Loading story…
Congress is facing challenges in passing a long-term renewal of the Cybersecurity Information Sharing Act of 2015, a foundational law that provides legal protections for companies sharing cyber threat data with the federal government and each other. House Homeland Security Chairman Andrew Garbarino has emphasized the importance of renewing the act, which recently received a short-term extension after lapsing in October, but faces opposition from various factions in both the House and Senate. Disagreements center on whether to pass a 'clean' 10-year reauthorization or to introduce changes addressing concerns about the Cybersecurity and Infrastructure Security Agency (CISA) and free speech protections.
The ongoing debate has led to uncertainty about the future of the law, with the possibility of another short-term extension being considered as negotiations continue. Garbarino has also called for the Senate to renew a cyber grant program for state and local governments and highlighted the need for a comprehensive national cyber strategy. The legislative impasse reflects broader divisions in Congress over the direction of federal cybersecurity policy and the role of CISA in protecting critical infrastructure and managing information sharing.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Lawmakers highlighted upcoming hearings on AI and cybersecurity after reports that Chinese hackers used Anthropic's Claude Code tool in global cyberattacks. Garbarino described the case as the first reported fully automated digital assault and said AI would be central to future cyber defense discussions.
House Homeland Security Committee Chairman Andrew Garbarino said political divisions were complicating a long-term renewal of the 2015 Cybersecurity Information Sharing Act. He indicated Congress would likely need another short-term extension while competing proposals remained unresolved.
The House Homeland Security Committee continued efforts to obtain more information about the federal response to the Chinese state-backed hacking groups Salt Typhoon and Volt Typhoon. The committee also worked with the House China Select Committee on possible legislative responses to Chinese cyber threats.
Congress put in place a short-term extension of the Cybersecurity Information Sharing Act rather than completing a long-term reauthorization. The extension was set to run through January 30 alongside government funding.
After the Salt Typhoon breach of telecommunications networks, the Federal Communications Commission enacted cybersecurity rules in response. Those rules later became a point of criticism when some were rolled back.
The Cybersecurity Information Sharing Act of 2015 was enacted, creating legal protections for companies that share cyber threat information with the government. Its scheduled expiration later became the focus of reauthorization efforts in Congress.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. senators are pushing for a 10-year extension of the Cybersecurity Information Sharing Act of 2015 (CISA 2015), which was temporarily extended after the recent government shutdown but is set to expire at the end of January. Lawmakers argue that allowing the law to lapse would hinder the ability of companies and government agencies to share cyber threat data without legal risk, potentially undermining national cybersecurity efforts. Senators Mike Rounds and Gary Peters, who are sponsoring the reauthorization bill, emphasize that the law is crucial for enabling collaborative vulnerability hunting and patching, especially during 'hunt forward' missions conducted by U.S. Cyber Command. The proposed extension would maintain the law's current provisions, with only a name change, and is supported by the administration. However, the path to permanent reauthorization remains uncertain, raising concerns about the continuity of legal protections for cyber threat information sharing.
Jul 12, 2026A temporary funding bill will extend the 2015 Cybersecurity Information Sharing Act (CISA) and the State and Local Cybersecurity Grant Program until November 21, 2025. Lawmakers are using the extension to reconcile differences between House and Senate versions of long-term renewals, with debates centering on liability protections and extension duration. Industry and federal officials stress the importance of these laws for threat intelligence sharing and critical infrastructure protection.
Jun 29, 2026
Senator Gary Peters has introduced new legislation aimed at extending and renaming the expired Cybersecurity Information Sharing Act of 2015 (CISA), which lapsed following a government shutdown on October 1, 2025. The expiration of CISA has left a gap in liability protections for private sector organizations that share cyber threat information with the federal government, a key feature that had encouraged robust information exchange since the law's enactment in 2015. Peters' new bill, the Protecting America from Cyber Threats (PACT) Act, seeks to extend these protections for another ten years and includes retroactive provisions to cover the period during which the law was inactive. Industry groups and cybersecurity professionals have emphasized the critical importance of these liability protections, often citing CISA as one of the most effective pieces of cyber legislation ever passed. The lapse in CISA's authority has created uncertainty for organizations that continue to share threat data, raising concerns about potential legal exposure. The legislative process to renew CISA has been complicated by political gridlock, with both the Senate and House advancing competing funding bills and short-term extensions that ultimately failed, leading to the shutdown. Peters has engaged in direct discussions with Senate leadership, including Majority Leader John Thune, to advocate for a swift renewal. The new bill also addresses confusion among lawmakers who conflate the CISA law with the Cybersecurity and Infrastructure Security Agency, clarifying that the legislation pertains to information sharing, not agency reauthorization. The expiration of CISA has also impacted related programs, such as the State and Local Cybersecurity Grant Program, which similarly lost authorization during the shutdown. The Department of Homeland Security's Automated Indicator Sharing (AIS) system, which had served as the central hub for threat intelligence exchange under CISA, now operates without the legal framework that previously governed its activities. Peters and his colleagues have repeatedly sought unanimous consent in the Senate to pass a clean extension of the law, but partisan disagreements have stalled progress. The proposed PACT Act aims to reassure private entities that any information shared during the lapse will be protected from liability, thereby maintaining the flow of critical threat intelligence. The ongoing debate underscores the importance of real-time cyber threat information sharing in defending against persistent and evolving cyberattacks. As Congress continues to negotiate, the cybersecurity community remains concerned about the potential chilling effect on information sharing and the broader implications for national cyber defense. The outcome of these legislative efforts will determine whether the United States can sustain the collaborative public-private partnerships that have become central to its cybersecurity strategy.
Jun 29, 2026