From Diagnosis to Accountability: How RAND and AICELA Target AI’s Hidden Insider Threat

RAND Analysis vs AICELA: They are complementary in diagnosis and divergent in the institutional tool each proposes.

While the public debate around artificial intelligence remains fixated on model alignment and catastrophic outputs, the frontier’s biggest security flaw may already be inside the building. Frontier AI labs spend millions fortifying their digital perimeters, yet non-public model weights—the crown jewels of the modern AI economy—remain deeply vulnerable to insider access and custody breakdown. RAND diagnosed the vulnerability; AICELA wants to write it into law. Here is how these two leading frameworks approach the high-stakes battle over who controls frontier AI.

RAND’s 2024 analysis (and follow-on work) and the AICELA discussion draft both treat non-public model weights as the critical asset and insider/near-insider access as a high-feasibility risk, but they differ sharply in form, scope, and theory of action. RAND Analysis

The core document is the May 2024 RAND report Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models (Nevo et al.). It:
Maps ~38 distinct attack vectors across attacker capability levels (from opportunistic criminals to top-tier nation-states). 

Finds insider and near-insider routes among the more feasible paths to weight theft or exfiltration.

Defines graduated security levels (SL1–SL5) and recommends practical measures: centralize weight copies on monitored systems, sharply reduce the number of people with access, harden interfaces against exfiltration, run insider-threat programs, use defense-in-depth, conduct third-party red-teaming that simulates relevant actors, and adopt confidential computing.

Later 2026 work (e.g., Achieving AI Model Weight Security Level 3) translates this into a large set of concrete controls adapted from NIST SP 800-53, focused on organized cybercrime and insiders.
RAND is diagnostic and prescriptive for labs and policymakers. It is not a statute.

It treats voluntary high-level commitments and perimeter-focused approaches as insufficient on their own for weight security, and it supplies the technical case for treating access control, custody, and insider risk as first-order problems.

AICELA Proposal

AICELA (the CotoBuzz Artificial Intelligence Custody and Equal Liability Act discussion draft) is a concrete statutory instrument focused on custody of non-public weights and production privileges. Key elements include:

A mandatory, auditable privilege roster of every person and service account with access (contractors, evaluators, and auditors included).

Dual independent authorization for high-impact actions (copying weights or large checkpoints, altering logs or privilege policy, production release, etc.).

Strict revocation timelines; retained post-role access is a custody failure per se.

Explicit rejection of process/safe-harbor defenses: voluntary frameworks, certifications, or internal protocols do not shield an operator if a causal custody defect is proven. Liability remains inside ordinary negligence and recklessness standards; no new criminal offenses.
Scoped custody testing (internal or external depending on privilege thresholds or prior failures), scored by a Privilege Exposure Index (\text{PEI} = \frac{P \times W}{C \times L}) (privilege level × exposure window ÷ colluders × log quality), with automatic fails for critical defects such as unrevoked high-privilege credentials or single-signature high-impact actions.

Open-weight publication as a clean exit from weight-custody duties for those published weights (remaining duties apply only to private checkpoints and production credentials).

Equal application to public- and private-sector custodians, a minimization principle (no added oversight whose administrative risk exceeds the operational risk it reduces), and a ban on pre-deployment licensing or conditioning market entry on unpublished or subjective evaluations.

Overlap:

 Both treat high-level compliance, public red-teaming of APIs, and perimeter narratives as inadequate proxies for real resilience. Both elevate reducing and controlling privileged access, dual or multi-person controls, auditability, and the practical realities of people with read/write rights to weights. 

RAND supplies the empirical map of why insider vectors matter; AICELA attempts to hard-code structural responses (rosters, dual control, no process defense) and attach consequences that do not depend on gatekeeper certification of “safety.”
Divergence: RAND is broader and capability-graded; it is advisory. AICELA is narrower, statutory, and deliberately limited to custody artifacts so that it cannot expand into subjective safety or licensing regimes. It accepts that a well-custodied model can still cause harm (ordinary tort law remains the remedy) and that external attackers outside the roster are out of scope.

