US Business Groups Push for 10-Year Renewal of Cyber Threat Sharing Law

Thirty-five business groups, led by Business Roundtable and including the Chamber of Commerce, have written to the leaders of the US House and Senate Armed Services committees. They want a 10-year renewal of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) included in the fiscal year 2027 National Defense Authorization Act. The law gives legal protections for sharing threat data between government and private companies, and between companies themselves.

The law's original 10-year term ended last year, and Congress has since used a mix of short-term renewals and lapses. It is now due to expire again on 11 December. The groups argue that advanced AI systems can find and exploit software weaknesses at machine speed, shrinking the time between discovery of a flaw and an attack. They also say AI is making sophisticated cyber capabilities cheaper and easier to use, so the speed of information sharing depends on the legal certainty the law provides.

The House version of the defense bill includes a 10-year extension, but the Senate version does not. Past attempts have met objections from Senate Homeland Security and Governmental Affairs Chairman Rand Paul. He has tied his support to provisions limiting past practices at the Cybersecurity and Infrastructure Security Agency, which he maintains threaten free speech. This is a US debate, but it shows how much weight industry places on shared threat intelligence.