5 ms·

"First, it’s not clear to us that other governments have any less intrusive surveillance activities." Well, it is clear the US has it. That should be enough. T

"First, it’s not clear to us that other governments have any less intrusive surveillance activities." Well, it is clear the US has it. That should be enough. There are some unknowns unknowns, but this is a known unknown. There are other governments with the same willingness and capabilities of spying on everyone (do not move to China), but most of the countries in the world do not have a Government with both willingness and the technical abilities to do it. And most of the countries do not have a huge and highly sophisticated shadow-government, with multiple agencies working out of the public oversight. Most countries have secret services, but they are a joke compared to what the US is able to deliver. "Second, as a US company, Mozilla is subject to US Laws, wherever we host our servers." Move the company out of the US. I undertsand that it won't be easy, but is the only way to be 100% sure that the US Government will not come requesting data (not that they will not take it anyway, if they are able to) "Third, we’d rather not engage in an arms-race with US government agencies." Read: we are afraid to lead here, because backlash from the government (and the public?) could be too damaging for Mozilla. "We’d rather focus on efforts to change the Law to respect user data wherever it lives." We know so much: the privacy situation in the US is bad, and getting worse very fast. No amount of public discussion or legislation is going to change that. If PRISM is outlawed, even if those responsible are put into prison, they will start the PROSM program, more secretive, more broad. We will know about it on 2037 (maybe not, since by then we will be already living in a fully accomplished Orwell world). By then Mozilla will issue a statement similar to this one, explaining why they are not really taking the necessary steps. Fazit: if even a company committed to freedom and openness like Mozilla is not willing and/or able to take the necessary steps, it shows how unavoidable 1984 is.

foobarbazqux 13y ago
> Move the company out of the US. > Read: we are afraid to lead here... Both the non-profit and for-profit arms of Mozilla are funded almost entirely by Google. It's a pretty safe bet that they'll follow Google's overall lead in dealing with the government. https://en.wikipedia.org/wiki/Mozilla_Foundation https://en.wikipedia.org/wiki/Mozilla_Foundation - "funded almost exclusively by Google Inc." https://en.wikipedia.org/wiki/Mozilla_Corporation https://en.wikipedia.org/wiki/Mozilla_Corporation - "Google pays Mozilla a substantial sum – in 2006 the total amounted to around $57 million, or 85% of the company’s total revenue. [The deal was extended multiple times and currently expires in November 2014.]"
- dochtman 13y ago
  That doesn't really make sense in this case. Mozilla does get a lot of cash from Google, but Mozilla has a strong enough mission (see the manifesto) to make sure it's not a Google sockpuppet.
  - fpgeek 13y ago
    Google's funding isn't the end of the story. There are others (e.g. Microsoft) who would be happy to fund Mozilla. The real question is: How much cash could Mozilla get from non-US sources? I'd guess orders of magnitude less, sadly.
    - foobarbazqux 13y ago
      That's an interesting thought. Do you really think Microsoft would fund a cross-platform browser? Do you think Apple would fund a cross-platform browser? Yahoo is close with Microsoft, so they're out if Microsoft is. Oracle and IBM aren't really consumer facing. Intel, mostly hardware. Facebook's walled garden seems to conflict with Mozilla's core mission. Adobe, possibly. Who else were you thinking of?
      - fpgeek 13y ago
        Based on the rumors (and partially supported by Firefox with Bing), both Microsoft and Yahoo were actively bidding against Google (for the ad revenue, presumably). Microsoft also probably has some interest in supporting Firefox for "browser strategic" reasons (pushing back against WebKit/Blink on mobile, a partner other than Google or Apple for work with on new web standards, etc.). I find it harder to imagine Apple being interested, but perhaps that would change if Blink starts eclipsing WebKit or if they want to push iAds more. More generally, though, the point I'm making is that (almost?) all potential alternative sponsors have extensive US ties and/or interests...
        foobarbazqux 13y ago
        Yeah it's a good point, and probably more relevant than whether it's Google or somebody else in the US.
fpgeek 13y ago
> Move the company out of the US. But that's not enough. If they really want to be free from the US's reach they'd have to: - not do business with any companies under US jurisdiction (oops - Google and Microsoft) - not employ and US citizens or permanent residents - warn employees that they could get arrested if they visit the US - ... And given that Firefox is a very visible browser with significant market share, the US government would probably be very motivated to squash outright defiance.
- gonvaled 13y ago
  You are probably right, but Mozilla should go down putting up a fight. And this is a fight worth losing.
  - fpgeek 13y ago
    So Mozilla should throw away their funding, lay off the majority of their employees and then fight the good fight? How much of Mozilla would be left to do that again?
    - gonvaled 13y ago
      Mozilla would probably die, and that would be a very bad thing. So you are right, this is not the wisest path (it is the bravest, but the graveyard is full of brave people). The other option is to contribute to educate the public by being honest. Giving the false hopes that they provide in their statement, they are doing a disservice to the public by downplaying the risk posed by the government. I would have hoped from more honesty from Mozilla; they should just call it what it is: the US is a police state, so you'd better protect yourself.
- adaml_623 13y ago
  What a load of FUD. If they want to be able to store a bit of customer information that they don't have to pass over to the US government then they just have to move the company and their servers out of the US. Why would a company that has nothing to do with the US have to warn employees that they could get arrested if they visit the US?
DanBC 13y ago
NSA and GCHQ are very good at math and very good at surveillance. Not engaging in an arms race with well funded, very smart, government agencies is probably a good idea. If they think you're a criminal (doesn't apply to Mozilla) they will coerce foreign governments to cooperate - see for example the illegal attacks on Mega or the domain seizures for gambling or torrent sites. But we know, from ECHELON, that they're happy to spy on anyone, and use weird loopholes in the law to do so. Mozilla would need to find a country that had great Internet infrastructure; good strong laws and privacy culture[1]; lack of links to US; comfortable living for staff; etc etc. That's not easy. [1] The US has a strong culture of privacy, which is what makes PRISM so surprising for their citizens. (Not for many other people who were saying it's happening, and have been doing so for a while.)
- gonvaled 13y ago
  "good strong laws and privacy culture[1]" "[1] The US has a strong culture of privacy, which is what makes PRISM so surprising for their citizens. (Not for many other people who were saying it's happening, and have been doing so for a while.)" When will the public accept that "good strong laws and privacy culture" is not in the least a characteristic of the US, and hasn't been for the last 30 years? The US is probably not a democracy anymore, and hasn't been for over 20 years, since Governments are elected by corporate interests (via campaign funding)
  - ricardobeat 13y ago
    That's not the impression you get from people's reactions to PRISM (see "nothing to hide").
- Ntrails 13y ago
  NSA and GCHQ are but 2 on a long list of government intelligence agencies with exceptionally skilled individuals. It is madness to believe that even if you moved to a fully neutral location [if you can find one] you wouldn't be compromised for the information you store, through agents/moles/whatever or otherwise.
Xylakant 13y ago
> "Third, we’d rather not engage in an arms-race with US government agencies." > Read: we are afraid to lead here, because backlash from the government (and the public?) could be too damaging for Mozilla. I read "This is a race we'll probably not win and even if we do, we'd have a lot of power tied up there. But we can win by just changing the rules, so let's do that."
- gonvaled 13y ago
  The US has been changing the rules since decades. The shadow government has adapted to those changes, becoming more and more powerful with each change. The US will pass a couple of "government openness" laws in the coming months (years?). The shadow government will laugh at that, move operation proceedings to the new release, and increase the broadness of surveillance, thanks to improvements in technology. The only way to stop this, until privacy technology is widespread (which I hope will become a huge topic soon), is to stop doing business in the US right now.
  - Xylakant 13y ago
    Note that moving the servers from the US would not be sufficient - you'd have to move the domain to a TLD not controlled by the US or any other entity that they can influence. You'd have to host with a provider independent enough etc. Thus, the stated goal of persona is to remove the need for a centralized auth provider - thus sidestepping the problem of where those centralized servers are located. That's why they don't want to engage in a whack-a-mole game with the US government.
    - gonvaled 13y ago
      So you are saying that Mozilla can be a trustworthy partner in the development of Persona (since it is opensource, I guess?), but not a trustworthy Persona provider (since they are US based). That sounds reasonable, and Mozilla deserves much credit for that.

