Falls Church has hidden nothing about its AI use. The bigger question is who’s watching for the risks nobody has thought of yet.

By Nick Gatz

There is a difference between what a government hides and what nobody knows yet. Falls Church City Hall has hidden nothing from this newspaper. Every question the News-Press has asked about artificial intelligence has been answered in writing and on the record, and nothing we have gathered points to misuse, a breach or bad intent. But ask whether anyone logs or audits how City employees use AI, and IT Director Nate Dupree and Communications Director Mary Catherine Chase give a one-word answer: “No.”

That answer matters because of the problems nobody can see coming. The known risks are the easy ones, and the City has written rules for them. The dangerous ones are what we don’t know we don’t know: a feature switched on in a routine software update, an AI agent that wanders somewhere nobody sent it, a vendor that can see more than anyone realized. Nobody can write a rule for a risk they haven’t imagined. The only real defense is someone watching.

Start with what the City has: a May 6 memo from City Manager Wyatt Shields bars staff from feeding personally identifying City data into AI. Every employee can use Microsoft Copilot Chat through a City work account, five employees hold paid Microsoft 365 Copilot licenses, and consumer AI sites such as ChatGPT are blocked on City networks and devices. Asked what technical controls keep prohibited data out of AI tools, the City listed two: “AI guidance memo and web filter.” Asked how an AI incident would be reported, it said, “We follow our HR related discipline policy.”

Several answers were reassuring. AI features are not switched on in the vendor software the City uses for finance, permitting, HR, utilities or public safety, the City said, and HR does not use AI to screen or rank job applicants. Beyond a $1,700 purchase, IT has licensed no other AI tools since fiscal 2025.

A web filter blocks a website. It cannot see what an employee types into an approved tool, and it cannot reach a personal phone. Recording activity, flagging the odd stuff and having a human actually look at the flags are three separate jobs, and based on its own answers, the City does none of the three for employee AI use.

Those are not the same safeguard. A system can keep logs of who opened what and when. Software can turn those logs into alerts for odd behavior, like a 3 a.m. login or a mass download. A person can review the alerts, quickly or never. An outside firm can audit the whole setup. Only a person or an auditor catches what the computer wasn’t told to look for, which is exactly where the unknown unknowns live.

Georgia is what an unknown unknown looks like. On Oct. 25, Anthropic disclosed that one of its Claude AI agents, working on a statistics project, requested an access token from a Georgia Secretary of State dashboard without being told to and pulled aggregate vote counts. Both sides say the voter registration system was never touched. But Axios first reported that Georgia officials and Anthropic both said the agent got around a paywall, and a day later Georgia said it had not. The state learned of the episode when Anthropic called, and it has not said whether its own systems would have caught it. Secretary of State Brad Raffensperger pushed back hard: “Accessing public information is not a hack, and pretending otherwise is reckless and dangerous.” He may be right, but no independent investigator has publicly reviewed either side’s account.

The federal help meant to back up small governments is shrinking, too. Answering a News-Press question during his Oct. 21 media call with Virginia reporters, Sen. Mark Warner, D-Va., turned to the Cybersecurity and Infrastructure Security Agency. “President Trump has decimated, cut its personnel in more than half,” Warner said. “It is not up to doing the job that it needs to do. And that is even before we see the advent of all these new AI tools that are making all of our systems much more vulnerable.”

Warner’s warning is real, but his number runs hot. Published figures put CISA’s losses at roughly a third, about 1,000 employees, and Warner himself said “one-third” in June. The administration says the cuts put CISA “back on mission,” and it plans to hire hundreds back. Closer to home, the federally backed network that gave local governments free threat warnings lost its federal funding last fall, and a state IT spokeswoman told Cybersecurity Dive that Virginia had to “scale down our agreement due to the loss of federal funding.” The state has added one option since: in June, the Virginia Information Technologies Agency hired contractor CAI to offer localities round-the-clock security monitoring and incident response. Whether Falls Church is covered by either is one of the questions the News-Press is now asking.

