Some of the biggest names in tech including Google, Yahoo, Facebook and T-Mobile have come out against a controversial cybersecurity bill, arguing that it fails to protect users’ privacy and could cause “collateral harm” to “innocent third parties”.

In an open letter published on Thursday the Computer and Communications Industry Association (CCIA), a trade group representing those and several other major tech firms including eBay and RedHat, came out staunchly against the Cybersecurity Information Sharing Act (Cisa).

The bill, which has bipartisan support, would, among other things, allow companies to share users’ personal information with the US government in exchange for immunity from regulators and the Freedom of Information Act. It will receive a Senate vote later this month.



“CCIA is unable to support Cisa as it is currently written,” wrote Bijan Madhani, policy counsel for CCIA. “Cisa’s prescribed mechanism for sharing of cyber threat information does not sufficiently protect users’ privacy or appropriately limit the permissible uses of information shared with the government. In addition, the bill authorizes entities to employ network defense measures that might cause collateral harm to the systems of innocent third parties.”



Not everyone in the Senate is sold, despite a presidential endorsement, and news of the CCIA’s opposition was welcome to the bill’s opponents in the legislature.

“CCIA represents some of the biggest names in tech and their opposition to the current version of Cisa is a shot in the arm for those of us fighting for privacy and security,” said Senator Ron Wyden of Oregon. “These companies understand it is untenable and bad for business to enact flawed ‘cybersecurity’ policies that infringe on users’ privacy while doing little to prevent sophisticated hacks. By coming out against this bill, CCIA’s members, including Google, Yahoo, and Facebook, have made the clear statement that they have their users’ backs.”

The bill was originally pitched as a way to permit tech companies to share “anonymized” user information with the Department of Homeland Security (DHS). DHS has itself come out against the bill, since it would then be compelled to share the information on to “relevant entities”, widely assumed to include the NSA and FBI.

Cisa has raised concerns about surveillance among industry experts.



“Members of Congress should pay attention: nobody wants this bill,” wrote Evan Greer, policy director of activist group Fight for the Future, which has long opposed the bill. “Not the public, not security experts, and not even the industry it’s supposed to protect. The safety of internet users’ personal information is more fragile than ever, if Congress decides to make matters worse, everyone will know it was the result of ignorance and corruption.”

Lauren Weinstein, whose history with technology and privacy goes back to Arpanet (the internet’s great-grandfather) at UCLA, said he didn’t necessarily believe that the government had anything nefarious planned for the data – he just didn’t believe they could competently secure it, either.

“The government has shown a striking inability to secure their own house,” Weinstein said. “We see this again and again and again. You know the recent devastating cases – the Office of Personnel Management case had some of the most critical information people ever give the government. You can’t get your biometrics back – it’s a real hassle to get your fingerprints changed.”

Indeed, there is concern among data experts that simply putting multiple corporate data sets in the same place could be used to create comprehensive profiles containing personally identifying information. It could even do so by accident.

Elaborate user information is organized – primarily by advertisers – so that users are split up into multiple categories: one person may be in a group scheduled to receive ads for cat lovers, a group likely to change toothpaste brands, and a group of Honda owners. But the companies take precautions to make sure they don’t accidentally create individual digital dossiers when they’re simply trying to serve ads.

“[Marketers] are [compiling user data] in a so-called ‘clean room’ where I’m not touching the data and an independent party doesn’t have access to the data,” explained Jon Mandel, whose company PrecisionDemand (since sold to AOL) worked with television advertisers. “It’s all in a clean room, it’s all on the up and up, nobody has everything so nobody can figure it all out.” The problem, Mandel said, is that one bad actor – or even a curious actor – can reverse the process giving them unprecedented access to personal information.

Some companies that would be eligible to participate have come out in favor of the bill, notably Experian, the data broker that recent lost 15m sets of T-Mobile customer data. “Experian supports legislation that would facilitate greater sharing of cyber threat information among appropriate private and government entities,” the company said in August. “Congress has the responsibility to balance the need for facilitating greater information sharing, and thereby enhancing cybersecurity, with important consumer privacy concerns.”