Shutdown guts US cybersecurity agency at perilous time

The lead U.S. agency for protecting the electric grid, water supply and other critical services from hacking has furloughed most of its already trimmed-down staff in the government shutdown, just as a decade-old law giving companies leeway to collaborate on cyberdefense expired.

The twin impacts leave employees at the Cybersecurity and Infrastructure Security Agency and outside professionals unsettled as they try to fend off a surge in sophisticated hacks from China as well as continued ransomware threats.

CISA is set to keep 889 employees, or 35% of the workforce it had in May, according to a planning document released by its parent department, the Department of Homeland Security. More will be available for emergencies, DHS said.

“CISA remains fully committed to safeguarding the nation’s critical infrastructure,” agency spokeswoman Marci McCarthy wrote in an e-mailed statement. “While a government shutdown can disrupt federal operations, CISA will sustain essential functions and provide timely guidance to minimize disruptions.”

The shutdown comes at a precarious time, however, and not only because China-backed hacking groups have been emboldened to target more entities, in some cases without the prior approval of the Beijing government.

By unhappy coincidence, the main law that shields companies from antitrust and other liabilities for sharing what they see about cyberattacks with other companies and the government expired Tuesday at midnight.

Both parties and the White House enthusiastically supported renewing that information-sharing law, known as CISA 2015. The continuing resolution that passed the House and would have kept the government open included a reauthorization. But it was collateral damage in the spending standoff that led to it failing to pass the Senate.

As a result, some corporate legal departments are urging companies to pull back from industry security information clearinghouses until further notice.

“The lapse of CISA 2015 could effectively turn the lights out on U.S. cyber intelligence from companies that have been, or are being, attacked,” Hugh Thompson, executive chairman of the RSA security conference, said in an email Tuesday. “This breakdown of ‘collective defense’ would weaken domestic cybersecurity but could also have a global impact given that the U.S. shares cyberthreat intelligence with other nations.”

In another coincidence, Wednesday marked the beginning of Cybersecurity Awareness Month, when public and private entities strive to educate more people about online risks and how to mitigate them.