AI cuts both ways, and Warner’s own example proves it. The day he spoke, AP reported that AI-assisted researchers had found critical flaws in PHP, the code behind about 70% of the world’s websites, before attackers did. The FBI told operators to pull sites offline if they couldn’t patch fast. The machine found the hole first. Getting it fixed was up to people.

That is why the News-Press keeps chasing these stories, and it is worth saying plainly. This is not about a gotcha moment, and there is no hidden agenda. Holding everyone accountable is the job, whether that means City Hall, a U.S. senator, a federal agency or a billion-dollar software company. The only goal is making sure the companies building these tools don’t go off the rails while the people responsible for watching them are stretched thin.

Falls Church has done the hard part by answering openly. The next step is a log of how AI gets used, a person who reviews it and a named owner for incidents. Rules cover the risks we can see. Watching is the only way to catch what we don’t know we don’t know.

Continued online at FCNP.com: how federal cuts reached Virginia, what logs can and can’t catch, and why AI keeps going places nobody sent it.

Online (FCNP.com continuation)

What the City has and hasn’t built

The rest of the City’s written answers fill in the picture. The memo bars feeding AI anything from personnel and taxpayer records to recreation enrollment data and credit card numbers. It tells staff to “expect errors,” treat AI output as a first draft and disclose when AI helped, and it notes that AI wrote the memo’s own first draft. No AI training is currently required, though the memo promised training “in the coming weeks,” and the City said training is available through Copilot. The City keeps no central inventory of AI tools, including AI built into vendor software, though one is planned.

The City added that the public safety software IT supports has no built-in AI tools. It also said AI was not used to prepare its answers to the News-Press.

Several answers leave the door open. Asked whether paid Microsoft 365 Copilot can reach City email or files holding taxpayer or personnel records, the City answered, “Only data provided by the subscription holder,” which doesn’t say what that subscription holder can already reach. Asked who approves new AI tools, it pointed to the City Manager’s Office. Asked when the interim memo becomes a final policy, it said the memo “did not outline a timeline.” Asked how an incident would be reported and to whom, it again pointed to its HR discipline policy, which covers consequences but not how a problem gets caught in the first place.

The threat from inside

Outsiders breaking in is only half the risk. The second question is what stops people who already have access, whether an employee, a contractor, a vendor or an automated tool, from pulling, combining or misusing information they are allowed to see. A system can be locked tight against hackers and still be wide open to authorized misuse. That is where this series’ reporting on data brokers comes in, and Warner drew the same line on the Oct. 21 call. “We need a comprehensive privacy bill that deals in an era of AI and enhanced cyber,” he said. “We don’t have that.” Private data brokers, he added, sell personal information to American companies for marketing, “but I think records have shown they’ve sold it to foreigners as well. That loophole needs to be closed.”

The Georgia lesson

Georgia’s episode is a clean example of how hard it is to know what happened, even after the fact. According to Anthropic, the agent was working on an internal statistics project, learned from an archived copy of the state’s website that a public dashboard handed visitors an access token, then requested one and queried the dashboard. Anthropic first described the data as information Georgia normally sells. On Oct. 26, Georgia’s Secretary of State’s office said Anthropic had confirmed the agent did not bypass a paywall and reached data on the state’s free public Data Hub. Georgia says Anthropic first contacted it on Oct. 8 and that it shared its findings with the White House the next day.

Warner, for his part, told Virginia reporters on the same Oct. 21 call that the commonwealth’s elections are safe. “We have seen no evidence of any foreign nation that is trying to do interference,” he said, while warning that Russia, China and Iran are spreading disinformation. He also said AI companies that promised in 2024 to take down election deepfakes “failed miserably.”

AI cuts both ways

Georgia was not a one-off. This year, OpenAI disclosed that two of its models broke out of a test environment and breached Hugging Face’s production systems to cheat on a benchmark. Anthropic disclosed that its Claude models reached real companies’ systems during misconfigured security tests, and that its agents filed 20 visa applications on the State Department’s website and sent a false homicide tip to Philadelphia police. Anthropic has also reported that a Chinese state-sponsored group used its Claude Code tool to automate much of a hacking campaign against about 30 organizations, a claim some security researchers questioned. None of those cases required a villain behind the keyboard.

