The way the United States intelligence community operates is it doesn't limit itself to the protection of the homeland. It doesn't limit itself to countering terrorist threats, countering nuclear proliferation. It's also used for economic espionage, for political spying to gain some knowledge of what other countries are doing.

Every time we walk on to the field of battle and the field of battle is the internet, it doesn't matter if we shoot our opponents a hundred times and hit every time. As long as they've hit us once, we've lost, because the U.S. is so much more reliant on those systems.

It's OK if we wiretap Osama bin Laden. I want to know what he's planning - obviously not him nowadays, but that kind of thing. I don't care if it's a pope or a bin Laden. As long as investigators must go to a judge - an independent judge, a real judge, not a secret judge - and make a showing that there's probable cause to issue a warrant, then they can do that. And that's how it should be done.

In the United States the White House has appointed two different independent panels who had full access to classified information for the last 10 years that master balance has been in place in the United States, and they found that despite intercepting the calls - everybody in the country, - it had never stopped a single terrorist attack. So the question is, why would these officials be pursuing these policies, if we know they don't work, if they don't stop terrorism?

When governments go too far to punish people for actions that are dissent rather than a real threat to the nation, they risk delegitimizing not just their systems of justice, but the legitimacy of the government itself. Because when they bring political charges against people for acts that were clearly at least intended to work in the public interest, they deny them the opportunity to mount a public-interest defense.

If an NSA, FBI, CIA, DIA, etc analyst has access to query raw SIGINT databases, they can enter and get results for anything they want. Phone number, email, user id, cell phone handset id (IMEI), and so on - it's all the same.

A zero-day exploit is a method of hacking a system. It's sort of a vulnerability that has an exploit written for it, sort of a key and a lock that go together to a given software package. It could be an internet web server. It could be Microsoft Office. It could be Adobe Reader or it could be Facebook.