Critical Infrastructure Cybersecurity at Risk as Information Sharing Law Expires

Growing Cyber Threats Target Critical Infrastructure

Critical infrastructure sectors are facing increasingly sophisticated cyber threats while a key information sharing law remains expired, according to industry reports. Security experts indicate adversaries are now focusing on operational technology and industrial control systems where they can potentially disrupt essential services.

“We’ve seen a consistent rise in threat activity over the years,” Martz stated, noting that threat actors are exploiting internet-facing devices to conduct reconnaissance. Analysts suggest these intruders use “living off the land” techniques, employing legitimate network tools to conceal their presence while gathering sensitive information like GIS data and network maps.

Industry Calls for Legal Protections

Major utility associations have united in urging Congress to reinstate the Cybersecurity Information Sharing Act (CISA) of 2015 without amendments. Sources indicate that organizations including the Edison Electric Institute, American Gas Association, and National Electrical Manufacturers Association signed a September letter advocating for what they term a “clean” reauthorization.

The expired law “provides safeguards for businesses regarding public disclosure, regulatory issues, and antitrust concerns to facilitate the timely exchange of information between the public and private sectors,” the groups argued in their letter to Congress. They warned that without these protections, the U.S. faces a “more complex and dangerous security environment.”

Legislative Hurdles and Proposed Solutions

Congress failed to reauthorize the program despite broad support from administration officials, lawmakers, and cybersecurity experts. The lapse occurred after Senator Rand Paul blocked renewal efforts while seeking new restrictions related to combating online misinformation, according to congressional reports.

Bipartisan legislation introduced by Senators Gary Peters and Mike Rounds would renew CISA for ten years with retroactive coverage for the current gap. The proposal has garnered support from cybersecurity leaders who describe the information sharing authority as critical for protecting infrastructure.

Industry Impact and Security Concerns

Utility security professionals express concern that the legal uncertainty could hamper their ability to share threat intelligence effectively. “I need to know I’m not going to be punished for sharing something that can better protect the nation,” said Kate Mabbett of American Electric Power during a Columbia University panel.

Security analysts note that while existing regulations like the North American Electric Reliability Corporation’s standards have established baseline protections, new threat groups are developing specialized malware that exploits detailed knowledge of utility operations. These threat actors increasingly target the unique systems controlling critical infrastructure across North America.

Broader Implications for Cybersecurity Cooperation

The expiration comes amid rapidly growing electricity demand and increasing sophistication of cyber threats. Dragos CEO Rob Lee emphasized in a statement that “threat intelligence sharing between the private and public sector is vital in protecting critical infrastructure from cyberattacks,” adding that the legal framework provides “the guardrails, and the confidence needed for responsible cooperation.”

Industry observers suggest the situation highlights ongoing challenges in balancing security needs with other policy considerations. As recent technology developments create new vulnerabilities, the need for coordinated defense mechanisms becomes increasingly urgent. The current legislative impasse demonstrates how industry developments can be affected by political considerations.

According to Senate committee sources, the proposed bipartisan solution would restore what stakeholders describe as essential protections. The legislation has received support from various sectors concerned about market trends in cybersecurity vulnerability.

As the debate continues, security professionals warn that delayed reauthorization could affect how organizations respond to emerging threats and related innovations in cyber defense. The situation remains fluid, with industry representatives continuing to advocate for solutions that address both security needs and legal concerns amid evolving industry developments.

This article aggregates information from publicly available sources. All trademarks and copyrights belong to their respective owners.

Note: Featured image is for illustrative purposes only and does not represent any specific product, service, or entity mentioned in this article.