Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
City cybersecurity deputy warns of nation-state exploitation, outlines AI governance and staffing steps
Summary
Douglas Granat, Richmond's deputy director for strategy and cybersecurity, told the Governmental Operations Committee that nation-state actors and AI-enhanced attacks have broadened the city’s attack surface, described the city’s AI governance under Administrative Regulation 2.13, and said continuity plans are reviewed annually; he also noted DIT’s cybersecurity team has grown but one vacancy remains.
Douglas Granat, deputy director in charge of strategy and cybersecurity, briefed the Governmental Operations Committee on emerging cyber threats, staffing and governance measures the city is taking to protect municipal systems.
Granat said the city routinely records every incident and has observed exploitation attempts linked to nation-state actors. "Nation state sponsored is those coming from other countries, originating from adversaries such as Iran, such as, Russia, China, North Korea," he said, and raised concern about nation-states partnering with criminal organizations to increase the scale and sophistication of attacks.
He told the committee that the city is shifting from a purely technical incident response model to ongoing risk management, integrating AI governance with security and legal review under Administrative Regulation 2.13 so the city can assess risks before deploying new technologies. "What we're doing is we're actually putting security, the city attorney's office, other agencies within the city, within our AI governance board through administrative regulation 2.13," Granat said.
Granat described practical steps the city takes: monitoring and recording incidents on a 24/7 basis, working in shared operational models across agencies, partnering with external organizations including the FBI cybercrime division, and training staff to recognize AI-enabled threats. He said the city has grown its dedicated cybersecurity team "from a dedicated team of 3 to a team of 7," but acknowledged one vacancy remains under active recruitment.
In response to committee questions about deepfakes and reputational response, Granat said the FBI cybercrime division is a partner and that communications response would be coordinated across the administration and relevant agencies rather than handled solely within his office. On resiliency, he said continuity plans and critical-system reviews occur at least annually.
Granat also noted that DIT had one outstanding audit item that was recently logged and is in progress. He invited closed-session follow-up where discussing tactics, techniques and procedures (TTPs) would be inappropriate in public.
Next steps: Granat said staff will continue recruitment and interagency coordination on AI governance and incident response; committee members requested continued updates on resiliency and testing for critical infrastructure.
