How the lapse of a 2015 law put counsel in the threat-sharing loop

The week

At midnight on September 30, 2025, federal appropriations lapsed. The money Congress provides each year to keep the government running had not been renewed, and a government shutdown began on October 1. That was the headline. A less noticed casualty of the same night mattered a great deal to security teams across banking, health care, government and industry.

The Cybersecurity Information Sharing Act of 2015 expired without reauthorization. A word on names first, because they are confusing: the 2015 law is often abbreviated CISA, which is also the acronym of the federal Cybersecurity and Infrastructure Security Agency. Here the law is “the 2015 act” and the agency is “CISA.”

The 2015 act had been written with an expiry date, and keeping it alive required Congress to act. A House-passed continuing resolution, the short-term funding bill that would have reopened the government, would have extended it, but the Senate did not pass that bill. Senate committee action on a separate reauthorization was postponed. So the act lapsed.

The act had made it safer for organizations to warn each other. It gave companies liability protection for monitoring their systems and sharing threat indicators in good faith. A threat indicator is a small, technical clue that something malicious is happening: the address of a website used in a scam, the fingerprint of a piece of malware, the subject line of a phishing email. The act also provided an antitrust exemption for sharing among competitors, so that rival banks or hospitals could swap warnings without fear of being accused of collusion. It exempted information given to the government from public disclosure laws, such as freedom of information requests. And it limited regulators’ use of shared information, so that a company’s candor about an attack could not easily be turned against it in supervision.

Law firms advised clients that the protections still covered sharing completed before the lapse, but not new exchanges. From October 1, every new warning sent outside the organization sat on less certain legal ground.

Meanwhile, under the Department of Homeland Security’s lapse plan, CISA kept excepted work running with much of its staff furloughed. Excepted work is the activity an agency judges essential enough to continue during a shutdown. The federal partner on the other end of much threat sharing was still there, but thinner.

Suppose it is two in the morning at a regional hospital system. A security analyst on the overnight shift spots a wave of phishing emails aimed at the billing department, all from the same look-alike domain. For years her routine has been simple: block the domain, then post it to the health sector’s sharing community so that other hospitals can block it too, before their staff arrive for work. It takes a few minutes. Tonight, a new instruction sits at the top of her team’s chat: no outside sharing without legal sign-off until further notice. The hospital’s lawyers will be in at nine. The other hospitals’ billing staff will start opening email at eight.

That small scene captures what the lapse of the 2015 act did to organizations that had never written down who approves sharing. Threat sharing is mostly routine work. An analyst sees a malicious domain, a phishing lure or an exploit pattern and posts it to an information sharing and analysis center, a vendor community or a government portal. For a decade the 2015 act made that a technical judgment. As long as the analyst stripped irrelevant personal information and shared for a cybersecurity purpose, the organization had statutory cover. When the act lapsed, the same post raised questions about liability, antitrust and disclosure that an analyst cannot answer.

Why threat sharing matters

Cyber defense has an odd economic property. An attacker who builds a phishing campaign or a piece of malware usually reuses it against many targets. The first organization to spot it pays the price of discovery. Every organization that hears about it afterward can block it almost for free. Sharing turns one victim’s bad morning into everyone else’s early warning.

Threat sharing works like a neighborhood watch: one household notices a stranger trying door handles and tells the street, and nobody needs to share the contents of their home. Threat indicators are the description of the stranger.

That sharing happens through several channels. An ISAC, or information sharing and analysis center, is a member organization for a particular sector, such as financial services or health care, where security teams exchange warnings with peers. Vendor communities are the networks run by security companies, where customer products report what they see and receive updates in return. Government portals, including CISA’s Automated Indicator Sharing service, let organizations exchange indicators with federal agencies.

Speed is the whole point. A warning that arrives after the attack has spread is a history lesson, so a review step measured in hours, inserted into a process measured in minutes, matters so much.

Sharing also has a less obvious benefit that rarely appears in budgets. Analysts who take part in sharing communities learn what peers are seeing, build relationships they can call on during a crisis, and develop a sense of which threats are aimed at their sector right now. That shared awareness is hard to buy and slow to rebuild. An organization that drops out of the conversation for a few months loses more than the indicators it would have received; it loses some of the trust and familiarity that make the next exchange quick and candid. That makes the sharing workflow an asset worth protecting, rather than a courtesy the security team extends to others.

What the analyst used to decide alone

In most security operations centers, sharing rules are informal. A security operations center, or SOC, is the team, often working around the clock, that watches an organization’s systems for signs of attack. Indicators of compromise go out freely. Incident narratives go out after a manager’s review. Anything involving customer data goes to legal. That division worked because the act covered the large middle: technical indicators and defensive measures shared with peers and government.

