The bill
Extending Expired Cybersecurity Authorities Act
S. 2983, 119th Congress — read as touching Cybersecurity.
Sponsored by
Sen. Peters, Gary C. [D-MI]
ID: P000595
Follow the money
The bill
S. 2983, 119th Congress — read as touching Cybersecurity.
The sponsor
Every bill has someone who introduced it. That name is where the paper trail starts.
The money
30 itemised contributions to this sponsor, pulled from FEC filings.
The alignment
This bill's text tracks the "Intelligence Community" section, p. 254-256 of the Mandate for Leadership.
Track this bill's progress through the legislative process
Latest Action
Read the second time. Placed on Senate Legislative Calendar under General Orders. Calendar No. 182.
October 7, 2025
📍 Current Status
Next: The bill will be reviewed by relevant committees who will debate, amend, and vote on it.
1. Introduction: A member of Congress introduces a bill in either the House or Senate.
2. Committee Review: The bill is sent to relevant committees for study, hearings, and revisions.
3. Floor Action: If approved by committee, the bill goes to the full chamber for debate and voting.
4. Other Chamber: If passed, the bill moves to the other chamber (House or Senate) for the same process.
5. Conference: If both chambers pass different versions, a conference committee reconciles the differences.
6. Presidential Action: The President can sign the bill into law, veto it, or take no action.
7. Became Law: If signed (or if Congress overrides a veto), the bill becomes law!
Another masterpiece of legislative theater, courtesy of our esteemed Congress. Let's dissect this farce, shall we?
**Main Purpose & Objectives:** The "Extending Expired Cybersecurity Authorities Act" (because who needs a catchy title when you can just phone it in?) aims to reauthorize the Cybersecurity Information Sharing Act of 2015. Wow, what a bold move! Reauthorizing an existing law that's about to expire? How innovative.
**Key Provisions & Changes to Existing Law:** The bill extends the sunset date of the Cybersecurity Information Sharing Act from September 30, 2025, to September 30, 2035. Oh, and it also changes the name of the act to "Protecting America from Cyber Threats Act" because, you know, rebranding is everything in politics. It's like putting a fresh coat of paint on a clunker – it still won't run, but hey, it looks prettier.
**Affected Parties & Stakeholders:** The usual suspects are involved: the federal government, private sector companies, and cybersecurity firms looking to cash in on the gravy train. You can bet your bottom dollar that lobbyists for these industries have been busy greasing palms and whispering sweet nothings into the ears of our fearless leaders.
**Potential Impact & Implications:** This bill is a classic case of "CYA" (Cover Your Assets) politics. By reauthorizing an existing law, Congress gets to pretend it's doing something about cybersecurity while actually accomplishing nothing meaningful. The real impact will be felt by the companies that get to profit from this extension, and the politicians who get to tout their "commitment to national security" in campaign ads.
Diagnosis: This bill is a symptom of a deeper disease – the chronic inability of our government to address actual problems. It's a placebo, designed to make voters feel like something is being done while the real issues fester. The lawmakers behind this bill are either incompetent or corrupt (or both). Either way, it's a waste of time and taxpayer dollars.
Treatment: A healthy dose of skepticism, followed by a strong prescription of critical thinking. Voters need to stop buying into these legislative placebos and demand actual solutions to the problems plaguing our nation. But hey, that's just a pipe dream – after all, who needs effective governance when you can have empty rhetoric and pork-barrel politics?
Sen. Peters, Gary C. [D-MI]
Congress 119 • 2024 Election Cycle
No PAC contributions found
No committee contributions found
This bill has 10 cosponsors. Below are their top campaign contributors.
ID: R000605
Top Contributors
23
ID: K000383
Top Contributors
24
ID: C001095
Top Contributors
24
ID: B001305
Top Contributors
20
ID: G000555
Top Contributors
25
ID: R000608
Top Contributors
42
ID: C001096
Top Contributors
26
ID: C001035
Top Contributors
21
ID: W000805
Top Contributors
23
ID: L000575
Top Contributors
22
Hub layout: Politicians in center, donors arranged by type in rings around them.
