Price of Progress: Ethical Cybersecurity in Tech Communities

Price of Progress: Ethical Cybersecurity in Tech Communities

Speakers: Joy Toney, Senior Program Consultant, AIM for Change LLC

Conference: Blacks in Cyber Village

YouTube: https://www.youtube.com/watch?v=98LptR2jhqM

Overview

Joy Toney, a distinguished cybersecurity professional and advocate for ethical technology, delivered a thought-provoking talk at the Blacks in Cyber Village conference titled "Price of Progress: Ethical Cybersecurity in Tech Communities." This presentation critically examines the often-overlooked societal implications of rapid technological advancement, particularly the proliferation of Artificial Intelligence (AI) and the expansion of big tech infrastructure. Toney argues that as cities actively court major technology companies, they must concurrently address the significant risks these developments pose to public systems such as water, energy, and waste management, which are vital for community sustainability.

The core of Toney's discussion revolves around the ethical obligations of cybersecurity professionals, extending beyond traditional corporate boundaries to encompass broader societal well-being. She emphasizes that the ethical frameworks underpinning the cybersecurity profession are not merely theoretical constructs but practical guides for building and maintaining sustainable, resilient communities in an increasingly tech-driven world. By leveraging real-world case studies, Toney illustrates how the pursuit of technological progress, if unchecked by ethical considerations, can inadvertently lead to environmental degradation, resource depletion, and adverse health outcomes for local populations, thereby undermining the very communities it purports to benefit.

This talk is particularly salient in an era where AI adoption is accelerating at an unprecedented pace, demanding enormous computational resources. Toney highlights the critical need for a balanced approach where technological innovation is harmonized with responsible resource management and robust community engagement. For cybersecurity professionals, the message is clear: their role as protectors extends beyond digital assets to include the physical infrastructure and environmental health of society, requiring them to act as an "organizational conscience" in guiding ethical technology decisions.

Background

▶ Watch: Speaker introduction and talk overview (0:00)

The rapid integration of AI across various sectors has introduced a new paradigm of risks that extend beyond traditional cybersecurity concerns. Joy Toney meticulously outlines several categories of AI risks that organizations and society must contend with. Firstly, there are risks to organizational assets, encompassing the systems themselves and the sensitive data they house. A lack of human oversight over AI systems with extensive permissions can compromise data privacy and security. Secondly, organizational operations face threats from unreliable or unavailable AI systems, potentially due to attacks or misconfigurations, leading to service failures that negatively impact customers and constituents. Thirdly, consumers and users are vulnerable to harmful outputs generated by AI, which could result from data poisoning attacks during training or improper programming that generates biased or false information, leading to adverse outcomes or decisions. Lastly, the agentic actions of autonomous AI systems, if not properly programmed with protective logic, can lead to unintended consequences and significant liability issues for organizations.

To mitigate these emerging risks, Toney points to established and developing frameworks. The OWASP Generative AI Incident Response guide offers practical advice for handling and troubleshooting harms. Internationally, the ISO (International Standards Organization) provides standards for ethical and transparent AI systems, though these come at a significant cost (around €200). More accessibly, the NIST AI Risk Management Framework and its accompanying Secure Software Development Practices for Generative AI are available for free download, offering comprehensive guidance for securing AI systems.

A cornerstone of Toney's argument is the ethical responsibility inherent in the cybersecurity profession. As a holder of both CISSP (Certified Information Systems Security Professional) and CCSP (Certified Cloud Security Professional) certifications, Toney is bound by the ISC2 ethical canons. She specifically highlights two crucial tenets: "Protect society, the common good, necessary public trust and confidence in infrastructure" and the repeated emphasis on "protect." Toney stresses that the definition of "protect" is broad—to shield from exposure, injury, damage, or destruction, and to maintain integrity. This extends far beyond the four walls of an employer's organization, compelling cybersecurity professionals to consider their impact on the wider community and public trust.

The problem Toney addresses stems from an economic imperative: cities frequently court big tech companies with incentives like tax breaks and resource provisions, aiming to boost local economies, create jobs, and enhance their profiles. However, this pursuit of progress often overlooks the substantial strain these large-scale operations place on local resources and infrastructure. The talk delves into how this dynamic creates a tension between economic growth and environmental sustainability, setting the stage for the detailed case studies presented later.

