City CIO urges cautious, phased approach to artificial intelligence and outlines security uses

The City of Nampa’s chief information officer gave a wide-ranging briefing on artificial intelligence, urging caution while laying out specific security and operational uses the city is studying.

Butch Shireman, identified in the meeting as the city’s chief information officer, told council members that artificial intelligence spans many technologies—from narrow/"weak" AI and machine learning to deep learning, natural language processing and generative AI—and that each category brings different benefits and risks. "AI is the next buzzword that's come up," Shireman said. "Artificial intelligence is a calculator. It does something that you normally need in your head."

Shireman described both productivity gains and security threats. On benefits he listed threat detection, faster incident response, behavioral analysis to detect unusual account activity, predictive vulnerability management, phishing detection and automation for repetitive tasks such as drafting grant-framework documents. He said those technologies could reduce some future staffing growth by making employees more efficient.

On risks, Shireman warned that data fed to public cloud generative-AI services can be exposed or become subject to platform terms: he recounted industry cases where proprietary code submitted to third-party AI platforms was later accessible through the platform’s outputs. "If we share financial information, plans, whatever, and it gets into the wrong hands, that's a big problem," he said. He said the city's approach is restrictive: pilot internal generative-AI systems that keep data on-premises or within a controlled environment rather than exposing city data to public models.

Shireman described a recent cybersecurity incident to illustrate operational need: a distributed-denial-of-service (DDoS) attack on a Monday morning that hammered the city's VPN and caused repeated account locks. He said responding required manual analysis and temporary shutdowns, and that an AI-enabled security system could have detected and mitigated the pattern minutes faster. "We had a DDoS attack... it took us time. It took us an hour to get it all figured out and then by the time we got done, AI could have done that if we had an AI security system," he said.

The CIO said the city already uses Microsoft/Azure security features and KnowBe4 phishing training, but acknowledged gaps: the city’s filters flag suspicious mail but do not automatically open attachments to test them for malicious code, and staff cannot guarantee messages flagged as out-of-domain are safe. He said the city is testing internal generative-AI services and studying AI-driven security tools for threat detection and automated incident response.

Council members asked about law-enforcement uses, dispatch integration, and traffic-signal and other operational uses. Shireman said those are under consideration but stressed the need to ensure data quality and guardrails so incorrect inputs don’t create dangerous outcomes in emergency dispatch. On traffic management, he said AI can analyze traffic flows and adjust signals quickly to improve throughput.

Shireman recommended a phased, risk-managed approach: apply AI for internal productivity where data can be protected, pilot AI-security tools that augment analysts, and use controlled, on-premises generative models for city data. He also emphasized ongoing staff training and cautious procurement of AI services.

No formal action was taken; the presentation closed with council members expressing support for careful adoption and follow-up work with IT.