Showing 52 nodes and 74 connections
Total contributions: $74
Showing top 18 donors by contribution amount
Which industries are materially affected by specific provisions in this bill. 1 helped.
Section 2(a) extends the Cybersecurity Information Sharing Act of 2015 authorization from September 30, 2025 to September 30, 2035, providing a clear benefit (regulatory continuity) to cybersecurity firms.
This bill shows semantic similarity to the following sections of the Project 2025 policy document.AI-enhanced analysis provides detailed alignment ratings.
AI Analysis:
"The bill extends the Cybersecurity Information Sharing Act, directly supporting the Project 2025 Intelligence Community goal of enhancing cyber threat information sharing with private-sector partners and establishing an 'obligation to share' policy. While it does not address intelligence analysis reforms or real-time auditing, its focus on sustained sharing aligns strongly with the policy's emphasis on timely, relevant defensive intelligence dissemination."
— 221 — Intelligence Community influence and the FBI’s warnings about continued efforts through the 2022 mid- terms highlight the folly of undue certainty without consideration of alternatives. On election influence and other controversial issues, such as the origin of COVID-19, analysts at the most powerful intelligence agencies have increasingly tended to use the leeway they have been given to insert their political views into their work in order to influence (if possibly even control) the analytic process. They do this in ways that attempt to squash dissent and impair the creation of a culture in which entrenched views are challenged and unpopular analytical lines can sur- vive or not according to their merits. To help the United States and its leaders to outcompete China across mul- tifaceted societal, economic, military, and technological threats, the IC’s capability to conduct strategic intelligence analysis that is relevant to policymak- ers in both parties must be rebuilt and strengthened. Because Beijing may be a peer or even exceed U.S. capabilities in some areas, the post-9/11 analytic focus on quick-turnaround secrets is not good enough. Strategic planning—informed by intelligence—must take place for the United States to stay ahead of whatever new threats China may pose. An incoming conservative President will have the opportunity to signal the demand for such strategic products and prioritize their production through communications to intelligence leaders and formal mechanisms such as shifting priorities within the National Intelligence Priority Framework and structuring the President’s Daily Brief. The incoming DNI should also emphasize implementing the recommendations in the Ombudsman’s report, especially regarding objectiv- ity, the inclusion of dissenting viewpoints, and more serious efforts to hold senior leaders accountable for backchannel attempts to change or suppress analytic views. Accounting for the long history of intelligence failures and surprises, an incom- ing conservative President must appreciate the ambiguity, complexity, limits, and assumptions inherent in intelligence assessments. Intelligence often deals with the human dimension in complex decision systems within a foreign country or organi- zation, and this makes consistently accurate predictions difficult if not impossible to develop. Seeing something and understanding what you are seeing are two dif- ferent things, so a President should consistently and patiently press the IC about its potential biases, assumptions, methodology, and sourcing. With regard to election-threat analysis and politically controversial topics, agency leaders should take seriously the Ombudsman’s admonition that we need to maintain tradecraft standards across all countries and topics by ensuring that equitable standards apply across all foreign threat actors. Analysis should be put forward without regard to the domestic political ramifications of intelligence conclusions. “Obligation to Share” and Real-Time Auditing Capability. The fed- eral government has made admirable progress in recent years by being more — 222 — Mandate for Leadership: The Conservative Promise forward-leaning in sharing cyber threat