2025 Government Shutdown: FTC Closed, CISA Expired

TL;DR: As of October 1, 2025, a lapse in government funding has shuttered key federal agencies, allowing the Cybersecurity Information Sharing Act to expire and taking the FTC offline, creating a dangerous vacuum in the nation's cybersecurity and consumer protection infrastructure.

What changed (August 6, 2026): The 43-day shutdown ended in November 2025, and Congress revived CISA 2015 through January 30, 2026 as part of the funding bill. A subsequent Consolidated Appropriations Act in early February 2026 pushed the sunset to September 30, 2026, but the long-term reauthorization fight is still unresolved and a separate DHS funding lapse in spring 2026 again stressed CISA operations before funding was restored.

A Void in Washington

As of October 1, 2025, a lapse in government funding has shuttered key federal agencies, creating a dangerous vacuum in the nation's cybersecurity and consumer protection infrastructure. The shutdown has not only paused routine operations but has also allowed a critical piece of cyber-defense legislation to expire and taken the primary consumer protection agency offline, leaving both private industry and the public exposed.

The CISA Lifeline is Cut, Leaving Industry in the Dark

A cornerstone of public-private cybersecurity cooperation, the Cybersecurity Information Sharing Act of 2015 (CISA 2015), expired on October 1 amid the shutdown.[1, 2] This law was instrumental in fostering a collective defense against cyber threats by providing legal liability protections to companies that voluntarily shared threat intelligence with the government and each other. These safeguards encouraged the timely exchange of information about new attack methods and vulnerabilities, allowing defenders to learn from each other in near real-time.

With the law's expiration, these legal protections have vanished. A coalition of over 50 industry groups had warned Congress that such a lapse would dramatically decrease information sharing, leading to a "more complex and dangerous" security environment.^[1] Without this framework, private entities are now isolated, hesitant to share critical data for fear of lawsuits. This creates a significant advantage for malicious actors, who thrive when their targets are unable to coordinate a defense.

The FTC Goes Dark, Muting Consumer Protection

Simultaneously, the Federal Trade Commission (FTC), the nation's chief consumer protection watchdog, has effectively closed its doors.[3, 4] The shutdown has rendered its most important public-facing services unavailable. Critical resources for citizens, including ReportFraud.ftc.gov, IdentityTheft.gov, and the National Do Not Call Registry, are all offline.^[4]

While the FTC's Consumer Sentinel Network, a database of consumer complaints, remains technically available to law enforcement, no new complaint data will be entered until the government reopens.^[4] This effectively freezes the nation's primary repository of consumer fraud data, blinding authorities to emerging scams and leaving victims with no official channel to report harm. The federal government's withdrawal from the field signals a systemic weakness that invites other actors (both regulatory and criminal) to fill the void.

National Security and Economic Implications

The simultaneous lapse of CISA and closure of the FTC creates a perfect storm of vulnerability. At a time when cyber threats are increasingly sophisticated and consumer fraud is rampant, the United States has effectively disarmed two of its primary defense mechanisms. The timing could not be worse, as threat actors worldwide are likely to view this period as an opportune moment to launch attacks or scams with reduced risk of detection or consequence. Federal contractors are already a target: a ransomware crew hit a contractor serving ICE, DHS, and CISA.

For businesses, the absence of legal protections for information sharing means that critical threat intelligence may not reach those who need it most. A vulnerability discovered by one company may not be shared with others in the same sector, allowing attackers to exploit the same weakness across multiple targets, the same dynamic that drives supply chain attacks through third-party vendors. This fragmentation of the cybersecurity ecosystem undermines years of progress in building collaborative defense strategies.

For consumers, the closure of the FTC means that fraud victims have nowhere to turn. Scammers know that reports will not be processed, investigations will not be initiated, and enforcement actions will not be taken. This creates a lawless digital environment where bad actors can operate with near impunity.

What You Can Do

While the federal government is unable to provide protection, individuals and organizations can take proactive steps to defend themselves during this period of vulnerability.

For Individuals: Heighten Your Vigilance

Be extra cautious of phishing attempts, unsolicited calls, and unusual requests for personal information. Verify the identity of anyone claiming to be from a government agency or financial institution by calling them back at a known, legitimate number.

For Businesses: Strengthen Internal Sharing

Even without CISA protections, continue to share threat intelligence within your industry through trusted channels. Consider joining private sector information sharing and analysis centers (ISACs) that operate independently of government frameworks.

Document Everything

If you are a victim of fraud or a cybersecurity incident, document everything thoroughly. Once the FTC reopens, you may still be able to file a retroactive complaint. Keep records of dates, communications, and financial losses.

Use Alternative Reporting Channels

While the FTC is offline, you can still report fraud to your state's Attorney General office, local law enforcement, or the FBI's Internet Crime Complaint Center (IC3) at ic3.gov.

A Self-Inflicted Wound

This government shutdown is not a natural disaster or an external attack. It is a self-inflicted wound that has left the nation more vulnerable to both cyber threats and consumer fraud. The expiration of CISA and the closure of the FTC demonstrate how political dysfunction can have immediate and tangible consequences for national security and economic stability. As this crisis continues, the burden of protection has shifted entirely to individuals, businesses, and state governments, none of whom have the resources or legal authorities that federal agencies possess.

Update (August 6, 2026): CISA 2015 revived, then pushed to September 30, 2026

The 43-day shutdown ended when President Trump signed H.R. 5371, a continuing resolution that Cybersecurity Dive reported on November 13, 2025 also temporarily revived CISA 2015 through January 30, 2026.^[5] The FTC's National Do Not Call Registry came back online the same day; the agency reported that "all Do Not Call services are fully active" and that enforcement had resumed.^[6] On December 22, 2025, the FTC moved to reopen and set aside the 2024 Rytr final consent order under the Trump administration's AI Action Plan, the first publicly visible signal that the agency's privacy enforcement docket was unstuck.^[7]

The CISA 2015 sunset was then pushed out again by the Consolidated Appropriations Act, 2026, enacted in early February 2026, which extended the statute through September 30, 2026 without amending any of the substantive cyber-information-sharing provisions.^[8] A long-term reauthorization remains unresolved: Senator Rand Paul, who chairs the Senate Homeland Security Committee, has blocked multi-year extensions demanding CISA be barred from "disinformation" work, and the path to a permanent fix is still "murky" according to Federal News Network's congressional staff reporting.^[9]

A separate DHS funding lapse in spring 2026 again stressed CISA operations. By April 2026, CISA Acting Director Nick Andersen was publicly warning House appropriators that the agency's resources were "more limited than I would like" and that many "preparatory activities within the environment, a lot of the outreach that we'd typically be able to do" were not permitted during the ongoing DHS shutdown.^[11] DHS had been unfunded for about two months due to a partisan stalemate over immigration enforcement reforms, employees were called back to the office using funds from the One Big Beautiful Bill Act, and CISA had cancelled plans to onboard summer interns in the CyberCorps scholarship program.^[11] The September 30, 2026 sunset is now the next hard deadline for both CISA 2015 and the broader information-sharing legal protections this article originally warned were lost.

A Self-Inflicted Wound: How the 2025 Government Shutdown Dismantled U.S. Cybersecurity and Consumer Protection