Key Findings

▶ Watch: Transitioning from security to ethical considerations (3:50)

The central finding of Joy Toney's talk is the stark reality of AI's escalating resource consumption and its profound, often negative, impact on local communities and critical public systems. The scale of this consumption is staggering:

• Energy Consumption: Data centers, especially those powering AI, demand colossal amounts of electricity. A 2023 projection for 2030 estimated collective data center electricity usage to be equivalent to that of the entire country of France. Toney notes that due to the exponential growth of AI, this projection is already outdated and conservative, meaning current consumption is likely far higher. A vivid comparison illustrates this: a single ChatGPT conversation consumes approximately 10 times the energy of a standard Google search. When multiplied by millions of users, this translates into an immense and often unseen energy burden.
• Water Consumption: AI systems require enormous volumes of fresh water, primarily for cooling their processors and generating electricity. One study, conservative even at the end of 2024, suggested that AI's water demand could reach half that of the United Kingdom by 2027. The United Nations predicts that by 2030—less than five years away—half of the global population will face a severe water crisis, a situation exacerbated by AI's intensified demand on the planet's limited fresh water resources.
• Ethical Responsibility Beyond the Organization: Toney underscores that the ethical obligations of cybersecurity professionals, as outlined by ISC2 canons, extend beyond protecting corporate assets to safeguarding "society, the common good, necessary public trust and confidence in infrastructure." This means professionals must act as an organizational conscience, advocating for sustainable practices and community well-being, even when it conflicts with immediate business interests.
• Community Impact and Environmental Justice: The case studies presented highlight how big tech's expansion can lead to tangible harms for local residents, including air and water pollution, respiratory illnesses, and the depletion of essential resources like clean drinking water. These impacts often disproportionately affect marginalized communities, raising significant concerns about environmental justice.
• Innovative Sustainable Solutions Exist: Despite the challenges, Toney showcases examples of technology companies actively pursuing and implementing sustainable practices, such as closed-loop cooling systems and underground data centers that minimize environmental footprints. These examples demonstrate that technological progress and environmental stewardship are not mutually exclusive.

In essence, Toney's key findings reveal that the "price of progress" in the age of AI can be a significant environmental and social cost if ethical considerations and community impact are not integrated into the core decision-making processes of both technology companies and the cities that host them.

Technical Deep Dive

▶ Watch: ISC2 ethical canons: protecting society and public trust (4:50)

The technical core of Toney's talk centers on the immense resource requirements of AI infrastructure and the innovative, or sometimes problematic, approaches taken by tech companies. The primary resources under scrutiny are energy and water, both critical for the operation and cooling of data centers.

Toney presents compelling statistics regarding energy consumption. She references a 2023 study projecting that by 2030, the collective electricity usage of data centers would be comparable to that of France. However, she notes that the exponential growth of AI has rendered this projection conservative, suggesting actual consumption is already outpacing these estimates. A particularly striking comparison illustrates the scale: a standard Google search is approximated to consume one unit of energy, while a ChatGPT conversation demands ten units. This 10x increase for generative AI queries, multiplied across millions of users, translates into a staggering global energy demand that strains existing grids and contributes to carbon emissions if not powered by renewable sources.

The demand for water is equally critical. AI data centers require vast quantities of fresh water for cooling their processors and facilitating electricity generation. Toney highlights a concerning forecast that AI's water demand could equate to half of the United Kingdom's total by 2027, an estimate she suggests is likely conservative. The global implications are dire, with the UN predicting a severe water crisis for half the global population by 2030.

Toney provides specific case studies to illustrate these points:

1. Arizona's Water Crisis (Intel, TSMC, Google): Arizona faces a severe water crisis, with the Colorado River and local groundwater levels shrinking. Despite this, companies like Intel, TSMC, and Google operate data centers that are significant water consumers. Google, for instance, reportedly uses approximately 4 million gallons of water per day, equivalent to the daily consumption of about 27,000 residents. TSMC's expansion in Phoenix, driven by chip manufacturing, also entails massive water demand for production and data center cooling. Toney criticizes the approach of treating water merely as a "cost of doing business," warning that communities will suffer even as tech markets thrive. Proposed, unsustainable solutions like trucking in water or diverting rivers underscore the severity of the problem.

1. Microsoft's Closed-Loop Cooling: On a more positive note, Microsoft has committed to innovating its data centers by implementing closed-loop cooling systems. These systems recycle water, effectively reducing external water consumption to zero. Microsoft aims to make this its primary cooling method across all data centers, setting a healthy example for the industry and demonstrating a commitment to environmental stewardship.

1. CyrusOne's Zero Water Cooling: Another exemplary case is CyrusOne, which designs its new data centers from 2024 onward to use zero water for cooling. Their only water usage, a negligible 180,000 gallons per year, is for humidification purposes, showcasing an advanced approach to water conservation.

