Why I Care That You Don’t Know How to Use AI

I asked the room once again whether anyone had heard of AI hallucinations. The resulting silence was of a type with which I am now thoroughly familiar: well tempered, accustomed to patience and totally impervious to follow-up. Not hostile, but certainly not interested. Rather, it reflected the experience of a population that has survived cyclones, reductions in federal support and three reorganisations of the local health care system. Finally, it simply concluded that whatever I had to sell could wait.

The Silence I Have Come to Recognise, and the Curdling That Followed It

To which I always respond with a professional degree of optimism. But on this occasion, something within me coagulated. With the gentlest possible diagnostic question, I began the workshop: Who has used ChatGPT, Claude or Gemini? Two hands belonging to one woman, who also brought cookies. As a further demonstration of mild concern, I continued with my presentation and then asked an even more provocative question: Has anyone here heard of AI hallucinations?

And there was the silence again, a complete absence of atmospheric noise that accompanies every discussion approaching the point at which an opinion must be expressed. After 1 year of presenting these data, I have developed a high degree of tolerance for this silence, and accepted it with a smile, with redirection and with production of a brief definition specifically prepared for this purpose. As a consequence, the meeting proceeded without interruption and no one cried.

A Confession Concerning the Birthday-Text Industrial Complex

Those who do not understand what an AI hallucination is are precisely those who have large quantities of my personal information. My phone number is on their phones, my e-mail is on their machines and my photo of me from 2017 that I would not have selected is on their iPhones. Their devices, which run an operating system developed under two prime ministers, have identified my home as a "frequent location." In effect, I am a member of a small constellation of devices over which I have no control and for which I have little peace of mind.

These same individuals also text me at 6:47 a.m. on my birthday, not because they remembered, but because their phones reminded them using a contact card that included my full legal name, my cell phone number and e-mail address, and possibly the date of my last visit to their home, which has been continuously recorded by the background processes of iOS since about the time of the Rudd government. They love me, and they also have me in digital form as a resident of a device whose password is the date of their wedding, which is on their Facebook page.

As a consequence of my professional experiences, I have developed a quiet but not entirely virtuous concern about the digital behaviours of others. This results in public expressions of my hope that you will be safe on-line, love. But in reality, it reflects a far greater degree of concern with my own security. In effect, you represent the weak underbelly of my on-line security, and I have fantasised on at least three separate occasions about throwing your telephone into the harbour.

Finally, within the confines of my own thoughts, I have on several occasions imagined a small, dignified intervention in which I would gently but firmly replace your telephone in the pocket of your garment with a brick. This brick would be of a size and weight sufficient to completely prevent further transmissions of electronic information to or from your devices. The brick has never vibrated to signal arrival of a parcel.

And I doubt that I am entirely alone in this. In my view, most individuals working in or near information security share a variant of the same underlying self-centred concern. They express this concern with remarkable social discipline as a form of useful advice. It certainly is useful advice. But beneath the surface, it reflects a realisation that the individual in question is a risk not only to himself but to everyone for whom his telephone number represents a point of contact.

An Incomplete Lexicon of Things We Say When We Mean Something Worse

In the interests of public service, and in the spirit of bringing a problem into the light where it might be more easily contained, I offer here an incomplete lexicon of phrases used by cybersecurity-adjacent professionals when addressing beloved family members whose digital practices have begun to give them a quiet, persistent stomach ulcer.

The phrases are gentle because the relationships are non-negotiable.

The Drunk Driver Offers You a Lift

The cyber-illiterate friend is, in effect, the drunk driver who just offered to give you a ride home. Not malicious. Warm. Insistent. Already in possession of your handbag. Pointing toward the parking lot with keys held high in an unmistakable message that the offer was no longer a question several minutes earlier. As a result, you sit in the passenger seat, white-knuckled, watching as they merge onto a highway of phishing e-mails, unencrypted wireless and text messages from companies of which you have never heard, and with all the subtleties of someone who hopes desperately not to offend.

And they reply, "I've been doing this for years, love. She'll be right."

Technically and statistically, they have indeed been doing this for years and have been correct in every instance. Until, that is, the afternoon of a Tuesday when a reused identifier from a forum in 2014 appears on a pasting Web site and precipitates a cascade of unpleasant events that includes, among other things, you, because your telephone number appears in their address book and your maiden name appears in their text messages. The recovery e-mail address for their bank login, on further examination, turns out to be an address for which you and they jointly served as administrator in 2011, of which you had completely forgotten.

Now Replace the Car With the Internet, and the Drunk Driver With Approximately Everyone

The experience of AI illiteracy is exactly the same as that of the drunk driver. Only there are many more drunk drivers, and they are not slowing down for any of the turns.

They are completely unaware that the image of a political figure was produced only 4 days earlier by an individual located on the other side of the world with a graphics card and considerable resentment. Nor do they know that an article describing all of their previous beliefs was actually written by a chatbot trained to appear very convincing. They cannot recognise that the e-mail from the bank is not authentic, because authentic bank e-mails are as likely to be generated by a chatbot that receives rewards for projecting high confidence as to produce a more convincing impression of legitimacy.

Consequently, the threshold for assessing plausibility has increased as a result of the very technology that facilitates generation of an implausible impression with greater ease. As a result, discernment is becoming a luxury.

They forward the article to me with a string of exclamation marks, respond to the urgent message from the bank with their account number, and continue with their lives in contact with mine in a multitude of ways.

This is why I would like to jump into their handbag.

The Serious Bit, Which Is, This Time, Genuinely Serious

I am going to drop the comedy for a moment. It will return.

Digital literacy is not a matter of personal taste. It is not yoga. It is not about preferring oat milk in your flat white or having strong opinions about the parking policies of your local council. Instead, it is more like driving, or receiving a vaccination, or stopping at a red light.

Your actions-or failures to act-on the internet do not remain confined to your own little corner of cyberspace, because the internet is and always has been a network of interconnected computers. The lesson is in the name. We are not each living in our own private metaverse, but are sharing a single set of pipes, a single set of platforms and a rapidly fraying epistemological common. The person reading a fictitious article about a politician on a web site that did not exist six months ago and sitting next to you on the Pandanus Reach bus will ultimately vote in the same election, drink from the same source of water and transmit the article with complete conviction to a chat group that includes your mother. Thus, we are not each living in our own private metaverse. Instead, we are sharing one common set of pipes, platforms and epistemological resources. That represents the magnitude of the externality.

It is not fashionable to quantify this externality. But it must be done.

What I Actually Want to Say in Workshops, and What I Say Instead

When you sit in my workshop and proudly declare that you "do not really use AI," I will smile, nod and express appropriate appreciation for meeting people at the level at which they experience care. I will then refer you to the section of our training materials entitled, "What exactly is a large language model? Slowly, with pictures."

What I am doing internally is calculating the blast radius.

Not as a punitive exercise, but because I must. Your inability to recognise an AI-generated photograph influences the types of photographs that ultimately will be shared with me. Your failure to identify a fraudulent Web site determines which sites ultimately will be linked to me by you, with instructions to read the article. Finally, your ignorance of what AI can and cannot reliably accomplish affects whom you will consult, which products you will recommend and to what extent you will believe the voice on the telephone of a child in distress, enough to drive to the drug store for a gift card. (This fraud is entirely real and is currently operating in Australia. Our consumer-protection agencies have made appropriate criticisms, but have not yet achieved complete protection.)

This is not a private matter. It has never been a private matter. I am genuinely sorry to be the one to tell you.

I would still come to your birthday. I would just, very gently, like to take your phone.