intelligence with private-sector partners and the public, emphasizing that the protective nature of such information is of value only if put into the right hands at the right time. Since critical infrastructure and services are overwhelmingly owned, managed, and defended by the private sector in the United States, there has been an increasing emphasis on declassify- ing intelligence and sharing actionable information with private-sector partners, often through industry-specific Information Sharing and Analysis Centers (ISACs); regional meetings of government and private-sector experts called InfraGard, run by the FBI; direct public notification from the Department of Homeland Security, the FBI, and (increasingly) the NSA; and more discreet one-on-one engagements led by the collecting agencies. These programs properly recognize the private sector’s role in providing cyber- security for Americans; in practice, however, the intelligence shared by the U.S. government through these venues is too often already known or no longer relevant by the time it makes its way through the downgrade process for sharing. In addition, government-shared information often needs to take advantage of the opportunity to provide contexts, such as attribution, trends, and size of the observed cyber problem. As warranted, additional context should be provided to the private sector as a matter of routine. To continue improving the U.S. government’s ability to defend the country’s most vital networks, the IC must adopt an “obligation to share” policy process, including the capacity for “write to release” intelligence products whereby newly discovered technical indicators, targeting, and other intelligence relevant to cyber defense are automatically provided either to the public or to targeted entities within 48 hours of their collection—which is how counterterrorism intel- ligence has been managed for years when it comes to a “duty to warn.” Under this policy, agency heads should still have the flexibility to withhold intelligence for operational or counterintelligence reasons but would need to report regularly to Congress on the number of and justification for exceptions. This policy would make sharing intelligence and defending networks the default, as it already is in the rest of the cybersecurity community outside the IC, to improve the quantity, relevance, and timeliness of defensive information while ensuring accountability for top leaders when they must withhold this information. One of the most significant challenges within the IC is presented by the need to share information promptly among the 18 elements of the intelligence enterprise. The only long-term solution to the understandable tension between the need to share information and the need to protect intelligence sources and methods is a robust real-time auditing capability that electronically flags unauthorized access. Under an identity management system with real-time audit, even the most sensi- tive information acquired by America’s intelligence agencies can be shared, and the access to and use of that information are appropriately monitored. Establishing
AI Analysis:
"The bill extends cybersecurity information sharing authorities, directly supporting the Intelligence Community's mission to collect, analyze, and disseminate cyber threat intelligence and to strengthen government‑private sector collaboration on national security threats."
— 233 — Intelligence Community 19. Michael E. DeVine, “Covert Action and Clandestine Activities of the Intelligence Community: Selected Definitions,” Congressional Research Service Report for Members and Committees of Congress No. R45175, updated November 29, 2022, https://sgp.fas.org/crs/intel/R45175.pdf (accessed February 24, 2023). 20. H.R. 2663, Central Intelligence Agency Act of 1949, Public Law No. 81-110, 81st Congress, June 20, 1949, https:// govtrackus.s3.amazonaws.com/legislink/pdf/stat/63/STATUTE-63-Pg208.pdf (accessed March 6, 2023). 21. Nicole Ogrysko, “Intelligence Community Workforce Is More Diverse, but Still Struggles with Retention and Promotion,” Federal News Network, October 27, 2021, https://federalnewsnetwork.com/workforce/2021/10/ intelligence-community-workforce-is-more-diverse-but-still-struggles-with-retention-and-promotion/ (accessed March 18, 2023). 