foobarbazqux 13y ago

> Move the company out of the US. > Read: we are afraid to lead here... Both the non-profit and for-profit arms of Mozilla are funded almost entirely by Google. It's a pretty safe bet that they'll follow Google's overall lead in dealing with the government. https://en.wikipedia.org/wiki/Mozilla_Foundation https://en.wikipedia.org/wiki/Mozilla_Foundation - "funded almost exclusively by Google Inc." https://en.wikipedia.org/wiki/Mozilla_Corporation https://en.wikipedia.org/wiki/Mozilla_Corporation - "Google pays Mozilla a substantial sum – in 2006 the total amounted to around $57 million, or 85% of the company’s total revenue. [The deal was extended multiple times and currently expires in November 2014.]"

dochtman 13y ago
That doesn't really make sense in this case. Mozilla does get a lot of cash from Google, but Mozilla has a strong enough mission (see the manifesto) to make sure it's not a Google sockpuppet.
- fpgeek 13y ago
  Google's funding isn't the end of the story. There are others (e.g. Microsoft) who would be happy to fund Mozilla. The real question is: How much cash could Mozilla get from non-US sources? I'd guess orders of magnitude less, sadly.
  - foobarbazqux 13y ago
    That's an interesting thought. Do you really think Microsoft would fund a cross-platform browser? Do you think Apple would fund a cross-platform browser? Yahoo is close with Microsoft, so they're out if Microsoft is. Oracle and IBM aren't really consumer facing. Intel, mostly hardware. Facebook's walled garden seems to conflict with Mozilla's core mission. Adobe, possibly. Who else were you thinking of?
    - fpgeek 13y ago
      Based on the rumors (and partially supported by Firefox with Bing), both Microsoft and Yahoo were actively bidding against Google (for the ad revenue, presumably). Microsoft also probably has some interest in supporting Firefox for "browser strategic" reasons (pushing back against WebKit/Blink on mobile, a partner other than Google or Apple for work with on new web standards, etc.). I find it harder to imagine Apple being interested, but perhaps that would change if Blink starts eclipsing WebKit or if they want to push iAds more. More generally, though, the point I'm making is that (almost?) all potential alternative sponsors have extensive US ties and/or interests...
      - foobarbazqux 13y ago
        Yeah it's a good point, and probably more relevant than whether it's Google or somebody else in the US.

