On Saturday, September 19, the President posted twice about artificial intelligence. The first post asked his followers to vote on a new name for the technology. The second one announced an AI Force, compared it to the Space Force he created in his first term, and promised an AI czar in the near future.
That was the whole announcement. No mission statement. No budget. No home in any department. No leader, no start date, no org chart. Four people from the tech industry told reporters nobody warned them it was coming. The White House didn’t answer questions from Axios or NBC News that afternoon, and by Sunday the word from Washington was that details on the czar would arrive sometime this week.
I spent 20 years as Director of Computer Operations and Technical Services at Trader Joe’s, and I carried disaster recovery responsibility the entire time. I read that post the way I’d read an incident plan somebody handed me for review. It has a name and a logo. It has nothing else.
My reaction was frustration, and it hasn’t worn off.
AI agents are already breaking out of test environments and attacking real companies, and the response was a naming poll and a comparison to a military branch. Anyone who has been responsible for keeping systems running knows the announcement is the easy part. The rules, the owners and the drills are the work, and none of them showed up.
What is Trump’s AI Force supposed to do?
Nobody knows, and that includes the people who would have to run it. Some news outlets reported it as a task force, but the post says force, and it says Space Force. A task force is a committee, while a force in the Space Force sense is an armed service with a statute, a budget and a chain of command.
The one sentence in the post that reads like policy says the administration won’t hinder or stifle the industry, and that it will be “looking for BAD” through the criminal and civil justice system that already exists. That’s a statement that no new AI law is coming. Everything else in the post is branding.
Branding is the cheap part, and a security program that stops there is a sham. Organizations announce them all the time. They print the posters, hold the kickoff meeting and never write the procedures, so when something breaks, nobody knows who’s supposed to do what. A poster has never stopped an incident, and a post on social media won’t either.
A fire department is the part you build second
Every city has two kinds of fire protection. The first is the one everybody sees: trucks, sirens, brave people running into smoke. The second is boring. It’s the fire code. Exits you can reach, doors that open outward, sprinklers, occupancy limits, inspections nobody enjoys.
The code is written in advance because the fire already happened somewhere else. In March 1911, 146 garment workers died in the Triangle Shirtwaist Factory fire in New York, many of them trapped behind doors that were locked. The fire department came. It couldn’t save them. What saved the next building’s workers was the wave of factory safety laws New York passed afterward.
A fire department with no fire code stays busy forever. It’s heroic and it’s expensive and it loses a lot of buildings. That’s the design Saturday’s post describes, and the first people burned by it will be the businesses and customers on the receiving end of somebody else’s AI, who never had any say in the matter.
“Looking for BAD” is a promise to show up after the fire
Courts act after harm. They need a victim, a complaint, evidence and time, usually a lot of time. And evidence depends on two things this announcement doesn’t touch: somebody has to report the incident, and the records of what happened have to be honest.
Look at the last big one. In July, a swarm of AI agents inside an OpenAI evaluation broke out and broke into Hugging Face. The lab didn’t notice until the victim went public. Every disclosure since has been voluntary. The independent investigators got six days on site and a scope that ended before the agents went after OpenAI’s own systems. And according to the published reports, some of the agents falsified their own activity logs.
So walk the “existing justice system” plan through that incident. Who reports it? Nobody has to. What’s the evidence? Logs the attacker could edit. Who does a prosecutor charge? A process that stopped existing when its run ended. A prosecutor can’t charge what nobody has to report, and a jury can’t weigh a log that lies.
On Sunday, Treasury Secretary Scott Bessent told reporters the U.S. has proposed a notification mechanism for AI incidents that could affect national security, as part of talks with China ahead of this week’s meeting with Xi Jinping. So Washington wants Beijing to report AI incidents, and American labs still don’t owe anyone the same notice. Asking a rival to do what we won’t require of our own labs is hard for me to take seriously.
Can a president create an AI Force without Congress?
No. The Space Force comparison is the thing that sinks the announcement. Space Force exists because Congress created it in the National Defense Authorization Act for fiscal 2020, signed in December 2019. It sits in Title 10 as the sixth armed service because a statute put it there, with a mission, a budget and a place in the chain of command.
The last time an attack forced the government to build a new cyber institution, it went the same way. When a worm crossed the Pentagon’s classified networks on a USB drive picked up in a parking lot, the cleanup took about fourteen months, and the lessons produced U.S. Cyber Command. That command has authorities, a commander and orders. It came after the fire, and it came with a structure.
Everything comes down to authority. The best training I ever got was a disaster recovery tabletop in San Diego, and the lesson that stuck was the government officials at the table saying, over and over, that they had to send each decision up the line because they weren’t allowed to make it at their level. An AI Force with no statute is that table. Everybody’s in the room. Nobody can decide anything.
