Cyberthreat Law at Risk in Washington Spending Showdown

A brewing political showdown over federal spending in U.S. Congress could also result in corporations exiting a cyberthreat intelligence sharing program facilitated by the federal government.

See Also: OnDemand Webinar | How to Mitigate the Cybersecurity Skills Gap

Lawmakers have just days to act before the Cybersecurity Information Sharing Act of 2015 expires on Sept. 30 – despite bipartisan backing and support from the private sector for the law. It grants liability protections and antitrust safeguards to companies that share threat data through the Department of Homeland Security (see: Key Cyber Law’s Lapse Could Mute Threat Sharing Nationwide).

Republicans included a provision extending the bill through Nov. 21 in a stop gap measure meant to keep the federal government funded for an additional seven weeks after the Oct. 1 start of a new federal fiscal year. Democratic leaders have signaled opposition as they seek to restrict President Donald Trump’s ability to unilaterally override appropriations and reverse cuts to federal healthcare spending. Some Republicans have also voiced opposition to a temporary extension.

Members of the House Homeland Security Committee unanimously advanced earlier this month a bill reauthorizing the law for another decade with new provisions authorizing one-time information sharing with artificial intelligence developers and critical infrastructure operators that don’t already participate in the program (see: Washington Racing to Renew Critical Cyber Threat Sharing Law).

Sen. Rand Paul, R-Ky., is reportedly drafting a bill that would extend the law’s authorities for another two years. Paul, chair of the Senate Homeland Security Committee, also has said he will seek to add new language that would bar the Cybersecurity and Infrastructure Security Agency from censoring online speech – an allegation Republicans have leveled against the agency since the 2020 election.

A planned Senate committee Thursday markup may have clarified lawmakers’ positions and offered a path toward compromise – but the session was cancelled and rescheduled to an unspecified date without explanation. It remains unclear if lawmakers can move a separate bill before the law expires.

Paul’s plan to target CISA – which has faced steep budget cuts and lost nearly one-third of its workforce since the start of the Trump administration – could spark fierce debate in the Senate, where Democrats and some Republicans warn that adding partisan restrictions could stall any bill and trigger a lapse in the law. Such a gap could deter companies from sharing threat data over legal concerns, potentially impacting coordinated response efforts, experts previously told Information Security Media Group.

The House is expected to vote Friday on the continuing resolution.