22. See James J. Wirtz, “The Intelligence Policy Nexus,” in Loch K. Johnson, ed., Strategic Intelligence, Volume 1: Understanding the Hidden Side of Government (Westport, CT: Prager, 2007), and Richard K. Betts, “Analysis, War, and Decision: Why Intelligence Failures Are Inevitable,” World Politics, Vol. 30, No. 1 (October 1978), pp. 61–89. 23. Letter from Barry A. Zulauf, IC Analytic Ombudsman, Office of the Director of National Intelligence, to Senator Marco Rubio, Acting Chairman, and Senator Mark Warner, Vice Chairman, Select Committee on Intelligence, U.S. Senate, “RE: SSCI #2020-3029,” January 6, 2021, https://int.nyt.com/data/documenttools/ ic-ombudsman-election-interference-with-responses/c50e548011fd6168/full.pdf (accessed March 14, 2023). 24. Joshua Rovner, Fixing the Facts: National Security and the Politics of Intelligence (Ithaca, NY: Cornell University Press, 2011), pp. 30–31. 25. Joshua Rovner, “Is Politicization Ever a Good Thing?” Intelligence and National Security, Vol. 28, No. 1 (2013), p. 58. 26. S. 1566, Foreign Intelligence Surveillance Act of 1978, Public Law No. 95-511, 95th Congress, October 25, 1978, https://www.govinfo.gov/content/pkg/STATUTE-92/pdf/STATUTE-92-Pg1783.pdf (accessed March 6, 2023). 27. The Cipher Brief, “702 Reauthorization: Defending a Key Intelligence Tool,” remarks of Benjamin Powell, former General Counsel to the Director of National Intelligence, stating that FISA 702 provides “between 40 and 60 percent” of the intelligence in the PDB, December 18, 2017, https://www.youtube.com/ watch?v=mRJ09GHVRFk&ab_channel=TheCipherBrief (accessed March 18, 2023). 28. An intelligence alliance that includes Australia, Canada, New Zealand, the United Kingdom, and the United States. Office of the Director of National Intelligence, National Counterintelligence and Security Center, “Five Eyes Intelligence Oversight and Review Council (FIORC),” https://www.dni.gov/index.php/ncsc-how-we- work/217-about/organization/icig-pages/2660-icig-fiorc (accessed March 10, 2023). 29. Porter, “Seven Questions the Next President Will Need the Intelligence Community to Answer to Win the Technology Competition with China.” 30. H.R. 1591, An Act to Require the Registration of Certain Persons Employed by Agencies to Disseminate Propaganda in the United States and for Other Purposes, Public Law No. 75-583, 75th Congress, June 8, 1938, https://govtrackus.s3.amazonaws.com/legislink/pdf/stat/52/STATUTE-52-Pg631.pdf (accessed March 6, 2023). 31. Kristina Wong, “Exclusive: Former DNI John Ratcliffe Pleased CIA Following His Lead on China Threat,” Breitbart, October 13, 2021, https://www.breitbart.com/politics/2021/10/13/exclusive-john-ratcliffe-pleased- cia-following-lead-china-threat/ (accessed March 11, 2023). 32. H.R. 4628, Intelligence Authorization Act for Fiscal Year 2003, Public Law No. 107-306, 107th Congress, November 27, 2002, Title IX, https://www.govinfo.gov/content/pkg/STATUTE-116/pdf/STATUTE-116-Pg2383.pdf (accessed March 6, 2023). 33. President George W. Bush, Executive Order 13354, “National Counterterrorism Center,” August 27, 2004, in Federal Register, Vol. 69, No. 169 (September 1, 2004), pp. 53589–53592, https://www.govinfo.gov/content/ pkg/FR-2004-09-01/pdf/04-20050.pdf (accessed March 6, 2023). 34. Office of the Director of National Intelligence, National Counterintelligence and Security Center, “Who We Are: History of NCSC,” https://www.dni.gov/index.php/ncsc-who-we-are/ncsc-history (accessed March 11, 2023). 35. Gregory F. Treverton and C. Bryan Gabbard, Assessing the Tradecraft of Intelligence Analysis, RAND Corporation, National Security Research Division Technical Report, 2008, p. 6, https://www.rand.org/pubs/ technical_reports/TR293.html (accessed March 1, 2023).
AI Analysis:
"The bill extends the Cybersecurity Information Sharing Act, ensuring continued government‑private sector cyber threat information sharing, which aligns with Project 2025’s goal of forward‑leaning intelligence sharing with private partners. However, it does not implement the specific IC reforms such as an ‘obligation to share’ policy, real‑time auditing, or declassification changes outlined in the policy."
