City amends computer procedures and ethics policy to add AI, annual cybersecurity training and password management

The Bowling Green Board of Commission on Jan. 21 approved revisions to the city’s computer procedures and ethics policy that add sections on personally identifiable information, security-camera footage and artificial intelligence, and require annual cybersecurity training and rollout of a password management system.

City Manager Jeff Meisel summarized the changes and asked Danita (city IT staff) to explain technical details. "We're requiring employees to take that cybersecurity awareness training," Meisel said, noting the city is under regular cyberattack attempts. Meisel said the city is also implementing a password-management tool and expanding two-factor (Duo Mobile) authentication for city devices.

Danita said the revisions cover email, text messages, social-media contact and other social-engineering channels and that annual web-based training will be used to educate staff about evolving methods such as AI impersonation, voice cloning and visual deepfakes. "A lot of the protection that we put in place, they are designing new ways around that," Danita said, adding that security incidents sometimes require days or weeks of investigative work.

Commissioners asked whether training is web-based (Danita said yes) and raised operational concerns about balancing security with staff efficiency. Danita said strengthening defenses is a continuing effort and that the city must weigh usability against protection.

City staff recommended the revision package for approval; commissioners voted to adopt the changes during the Jan. 21 meeting.