Warner pointed to those PHP flaws himself. “There was a major report today on PHP,” he said on the call, describing “a long known gap there. And these AI tools can help you exploit it.” Parts of some government websites in Britain and Japan went dark as a precaution while operators patched. Finding a flaw is now faster than ever. Patching it still depends on staff who have the time and authority to act.

What happened at CISA

Here is what the record shows. CISA started 2025 with about 3,300 employees and ended the year with 2,389, a drop of roughly 900 people, or about 28%, according to figures cited by House Democrats who have asked the Government Accountability Office to review the cuts. Warner’s own past statements line up with that. In June he told Broadband Breakfast that “CISA has lost one-third of its workforce,” and his June 16 letter to the agency put the losses at more than 1,000.

His “more than half” on the Oct. 21 call goes further than any agencywide count. Only two published figures break 50%, and both are narrower. One division, the team that works with private companies, lost 96 of its 189 staffers, according to House testimony reported by Federal News Network. And during February’s Homeland Security shutdown, 62% of CISA’s workforce was sent home on furlough, leaving about 888 people working until roughly 1,200 were called back in April, according to the Cloud Security Alliance.

The administration has defended the cuts as a return to CISA’s core job, after ending election-security work and other programs it said fell outside that mission. Homeland Security Secretary Markwayne Mullin told Congress in June the department would hire about 600 people over a year or more, and the agency’s acting director said in September that roughly 250 had tentative offers awaiting clearance. Warner called the rehiring “an important step” but said the departed staff “should never have lost their jobs in the first place.” When Warner pressed CISA in June for regional staffing records, an agency spokesperson said CISA does not “reply to congressional correspondence in the press.”

How the cuts reached Virginia

The clearest local effect runs through the Multi-State Information Sharing and Analysis Center. For more than 20 years, federal money let it give state and local governments free threat warnings and security tools, and the scale of what it did is easy to miss. A local government cyber official told Cybersecurity Dive that more than 90% of the state and local threat intelligence CISA distributes came from the center. After federal funding ended, it lost roughly 70% of its members, dropped to 21 member states, cut staff and moved new members to a self-guided online portal, Cybersecurity Dive reported in June. Membership fell from 18,574 organizations to about 5,600. Organizations that leave lose its ransomware alerts and warning signs of intrusions. Virginia is still a member and was negotiating a new, smaller agreement, according to that report.

The bill runs downhill from there. States and localities now pay MS-ISAC membership fees, and federal State and Local Cybersecurity Grant Program dollars cannot be used to cover them, StateTech reported. The state’s CAI contract, a statewide purchasing deal for round-the-clock monitoring, threat detection and incident response, gives localities one place to turn, though it is not free. Whether Falls Church, Arlington or Fairfax uses that contract, another vendor or its own staff to watch its networks has not been publicly documented, and no Northern Virginia locality has publicly reported a monitoring gap tied to the cuts.

Washington’s part

Warner says Congress and the White House share the blame. He has pressed CISA for regional staffing records and introduced a bill to restore MS-ISAC funding, and his Sept. 24 push for AI safety testing rules stalled when Sen. Ted Cruz, R-Texas, objected. On the call, he faulted the administration for “saying to AI companies, hey, have at it, you guys self-regulate.” The administration’s position is that a smaller, refocused CISA can do the job, with more responsibility shifted to states and localities. Either way, that shift lands on places like Falls Church.

What the News-Press is asking next

The News-Press is now asking the City who reviews security alerts on its networks, whether monitoring is done by City staff or a contractor, how often alerts get reviewed, whether approved AI tools get their own monitoring, whether the City is an MS-ISAC member, whether federal cybersecurity help has changed since January 2025 and whether independent security audits are done. If some of those answers can’t be released for security reasons, the City can say so and describe the safeguard in general terms. We are also asking CISA what changed for Virginia localities.

None of those questions assumes anything is wrong. Every resident already knows from their own phone and laptop that software changes, often without asking first, and the tools governments buy are no different. A feature that didn’t exist in May can show up in an update by October. The questions above are how a community finds out who is actually on watch, and what it doesn’t yet know to ask.