Tech Policy at Duke University

At 8 pm on a Friday night, I found myself standing on Duke’s Abele Quad next to my fellow faculty member Prof. Lewis Akenji and one of my sons, listening to a group of students play music for hundreds of their friends and classmates. While enjoying the concert, I was thinking about artificial intelligence (AI) regulation (as I so often have been this past year). Earlier that day, I had interviewed Congresswoman Deborah Ross on her thoughts on the cybersecurity implications of AI and how the federal and state governments could regulate to enhance its benefits while decreasing harms to individuals. These two parts of my day may seem at odds with each other as one shows humans coming together, and the other is about the risks to those humans from technology. But instead, the combination of the two fills me with hope.

The concert was the culmination of Duke Music Day, an idea hatched a year ago by current Duke senior Pallavi Bhargava during a train ride we took from Oxford to London. Pallavi was part of a team of four Laidlaw Scholars working with three staff and three faculty members to explore the impact of AI on music in Europe. As we discussed our experiences at the Paris Fête de la Musique a few days before, she described the joy she saw as she and her peers wandered around Paris watching humans enjoying other humans playing live music. Pallavi decided she wanted to bring that joy and human connectivity to Duke. It is a unique and special pleasure to observe a student have an ambitious idea, rally a team of her peers to the cause, overcome obstacles (more on these later), and see the positive benefits of building community that can come from many hours of hard work.

In my AI cybersecurity conversation with Congresswoman Ross earlier in the day at the Duke Cybersecurity Conference, we also discussed some of the broader implications including on muscians. In May 2026, Congresswoman Ross reintroduced the Protect Working Musicians Act (PWMA), which would allow independent musicians to collectively bargain for reasonable payment for their creative efforts, an issue even more important in the AI age.

Over the past two years Grammy-nominated musician and Duke researcher Tift Merritt and I have been the faculty co-leads on a project to explore AI’s impact on the music industry. We see that impact as a canary in the coal mine for how AI will disrupt many sectors of the economy. Other professions such as software development, law, finance, and management consulting are already starting to experience similar market pressures that come from automating many of the cognitive functions that make up white-collar labor. Whether AI’s use in those professions translates to dramatic job losses remains to be seen. However, we are already observing wage growth reduction, changes to working conditions, and decreases in hiring for entry-level positions. As Spotify has become the dominant method for musicians to reach audiences, they have seen their royalties plummet while 100% AI-generated music floods the platform. The PWMA would help musicians address these issues in much the same way that screen actors and writers have secured protections through their unions by negotiating with digital platforms and limiting AI’s use in film and television production.

Standing in front of the stage hearing Pallavi sing Alanis Morissette’s hit ‘Ironic’ was fitting on many levels. Among the obstacles she and her peers had overcome were thunderstorms that had played havoc with the schedule for the smaller performances across campus earlier in the day.

The way the clouds cleared just in time for the main performance caused me to reflect on the optimism I am filled with by teaching at Duke. With AI agents escaping from testing environments and continued inaction from the current U.S. administration, there are plenty of reasons to worry about the future. But watching college students join together to celebrate human creativity and community fills me with hope and is one of the reasons why I am privileged to be at Duke.

I teach and have taught several of the students who joined Pallavi on stage and many of the students in the audience. The band included Sam Dillon (bass and vocals on several numbers), who was a student in my Intro to Cyber Policy class and participated in our Platform Accountability Bass Connections Project.

This year, she helped lead our research project to quantify the amount of AI music on Spotify and is currently leading a project examining streaming fraud as the economic engine driving AI-generated music on digital platforms. J.P. Goodwin (drums) is the lead teaching assistant for my Policy Choice as Value Conflict class and is a student in the AI and the Creative Economy class co-taught by Tift, Liz Sparacino, and me.

Jack Stapleton (lead guitar and vocals) is a current student in my Policy Choice as Value Conflict class and is exploring a final group project that will include an original music composition about the policy response to gun violence in the U.S.

