Office after their employment ended. Among the findings, the account of a former minister and that of a senior official who had since left their roles were still in use. The audit also found that the classified networks of the Prime Minister’s Office had lower-than-required security levels. "These are serious failures that must be addressed immediately", stated the State Comptroller. But that was not all: a team from the Government Ministries and State Institutions Audit Division, which examined the conversion system, successfully issued a fraudulent conversion certificate. Such a certificate allows its holder to falsely claim Jewish identity and obtain Israeli citizenship under the Law of Return. 

Hackers in the service of auditing

In a unique and unprecedented move among audit institutions worldwide, the State Comptroller's Office employs ethical hackers to conduct penetration testing on public systems. In the "Status Report" podcast, State Comptroller Matanyahu Englman stated: "We don’t just rely on reports submitted to us by the audited entities; instead, we actively test how public systems can be breached.  In some cases, these organizations fix the vulnerabilities we uncover in real-time".

Beyond these immediate fixes, does the audit process truly lead to lasting change? "Audited entities turn our reports on cybersecurity and information systems into action plans aimed at preventing the next breach," says Englman. "In this way, the audit makes a significant impact".

The State Comptroller recommends a series of measures in order to counter cybersecurity threats, including: designating certain public institutions as critical infrastructure requiring heightened protection, establishing advanced monitoring mechanisms, and enhancing cooperation with international organizations and governments on the matter. "Cyberattacks are a global issue. The estimated damage from cybercrime is expected to reach nearly $10.5 trillion by 2025", Englman noted.

State Comptroller Englman issues a clear call to the government:  "Regulations must be tightened, and immediate investment in cybersecurity is required. We must ensure that our data remains secure and that services remain available in order to protect the public".
In a reality where threats to the digital space we rely on are becoming increasingly sophisticated and dangerous, the State Comptroller's reports serve as warning signs, while also helping public entities improve and prepare for a more secure future.