Cyber Security Act Sunsets Under Shadow of Government Shutdown
Last night the Cybersecurity Information Sharing Act expired, 10 years after its passage, which mandated congressional reauthorization for its continuation no later than Sept. 30, 2025.
The moment has left many cybersecurity experts reeling.
The act provided authorization as well as legal safeguards for companies to share data with the federal government and with other entities. Those who operated under the provisions of the Act now find themselves at sea when it comes to what information they are allowed to share with the government and under what conditions. As renowned cybersecurity expert Michael Daniel argued this summer, should expiration of the Act occur, “the U.S. will take a giant step backward in its cyber defenses—an outcome that benefits no one except cyber criminals and adversaries.”
The CISA Act is not to be confused with the government’s Cyber Security and Cyber Infrastructure Agency, also known as CISA. The agency which oversees cybersecurity for the nation has been in existence since 2018, set up during President Trump’s first term. Its purpose is to protect against malicious cyber activity, including ransomware, phishing, hacking and other cyberattacks. CISA connects threat information across government offices and with private organizations and mounts countermeasures to protect the country. An important part of its mission is to protect critical infrastructure.
Yet the message being sent to both CISA the act and CISA the agency is one and the same: These cyber protections are apparently no longer considered a high priority in the country’s national security framework. While the act is expiring, a government shutdown will mean that CISA will be severely compromised. Its staff, already reduced, is expected to furlough 65 percent of its employees. The Big Beautiful Bill diverted $144 million from CISA to Immigration and Customs Enforcement, or ICE—a reduction in funding that was but a fourth of what Trump had called for.
(CISA’s workforce “more than doubled” during the Biden years, with its budget swelling to $3 billion and, under Director Jen Easterly, its mission of integrating information, coordinating cyber defenders, and developing strategies to reduce risk to critical infrastructure took on an enhanced energy, clarity and impact.)
Defenses Down
As the warnings about generative AI, election interference, and threats to critical infrastructure and more proliferate, the authorities, funding and staffing to identify and deter attackers are diminishing before our very eyes. And that is the reality even before the government shutdown.
Who or what’s responsible? Sen. Rand Paul (R-Ky.), who chairs the Senate Homeland Security Committee, blocked scheduled votes on a renewal while he drafted alternative legislation with “provisions to curtail DHS’s activities related to foreign disinformation,” according to the Security Review Daily, which called his actions “a move that diverges from the act’s cybersecurity focus and raises concerns about mission creep and politicization.” Other senators cricized his action as “out of sync with bipartisan efforts and potentially harmful to national security.” Bottom line: the renewal effort has died, and the government shutdown may well push off a solution for months, at the very least.###
SpyTalk Contributing Editor and podcast co-host Karen J. Greenberg is a Future Security Fellow at New America and author of Subtle Tools: The Dismantling of American Democracy from the War on Terror to Donald Trump and Rogue Justice: The Making of the Security State.
link