A czar with a 130-day clock
The czar job has been empty since March. David Sacks held it as a special government employee, and he stepped down when he ran into the limit on that status. A special government employee can serve no more than 130 days in any 365-day period.
If the next czar comes in the same way, the same clock starts. Imagine hiring a fire chief who has to leave after four months no matter what’s burning. Nobody would run a city’s fire department that way, and I can’t see any excuse for running national AI security that way.
What is the case for the AI Force approach?
The administration’s position deserves a fair hearing, because parts of it are right. Existing law does reach a lot of AI harm. Breaking into a company’s servers is a crime under the Computer Fraud and Abuse Act no matter whether a person or a program did the typing. Fraud is fraud. Theft is theft.
Rules written in a panic tend to protect the biggest companies, because they’re the only ones who can afford the compliance department.
Fifty states writing fifty different AI laws would be its own disaster, and that’s the argument behind preempting state rules. The race with China is real. And Space Force looked like a punchline when it was announced, and it’s a working branch of the military today.
Run the tabletop before the real event, find out who can’t decide what, and fix it while nothing is on fire.
All of that is fair. None of it answers the reporting problem or the log problem, and the resistance isn’t coming only from Democrats. A New York Times and Siena poll this month found 61 percent of likely voters opposed building AI data centers, including 47 percent of Republicans. The Senate voted 99 to 1 to strip AI preemption from the budget reconciliation bill. And the loudest calls for guardrails have come from the people who run the biggest AI labs.
What should an AI fire code require?
The code doesn’t have to be long. It has to exist before the fire, and it has to be written down by somebody with the authority to enforce it.
Mandatory incident reporting comes first, with a deadline, the way data breach laws already work. If an AI system breaks out of its environment or attacks someone else’s, the lab reports it in days, not whenever the victim’s press release forces the issue. Second, logs the system can’t edit. We solved tamper-evident logging for banks and card processors a long time ago, and I lived under those rules for years. There’s no excuse for letting an agent rewrite its own history.
Third, a named owner with real authority, a budget line and a term longer than 130 days. Fourth, exercises. Run the tabletop before the real event, find out who can’t decide what, and fix it while nothing is on fire. That’s four items. A statute could hold them on a few pages.
| Requirement | What it means | Where the idea already works |
|---|---|---|
| Mandatory incident reporting | Labs report a breakout or attack in days, with a deadline | Data breach laws already work this way |
| Logs the system can’t edit | Tamper-evident records so an agent can’t rewrite its own history | Banks and card processors |
| A named owner with real authority | A budget line and a term longer than 130 days | Unlike a czar on a special government employee clock |
| Tabletop exercises | Find out who can’t decide what, and fix it while nothing is on fire | Disaster recovery tabletops |
None of those four items is exotic. Banks and card processors live under rules like these every day, and they’re still in business. When an AI lab argues that reporting its incidents would slow it down, it’s asking for a pass no bank would ever get, and I don’t think it deserves one.
My take
Write the fire code before you hire the fire department. Mandatory incident reporting with a deadline comes first, then logs the system can’t edit, a named owner with real authority, and tabletop exercises. Banks and card processors have lived under rules like these for years, and they’re still in business. An AI lab that says reporting would slow it down is asking for a pass no bank gets. I wouldn’t give it one.
What can businesses do about AI security now?
If you run systems that use AI, don’t wait for the czar.
Write your own code now. Decide what counts as an incident, who gets told and how fast, where the logs live and who can change them, and who has authority to pull the plug at three in the morning. Then test it with a tabletop, because the plan you’ve never exercised is a wish.
The last article in my series on famous cyberattacks made the case that attackers eventually crossed every wall we trusted, and AI is the biggest act of trust in the history of computing. More on breaches and what they teach is in the Cybersecurity Hub. And if you’ve spent a career running security and you’re sitting on the lessons, I built my cybersecurity book process to get them written down.
My verdict is that the AI Force, as announced, is a press release. Until somebody with real authority writes down who reports an AI incident, how fast and to whom, and makes the logs impossible to edit, the country is ordering a shiny truck and skipping the fire code. The next breakout will get investigated with evidence nobody can trust, and the people it hits will pay for that.
Frequently Asked Questions
- Trump says he will form new ‘AI Force’ but continues to call AI fears a ‘hoax’, ABC News
- With the stroke of a pen, U.S. Space Force becomes a reality, United States Space Force
- Ethics Advisor’s Desk Reference, U.S. Department of Agriculture
- Senate Strikes AI Moratorium from Budget Reconciliation Bill After Weeks of Markey Raising Concerns, Office of Sen. Edward J. Markey
