When the lights go out at a power plant sometime in the future, we're going to know that that's a consequence of deprioritizing defense for the sake of an advantage in terms of offense.

When we have some horrible terrorist attacks happen in some country we see in the recording that follows, that the intelligence community already knew about these people in advance. We know that these countries were involved in intelligence sharing premiums, that they benefited from mass surveillance, and yet they didn't stop the attacks. Yet at the same time we immediately see intelligence officials running to the newspapers and claiming that we need more surveillance, that we need more intrusion, that we need more expense of powers because it could have stopped an attack.

Are our competitors - for example, China, which is a deeply authoritarian nation - becoming more authoritarian or more liberal over time?

When I was working in Japan, I created a system for ensuring that intelligence data was globally recoverable in the event of a disaster. I was not aware of the scope of mass surveillance. I came across some legal questions when I was creating it. My superiors pushed back and were like, "Well, how are we going to deal with this data?" And I was like, "I didn't even know it existed."

The Iraq war that I signed up for was launched on false premises. The American people were misled. Now, whether that was due to bad faith or simply mistakes in intelligence, I can't say for sure. But I can say it shows the problem of putting too much faith in intelligence systems without debating them in public.

In liberal societies we don't typically require citizens to rearrange their activities, their lives, the way they go about their business, to make it easy for the police to do their work.

The bare bones tools for a cyber-attack are to identify a vulnerability in the system you want to gain access to or you want to subvert or you want to deny, destroy, or degrade, and then to exploit it, which means to send codes, deliver code to that system somehow and get that code to that vulnerability, to that crack in their wall, jam it in there, and then have it execute.