Major industry groups are clamoring for Congress to include a 10-year extension of a law that they say is essential to cyber threat information sharing in the annual defense policy bill.

Congress has mixed a series of short-term renewals and lapses of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) — which provides legal protections for threat data exchanges between the government and private sector as well as between companies — since its previous 10-year sunset came and went last year. It’s now set to expire again on Dec. 11.

On Sunday, 35 business groups sent a letter to leaders of the House and Senate Armed Services panels, asking them to renew the law for 10 years as part of their final negotiations for the fiscal year 2027 National Defense Authorization Act.

“The case for a long-term reauthorization has only grown more urgent,” they wrote. “Recent incidents have demonstrated that advanced AI systems can identify and exploit software vulnerabilities at machine speed, collapsing the window between the discovery of a weakness and its use in an attack.”

“AI tools are also making sophisticated cyber capabilities cheaper, faster and easier to use, allowing threats to spread and adapt in real time,” they continued. “In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries. That speed depends on the legal certainty CISA 2015 provides.”

The letter’s signatories include overarching business groups like the Chamber of Commerce and Business Roundtable, the latter of which led the letter, as well as groups representing critical infrastructure sectors such as aviation, telecommunications and technology.

The House version of the fiscal 2027 defense bill includes a 10-year extension. The Senate version notably does not, and past efforts to include a long-term extension in the defense bill, which has been signed into law every year for decades, have encountered objections from Senate Homeland Security and Governmental Affairs Chairman Rand Paul, R-Ky.

Paul has hinged his support for any long-term extension of CISA 2015 on adoption of provisions designed to curtail past practices at the other CISA — the Cybersecurity and Infrastructure Security Agency — that he maintains threaten free speech.

Top Trump administration cyber officials have pressed Congress for a straightforward extension of the CISA 2015 laws. The Trump administration has also touted its efforts to crack down on what they said was the free-speech-limiting disinformation work of the agency CISA, which the Biden administration denied impinged on free speech and that it had ended anyway.

The annual defense policy bill often passes at the end of each calendar year or beginning of the next. A potential congressional committee leadership shuffle could change the equation for CISA 2015 in 2027, but the Dec. 11 expiration looms in 2026.

The post Business groups mount fresh campaign for long-term renewal of information sharing law appeared first on CyberScoop.