Congress returned Monday for its year-end session with three federal cybersecurity authorities set to expire Dec. 11, including the law that shields companies when they share cyber threat information with the government, Nextgov/FCW reported. Lawmakers have only a few weeks to act before Democrats take control of both chambers in January, and several bipartisan AI safety bills are still waiting.
What Happened
The Cybersecurity Information Sharing Act of 2015, known as CISA 2015, lapsed during last year's government shutdown and has survived since on short extensions. A recent stopgap spending bill also carried the Federal Cybersecurity Enhancement Act of 2015, which supports intrusion detection and prevention on federal networks, and the Technology Modernization Fund, which helps agencies replace aging systems, to the same Dec. 11 date.
The annual defense policy bill, the National Defense Authorization Act (NDAA), is the vehicle industry favors for a longer fix. The House narrowly passed its version July 22, but the Senate's version failed a procedural vote July 14, and the bill remains stalled there. The House bill would also make the Pentagon explain how it uses commercial cyber tools, including for offensive missions.
On AI, the FRONTIER Act from Reps. Jay Obernolte, R-Calif., and Lori Trahan, D-Mass., would require developers to disclose advanced models' risks and safeguards and report serious safety incidents. The AI Kill Switch Act from Reps. Ted Lieu, D-Calif., and Nathaniel Moran, R-Texas, would require covered developers to be able to restrict or shut down their systems and let the Department of Homeland Security order emergency action after a qualifying incident.
Why It Matters
The 2015 law gives companies liability protections, shielding them from lawsuits and regulatory penalties when they share threat information with federal partners such as the FBI, Nextgov/FCW reported earlier. Industry groups warn that any lapse makes companies more reluctant to share details of intrusions, weakening the early warnings that government and other companies depend on.
A coalition of 35 industry groups has asked defense bill negotiators to keep a House provision extending the law through 2035, which The Primary Wire reported Nov. 2. For AI developers and the companies that deploy their models, the FRONTIER and Kill Switch bills would turn safety reporting and shutdown ability into legal requirements. Any that stall face a new Congress whose incoming Democratic majority has sketched its own AI agenda, which The Primary Wire reported Nov. 6.
What to Watch
Watch whether the threat-sharing extension rides on the NDAA or a funding bill before Dec. 11. In the Senate, Sens. Gary Peters, D-Mich., and Mike Rounds, R-S.D., have pushed a 10-year extension, while Homeland Security Chairman Rand Paul, R-Ky., wants an amendment barring federal officials from pressuring social media companies to restrict speech, Nextgov/FCW reported.
Also pending is Section 702 of the Foreign Intelligence Surveillance Act, which lets intelligence agencies collect communications of foreign targets abroad without a warrant. It lapsed in June, but existing court approvals allow collection into 2027; renewal may come up this session.
