How the lapse of a 2015 law put counsel in the threat-sharing loop

The week

Federal appropriations lapsed at midnight on September 30, 2025, and a government shutdown began on October 1. The same night, the Cybersecurity Information Sharing Act of 2015 expired without reauthorization. A House-passed continuing resolution would have extended it, but the Senate did not pass that bill, and Senate committee action on a separate reauthorization was postponed. The act had given companies liability protection for monitoring their systems and sharing threat indicators in good faith. It also provided an antitrust exemption for sharing among competitors, exemption from public disclosure laws for information given to the government, and limits on regulators’ use of shared information. Law firms advised clients that protections still covered sharing completed before the lapse, but not new exchanges. Under DHS’s lapse plan, CISA kept excepted work running with much of its staff furloughed.

Threat sharing is mostly routine work. An analyst sees a malicious domain, a phishing lure or an exploit pattern and posts it to an information sharing and analysis center, a vendor community or a government portal. For a decade the 2015 act made that a technical judgment. As long as the analyst stripped irrelevant personal information and shared for a cybersecurity purpose, the organization had statutory cover. When the act lapsed, the same post raised questions about liability, antitrust and disclosure that an analyst cannot answer. Earlier in this series we looked at how agencies depend on federal continuity during funding fights. This article looks at the sharing workflow itself, in three parts: what the analyst used to decide alone, what changed in each sharing channel, and how to make sharing decisions survive the next lapse.

What the analyst used to decide alone

In most security operations centers, sharing rules are informal. Indicators of compromise go out freely. Incident narratives go out after a manager’s review. Anything involving customer data goes to legal. That division worked because the act covered the large middle: technical indicators and defensive measures shared with peers and government.

Without the act, organizations had to fall back on older ground. That included the 2014 Department of Justice and Federal Trade Commission policy statement on antitrust and cybersecurity information sharing, and general contract and privacy law. Those sources are reassuring but not statutory. Law firm advisories urged clients to review their sharing practices while the act was not in force. A cautious general counsel could reasonably ask to see sharing before it happened until reauthorization, and that is a defensible legal position. Operationally, it inserts a review step into a workflow measured in minutes, staffed by people who are not on call at night.

The workforce effect is easy to miss. Where such a review step appeared, analysts who once shared on judgment had reason to hold indicators, or to stop sharing because the approval path was unclear. Sharing communities depend on reciprocity, so a pause by many members at once reduces what everyone receives.

What changed in each sharing channel

The lapse did not affect every channel equally. Sharing with government lost the disclosure exemption and the limits on regulatory use. A bank or hospital sending incident details to a federal agency had less assurance about later public release or use in supervision. That mattered most for narrative detail, and least for bare technical indicators.

Sharing with competitors through an ISAC lost its explicit antitrust exemption. ISAC membership agreements, traffic light protocol markings and data handling rules remained in force, and they carry much of the practical protection. They do not replace a statute, and member counsel asked about them.

Sharing with security vendors, through product telemetry and threat intelligence platforms, was the least affected. It runs under commercial contracts that rarely relied on the act in the first place.

The shutdown compounded the effect on the government channel. With much of CISA’s staff furloughed, the receiving end of federal sharing was thinner, so ISACs and vendor channels carried more of the load for organizations that needed timely exchange.

The three channels also differ in who staffs them. Government sharing often runs through a compliance or legal liaison. ISAC sharing runs through analysts and threat intelligence staff. Vendor sharing is largely automatic. A lapse therefore lands hardest on the human-operated channels, which are also the ones that carry the context other defenders find most useful.

Making sharing decisions survive the next lapse

The durable fix is to move the legal judgment ahead of the incident. Counsel and the security team can agree a short sharing policy that sorts information into classes. Bare indicators, such as hashes, domains and IP addresses with no personal data, can be shared by analysts under any legal regime. Tactics and incident narratives go out after a named security manager’s review. Anything with customer, patient or employee data needs counsel, regardless of statute.

Scrubbing should be built into tooling. The act required removing personal information not directly related to a threat before sharing, and that discipline is worth keeping whatever the law says. A threat intelligence platform that strips email addresses, account numbers and names from outbound records by default lets analysts keep sharing indicators quickly without a lawyer reading each one. Sector rules still apply: a health system remains bound by HIPAA and a bank by its privacy obligations under the Gramm-Leach-Bliley Act when deciding what leaves the building.

The policy should state which classes change if the act’s protections lapse, so the change is a switch rather than a debate. It should name the approvers for each class with out-of-hours cover, and set a response time for counsel reviews during an active incident. Contracts deserve the same attention. Organizations can confirm that ISAC agreements, vendor terms and any government sharing arrangements carry confidentiality and use limits that stand on their own.

Measurement keeps the policy honest. Tracking indicators shared per month, and the time from detection to sharing, shows whether a lapse or a new review step has quietly stopped the flow. Those numbers belong in the security operations report, beside detection and response times.

With hindsight

The shutdown lasted 43 days, the longest on record, and ended on November 12, 2025. The law that reopened the government restored the act’s authorities and extended them through January 30, 2026. The Consolidated Appropriations Act, 2026, signed on February 3, 2026, extended the act again to September 30, 2026. At the end of September 2026, Congress passed another stopgap that carries it to December 11, 2026. As of this writing, a long-term reauthorization has not been enacted. The White House has backed a clean ten-year extension, while the Senate homeland security committee chairman has opposed moving one. Whether sharing during the 43-day gap is covered is a question for counsel. Short extensions have made the act’s status a recurring planning question for security teams. Organizations with a written sharing policy have been able to absorb each deadline without renegotiating their workflow.