One of the many petitions circulating on the Internet in the wake of leaks about the US government's massive surveillance programs is aimed at major Internet and technology companies. It calls on them to push Congress to investigate and stop the abuses.

This is, of course, a good idea. It may even help, now that some members of Congress are having misgivings about the programs they've worked so hard not to understand. Had companies like Microsoft, Google, Facebook, Apple and Yahoo done this in the first place – and had they been as ardent to protect privacy as they are to collect data on their users – the spying programs might not have metastasized to such a degree.

This could be a turning point for the tech industry. The biggest companies providing cloud-based Internet services, and some smaller ones as well, are under pressure amid increasing public unease about the government's insistence that privacy is all but a dead letter against the threat of terrorism.

They have a chance to regain trust. To do so they will need to rethink a lot of their methods – not least their adoption of systems, based in large part on monetizing their own data-mining, that are inherently insecure in the face of orders from people who command armies, and may be insecure in more general ways.

Let's be clear on one thing: the industry has, at the very least, been forced to cooperate with secret disclosure requests that include orders not to speak publicly about what's going on. It remains possible, their wholesale denials aside, that some or all of these companies have been not just cooperating but actively collaborating with the surveillance state.

We can't know for sure. By design, the system is opaque.

This helps explain why several of these companies have implored the government to make the National Security Agency letter data orders more transparent. They realize that their credibility has taken a serious jolt, and that they are in the position of trying to prove a negative, something that is more difficult when they're told, under threat of prosecution, that they can't talk about it beyond the most vague and meaningless statements.

The tech companies would be more convincing if their industry hadn't been so complicit in the development of the surveillance state in the first place. Silicon Valley and its global analogs made it possible, and have made vast amounts of money in the process as government suppliers. They've been arms dealers not just to American spies but to the world's most repressive governments as well.

Moreover, even the Internet-related tech companies that haven't actively helped the dictators and spies have been creating large businesses based on collecting, massaging and making money off of the data their users and customers provide in their day-to-day use of the services. And even if the companies themselves haven't been abusing their ownership of these giant data collections, they have by definition left themselves and their customers vulnerable to government overreach.

I do not put all of the companies mentioned above in exactly the same category, by the way. While I don't trust Google absolutely, I trust it more than, say, Facebook when it comes to these issues, based on long observation of both. (What should worry you, no matter who you trust today, is the possibility that the next generation of corporate leaders will have different policies.)

It is difficult, moreover, to take their denials of complicity fully to heart. Consider the Yahoo statement about the Prism program. Nothing is going on that should worry us, the company insists. Then look at a line-by-line analysis of the statement by the American Civil Liberties Union's Christopher Soghoian, who makes clear on his personal blog that "Yahoo has not in fact denied receiving court orders … for massive amounts of communications data."

Statements and letters to Congress won't solve their problem, even if Congress by some miracle changed the law to restrict the overweening data gathering and by a greater miracle President Obama – an ardent surveillance-statist leader, contrary to his campaign promises – were to sign it. (The biggest miracle of all would be compliance with such a law by the government.)

The tech companies need to rethink the way they do business entirely. They need to stop collecting so much data in the first place. Then they need to create systems that protect users' data even from people inside the companies, and be absolutely clear about the situations when they can't promise this.

For the rest of us, it's time to look for services and products that provide us with more security. The trajectory of surveillance, government and corporate, suggests we should assume we are being recorded at all times on unencrypted networks, for example. We need to adopt encryption and other countermeasures much more widely. I'll discuss there in upcoming columns.

Meanwhile, I'm hoping the tech companies will grab this opportunity. They can't prove a negative, but they can take positive actions to regain – or gain for the first time – our trust. Will they?