A defensive measure, in the act’s sense, is an action or tool that detects or stops a threat, such as a rule that blocks a malicious address. Sharing those rules is what lets a defense discovered by one organization protect many.

Without the act, organizations had to fall back on older ground. That included the 2014 Department of Justice and Federal Trade Commission policy statement on antitrust and cybersecurity information sharing, and general contract and privacy law. Those sources are reassuring but not statutory. A policy statement explains how enforcers intend to act; a statute is the law itself. Law firm advisories urged clients to review their sharing practices while the act was not in force.

A cautious general counsel could reasonably ask to see sharing before it happened until reauthorization, and that is a defensible legal position. Operationally, it inserts a review step into a workflow measured in minutes, staffed by people who are not on call at night.

The workforce effect is easy to miss. Where such a review step appeared, analysts who once shared on judgment had reason to hold indicators, or to stop sharing because the approval path was unclear. Sharing communities depend on reciprocity, so a pause by many members at once reduces what everyone receives. Analysts who are told to wait, without being told for how long or by whom, also learn a lesson about how much their judgment is trusted, and that lesson lingers.

What changed in each sharing channel

The lapse did not affect every channel equally. Sharing with government lost the disclosure exemption and the limits on regulatory use. A bank or hospital sending incident details to a federal agency had less assurance about later public release or use in supervision. That mattered most for narrative detail, and least for bare technical indicators.

The difference between those two kinds of information is worth spelling out. A bare indicator is a fact about the attacker: a web address, a file fingerprint. An incident narrative is a story about the victim: how the attacker got in, what they reached, how long it took to notice. The first reveals almost nothing about the organization sharing it. The second can reveal weaknesses, decisions and timelines that a regulator, a litigant or a journalist might find very interesting.

Sharing with competitors through an ISAC lost its explicit antitrust exemption. ISAC membership agreements, traffic light protocol markings and data handling rules remained in force, and they carry much of the practical protection. The traffic light protocol is a simple labeling scheme, from red to clear, that tells recipients how widely they may pass a piece of information along. These arrangements do not replace a statute, and member counsel asked about them.

Sharing with security vendors, through product telemetry and threat intelligence platforms, was the least affected. Telemetry is the stream of technical data a security product sends back to its maker. It runs under commercial contracts that rarely relied on the act in the first place.

The shutdown compounded the effect on the government channel. With much of CISA’s staff furloughed, the receiving end of federal sharing was thinner, so ISACs and vendor channels carried more of the load for organizations that needed timely exchange.

The three channels also differ in who staffs them. Government sharing often runs through a compliance or legal liaison. ISAC sharing runs through analysts and threat intelligence staff. Vendor sharing is largely automatic. A lapse therefore lands hardest on the human-operated channels, which are also the ones that carry the context other defenders find most useful.

A capability lost without a decision

The lapse is a case study in how a legal change can degrade an operational capability without anyone deciding to degrade it.

The risk is concrete. An organization that stops sharing usually stops receiving as much, because communities reward contributors. Its defenders see less, later. The cost of that is invisible until an attack that peers had already spotted gets through.

The legal exposure is real, too, which is why the lawyers’ caution was reasonable. Without the act, sharing with a competitor could in theory draw antitrust scrutiny; sharing with government could surface in a public records request; sharing about an incident could reach a regulator in a form the organization did not intend. A general counsel who weighs those risks is doing the job.

The trouble lies in the absence of a pre-agreed answer, which forces the caution to be applied case by case, at night, under pressure. The governance failure belongs to leadership rather than to the analyst or the lawyer.

Regulated sectors have an added layer. Their privacy obligations applied before the act, during the lapse and after, so a sharing policy has to respect them whatever happens to the 2015 act. HIPAA, the federal law protecting patient information, and the Gramm-Leach-Bliley Act, which governs how financial institutions handle customer data, are the two most leaders will recognize.

One incident, three channels

Follow a single incident through each channel. Suppose a regional bank discovers attackers tried to break into its online banking service using passwords stolen elsewhere. Its security team has three things it could share.

The first is a list of internet addresses the attack came from. That is a bare indicator. Its natural home is the financial sector’s ISAC, where peer banks can block the same addresses within the hour, and the bank’s security vendor, whose products may already be collecting it automatically. It contains no customer data. During the lapse, it lost the statute’s explicit antitrust shelter in the ISAC channel, but the membership agreement and traffic light markings still governed how it could be used, and the information itself revealed nothing about the bank.

The second is a short description of the attackers’ method: how they cycled through stolen passwords, at what times of day, and which login pages they targeted. This counts as tactics. It is valuable to peers because it helps them recognize the same pattern, and it reveals a little about the bank’s systems. A security manager’s review is a sensible check before it goes out.