Over eighty musicians performed during the day on makeshift “stages” under archways, in the dining hall, and outside coffee shops. Auditions were not required, and the only criterion for participation was a desire to share music with the campus. J.P. had the idea to further build community by having a “superband” of eighteen musicians cap off the day. He and Sam recruited participants from all corners of campus and oversaw late-night rehearsals for over a month.

I had nothing to do with what the group accomplished on Duke Music Day. Those students (along with many of their friends) did everything to raise funds, secure approval for spaces to play, obtain equipment, market the event, and do the emergency planning required by the thunderstorms. J.P. took charge of coordinating with Duke administrators on how to overcome the challenge of the storms. Sam improvised by moving equipment between various stages to allow people to play despite the weather. I was just able to stand next to Prof. Akenji and my son and enjoy the results as evidenced by the smiles on the faces of everyone on stage and in the audience.

Talented young adults were bringing their gifts together to spread joy to their community. This was happening on the same day that we discussed the challenges of putting in place effective regulation of AI to protect the work of creative humans. Thunderstorms had created fear and anxiety, but cleared just in time for the next generation to gain the benefits of their labor. The work we have done at Duke convinces me there are things we can do to push aside some of the metaphorical storm clouds on our AI horizon. Passing the PWMA is one of those steps.

I have also written recommendations that I call the Berlin Proposal that focus on required accountability mechanisms. These requirements include risk management process obligations, whistleblower protections, mandatory certifications of compliance, and criminal prosecutions of tech executives who ignore their responsibilities.

Now is the time to learn from Pallavi, Sam, J.P., Jack and their friends. We have the ability to use these accountability mechanisms (all of which are used in existing regulatory approaches) to significantly decrease the risks of AI to individuals and allow us to trust our use of AI to provide benefits to humans. Duke students regularly demonstrate to me that we can still do difficult things, and that fills me with hope. We just need to get to work to find the political will to shape the future we want. Wouldn’t that be ironic?

You can support the passage of the PWMA by signing this petition.

The Berlin Proposal, which I first described in this blog, is below.

