The Washington PostDemocracy Dies in Darkness

Apple and Dropbox say they don’t support a key cybersecurity bill, days before a crucial vote

October 20, 2015 at 7:15 p.m. EDT
Apple CEO Tim Cook. (AP Photo/Marcio Jose Sanchez, File)

Apple and Dropbox said Tuesday that they do not support a controversial cybersecurity bill that, according to critics, would give the government sweeping new powers to spy on Americans in the name of protecting them from hackers.

The announcement by the two companies comes days before the Senate expects to vote on the legislation, known as the Cybersecurity Information Sharing Act, or CISA.

"We don't support the current CISA proposal," Apple said in a statement. "The trust of our customers means everything to us and we don't believe security should come at the expense of their privacy."

Dropbox said that the bill needed more privacy protections in order to win its support.

"While it’s important for the public and private sector to share relevant data about emerging threats," said Amber Cottle, head of Dropbox global public policy and government affairs, "that type of collaboration should not come at the expense of users’ privacy."

Apple and Dropbox join a number of tech companies who say they're against the bill. In recent days, Yelp, reddit, Twitter and the Wikimedia Foundation — which runs Wikipedia — have all said that they oppose CISA.

Other Silicon Valley firms including Google, Facebook and Yahoo have voiced their concerns about the bill through a trade group that represents them in Washington called the Computer and Communications Industry Association.

The two firms' entry into the debate — particularly Apple, which rarely wades into Washington policy fights — complicates last-minute efforts to pass the bill, which has bipartisan backing and is expected to get a vote next Tuesday. One of its co-sponsors, Dianne Feinstein, (D-Calif.), the ranking member on the Senate Intelligence Committee, said Tuesday that the bill simply allows companies to share information on “cyber threats” with the government — not personal data.

"A bank would not be able to share a customer's name or account information," Feinstein said. "Things like Social Security numbers, addresses, passwords and credit information would be unrelated to a cyber threat and would, except in very exceptional circumstances, be removed" before being transmitted to authorities.

But a major critic of the legislation, Sen. Ron Wyden (D-Ore.), said the sheer number of tech companies aligned against the bill shows that it still lacks sufficient privacy safeguards.

"Sharing information about cybersecurity threats is a worthy goal," said Wyden. "Yet if you share more information without strong privacy protections, millions of Americans will say, 'That is not a cybersecurity bill. It is a surveillance bill.' "

Still, CISA's supporters estimate they have roughly 70 votes in the Senate, enough to approve the White House-backed legislation.

Apple has positioned itself aggressively on user privacy, encrypting messages between iPhone users and critiquing the government for asking the company to stop doing so.