It's hard to take on the surveillance state when you have to make a living and all the money and jobs are in surveillance and surveillance based business models.
I think there is a distinction to be made between surveillance and data, and I do not necessarily think you need to go full cypherpunk to make a meaningful difference. The cat is well out of the bag on data collection and analytics and it will be that way forever.
However, people working within institutions that contain sensitive data can help affect positive change from the inside as well as the outside. Be a voice for the security of user data within your organization, and do what you can to meaningfully contribute to methods that increase user anonymity and business models that do not require being excessively intrusive into the personal details of others. There is something you can do everywhere, and it is far better to have people privacy-minded even inside of the classical "surveillance" companies than having these companies run recklessly without a voice for the user. In fact, it may even have more impact than yet another frontend for yet another OTR implementation.
I hear you, but whether or not something is difficult is orthogonal to whether or not it's morally right. You don't get off the hook because doing the right thing is hard.
However, people working within institutions that contain sensitive data can help affect positive change from the inside as well as the outside. Be a voice for the security of user data within your organization, and do what you can to meaningfully contribute to methods that increase user anonymity and business models that do not require being excessively intrusive into the personal details of others. There is something you can do everywhere, and it is far better to have people privacy-minded even inside of the classical "surveillance" companies than having these companies run recklessly without a voice for the user. In fact, it may even have more impact than yet another frontend for yet another OTR implementation.