— 222 — Mandate for Leadership: The Conservative Promise forward-leaning in sharing cyber threat intelligence with private-sector partners and the public, emphasizing that the protective nature of such information is of value only if put into the right hands at the right time. Since critical infrastructure and services are overwhelmingly owned, managed, and defended by the private sector in the United States, there has been an increasing emphasis on declassify- ing intelligence and sharing actionable information with private-sector partners, often through industry-specific Information Sharing and Analysis Centers (ISACs); regional meetings of government and private-sector experts called InfraGard, run by the FBI; direct public notification from the Department of Homeland Security, the FBI, and (increasingly) the NSA; and more discreet one-on-one engagements led by the collecting agencies. These programs properly recognize the private sector’s role in providing cyber- security for Americans; in practice, however, the intelligence shared by the U.S. government through these venues is too often already known or no longer relevant by the time it makes its way through the downgrade process for sharing. In addition, government-shared information often needs to take advantage of the opportunity to provide contexts, such as attribution, trends, and size of the observed cyber problem. As warranted, additional context should be provided to the private sector as a matter of routine. To continue improving the U.S. government’s ability to defend the country’s most vital networks, the IC must adopt an “obligation to share” policy process, including the capacity for “write to release” intelligence products whereby newly discovered technical indicators, targeting, and other intelligence relevant to cyber defense are automatically provided either to the public or to targeted entities within 48 hours of their collection—which is how counterterrorism intel- ligence has been managed for years when it comes to a “duty to warn.” Under this policy, agency heads should still have the flexibility to withhold intelligence for operational or counterintelligence reasons but would need to report regularly to Congress on the number of and justification for exceptions. This policy would make sharing intelligence and defending networks the default, as it already is in the rest of the cybersecurity community outside the IC, to improve the quantity, relevance, and timeliness of defensive information while ensuring accountability for top leaders when they must withhold this information. One of the most significant challenges within the IC is presented by the need to share information promptly among the 18 elements of the intelligence enterprise. The only long-term solution to the understandable tension between the need to share information and the need to protect intelligence sources and methods is a robust real-time auditing capability that electronically flags unauthorized access. Under an identity management system with real-time audit, even the most sensi- tive information acquired by America’s intelligence agencies can be shared, and the access to and use of that information are appropriately monitored. Establishing — 223 — Intelligence Community a real-time auditing capability is essential to decreasing the risk for the heads of intelligence agencies in meeting their statutory requirements to ensure that they protect sources and methods associated with the classified information their agen- cies collect. Overclassification. There is broad consensus across the U.S. government and among stakeholders that the system for classifying, declassifying, and otherwise marking and handling sensitive information is at a crossroads. Exorbitant amounts of classified data are created daily, and agency personnel often mistakenly choose classification as the default selection to ensure national security. At the same time, the effectiveness of downgraded and carefully declassified information to support foreign policy efforts has been borne out in, for example, alerting the broader world of Russia’s buildup and likely plans for its invasion of Ukraine. Two executive orders principally govern how the U.S. government handles clas- sified and sensitive information. l Executive Order 13526, “Classified National Security Information,” issued in 2009,38 prescribes the classification levels and procedures for declassification. l Executive Order 13556, “Controlled Unclassified Information,” issued in 2010,39 aimed to establish a uniform program for managing all unclassified information that requires safeguarding or dissemination controls. The current system for declassifying classified national security information (CNSI) is extraordinarily analog, requiring experts’ review of individual records. Declassification policies are based on human review of paper and need to con- template and handle the proliferation and volume of digital records created by agencies. The U.S. government will soon reach the point at which manual review is impossible. The declassification of CNSI should support key U.S. national security objectives, reflect mission priorities, and not serve solely as a necessary procedural function. Reforms should include: l Tighter definitions and greater specificity for categories of information requiring protection. l More stringent policies to effect significant reductions in the number of Original Classification Authorities (OCAs). l Stricter accountability measures at the OCA level and more detailed security classification guides.
Showing 3 of 5 policy matches
Policy matches are calculated using a hybrid approach: initial candidates are found using semantic similarity between bill summaries and Project 2025 policy text, then an AI model (Llama 3.1 70B) provides detailed alignment ratings and analysis. Ratings range from 1 (minimal alignment) to 5 (very strong alignment). This analysis does not imply direct causation or intent.