1. Iron Mountain's Underground Data Center (Boyers, PA): This facility offers a unique and highly sustainable model. Built 200 feet underground in a cave, the natural environment provides inherent cooling. The data center further leverages an underground lake for cooling. Water is extracted, passed through a filtration system, and then pumped through a heat exchanger to cool server components in a closed-loop system. After cooling, the water is filtered and returned to the lake, creating a net-zero exchange. This innovative design earned Iron Mountain the first Energy Star certification for an underground facility and also enhances security by design due to its hidden location and restricted access.

1. XAI's Memphis Facilities (Memphis, TN): This case study highlights the negative consequences of unchecked expansion. XAI (Elon Musk's AI company) built data centers in Memphis, Tennessee, including a facility near the residential area of Boxtown. The company installed 32 to 35 gas turbines to supplement electricity from Memphis Gas, Light, and Water, essentially operating a "power plant without a permit." These turbines emit exhaust, causing air pollution and leading to respiratory issues like asthma among local residents. Furthermore, XAI has been draining the local aquifer—a source of pure drinking water for Memphis residents—for cooling purposes, rather than implementing sustainable water recycling. The company faced a lawsuit from the NAACP for Clean Air Act violations and has since acquired a power facility in northern Mississippi to pipe in electricity, a workaround to avoid local environmental regulations. While XAI has offered to fund upgrades for Shelby County schools, Toney argues this does not address the fundamental environmental harms. This case underscores the challenges of balancing economic development with environmental and community health, especially when companies prioritize rapid deployment over sustainable practices and community engagement.

These examples underscore the technical challenges and opportunities in designing and operating AI infrastructure sustainably. From innovative cooling solutions to problematic resource exploitation, the technical choices made have direct and often severe implications for the communities hosting these facilities.

Demo / Proof of Concept

▶ Watch: Defining 'protect' in cybersecurity beyond an organization (6:00)

While Joy Toney's talk did not feature a live technical demonstration or a software proof of concept in the traditional sense, the core of her presentation served as a compelling "proof of concept" through the meticulous presentation of real-world case studies and news reports. Toney effectively used these examples to demonstrate the tangible impacts—both positive and negative—of big tech's expansion and AI's resource demands on communities.

The inclusion of video clips from local news broadcasts regarding XAI's operations in Memphis, Tennessee, provided a direct and impactful demonstration of the community's struggle. These videos vividly illustrated the concerns of residents in Boxtown, showcasing individuals holding inhalers due to newly developed asthma, silently protesting neighbors, and handmade signs expressing dissent. This visual and auditory evidence served to concretely demonstrate the environmental justice issues and health consequences arising from the gas turbines and water consumption of XAI's data centers.

Similarly, the visual aids depicting the shrinking Colorado River and the detailed explanations of Google's and TSMC's water usage in Arizona, as well as the innovative designs of Microsoft, CyrusOne, and Iron Mountain, acted as powerful demonstrations. They illustrated the core findings about resource depletion and the feasibility of sustainable alternatives. In this context, the entire talk functioned as an extended, evidence-based demonstration of the critical need for ethical cybersecurity and sustainable practices in tech-driven communities.

Defensive Implications

▶ Watch: The role of Big Tech in urban development (7:30)

The insights shared by Joy Toney offer critical defensive implications for organizations, cybersecurity professionals, and local governments grappling with the expansion of AI and big tech. The core message is to adopt a proactive, ethical, and community-centric approach to technology development and deployment.

For Organizations and Leadership:

Organizations must cultivate a coexistence mindset regarding AI implementation, ensuring that technological progress does not come at the expense of the communities in which their facilities are housed. This requires:

• Leveraging Internal Influence: Cybersecurity professionals and other employees should use their "seat at the table" to voice community concerns and guide business decisions proactively, integrating ethical considerations early in the planning process.
• Building Community Feedback Loops: Establish formal mechanisms for ongoing dialogue with local communities to understand their concerns, gather input, and address potential impacts transparently.
• Considering Natural and Sustainable Solutions: When designing and locating data centers or other technology infrastructure, prioritize solutions that minimize environmental impact. Examples include utilizing naturally cool environments (like Iron Mountain's underground facility) or implementing advanced resource-saving technologies.
• Right-sizing AI for Business Needs: Avoid overconsumption of resources by carefully defining the business case for AI usage and ensuring that deployments are scaled appropriately, without unnecessary resource drain.
• Evaluating Vendor Sustainability: When selecting AI vendors or partners, inquire about their environmental and ethical practices, favoring those committed to sustainability and responsible resource management.
• Tracking AI Emissions: Implement systems to monitor and track the environmental footprint of AI programs, including energy and water consumption, to quantify impact and identify areas for improvement. Microsoft's goal to be carbon-neutral by 2030 and its water replenishment projects serve as a leading example.

