Many of the world’s top technology companies are against cybersecurity plans before US Senate on privacy grounds, according to a new poll
Senator Ron Wyden has been scathing in his distaste for the Cybersecurity Information Sharing Act currently before the US Senate. Photograph: Bloomberg/Getty Images
Sam Thielman in New York
Wednesday 21 October 201522.37 BS
Twenty-two of the world’s top technology companies are firmly against the controversial Cybersecurity Information Sharing Act (Cisa) now on the floor of the Senate, according to a new poll by internet activists Fight for the Future.
The poll lists Apple, Google, Twitter and Wikipedia as opposing the legislation while Comcast, HP, Cisco and Verizon are among the 12 companies who back or have remained silent on the bill. Cisa is aimed at tightening online security but has been criticised as infringing on civil liberties and privacy.
The bill could come up for a preliminary vote as early as Wednesday. Within the Senate itself, Cisa has both bipartisan support and bipartisan opposition. US Democratic senator Ron Wyden of Oregon was succinct in his distaste for the legislation before the body on Tuesday afternoon, addressing his comments to President Barack Obama: “I heard for days that this bill would have prevented the OPM [Office of Personnel Management] attack,” Wyden said. “After technologists reviewed that particular argument, that claim has essentially been withdrawn.
“There is a saying now in the cybersecurity field, Mr President: if you can’t protect it, don’t collect it. If more personal consumer information flows to the government without strong protections, my view is that’s going to be a prime target for hackers.”
Even the Department of Homeland Security, designated the entry point for all the information from the bill, has come out strongly against it, saying that it “could sweep away important privacy protections”.
Few companies that support the bill have issued public statements in favor of its current version, though many lobbied on an earlier version of the bill. Some of those companies, notably Apple, Facebook and Google, now oppose it.
Apple in particular came out swinging against the bill on Tuesday evening, issuing a statement saying that it did not support “the current Cisaproposal,” to the Washington Post. “The trust of our customers means everything to us and we don’t believe security should come at the expense of their privacy.”
With respect to the apparent policy reversals of companies that have supported the bill in the past, Fight for the Future campaign director Evan Greer said she thought private industry had simply read the writing on the wall.
“I think these companies recognize that this is a supremely unpopular piece of legislation among their users,” she said.
“Internet users have been opposing this kind of legislation for years; I think the Senate should consider that the same users that led revolts against these companies are also voters.”
Tech giants warn cybersecurity bill could undermine users' privacy
The bill would allow private industry to share user information with the Department of Homeland Security, which would be compelled to share it across “relevant government agencies”, presumably including the Federal Bureau of Investigation (FBI) and the National Security Agency (NSA). The bill has been touted by its supporters, notably the US Chamber of Commerce, as entirely voluntary, but in fact, as Wired points out, other such “voluntary” programs mandate the kind of data reported and the frequency of the reports.
Restrictions on the kinds of data private industry can compile from customers are significantly more lax than those within the government itself, and the granular levels of detail businesses could offer the government about user behavior – which are currently used primarily for advertising – have become a heated topic of debate.
Fight for the Future’s list doesn’t just cover Cisa; the group also breaks down industry support for the NSA-backed plan to insert “back doors” into cryptography and whether respondents support reform of the Electronic Communications Privacy Act, or ECPA (Reagan-era legislation which allows law enforcement to request all electronic messages older than six months by serving the provider with a subpoena, rather than a search warrant).
Fight for the Future’s scorecard highlights where companies land on mass surveillance.
With respect to the ECPA, Microsoft is currently in the midst of a pitched legal battle with the Department of Justice over its demands for access to emails held on a server in Ireland. Microsoft argues that the case has broad implications for the ability of American companies to conduct business internationally.
Three of the companies surveyed by Fight for the Future, Verizon, Xerox and Priceline, take the government line (or refused to answer the survey) on all three issues – cryptographic back doors, voluntarily sharing user info with the US government, and keeping old user info easy to obtain by authorities.
But far more in the industry oppose the whole batch of programs, largely through their proxies at industry trade associations, some of which have had changes of heart over the bill’s long life:
- The Computer and Communications Industry Association, representing Google, Facebook, Yahoo and several others: “Cisa’s prescribed mechanism for sharing of cyber threat information does not sufficiently protect users’ privacy or appropriately limit the permissible uses of information shared with the government. In addition, the bill authorizes entities to employ network defense measures that might cause collateral harm to the systems of innocent third parties.”
- The Business Software Alliance (BSA), representing Apple, Adobe, Dell and HP, among others, did an abrupt about-face. From August: “It is important to advance legislation that removes the legal barriers that discourage information sharing between the public and privates sectors while protecting consumer privacy, and that’s a critical balance to reach.” And then, from September, after negative coverage: “For clarity, BSA does not support any of the three current bills pending before Congress, including the Cybersecurity Information Sharing Act (Cisa).”
- Salesforce, represented by the BSA, felt the need to go further: “Salesforce does not support Cisa and has never supported Cisa.”
- More broadly, Microsoft’s chief legal officer, Brad Smith, said that US attitudes toward privacy had become damaging to the ability of the tech sector to work abroad. Calling the right to privacy “fundamental”, Smith wrote: “It is untenable to expect people to rely on a notion of privacy protection that changes every timesomeone else moves their information around. No fundamental right can rest on such a shaky foundation.”
- And Twitter, the day before the bill was reintroduced:
Greer said objections to the bill extended to concerns about basic competence. Cisa, she said, would put sensitive information in the hands of a government that is regularly and easily hacked “at a time when people’s online data is so fragile”.
“The concerns around this bill go so far past privacy,” Greer said. “People don’t trust the government or large corporations with their data anymore. We need mechanisms to hold them accountable and this bill goes in the exact opposite direction.”
