Skip to content
This is NOT an official site of the City of New York. Click here for official AI reports.

NYC Office of Technology and Innovation

NYC - DTPR AI Register

Back to your search

AI-Powered Cybersecurity Threat Detection for City Infrastructure

What it is for

Safety & Security
  • The system identifies potential cybersecurity threats across DEP's digital environment, prioritizes investigations, and supports effective incident response.
Risk Assessment & Triage
  • The tool scores and prioritizes cybersecurity risks, flagging unusual activity for human investigators to review and act upon.
Run by
Department of Environmental Protection (DEP)
Where
No fixed location
Kept
Not stated by the NYC Office of Technology and Innovation.
Shared with
Accountable organization
Your copy
You cannot see the data it holds about you. What you can do

What it is for

Safety & SecurityRisk Assessment & Triage

This system uses artificial intelligence to analyze computer and network activity logs at the NYC Department of Environmental Protection, flagging unusual patterns that may indicate cybersecurity threats. It produces risk scores, alerts, and recommended actions to help security staff prioritize and respond to potential incidents. The system handles DEP staff user IDs and machine information both as inputs and in its outputs. The vendor and specific tool details are not disclosed publicly to avoid aiding malicious actors.

What it collects and what happens to it

Data taken in

About behaviour
Pseudonymous data
  • Computer and network logs recording actions taken by DEP systems and staff, including user IDs and machine identifiers. User IDs link activity to individuals but do not directly expose legal names in the log data.
Sensitive personal information
Pseudonymous data
  • DEP staff user IDs and computer information are included in the input data, enabling the system to associate network activity with specific accounts.

Processing

Classification & Prediction
  • The system applies classification algorithms to network and log data to label activity as normal or potentially threatening, and to assign risk scores to detected events.
Anomaly Detection
  • The system identifies unusual or anomalous network patterns that deviate from a learned baseline of normal DEP infrastructure behavior, surfacing these as potential cybersecurity risks.

What it does

Deciding (Analytical AI)
Human decides
  • The system classifies and scores network and computer log data to identify potential threats, producing ranked risk alerts. Human security staff review and decide how to respond — the system is described as monitored, not autonomous.

Outputs

A recommendation or prediction
Anonymized data
  • The system outputs risk scores, unusual network patterns, alerts about potential cybersecurity issues, and recommended actions for security staff. These are advisory outputs reviewed by human investigators.
Sensitive personal information
Pseudonymous data
  • Output data includes DEP staff user IDs and computer information associated with flagged activity, allowing security staff to identify which account or machine is linked to a potential threat.

Run by

Department of Environmental Protection (DEP)
  • DEP deploys and operates this AI cybersecurity tool through its Bureau of Business Information Technology to monitor and protect its digital infrastructure.

NYC Algorithmic Tools Compliance Report — AI Cybersecurity Tool (DEP)

Built by

Undisclosed Cybersecurity Vendor
  • The vendor name and details are not publicly disclosed due to cybersecurity concerns and to prevent exposing information that could assist malicious actors. The relationship is a procurement or paid pilot arrangement.

NYC Algorithmic Tools Compliance Report — AI Cybersecurity Tool (DEP)

Kept for

Not stated by the NYC Office of Technology and Innovation.

Shared with

Available to the accountable organization
  • Alerts, risk scores, and output data are available to DEP's Bureau of Business Information Technology and cybersecurity staff for operational response purposes.
Not available to me
  • Individual staff members and members of the public do not have access to the outputs of this system, including any risk scores or alerts associated with their accounts or activity.

Stored

Not stated by the NYC Office of Technology and Innovation.

How to read the colours

Can it identify you?

Anonymized data
Data about people with the link to who is broken. Stripped of identifiers, blurred, aggregated, or noised so this system can’t reasonably tie a record back to an individual.
Pseudonymous data
Each person’s data is tied to a token (hash, ID, template) that lets this system recognise the same person across events, but the token itself doesn’t reveal a name. Reidentification is possible with extra information.
Identifiable data
The data either contains a direct identifier (name, address, account name, recognisable face or voice, plate number) or carries a token this system uses to look up legal identity during processing.

Who completes the loop?

Human decides
This mode suggests; a person decides what to do next. The AI is always advisory — a human is in the loop on every decision. Example: a triage tool ranks cases for a clinician who chooses which to see first.
Human executes
This mode decides; a person carries out the result. Example: an optimizer plans the day’s trash-collection routes, and drivers run them.
Autonomous
This mode decides and acts on its own. No person reviews each decision or carries out the resulting action.

Definitions from the DTPR standard. Amber is about your data, violet about who decides. The fuller the shape and the deeper the colour, the more identifying the data or the less a person is involved.

What you can do

Ask about this system

Questions go to the NYC Office of Technology and Innovation, not the vendor.

Your rights

  • Right to Be Informed of AI UseDEP staff whose activity is monitored by this system are entitled to know that an AI-powered cybersecurity tool is in use within the agency. This public register entry constitutes notice of its operation.
  • Right to Algorithmic TransparencyThe general nature of this system — AI-based classification and anomaly detection for cybersecurity — is disclosed in the NYC Algorithmic Tools Compliance Report. Specific vendor and technical details are withheld for security reasons.

Risks and safeguards

  • Civil liberties harmThe system processes DEP staff user IDs and computer information in both inputs and outputs, creating a risk of internal staff surveillance that could affect civil liberties or workplace rights.Safeguard: the system operates under a monitored (human-in-the-loop) autonomy model, meaning human reviewers assess alerts before action is taken. Use is scoped to cybersecurity threat detection within DEP's infrastructure.
  • Reputational harmThe system could incorrectly flag a staff member's activity as a cybersecurity threat, causing reputational or professional harm.Safeguard: the monitored autonomy model requires human security staff to review alerts before any consequential action, reducing but not eliminating the risk of erroneous flagging.