Re: Tor Project 2008 Tax Return Now Online

[Andrew Lewman <andrew@xxxxxxxxxxxxxx>]

On Mon, 16 Aug 2010 20:32:13 -0700
Julie C <julie@xxxxxxx> wrote:

First off, your enthusiasm and questioning our decisions is great and
encouraged.  Will you help us?

> The larger threat that I see is the Tor Project is absolutely ...
> dare I say it? ... PATHETIC AT MARKETING ITSELF.

Yes, this is by design.  For years we've been a boring R&D organization
working away in relative obscurity.  Only in the past year have we been
forced into the public spotlight.  First was the growing number of
Chinese citizens that found Tor circumvented the GFW just fine, and
protected their privacy when doing so.  Second was the Iranian protests
in June 2009.  We now answer the press questions, appear on tv/radio
shows, panels, and other Internet media.  There's an internal debate
over how much publicity is good versus harmful.  

We've learned that keeping a relatively low profile continues to let us
work on the R&D, rather than writing policy papers and dealing with
bureaucracy.  Many other organizations are great at doing the latter
two. We're happy to subcontract from the latter types of organizations,
which lets us focus on R&D.

> Something has been bugging me the last couple days about the bigger
> picture of the funding issue that came to light with the cryptome
> posting a couple days ago. It became clearer to me today as I was
> driving through my neighbourhood (yes, I am a Canadian) - only
> $500,000 in funding for all of 2008 for the Tor Project?!

Yes, 2 years ago that was more money than we could handle.  It's taken
6-8 months to ramp up to handle more funding and to get everyone
productive.  This includes finding the right people, passing audits,
managing the workload, and getting infrastructure assembled so people
can do their jobs.  

Conversely, think of all we've been able to accomplish with that
$500k.  

> Sorry, Roger and Andrew, but as talented as you are, I think you have
> to make it a priority to get some professional fundraisers on board.
> Anonymity, privacy, free speech, and stuff are absolutely more
> important than a few thousand homeless people in my home town.
> Somebody is not getting the message out, and all of the volunteers
> who believe in these bread and butter moral and ethical issues
> deserve more.

As Paul mentioned later in this thread, we did.  Karen is awesome and
currently handling the fundraising, policy meetings, grant writing, and
marketing for us.  However, she's one person, she could use help.

> Think bigger, please! Who is holding the project back from not
> thinking bigger? Why isn't the UN sending you $50M a year? 

We are self-limiting.  Too much growth, too fast, will kill us.
Bigger isn't always better.  We are a cash and project-based business.
By design, we take on slightly more than we can handle.  Think of a
startup versus a Fortune 50 company.  Like all startups, there is much
more to do than people to do it. That's fine, as it forces us to focus
on what's important.  We don't have an endowment to smooth out the
funding roller coaster.  All of our contracts can be cancelled at any
point in time. We either deliver or die.  

R&D work is much different than writing policy statements, legal
opinions, and producing documentaries.  So far, the UN, IGF, and parts
of various governments don't understand what we say nor what we do.  I'm
happy to keep talking to them and work on something that works for both
organizations.  Education and training seems to be the common ground
where we speak the same language.

We've recently started attracting potential sponsors that want us to
stand up for anonymity in general.  Starting to counter the
surveillance by design mentality of the general populace is a different
focus for us.  Frankly, the EFF and ACLU may be better at this than us,
nevertheless discussions continue. 

> enterprises need your software. All law enforcement needs your
> software. All governments need your software. All journalists, all
> bankers, accountants, lawyers, researchers - everyone who needs to
> have at least some of their communications off the record.

I agree.  We're working with a surprising number of people in those
categories.  However, the vast majority of the world doesn't understand
how the Internet works, nevermind how Tor can help them.  Education is
a big deal which takes time and understanding.  

I can't tell you how many times I've explained to victims of domestic
violence, child abuse, or human rights activists that organizing over
some social networking site is a horrible idea. There are many, many
good things that come out of social networking sites, but too many of
them are careless with private information or not clear in what is
collected, how it is collected, and how it is shared. This fact comes
back to bite people or groups in unexpected ways. In many cases, people
have lost their jobs, been arrested, or put their families and extended
networks at risk because of something on a social network site. 

I don't want people to use Tor because we told them to do so. I want
them to use Tor because they understand the risks and realize they need
it.  

> This is the way to solve the US-centric perception, the fear of big
> government - get everyone to be funding your work. 

This is a very US/Canadian value.  There are plenty of countries out
there where the general population trusts and believes in their
governments.  The average Chinese citizen appreciates that their
government protects them from bad things on the Internet with the GFW.
However, they fear "human flesh search" or corporate espionage and want
protection.  The point is that the world is a complex place, and
privacy/anonymity mean different things to different cultures.  Trying
to figure this out is the challenge.

> And keep it all open source so no one needs to be fearful of anyone else controlling
> it. Get 100,000 servers and relays and bridges out there - why aren't
> Google and Amazon and Microsoft and IBM and others throwing serious
> weight behind you?

There are anonymity and security issues to iron out, a few of which
Paul addresses later in this thread.  We are talking to the ISPs and
cloud providers.  They are large organizations scared of change
and what others may think about them if someone does something bad with
Tor through their IP space.  Everyone focuses on the exceptions of bad
behavior over Tor, very few focus on the vast majority of traffic that
helps someone.  However, we have bridges, exit policies, and lots of
other technologies they could sponsor just as easily.  

This is a long answer to your questions and suggestions.  However, I
encourage the debate.  Even more so, I encourage action to help us.
Thanks!

-- 
Andrew Lewman
The Tor Project
pgp 0x31B0974B
+1-781-352-0568

Website: https://www.torproject.org/
Blog: https://blog.torproject.org/
Identi.ca: torproject
skype:  lewmanator
***********************************************************************
To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxxx with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/