I think this is less a story of the NSA/GCHQ getting caught with their pants down than it is Google and Yahoo getting caught. According to yesterday's leaks, Google and Yahoo were (and continue to in Yahoo's case) sending customer data between disparate locations across the globe
unencrypted. That means that not only could NSA/GCHQ have been pulling data from it - so could China, Russia, Iran, any other nation with a reasonably developed intelligence service, organized crime syndicates, etc. We know that they collect unencrypted data against their targets. Every intelligence service does using whatever means legally available to them. That's the nature of collecting intelligence. The NSA isn't going to hurt their bottom line, but failing to take proper security measures to secure their customers' data might.
The outrage that's been pervasive throughout the tech community is based on the idea that the NSA is collecting data on everyone. This article bases a good deal of its argument on that assumption. All of the leaks have dealt with their sources and methods, though - not their targeting. I've mentioned it in previous comments, but the media does a huge disservice by not giving us any insight into who they're targeting. If the NSA/GCHQ is targeting regular people/business executives/members of their own country's government, show the evidence and let them face judgment for it. Telling people that they could be conducting surveillance on everyone does nothing but generate fear and hype, tip off legitimate intelligence targets, and now possibly cause financial damage to major internet companies.
Some problems from the article that I'd also like to address, since I see them so often:
* The NSA claims that it targets only foreigners, but it needs only 51 percent certainty that those targets are actually outside the US. That’s pretty much a coin toss.*
The whole 51 percent thing came from the Washington Post's original writeup on the PRISM slides, The quote was:
The supervisor must endorse the analyst's "reasonable belief," defined as 51 percent confidence, that the specified target is a foreign national who is overseas at the time of collection.
The NSA's wording quoted by WaPo is "reasonable belief"; WaPo's wording is "51 percent confidence". Nowhere in any of the leaked documents does anyone ever mention "51 percent", nor is it mentioned in any Congressional hearing to date. The phrases "reasonable belief" and "reasonable articulable suspicion" do come up. In the Congressional hearing from earlier this week they discuss the differences between that and "probable cause", which is a much higher standard, but to say that an NSA analyst could flip a slightly weighted coin to meet the legal criteria for targeting under FAA 702 authorities is disingenuous.
Meanwhile, the odds of an American being killed in a terrorist attack, including overseas, are about 1 in 20 million. “Your odds of dying in a terrorist attack are still far, far lower than dying from just about anything else,” the Post noted.
It's interesting that the author specifically mentions overseas locations - the author forgot about the military in doing so. It's worth noting that the NSA is an organization subordinate to the Department of Defense, and one its primary responsibilities is to provide signals intelligence to military. The same military which has employed quite a few Americans in hostile areas overseas, Since there are fewer than 20 million Americans serving in the military, one could use that figure to conclude that no serviceman has been killed during the past decade by anyone affiliated with a known terrorist organization. I recently visited a family member being treated at a military hospital. It was a bit shocking seeing the number of people moving past me in their wheelchairs using their 1-3 remaining limbs for propulsion and thinking to myself that these were the lucky ones. You can debate the merits of war and whether or not they should have been over there in the first place, but claiming that today Americans aren't getting killed by people working for the same organization that killed three thousand Americans back in 2001 is just wrong.
But in 2011, when the surveillance program was firmly in place and the anti-terrorism laws long since passed, there were nine recorded attacks in the US deemed as terrorism.
The NSA doesn't have the authority to target people on US soil. This is written in the law, rehashed at every Congressional hearing, and even confirmed by Snowden's own leaks [1]. If an international terrorist group like Al-Qaeda struck the US again, it would be fair to call out the NSA for failing to protect US citizens. You can't fault them for failing to prevent a terrorist attack hatched entirely on US soil by US persons, which is why Congress call the FBI director to answer for Boston bombings, not the NSA director.
[1] http://www.documentcloud.org/documents/758651-1qcy12-violati... (see page 6 - the section on "roamers")