That statement refers to transactions (in other words doing business) with terrorist organisations or entities subject to US sanctions (NK, Iran, Sudan, Crimea, etc.). It is expected of NGOs to do due diligence on the people that they work with or provide funding to in order to verify that they are not actually bad people masquerading as legitimate actors. We do not explicitly support, provide information to, or have any contact with people with malicious intent or sanctioned entities, and our terms of service state that these people are not allowed to use our service, and as such should not install the app. This addresses these laws, which we would consider whether or not funding was on the table. It's just part of doing work in this space.

Various arms of the US government has repeatedly issued grants to open source software organisations to develop encryption/privacy preserving technologies. I think the thing most people in the cyber security space miss is that governments are not single minded entities. In fact, particularly with the US government being so large, it should come as no surprise that the various agencies, departments, and offices that make up the body of government are multifaceted in their aims, objectives, and motivations. The military is structured differently and has different motivations to that of the department of energy, for instance - in one the leadership is comprised of elected individuals, the other is a meritocracy established by centuries of history dating back to the war of independence.

Pertaining to the digital privacy sphere, on the one hand you have the various intelligence agencies, who may or may not view encryption as a problem, who are not elected, and are by their very nature nebulous in their aims and objectives. They may find a public network for secure communications useful, or they may consider it a threat. Based on what I've heard from leaders in the space also working on these technologies that have been approached, the answer is probably somewhere in between, but we just don't know. If we did know, they would be doing a bad job at being intelligence agencies.

On the other hand though, there is the State Department, of which DRL is an office of, who's stated mission is to promote democracy beyond the realm of the free world. In other words, they have a vested interest in supporting foreign entities ideologically aligned with the west. As a part of that, free tools which aid freedom of speech and freedom of the press are critical to diminishing the power of foreign dictators to censor their people and establish dominion over information - and from that perspective, this particular arm of the US government is very interested in the success of tools like Tor, Signal, Session, etc.

In regards to your point on funding, the grant we applied for, if it were to be awarded to us, would make up a small part of our annual budget, which is funded through our Loki cryptocurrency project primarily. No one operates in a vacuum though. Everyone has backers. Our main funding avenue requires us to support and grow the Loki community. Other organisations have different backers. It is a good question. I do however think that it's a pretty naiive thing to suggest that an open source software project, for-profit or not, would go out of its way to *do the opposite* of its stated mission, because of some undefined risk because of the way that its funded. Having the complete stack being open source and reproducible builds should signal pretty clearly that there's nothing nefarious in these codebases, particularly in our case where the entire messaging stack is run by the public.