Most of the secrets the CIA has are about people, not machines and systems, so I didn't feel comfortable with disclosures that I thought could endanger anyone.

We need the security standards to apply to the internet. We need to be able to trust that when we send our emails through Verizon, that Verizon isn't sharing with the NSA, that Verizon isn't sharing them with the FBI or German intelligence or French intelligence or Russian intelligence or Chinese intelligence.

If I target for example an email address, for example under FAA 702, and that email address sent something to you, Joe America, the analyst gets it. All of it. IPs, raw data, content, headers, attachments, everything. And it gets saved for a very long time - and can be extended further with waivers rather than warrants.

I would argue that security and liberty, security and privacy are not actually opposing. The only place those can be oppositional is in the realm of rhetoric but not fact.

I know that fundamentally, changes to the fabric of the internet, and sort of our methods of communication, can enforce our rights.

The bare bones tools for a cyber-attack are to identify a vulnerability in the system you want to gain access to or you want to subvert or you want to deny, destroy, or degrade, and then to exploit it, which means to send codes, deliver code to that system somehow and get that code to that vulnerability, to that crack in their wall, jam it in there, and then have it execute.

The courts were afraid to challenge executive declarations of what would happen. Now, over the last year, we have seen - in almost every single court that has had this sort of national-security case - that they have become markedly more skeptical.