AI
The Ethics Obligation Security Professionals Miss
ISC2 requires CISSP and CCSP holders to uphold four ethical canons. Two of them use the word “protect.” The first canon names a specific target: society, the common good, and necessary public trust in infrastructure. Tony pointed out that most security work focuses on the organization writing the paycheck, not the public. ISC2 disagrees. Merriam-Webster defines protect as shielding from injury, damage, or destruction. By that definition, a security professional’s obligation extends past the server room to the communities where infrastructure is physically built.
AI’s Energy and Water Footprint
A 2023 study projected that data centers collectively would consume as much electricity as France by 2030. That estimate is already behind: AI grew faster than the model assumed. One chart compared energy per query. A Google search costs roughly one unit. A ChatGPT conversation costs ten. Multiply that 10x gap across millions of daily users and the cumulative load becomes visible. A 2024 estimate put AI’s water demand at half the United Kingdom’s total by 2027.
Arizona’s Water Under Strain
The Colorado River’s water level has been declining for years. Arizona is already in shortage. Google’s Phoenix-area data centers use about 4 million gallons of water per day, equivalent to roughly 27,000 residents. TSMC expanded in Phoenix with chip fabrication plants that consume large volumes for manufacturing and cooling. Intel is also drawing from the same supply. One proposed workaround, diverting water from the Mississippi River, isn’t viable: Tennessee and Mississippi already compete for that source. The local option is water recycling and harvesting, but no mandate forces companies to use it.
What Responsible Infrastructure Looks Like
Microsoft shifted to closed-loop cooling across its data centers, cutting net water consumption to zero. The company set a carbon-neutral goal for 2030. Cyrus One uses only 180,000 gallons per year for humidification; all new facilities since 2024 use zero water for cooling. Iron Mountain’s data center in Boyers, Pennsylvania, sits 200 feet underground. It draws from a private lake, filters the water through a heat exchanger, then returns it to the lake. The site became the first underground facility to earn an Energy Star certification.
XAI Memphis: Gas Turbines and No Permits
XAI built its first data center in Memphis in June 2024, near a neighborhood called Boxtown. The facility ran 35 gas turbines to supplement electricity from Memphis Light, Gas, and Water. None of those turbines had permits. Residents reported new respiratory illnesses. One woman documented her asthma developing after the turbines went online. The company requested 150 megawatts from the Tennessee Valley Authority, enough to power more than 100,000 homes. The NAACP filed a Clean Air Act lawsuit. That case is still active.
AI Governance Recommendations
Tony’s recommendations start with a basic ask: inventory every AI component in your organization, then build governance around what you find. Identify risks, define policies, and set up cross-functional committees so more voices reach the decision. Rightsize AI for actual business needs. When choosing AI vendors, check their environmental record and track emissions from your own programs. Build community feedback loops into major infrastructure decisions. If your organization is causing harm and you have a seat at the table, use it. Someone needs the ability to shut a system down when it goes wrong.
Q&A
Is XAI using recycled water at its Memphis facility? XAI planned a water recycling system but hadn’t built it; with the facility rushed to launch, the company tapped Memphis’s aquifer, draining drinking water from residents. ▶ 36:57
How many local jobs has XAI created, and how is it solving its gas supply problem? Fewer than 100 positions, with roughly half relocated from other states and local salaries of $60,000 to $70,000; XAI recently purchased a Mississippi power facility to pipe electricity across the state line and retire the gas turbines. ▶ 39:43
How can an employee speak up when company leadership won’t engage with community concerns? Start internally; if shut down, connect with community advocacy groups like the local organization that brought the NAACP into the XAI case. ▶ 41:43
Notable Quotes
the energy cost someone something Joy Tony · ▶ 10:13
communities are not thriving at all. Joy Tony · ▶ 13:32
That’s federal. Elon Musk is Doge. Memphis community member · ▶ 25:42
organizations are doing harm, too. So, Joy Tony · ▶ 43:29
Key Takeaways
- XAI’s Memphis facility ran 35 unpermitted gas turbines, causing respiratory illness in Boxtown.
- A ChatGPT query uses 10x the energy of a Google search; the gap compounds at scale.
- Closed-loop cooling, used by Microsoft and Cyrus One, cuts data center water use to zero.
- ISC2 ethics require security professionals to protect society, not just the organization they serve.
About the Speaker
Joy Tony is a cybersecurity professional and advocate for ethical technology in community development, with more than 20 years of experience across nonprofit, customer services, government contracting, and transportation sectors. She is a senior program consultant at AIM for Change LLC and holds CISSP, CCSP, and SHRM-CP certifications.