Industry groups want cyber threat-sharing law renewed through defense authorization bill

Mehmet Eser/Anadolu via Getty Images

Banks, utilities, and other industries are asking lawmakers to extend liability protections through 2035.

A coalition of 35 industry groups is urging Congress to use the annual defense policy bill to renew a law that gives companies legal protections when they share information about cyber threats with the federal government.

In a Nov. 1 letter to the leaders of the House and Senate Armed Services committees, the groups asked negotiators to keep a provision in the House bill that would extend the Cybersecurity Information Sharing Act of 2015 through 2035. The law lapsed during last year’s record government shutdown and has since stayed in place through a series of spending bills. Its current extension expires Dec. 11.

The signers include the U.S. Chamber of Commerce, Business Software Alliance, American Bankers Association, Airlines for America, the American Public Power Association and the National Rural Water Association.

“In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries,” the groups wrote. “That speed depends on the legal certainty CISA 2015 provides.”

The key liability protections in the law are designed to shield firms from lawsuits and regulatory penalties when sharing threat information with federal partners like the FBI or National Security Agency. That data often includes personal or proprietary information tied to individuals and companies affected in cyber intrusions.

Industry groups have consistently warned lawmakers that allowing the measure to lapse would create legal risks for companies sharing breach data, leading to a drop in private sector threat disclosures.

On the first day of the shutdown last year, cybersecurity attorneys were already fielding calls from clients about whether their existing agreements still protected them.

Congress restored the law through January 2026, when it reopened the government in November 2025. Lawmakers extended it again in February of this year, this time through Sept. 30, then moved the deadline to December in a stopgap funding bill.

A sticking point in the Senate reauthorization process has been what else to put in a longer renewal. Sens. Gary Peters, D-Mich., and Mike Rounds, R-S.D., pushed for a 10-year extension during last year’s shutdown.

But Senate Homeland Security and Governmental Affairs Committee Chairman Rand Paul, R-Ky., told Roll Call last month that he wanted a provision barring federal officials from pressuring social media companies to restrict speech. Paul — who has routinely pushed back on clean extensions of the law — said he and Peters had discussed the amendment several times without reaching an agreement.

NEXT STORY: Financial aid for Ukraine is getting harder to find

穆罕默德·埃瑟 (Mehmet Eser)/阿纳多卢 (Anadolu)，盖蒂图片社

银行、公用事业和其他行业正在请求立法者将责任保护期延长至 2035 年。

由 35 个行业团体组成的联盟敦促国会利用年度国防政策法案来更新一项法律，该法律赋予企业在与联邦政府分享网络威胁信息时获得法律保护的权利。

在11月1日致众议院和参议院军事委员会领导人的一封信中，这些团体要求谈判代表保留众议院法案中的一项条款，该条款将2015年《网络安全信息共享法案》的有效期延长至2035年。该法案在去年创纪录的政府停摆期间失效，此后通过一系列支出法案得以继续有效。其目前的延期将于12月11日到期。

签署者包括美国商会、商业软件联盟、美国银行家协会、美国航空协会、美国公共电力协会和国家农村水务协会。

这些团体写道：“在这种环境下，防御者共享信息的速度和广度决定了他们能否跟上对手的步伐。而这种速度取决于《2015年网络安全和基础设施安全法案》（CISA 2015）提供的法律确定性。”

该法律中的关键责任保护条款旨在保护企业在与联邦合作伙伴（例如联邦调查局或国家安全局）共享威胁信息时免于诉讼和监管处罚。这些数据通常包含与受网络入侵影响的个人和公司相关的个人信息或专有信息。

行业团体一直警告立法者，如果允许该措施失效，将会给共享泄露数据的公司带来法律风险，导致私营部门威胁披露减少。

去年政府停摆的第一天，网络安全律师就接到了客户的电话，询问他们现有的协议是否仍然能保护他们。

国会于 2025 年 11 月重新开放政府时，恢复了该法律的有效期至 2026 年 1 月。今年 2 月，立法者再次延长了该法律的有效期，这次延长至 9 月 30 日，然后在一项临时拨款法案中将截止日期推迟至 12 月。

参议院重新授权程序中的一个症结在于，在延长的续期中加入哪些其他内容。去年政府停摆期间，密歇根州民主党参议员加里·彼得斯和南达科他州共和党参议员迈克·朗兹力主将授权期限延长10年。

但参议院国土安全与政府事务委员会主席、肯塔基州共和党参议员兰德·保罗上个月告诉《点名》杂志，他希望加入一项条款，禁止联邦官员向社交媒体公司施压，要求其限制言论自由。保罗——他一直以来都反对对该法律进行彻底的延期——表示，他和彼得斯曾多次讨论过这项修正案，但始终未能达成一致。

下一篇报道：对乌克兰的财政援助越来越难找