Transparency, Openness, and Our 2016 and 2017 Financials
After completing a standard audit for 2016, our 2016 federal tax filings and audit, along with our 2017 federal tax filings, are available. We publish all of our related tax documents because we believe in transparency.
The 2016 documents are alas quite late. We followed the recommendation from 2015 of getting fresh auditors (because in theory fresh auditors will look for new things), but that process turned out to be way more bumpy than anybody expected. We’re sorry about that. On the plus side, we have the 2017 tax filing document available for you now, too.
In 2017, we changed our fiscal year to be "July through June" — having our fiscal year end right in the middle of fundraising season (Dec 31) makes it harder to plan budgets. So expect our next standard audit to cover "January 2017 through June 2018," and expect our next financial document to be for the same period (18 months). The audit document and tax filing for the six month period ending 06/30/2018 should be available in January.
Transparency for a privacy project is not a contradiction: privacy is about choice, and we choose to publish all of these aspects of our work in order to build a stronger community. From a development perspective, transparency doesn't just mean that we show you our source code (though of course we do). The second layer to transparency is publishing specifications to explain what we intended to implement in the source code. And the layer above that is publishing design documents and research papers to explain why we chose to build it that way, including analyzing the security implications and the trade-offs of alternate designs.
The reason for all these layers is to help people evaluate every level of our system: whether we chose the right design, whether we turned that design into a concrete plan that will keep people safe, and whether we correctly implemented this plan. Tor gets a huge amount of analysis and attention, from professors and university research groups down to individual programmers around the world, and this consistent peer review is one of our core strengths over the past fifteen years.
Starting partway through 2016, the board has also started publishing the minutes for each board meeting. The minutes aren't particularly exciting—and that's a good thing—but we hope they contribute a new angle to transparency.
Some observations to help you read through the 2016 and 2017 financial documents:
- Tor's annual revenue in 2016 was stable compared to 2015, at almost $3.2 million. That's good news because it shows our stability during Shari Steele's transition to becoming our Executive Director.
- In 2017 the revenue grew by almost $1 million. That's great, but what's even more great (check out page 41) is that most of the growth came from increased support by foundations and by corporations (Mozilla and DuckDuckGo). We've been wanting for several years now to get away from having too much of our budget centered on US government funding, and 2016 and especially 2017 represent solid progress toward this goal.
- In terms of percentages, while 2015 saw 85% of our funding coming from US government sources, 2016 saw the fraction drop to 76%, and in 2017 we're down to 51%. The numbers and percentages over the years deserve their own blog post to make it clear how we classified everything, which I'm going to save for later so I don't delay this post further.
- Tor's budget, even at the 2017 level, remains modest considering the number of people involved and the impact we have. And it is dwarfed by the budgets that our adversaries are spending to make the world a more dangerous and less free place.
- Check out the comment sections on the previous posts for previous years' versions of the usual "omg government funding" and "omg transparency" discussions. You might find this comment more useful than the rest.
- When people ask me about Tor funding, I explain that we have four categories of funders: (A) Research funding from groups like the National Science Foundation to do fundamental research on privacy and censorship, including studying how to improve Tor's performance and safety, and inventing new censorship circumvention techniques. (B) R&D funding from groups like Radio Free Asia and DARPA to actually build safer tools. Different funders might have different audiences in mind when they help us make Tor Browser safer and easier to use, but they want the same things out of Tor Browser: in all cases we make all of our work public, and also remember that anonymity loves company. (C) Deployment and teaching funding from organizations like the US State Dept and Sweden's foreign ministry to do in-country security trainings, user-oriented documentation, and otherwise help activists around the world learn how to be safer on the internet. (D) Core organizational support, primarily from individual donations (that's you!) and the Mozilla match, to cover the day-to-day operations of the non-profit, and most importantly to let us spend time on critical tasks that we can't convince a funder to care enough about.
- More generally, I should take a brief moment to explain how funding proposals work, for those who worry that governments come to us wanting to pay us to do something bad. The way it works is that we try to find groups with funding for the general area that we want to work on, and then we go to them with a specific plan for what we'd like to do and how much it will cost, and if we're lucky they say ok. There is never any point where somebody comes to us and says "I'll pay you $X to do Y."
- In 2016 we counted $630k in "donated services," that is, volunteers helping with translations, website hosting, and contributed patches (thank you!). In 2017 we started accounting for donated services differently, by writing about them in the attachments at the end rather than directly in Schedule D.
- The 2017 form has a "Schedule B Contributors" list, which it is standard practice for the accountants to anonymize (in case some contributors want to stay anonymous). Here's how they match up to funder names: contributors #1-6 correspond to SIDA, NVF, Mozilla, DRL, NSF part one, and NSF part two (I'm not sure why they were split up); and contributor #7 is a grant from the Knight Foundation for the Library Freedom Project.
In closing, remember that there are many different ways to get involved with Tor, and we need your help. For examples, you can donate, volunteer, and run a Tor relay.
In terms of percentages,…
In terms of percentages, while 2015 saw 85% of our funding coming from US government sources, 2016 saw the fraction drop to 76%, and in 2017 we're down to 51%.
Wait until Yasha "I-can-haz-FOIA" Levine discovers this paragraph to produce another one of his repugnant "news" articles. Thankfully at this rate Yasha will be out of business in 2024.
Gosh, is he even still a…
Gosh, is he even still a thing?
While I admit that it is easy to poke fun at him for not understanding how the security field works, people like that thrive on attention and outrage. So if you do think the articles are unhelpful, the right thing to do is to stay strong and not give in to the temptation to keep bringing it up.
There's so much important and hard work to do in making stronger tools, and in helping people understand why stronger tools are needed, and at the same time there are many well-funded groups trying to undermine these goals and looking for ways to drive us apart. We need to be aware of how the attention economy works, and help everybody stay focused on these long-term goals.
Thanks!
Thanks!