For Cybersecurity Professionals:

Toney emphasizes that cybersecurity professionals have a distinct ethical obligation, extending beyond technical security to societal well-being. They should:

• Be the Organization's Conscience: Act as advocates for responsible AI development, ensuring systems are fair, equitable, transparent, and designed to avoid inflicting harm.
• Contribute to AI Governance: Actively participate in shaping the organization's AI governance structure, establishing policies, roles, and procedures for ethical AI use. This involves leveraging cross-functional committees to ensure diverse perspectives are considered.
• Utilize Acceptable Risk Frameworks: Apply frameworks like the NIST AI Risk Management Framework or OWASP Generative AI Incident Response guidance to identify, assess, and mitigate AI-related risks, including those pertaining to environmental and social impact.
• Maintain Situational Awareness: Continuously monitor the evolving landscape of AI technologies, ethical guidelines, and reported incidents to stay informed and adapt defensive strategies.
• Ensure Human-in-the-Loop: Design AI systems with human oversight and intervention points to allow for shutdown or course correction if the AI operates outside ethical or operational boundaries.
• Develop Robust Incident Response Plans: Prepare for incidents that could arise from AI systems, including those with environmental or social consequences, drawing on established incident response methodologies.

For Local Governments and Policy Makers:

The case studies, particularly XAI in Memphis, highlight the critical role of local authorities. They should:

• Enforce Regulations and Permits: Ensure that tech companies adhere to local environmental regulations and obtain necessary permits for operations, especially concerning emissions and resource usage.
• Promote Cleaner Technologies: Encourage or mandate the use of cleaner power sources and water-saving technologies for data centers.
• Prioritize Community Engagement: Demand proactive and meaningful engagement from companies with affected communities, ensuring residents' voices are heard and their concerns are addressed.
• Balance Economic Incentives with Sustainability: Re-evaluate economic incentives (e.g., tax breaks) in light of potential environmental and social costs, ensuring a net positive impact for the community.

Ultimately, the defensive strategy against the negative "price of progress" requires a multi-faceted approach where technological innovation is inextricably linked with ethical responsibility, robust governance, and genuine community partnership.

Key Takeaways

• AI's Environmental Footprint is Massive: Generative AI systems, particularly data centers, consume enormous and rapidly increasing amounts of energy and fresh water, posing significant strains on global resources and contributing to environmental degradation.
• Ethical Responsibility Extends Beyond Corporate Walls: Cybersecurity professionals, guided by frameworks like the ISC2 canons, have a professional and moral obligation to protect society, the common good, and critical infrastructure, not just their employer's assets.
• Community Impact Must Be Prioritized: The pursuit of technological advancement and economic gain by big tech must be balanced with proactive consideration for the well-being, health, and resource security of local communities hosting these facilities.
• Sustainable Solutions Are Achievable: Innovative approaches like Microsoft's closed-loop cooling, CyrusOne's zero-water data centers, and Iron Mountain's underground facility demonstrate that advanced technology can be deployed with minimal environmental impact.
• Proactive Governance and Engagement are Crucial: Organizations must implement robust AI governance frameworks, establish community feedback loops, and commit to transparent, proactive engagement to mitigate potential harms and build sustainable coexistence.
• Cybersecurity Professionals as Ethical Conscience: Individuals in cybersecurity roles have the power and responsibility to be their organization's "conscience," guiding ethical AI development and advocating for sustainable practices from within.

About the Speaker(s)

Joy Toney is a highly experienced cybersecurity professional and a passionate advocate for ethical technology and community development. With over 20 years of experience, she has worked across diverse sectors including nonprofit, customer services, government contracting, and transportation. Currently, Miss Toney serves as a Senior Program Consultant at AIM for Change LLC. She holds multiple prestigious certifications, including the CISSP (Certified Information Systems Security Professional) and CCSP (Certified Cloud Security Professional), underscoring her deep expertise in information and cloud security. Additionally, she holds the SHRM-CP (Society for Human Resource Management - Certified Professional), indicating a broader understanding of organizational dynamics and human capital. Joy Toney is driven by a commitment to ensuring that technology serves both business objectives and the greater good of society, making her a compelling voice on the ethical dimensions of cybersecurity.