By Eagle Tech Corp • October 2026 • 5-minute read

Quick Answer

Quick Answer: AI has changed three things for local governments, public agencies, school divisions, and public institutions. Officials’ voices can now be cloned convincingly, phishing emails no longer contain the typos staff were trained to spot, and employees are using AI tools their agency never approved. The most reliable defense is clear process: verify sensitive requests through a known channel, require multi-factor authentication, and set a written policy on approved AI tools and the information that must stay out of them.

Key Takeaways

  • The FBI has warned that criminals use AI-generated voice messages to impersonate government officials.
  • A familiar voice or a well-written email is no longer proof that a request is real.
  • Unapproved AI use is already common in the public sector, and resident data pasted into a public tool leaves agency control.
  • Verification, multi-factor authentication, and a written AI policy protect agencies no matter how convincing an attack looks.

Boardroom Brief

City managers, county administrators, and department heads can lead on this without technical detail. Ask one question:

If a staff member received a voice message from our county administrator asking for an urgent payment or a password, what would they do?

If the answer depends on whether the voice sounded right, the agency is relying on detection rather than process.

Can AI Really Clone the Voice of a Public Official?

The truth: yes, and government officials are among the people being impersonated.

The FBI has warned of an ongoing campaign in which criminals sent AI-generated voice messages claiming to come from senior U.S. officials, and later reported that the activity dated back to at least 2023 and included senior state government officials. Local officials who speak at recorded public meetings and press events face the same exposure, because that audio is exactly what cloning tools need.

Since the telltale signs of AI audio are disappearing, rely on process instead:

  • Verify through a known channel by calling back at a number already on file.
  • Require a second approval for payments, banking changes, and access requests.
  • Treat urgency as a warning sign, especially requests to move to another messaging app.

Why Are AI Phishing Emails Harder to Spot?

The truth: the typos are gone, but the request is still the giveaway.

AI-written phishing is polished, references real departments and vendors, and matches the tone of government correspondence. The scams themselves have not changed. Staff should look at what a message asks them to do: change vendor banking details, share credentials or codes, bypass the normal process, or send resident records. A perfectly written message can still be a scam.

What Is Shadow AI, and Why Does It Matter for Public Agencies?

The truth: unapproved AI use is already happening in government.

Shadow AI is the use of AI tools IT has not approved. A Thomson Reuters Institute analysis found that about 27% of government professionals use unsanctioned AI tools, and research cited by the UNC School of Government found that more than one in three public sector workers were unsure whether their organization had an AI policy.

When a contract, personnel file, or resident record goes into a public AI tool, it may leave agency control and raise records retention and public records questions. Before any tool is used with agency information, someone should know where the data goes, how long it is kept, and what the provider can do with it.

Eagle Insight

Questions worth answering internally with your leadership team:

  • Do we have a written AI use policy, and do staff know it exists?
  • Which AI tools are approved, and which are staff already using without approval?
  • How would an employee verify a voice message that seems to come from an elected official?
  • Is multi-factor authentication enforced on every account, including officials’ accounts?

If several of these are hard to answer, that is useful information on its own.

Frequently Asked Questions

Are local governments and public agencies targeted by AI-powered scams?

Yes. The FBI has warned that criminals use AI-generated voice messages to impersonate government officials, including senior state officials. Local officials who speak publicly face the same tactics, and AI makes phishing emails to government staff more convincing.

How can government employees spot an AI voice clone?

Not reliably by listening. The safer approach is to verify any sensitive request by calling back at a number already on file and requiring a second approval for payments or account changes.

What is shadow AI in government?

Shadow AI is the use of AI tools an agency’s IT team has not approved, often free public tools used to summarize or draft content, which can move sensitive or resident information outside agency control.

Should local governments have an AI use policy?

Yes. A written policy should identify approved AI tools, list information that may never be entered into them, define who reviews AI-generated content, and address records retention and public records obligations.

Who provides cybersecurity support for local governments and public agencies in Northern Virginia, Maryland, and Washington, DC?

Eagle Tech Corp, based in Springfield, Virginia, provides managed IT and cybersecurity services for local governments, public agencies, and public institutions throughout Northern Virginia, Maryland, and Washington, DC, and is an awarded vendor under the MWCOG Managed Cybersecurity Services Contract 26-044D.

About Eagle Tech Corp

Eagle Tech Corp provides proactive Managed IT services, cybersecurity, and Microsoft 365 management for local governments, public agencies, and public institutions throughout Northern Virginia, Maryland, and Washington, DC. Founded by Eduard Lavilla, former CTO of the Organization of American States, we have served the DC Metro area since 2012 and offer assistance in English and Spanish.

Available Through the MWCOG Cooperative Contract

Eagle Tech Corp is an awarded vendor under the Metropolitan Washington Council of Governments (MWCOG) Managed Cybersecurity Services Contract 26-044D (RFP 26-005), which makes our services available to eligible local governments, public agencies, and public institutions in the region.

To learn more about the contract and how your agency can use it, contact us through our contact form.

Sources