The third is the full incident story, including how many customer accounts were affected and how long it took the bank to notice: a narrative involving people. Sending it to a federal agency during the lapse carried less assurance about later public release or use in supervision, and it would need counsel’s review in any case because it touches customer information.

Without a policy, all three items tend to be treated like the third, because nobody wants to guess. The addresses that peers could have blocked the same morning wait in a queue behind the narrative. With a policy, the first item goes out in minutes, the second within hours, and the third on counsel’s timetable, which is exactly how it should be.

Making sharing decisions survive the next lapse

The durable fix is to move the legal judgment ahead of the incident. Counsel and the security team can agree a short sharing policy that sorts information into classes. Bare indicators, such as hashes, domains and IP addresses with no personal data, can be shared by analysts under any legal regime. A hash is a file’s unique fingerprint; an IP address is the numeric address of a computer on the internet. Tactics and incident narratives go out after a named security manager’s review. Anything with customer, patient or employee data needs counsel, regardless of statute.

Scrubbing should be built into tooling. The act required removing personal information not directly related to a threat before sharing, and that discipline is worth keeping whatever the law says. A threat intelligence platform that strips email addresses, account numbers and names from outbound records by default lets analysts keep sharing indicators quickly without a lawyer reading each one. Sector rules still apply: a health system remains bound by HIPAA and a bank by its privacy obligations under the Gramm-Leach-Bliley Act when deciding what leaves the building.

The policy should state which classes change if the act’s protections lapse, so the change is a switch rather than a debate. It should name the approvers for each class with out-of-hours cover, and set a response time for counsel reviews during an active incident. Contracts deserve the same attention. Organizations can confirm that ISAC agreements, vendor terms and any government sharing arrangements carry confidentiality and use limits that stand on their own.

Measurement keeps the policy honest. Tracking indicators shared per month, and the time from detection to sharing, shows whether a lapse or a new review step has stopped the flow without anyone noticing. Those numbers belong in the security operations report, beside detection and response times.

The same night, with a written policy

Return to the analyst at two in the morning, this time at a hospital system with a written policy. The look-alike domain is a bare indicator with no patient data in it. The policy says analysts may share bare indicators under any legal regime, and the outbound platform strips any stray personal details automatically. She posts it to the sector community in minutes. Her incident summary, which describes how the emails reached the billing team, is a narrative; it waits for the security manager on call, who reviews it within the hour the policy sets. Nothing in her night depended on whether Congress had acted.

Organizations without such a policy go wrong in familiar ways. Sharing rules live only in people’s heads. A lapse is met with a blanket hold rather than a targeted change. Nobody is named to approve sharing after hours. Contracts with ISACs and vendors are assumed to be adequate without anyone reading them. And nobody measures sharing, so a months-long drop goes unnoticed until a peer asks why the organization has stopped contributing.

A written policy, night approvals and sharing numbers for security and counsel

• Do we have a written sharing policy that sorts information into bare indicators, tactics and narratives, and data involving people, with a named approver for each, and does it say exactly what changes if the 2015 act’s protections lapse?
• Who can approve sharing at night and on weekends, and how quickly must counsel respond during an active incident?
• Do our sharing tools strip personal information from outbound records by default?
• Have we read our ISAC agreements, vendor terms and government sharing arrangements to confirm they carry confidentiality and use limits of their own?
• How many indicators did we share last month, how long does it take from detection to sharing, and did that number drop during the lapse?

With hindsight

The shutdown lasted 43 days, the longest on record, and ended on November 12, 2025. The law that reopened the government restored the act’s authorities and extended them through January 30, 2026. The Consolidated Appropriations Act, 2026, signed on February 3, 2026, extended the act again to September 30, 2026. A second, four-day lapse ran from January 31 to February 3, 2026.

CISA’s guidance, updated in February 2026, says indicators shared in accordance with the act during both lapses are covered, because the extensions moved the sunset date; organizations should still confirm their own position with counsel. That was welcome news for those who kept sharing, and it shows how a legal position can be clarified after the fact. It was no help to an analyst at two in the morning in October 2025, who had to decide without it.

The September 30, 2026 deadline arrived as this series was being prepared, and readers should check the act’s current status, since we have not confirmed a long-term reauthorization.

Short extensions have made the act’s status a recurring planning question for security teams. Each new deadline brings the same uncertainty, and each one tests whether an organization has turned its sharing rules into a written, pre-agreed policy or is still deciding case by case.

Organizations with a written sharing policy have been able to absorb each deadline without renegotiating their workflow. Laws that protect sharing may come and go on Congress’s calendar. A clear internal answer to who may share what, with whom, and on whose approval, does not have to. It is a modest piece of governance, agreed once between the security team and counsel, and it keeps an organization’s early warnings flowing whatever happens in Washington. Boards can ask to see that policy, and to see the sharing numbers beside it, at least once a year.