Cybersecurity Policy Report, Private Sector Clamors for Reinstatement of Legal Protections for Cyber Threat Info-Sharing, (Oct 17, 2025)

By Tom Leithauser

Amid warnings that some private-sector organizations have become reluctant to report cyber attacks to the federal government, Sen. Gary Peters (D., Mich.) has published a list of 102 organizations that support the reinstatement of legal protections for voluntary sharing of cyber threat information.

The list and written endorsements from 23 organizations are an effort to pressure Congress to pass cyber threat information-sharing legislation introduced by Sen. Peters, ranking member of the Senate Homeland Security and Governmental Affairs Committee.

The Protecting America from Cyber Threats Act (S 2983), co-sponsored by Sen. Mike Rounds (R., S.D.), would reinstate legal protections that were enacted in 2015 to encourage private-sector organizations to share cyber threat information among themselves and with the federal government (CPR, Oct. 9).

Those protections lapsed on Sept. 30 when the Cybersecurity Information Sharing Act of 2015 (CISA 2015) expired, leading to uncertainty by some businesses about whether they might face repercussions if they reported cyber attacks to the government.

“Companies are currently reviewing how to change their practices now that the law has expired, and we only have a short window to reauthorize the law to avoid serious risks to our critical infrastructure and national security,” said Ari Schwartz, executive director of the Cybersecurity Coalition.

CISA 2015 “has been one of, if not the, most important laws for the members of the Cybersecurity Coalition to help us protect our customers by allowing us to proactively share timely information for critical cybersecurity purposes without need for extensive legal review,” Mr. Schwartz noted.

“Reauthorizing the Cybersecurity Information Sharing Act is critical to defending the nation’s infrastructure, economy, and security from increasingly sophisticated digital threats,” said Cory Gardner, president and chief executive officer of NCTA.

“Reauthorization ensures that our federal agencies, particularly those tasked with cyber defense, have the tools, authority, and resources they need to protect critical infrastructure, share threat intelligence, and respond quickly and effectively to emerging threats,” Mr. Gardner added.

The legal protections that would be reinstated by S 2983 include “liability shields, antitrust exemptions, and defenses against regulatory misuse or public disclosure, enabling businesses to share data without risking lawsuits or competitive disadvantages,” according to Chris Mohr, president of the Software & Information Industry Association.

“Without these protections,” said Frank Ciluffo, director of the McCrary Institute for Cyber and Critical Infrastructure Security, “the federal government has reduced insight into the latest cyber threats and vulnerabilities persistently targeting America’s critical infrastructure, and, in turn, is less able to provide threat analysis and protection to state, local, tribal, territorial, and private sector partners.”

“Small businesses need the protections of this program to safely share information regarding cyberattacks, cybersecurity incidents, and cybersecurity best practices with each other without fear of antitrust violations,” said Morgan Reed, president of ACT, a trade group for app developers.

The testimonials and list of supporters—which also includes CTIA, the Information Technology Industry Council, NTCA, and USTelecom—might be aimed at one person, Sen. Rand Paul (R., Ky.), chairman of the Senate Homeland Security and Governmental Affairs Committee.

Sen. Paul has blocked attempts to win Senate passage of legislation to reinstate the liability protections of CISA 2015 seven times since late September, most recently yesterday, when Sen. Elissa Slotkin (D., Mich.) sought unanimous consent to adopt S 2983. Her request was met with an “I object” from Sen. Paul.

Sen. Paul didn’t explain his objection yesterday, but he has sought to tie CISA 2015 reauthorization to legislation that would prohibit federal agencies from engaging in efforts to flag online mis- and disinformation (CPR, Sept. 16).

MainStory: TopStory FederalLegislation DataSecurity