McCaul: Letting Cyber Law Expire Would Endanger U.S. Security

By Amr Gohar

Washington, D.C. — U.S. Rep. Michael McCaul (R-Texas), chairman emeritus and current vice chairman of the House Committee on Homeland Security, warned that the United States could face serious cybersecurity risks if Congress fails to reauthorize a critical cyber information-sharing law set to expire later this month.

Speaking during a full committee hearing titled “Oversight of the Department of Homeland Security: CISA, TSA, S&T,” McCaul emphasized the growing importance of the Cybersecurity and Infrastructure Security Agency (CISA) as cyber threats become more sophisticated and widespread.

McCaul, who authored the Cybersecurity and Infrastructure Security Agency Act and helped pass the Cyber Information Sharing Act in 2015, questioned Acting CISA Director Dr. G. Srinivas Gottumukkala about the agency’s current capabilities and the consequences of a potential lapse in authorization.

“One of the most critical pieces of CISA, as we imagined in Congress, was to share information with the private sector,” McCaul said, noting that private companies hold roughly 80 percent of cyber threat intelligence. He stressed that Congress deliberately placed CISA under civilian oversight rather than the National Security Agency to ensure stronger collaboration with industry partners.

While CISA itself was permanently authorized in 2018, McCaul highlighted that the Cyber Information Sharing Act includes a sunset provision and is scheduled to expire on January 30, 2026. He warned that failure to renew the law could severely undermine national cybersecurity efforts.

“At this point in time, the cyber threat is far greater today than when we first created the agency,” McCaul said, citing upcoming high-profile events such as the FIFA World Cup, the Olympic Games, and the United States’ 250th anniversary as potential targets for cyberattacks.

Dr. Gottumukkala told lawmakers that the Department of Homeland Security supports long-term reauthorization of the act, describing it as a foundational authority for defending U.S. critical infrastructure. He emphasized that CISA’s strength lies in its partnership with the private sector and continued information sharing.

McCaul placed responsibility for the looming deadline squarely on Congress, particularly the Senate, accusing lawmakers of playing politics with national security.

“This is not your fault; this is Congress’s fault,” McCaul said. “Without reauthorization, your ability to collect 80 percent of the threat information from the private sector is gone. That is highly irresponsible and, quite frankly, downright dangerous.”

McCaul concluded by urging the Senate to act swiftly, stressing that cybersecurity has historically been a bipartisan issue and warning that delays could expose the nation to unnecessary risk.