Crime... Disclosing Work Secrets to Artificial Intelligence

Cybersecurity and artificial intelligence experts have warned against the consequences of sharing sensitive data or disclosing employer secrets when using AI tools, noting that such actions could lead to legal accountability, even if the disclosure was made in good faith to leverage the capabilities of these tools.

In statements to "Al-Rai," the experts clarified that "some cases have been implicated in this matter, resulting in legal accountability," and emphasized that "disclosing work secrets to artificial intelligence constitutes a crime; therefore, it is essential to verify the authorization granted for sharing information and the mechanism of such sharing, to prevent any data leaks that AI tools might exploit and publish without the knowledge of the concerned entity."

Cybersecurity expert Shorouq Al-Sayegh observed that "artificial intelligence has become a daily tool that helps employees prepare reports, summarize documents, or build presentations within minutes. However, the problem does not start with the use of AI itself, but rather with the type of information employees input into these tools."

Al-Sayegh added that "an employee might, in good faith, copy an internal report, client data, financial figures, or correspondence specific to the institution, and ask an AI tool to summarize it or convert it into a presentation. The potential liability here relates to the nature of the information, its level of confidentiality, the employee’s authorization to use or disclose it, the institution’s policies, the terms of service of the tool used, and whether the action resulted in the disclosure of data or harm to the entity or individuals concerned."

She urged employees "not to enter any information into general AI tools that they are not authorized to share outside the institution. If employees wish to benefit from AI, they can remove names, numbers, and data that reveal the identity of individuals or the institution, use dummy data when seeking assistance, or rely on solutions officially approved by their employer."

She continued: "The problem, therefore, is not that the employee asked AI to create a presentation, but that they may have inadvertently provided it with the confidential material upon which that presentation was based."

Al-Sayegh concluded that "with the rapid expansion of AI use in work environments, institutions need clear policies that specify for employees which data can be used with AI tools, which tools are approved, and which information is prohibited from being uploaded. Awareness here is not a technical luxury, but a part of protecting both employees and institutions."

Cybersecurity expert Mohammed Al-Rashidi stated that "the use of artificial intelligence may constitute a cybercrime if it involves disclosing sensitive topics related to an employer, as this exposes the institution where the discloser works to the risks of data leakage."

Al-Rashidi stressed the "necessity of avoiding the sharing of any sensitive data, as AI tools may use this information and publish it," noting that "there have been cases where individuals leaked data and faced legal accountability as a result; therefore, such consequences must be avoided to preserve the integrity of individuals and institutions."

Information Technology and Cybersecurity Advisor Engineer Hussein Ali Al-Nakass confirmed that “some individuals have, in good faith, used artificial intelligence to prepare reports, create visual presentations, summarize contracts, analyze documents, or draft correspondence. This practice often involves sharing personal, professional, or financial information, or documents belonging to their employer, without realizing that such data is being processed outside the environment in which it was originally stored, and in accordance with the terms and policies of the platform being used.”

Al-Nakass clarified that “the issue does not lie in the use of artificial intelligence per se, but rather in the type of information we input into it and how it is used. Some data may be confidential, private, pertain to other individuals, or belong to government entities or companies. Irresponsible handling of such data may violate policies or contractual obligations, and could entail legal liabilities depending on the nature of the data and the circumstances of its use.”

He emphasized that “uploading sensitive or confidential data to artificial intelligence platforms without authorization or approval may not merely constitute an insecure practice; in some cases, it may lead to violations or even criminal offenses, particularly if the data includes personal information of others, trade secrets, government documents, financial data, or information protected by law or employment contracts.”

He added that “this could result in investigations or civil or criminal liability, depending on the nature of the data, how it was obtained and used, and the affected party. Therefore, no sensitive data should be shared unless there is clear authorization and formal approval, in compliance with the policies of the relevant entity and the laws in force in the State of Kuwait.”