Key Cyber Law’s Lapse Could Mute Threat Sharing Nationwide

A pivotal cybersecurity law is just a few dozen working congressional days from expiring, leading worried analysts to fret that the U.S. federal statute underpinning private sector information sharing could expire – or be hurriedly renewed without improvement.

The Cybersecurity Information Sharing Act of 2015, otherwise known as CISA 2015 and not to be confused with the nation’s cyber agency, expires Sept. 30. The law has broad bipartisan backing, strong support from the private sector and the chair of the House committee handling its renewal has called reauthorizing it “a top priority this year.”

That doesn’t mean the law is perfect – far from it, according to public sector cybersecurity and information sharing analysts. They say it needs to be updated with stronger definitions, expanded liability protections and clearer guidance to improve defenses amid evolving threats. But the countdown is on for the Congress to land on a bill that can clear markup and survive any procedural snags, negotiation setbacks or scheduling delays before it expires, which experts warn could severely damage the government’s visibility into critical infrastructure and weaken public-private sharing agreements.

Of the 99 calendar days that extending from today through the end of September, the House is set to meet on just 27 of them, the Senate on 37 days. During that time, Congress must also approve spending bills to keep the federal government open and grapple with the “One Beautiful Bill Act” reconciliation proposal from the Trump administration. Time is tight.

The biggest short-term impact of a lapse in CISA 2015 would be that many private sector entities would need to reassess the legal basis for information sharing agreements formed over the past decade, said Ari Schwartz, executive director of the Center for Cybersecurity Policy. Many organizations rely heavily on the law, and in its absence, may need to halt sharing until new agreements are drafted – some of which would likely restrict the scope of what can be shared going forward.

“Some of these entities will have to stop sharing information altogether,” said Schwartz, a former top cybersecurity official in the Obama White House. “This outcome will clearly make us less secure.”

CISA 2015’s liability protections, privacy safeguards and centralized reporting mechanisms helped improve information sharing over the past decade by reducing legal risk and formalizing a framework for real-time collaboration. But cybersecurity hasn’t stood still for a decade. Technology policy and cybersecurity experts have called for modernizing key definitions, expanding liability protections and strengthening legal safe harbors during a recent House Homeland Security cyber subcommittee hearing focused on how well the law still serves the private sector.

Panelists pointed to outdated language that limits the law’s usefulness in addressing emerging threats like artificial intelligence manipulation, pre-deployment software tampering and attacks on nontraditional targets like operational technology and Internet of Things devices.

Congress should “expand and clarify liability protections to encourage broader information sharing” between the public and private sectors, said Diane Rinaldo, a former House staffer who helped draft the original 2015 law. John Miller, senior vice president of policy for trust, data and technology at the Information Technology Industry Council, urged lawmakers to update key definitions like “cyber threat indicator” and “cybersecurity threat” to better reflect modern risks, including attacks on machine-learning models, corrupted software supply chains and nontraditional devices like IoT and OT systems.

Should the cyber subcommittee opt for a full overhaul of the bill, reauthorization could stall amid several potential roadblocks, including efforts to bundle in AI and supply chain updates that may complicate voting, as well as objections from privacy advocates, floor scheduling hurdles and other procedural delays. Lawmakers may resist a clean renewal if the bill lacks updated safeguards needed to strengthen cross-sector information sharing.

A lapse could be further compounded by recent cuts to cybersecurity teams across the public sector, a severe cyber talent gap and further disruptions to federal information sharing collaborations.

If the law lapses, it could create widespread uncertainty around how organizations share cyber threat data and significantly raise the legal and logistical burdens tied to that sharing, said Michael Daniel, president and CEO of the Cyber Threat Alliance.

“We could potentially lose the ability for information about major threat actors to be shared across the ecosystem in a timely manner because companies become overly cautious,” said Daniel.