Stallman was right about one thing: you can't trust closed-source software. Even if the claim isn't true now, it's highly plausible that back doors have been or will be inserted for a gov't agency at some point.
Based, exactly, on what?
I've worked in both open and closed source and I can tell you that while the government does ask for these things (you can read that much in the news, which is how I know of it), their actual ability to get them is far less than you think (this, I know based on how projects are done).
For one thing, a lot of the companies are international. For another, their ability to comply with these sorts of things in secret
is very much in doubt and, what's more, they know it. They have to weigh the value of consent against the big, black eye they get if they get caught -- and they had better plan on getting caught. Think: Google and China.
It isn't always needful to see the source code, after all.
Any secret hooks in a browser
, in particular, are eternally vulnerable to being exposed. A lot of individuals and a lot of companies
have the skill to monitor TCP/IP networks if for no other reason than to keep them smoothly running.
When the "secret patch" reports in, no matter how seldom it does so, it is eternally at risk for being uncovered. And, even if the data inside is perfectly encrypted and secure, the IP addresses cannot be and so ordinary "traffic analysis" can and will be done.
That will render the content largely irrelevant in terms of the blow-back. The problem is, once the patch is known, it's all downhill. (This doesn't even cover the whistle blower scenario, either).
Open source, it is true, makes this even more difficult, because the encryption can't be kept secret, but detection is an important issue for these things.
Not that I think either scenario is likely or plausible, but the US gov could sooner enforce restrictive and oppresive BIOS's through hardware import bans for example, before they could ban an FOSS project.
What's more, this is what they have
done. Until the Clinton administration, there was a long, concerted, and successful effort to keep strong encryption out of the commercial sector by the US.
The main way they did so was by refusing to have export licenses for certain kinds of encryption hardware going to certain countries. They also required such licenses for software (though in the enterprise, where this mattered the most, the hardware was actually the most important overall).
But, once the 'net took off in a big way and the lack of strong encryption was clearly going to stand athwart commerce (and potentially undermine US dominance), it all went away.
PS, one of the biggest users of open source is. . .the US government "Secrecy Industry" itself. They can get all this great stuff "for free" and put in all the private hooks they need. Since they don't redistribute (by definition), they don't have to "give anything back" not even for GPL stuff.