The Berlin Proposal

1. For online technology platform that have at least 45 million monthly active U.S. users (“the Platforms”), the following requirements should apply:
   1. Contribute 1% of global revenue to a non-profit entity (“the Reviewer”) charged with the mission of independent accountability reviews of the Platforms.
   2. Be required to file with the Reviewer an annual statement signed by the Chairman of the Board and the Chief Executive Officer that it has performed an accountability review, fully reviewed by those executives, and that it is taking active steps to appropriately mitigate any noted gaps.
   3. Accompanying the signed statement should be a detailed description of how the Platforms comply with the Accountability Requirements described below. Platforms should include in the annual statement that they subject themselves to the authority of the U.S. Federal Trade Commission and the State Attorneys General for any misrepresentations made in the statement and detailed description.
   4. The Reviewer should hire independent testing laboratories to conduct safety reviews of the development environments at the Platforms, which are obligated to provide full access and assistance to those doing the testing.
   5. The Reviewer should publish quarterly updated best practices for complying with the Accountability Requirements.
   6. The Reviewer should be governed by a board elected by the U.S. State Attorneys General. Board members should serve five-year staggered terms and be limited to only one term and should not receive any compensation directly or indirectly from Platforms, including making a signed commitment to not receive any such direct or indirect compensation for a period of ten years after serving on the board.
   7. Platforms which do business with the U.S. federal government should also be required to file the statement with the U.S. Federal Trade Commission, and the filing should be subject to the False Claims Act including whistleblower incentives and criminal provisions for deliberate fraud by the Chairman and CEO.
   8. The Accountability Requirements should include (these elements are based on those from the Center for Information Policy Leadership’s 2010 paper, Demonstrating and Measuring Accountability, which I helped draft)
      1. Policies: Existence of binding and enforceable written platform safety policies and procedures that reflect applicable laws, regulations and industry standards. Platforms should develop, implement and publish safety policies (including privacy and cybersecurity) informed by appropriate external criteria found in law, regulation, or industry best practices, and designed to provide the individual with effective safety protections.
      2. Executive Oversight: Internal executive oversight and responsibility for data privacy and protection. Executive oversight will require the creation of a safety leadership position supported by appropriate resources and personnel, and responsible for reporting to organization leadership. Commitment by top management should include appropriate reporting and oversight of the organization’s safety program. Top management should empower and require senior-level executives to develop and implement the organization’s programs, policies and practices.
      3. Staffing and Delegation: Allocation of resources to ensure that the organization’s safety program is appropriately staffed by adequately trained personnel. While recognizing the need to work within economic and resource constraints, accountable organizations should have in place sufficient staff to ensure the success of their safety program. Such staff should receive adequate training, both as they assume their role in the safety program and as that program evolves to address new developments in the organization’s business model, data collection practices and technologies, and offerings to consumers.
      4. Education and Awareness: Existence of up-to-date education and awareness programs to keep employees and on-site contractors aware of safety obligations. Organizations should provide the necessary briefings, information and education for their personnel to keep them apprised of current and emerging requirements. Such education should involve keeping employees aware of new safety issues that may affect the performance of their job, and sensitive to the importance of safety to individuals and to the success and reputation of the organization.
      5. Ongoing Risk Assessment and Mitigation: Implementation of a process to assist the organization in understanding the risks to safety raised by new products, services, technologies and business models, and mitigating those risks. To be accountable, organizations must assess the safety risks raised by their products and practices as they are developed and implemented, as they evolve, and as their data requirements change. In response to the findings of those assessments, organizations must take measures to mitigate those risks.
         1. Safety Impact Assessments are one important risk assessment and mitigation tool. A Safety Impact Assessment is carried out as part of the process for determining whether to collect data, deploy a new technology or data-driven business model, or use or manage data in a particular way. It is also important when making decisions about how best to secure data. It involves close examination of each new application or process, an evaluation of its attendant risks, and a determination of the steps that must be taken to ensure that the organization meets the requirements of applicable law, regulation and the organization’s safety promises. To be accountable for their risk assessment and mitigation practices, organizations also should be able to demonstrate the nature of their risk analysis. The organization must show the rigor of the criteria against which analyses are carried out and the suitability of those criteria to the nature of the technology or service. Further, the organization should be able to demonstrate how decisions are made and steps are taken to mitigate risk. The organization must also demonstrate that the decisions it takes to respond to identified risks are appropriate and effective.
      6. Program Risk Assessment Oversight and Validation: Periodic review of the totality of the accountability program to determine whether modification is necessary. An accountable organization should periodically review its accountability program to ensure that it continues to meet the needs of the organization by supporting sound safety decisions. To encourage transparency, the results of that program review should be available to those persons or organizations external to the reviewing group tasked with program oversight. The method by which this information is derived and reviewed must be both appropriately rigorous and cost effective for both organizations and regulators. The results of these assessment measures and/or audits should be reported to the appropriate personnel within the organization, and when necessary, corrective action should be taken.
      7. Event Management and Complaint Handling: Procedures for responding to inquiries, complaints and cybersecurity incidents. An accountable organization should implement a well-designed, reliable procedure for addressing safety problems when they arise. The procedure should include a formal complaint process to address safety concerns of individuals and potential or actual failures.
      8. Internal Enforcement: Internal enforcement of the organization’s policies and discipline for non-compliance. Accountable organizations should have in place policies and procedures for enforcement of their safety policies. Personnel who disregard those policies should be subject to sanctions, including dismissal.
      9. Redress: The method by which an organization provides remedies for those whose safety has been put at risk. Accountable organizations should establish redress mechanisms whereby individuals may have their complaints heard and resolved. The redress mechanism should be readily accessible to individuals and address complaints efficiently and effectively.

[1] I did not use AI for this blog, although I would not have been opposed to doing so. Many thanks to Liz Sparacino and Holden Buchanan for their editing assistance.