In short, RAND diagnoses the operational gap the original essay highlights (insider access and the insufficiency of approved process metrics). AICELA is one concrete attempt to force policy attention onto verifiable custody records and dual-control mechanics rather than declarative assurances. They are complementary in diagnosis and divergent in the institutional tool each proposes.

 

Since RAND and AICELA are complementary in diagnosis, how to strengthen AICELA 

RAND’s analysis can materially strengthen AICELA while preserving its core architecture (custody artifacts over discretionary licensing, no process safe harbors, post-harm liability under ordinary tort standards, dual control, privilege roster, minimization, and public/private parity). The result is a tighter AICELA 1.1 that uses RAND’s empirical threat map and technical recommendations as objective, testable constraints rather than as a pretext for broader behavioral or pre-market regulation.

Why the fit is strong

RAND (especially the 2024 Securing AI Model Weights report and the 2026 SL3 control work) documents that insider and near-insider vectors are among the more feasible routes to weight theft or exfiltration. It recommends concrete measures that map directly onto AICELA’s existing tools:

Centralize copies of weights on a limited number of monitored systems.
Reduce the number of people with access.
Harden interfaces against exfiltration.
Implement insider-threat programs.
Use defense-in-depth and confidential computing.

Conduct adversarial testing that simulates relevant threat actors.
AICELA already targets the same residual risk (privileged access to non-public weights and production credentials) through roster, dual authorization, rapid revocation, automatic fails for single-signature high-impact actions or lingering credentials, and the Privilege Exposure Index (PEI). RAND supplies the threat-model detail and specific control types that make those duties more precise and harder to game.

Concrete upgrades for AICELA 1.1
These can be added without expanding scope into model outputs, prohibited uses, or pre-deployment licensing:
Threat-informed testing scenarios
Explicitly require the scoped custody test (Section 5) to evaluate a defined subset of high-feasibility vectors drawn from RAND’s 38 (credential compromise, interface exfiltration, unauthorized physical or logical access by authorized holders, log manipulation). Automatic fails remain for the critical cases already listed; PEI scoring incorporates the additional scenarios.

Testable technical controls as artifacts
Treat the following as measurable custody elements that affect PEI or trigger conditional/automatic failure:
Number and location of weight copies (centralization).

Use of confidential computing for weight handling/inference where weights leave a tightly controlled environment.
Interface hardening metrics (exfiltration resistance under the test scenarios).
Existence of an insider-threat program that produces auditable artifacts (e.g., access reviews, anomalous-access alerts) rather than mere policy statements.
These stay inside the minimization principle: they are required only to the extent they reduce operational exposure more than they increase administrative surface.

Graduated rigor keyed to privilege concentration

Retain AICELA’s existing threshold (e.g., five or more holders at privilege level 7+) for external testing. Layer a RAND-style security-level concept only as a testing intensity or control baseline for operators above that threshold, not as a licensing gate or capability classification of the model itself. Smaller operators continue with internal dual-controlled tests against the same metrics.

PEI refinements

Keep the existing formula (\text{PEI} = \frac{P \times W}{C \times L}) and automatic fails. Optionally add parallel scoring factors or scenario weights for copy proliferation, detection latency, and interface hardness so the index better reflects RAND’s feasibility findings without becoming a subjective “safety” score.

Findings and justification

A short findings clause can cite the documented feasibility of insider and near-insider routes (RAND) to ground the statutory duties. This supplies the empirical anchor without importing RAND’s full voluntary playbook or any pre-market authority.

Open-weight and public-sector continuity
The clean exit for published open weights and equal duties for public custodians remain unchanged. RAND’s recommendations apply to retained non-public checkpoints and production privileges in both sectors.

Net effect

AICELA 1.1 would remain a narrow, anti-discretionary custody statute. It would simply make the existing roster, dual-control, revocation, testing, and PEI machinery more tightly calibrated to the concrete attack vectors and controls RAND has shown are feasible and material. The liability rule stays the same: a proven causal custody defect defeats a process defense under ordinary negligence/recklessness standards; it does not itself prove causation or damages, and it creates no new criminal offenses.

This is a strengthening that is compatible with AICELA’s theory of regulation rather than a shift toward the discretionary frameworks it was written to counter.