[tptacek]

I think it's not the kind of question that's best asked of companies. Companies should commit not to collect abusable data in the first place.

Employees, on the other hand, can in fact pledge not to assist the DOJ, even if "correct process" is used. If enough of them pledge that, companies will have to adjust their retention practices, lest their data function as a time bomb waiting to blow their teams up.

I think if you're going to mirror NeverAgain.tech, don't water it down. But the bigger issue is: stop looking to companies to make promises. People promise. Companies can only posture.

[bermanoid]

Ok, but given the starting premise, "what's a pledge that we can coerce companies into signing?", what would you shoot for, instead?

To me, the bit where companies would need to agree to not implement backdoors into encryption protocols is actually pretty meaningful. You know that the evil shitfuck companies like Palantir are not going to sign on with that clause in place, but they weren't going to listen, anyways.

If Facebook signs on, though, it could actually be a toothy, verifiable commitment.