fpgeek 13y ago

> Move the company out of the US. But that's not enough. If they really want to be free from the US's reach they'd have to: - not do business with any companies under US jurisdiction (oops - Google and Microsoft) - not employ and US citizens or permanent residents - warn employees that they could get arrested if they visit the US - ... And given that Firefox is a very visible browser with significant market share, the US government would probably be very motivated to squash outright defiance.

gonvaled 13y ago
You are probably right, but Mozilla should go down putting up a fight. And this is a fight worth losing.
- fpgeek 13y ago
  So Mozilla should throw away their funding, lay off the majority of their employees and then fight the good fight? How much of Mozilla would be left to do that again?
  - gonvaled 13y ago
    Mozilla would probably die, and that would be a very bad thing. So you are right, this is not the wisest path (it is the bravest, but the graveyard is full of brave people). The other option is to contribute to educate the public by being honest. Giving the false hopes that they provide in their statement, they are doing a disservice to the public by downplaying the risk posed by the government. I would have hoped from more honesty from Mozilla; they should just call it what it is: the US is a police state, so you'd better protect yourself.
adaml_623 13y ago
What a load of FUD. If they want to be able to store a bit of customer information that they don't have to pass over to the US government then they just have to move the company and their servers out of the US. Why would a company that has nothing to do with the US have to warn employees that they could get arrested if they visit the US?

DanBC 13y ago

NSA and GCHQ are very good at math and very good at surveillance. Not engaging in an arms race with well funded, very smart, government agencies is probably a good idea. If they think you're a criminal (doesn't apply to Mozilla) they will coerce foreign governments to cooperate - see for example the illegal attacks on Mega or the domain seizures for gambling or torrent sites. But we know, from ECHELON, that they're happy to spy on anyone, and use weird loopholes in the law to do so. Mozilla would need to find a country that had great Internet infrastructure; good strong laws and privacy culture[1]; lack of links to US; comfortable living for staff; etc etc. That's not easy. [1] The US has a strong culture of privacy, which is what makes PRISM so surprising for their citizens. (Not for many other people who were saying it's happening, and have been doing so for a while.)

gonvaled 13y ago
"good strong laws and privacy culture[1]" "[1] The US has a strong culture of privacy, which is what makes PRISM so surprising for their citizens. (Not for many other people who were saying it's happening, and have been doing so for a while.)" When will the public accept that "good strong laws and privacy culture" is not in the least a characteristic of the US, and hasn't been for the last 30 years? The US is probably not a democracy anymore, and hasn't been for over 20 years, since Governments are elected by corporate interests (via campaign funding)
- ricardobeat 13y ago
  That's not the impression you get from people's reactions to PRISM (see "nothing to hide").
Ntrails 13y ago
NSA and GCHQ are but 2 on a long list of government intelligence agencies with exceptionally skilled individuals. It is madness to believe that even if you moved to a fully neutral location [if you can find one] you wouldn't be compromised for the information you store, through agents/moles/whatever or otherwise.

Xylakant 13y ago

> "Third, we’d rather not engage in an arms-race with US government agencies." > Read: we are afraid to lead here, because backlash from the government (and the public?) could be too damaging for Mozilla. I read "This is a race we'll probably not win and even if we do, we'd have a lot of power tied up there. But we can win by just changing the rules, so let's do that."

gonvaled 13y ago
The US has been changing the rules since decades. The shadow government has adapted to those changes, becoming more and more powerful with each change. The US will pass a couple of "government openness" laws in the coming months (years?). The shadow government will laugh at that, move operation proceedings to the new release, and increase the broadness of surveillance, thanks to improvements in technology. The only way to stop this, until privacy technology is widespread (which I hope will become a huge topic soon), is to stop doing business in the US right now.
- Xylakant 13y ago
  Note that moving the servers from the US would not be sufficient - you'd have to move the domain to a TLD not controlled by the US or any other entity that they can influence. You'd have to host with a provider independent enough etc. Thus, the stated goal of persona is to remove the need for a centralized auth provider - thus sidestepping the problem of where those centralized servers are located. That's why they don't want to engage in a whack-a-mole game with the US government.
  - gonvaled 13y ago
    So you are saying that Mozilla can be a trustworthy partner in the development of Persona (since it is opensource, I guess?), but not a trustworthy Persona provider (since they are US based). That sounds reasonable, and Mozilla deserves much credit for that.