Or, probably, somewhere in between. It seems likely both that the government publicity around the terrorism theme is vastly exaggerating the true threat but also that some level of danger really does exist and these agencies really do prevent some attacks from taking place.

The question is whether the true risk level is acceptable? If it is then we don't need any of the surveillance (which in and of itself is a massive risk to our democracy). The other question is whether the surveillance actually reduces the terrorist risk?

Exactly. These are the kinds of questions we should be asking.

If those with access to the relevant information were willing to give reasonably realistic and honest assessments of the risks involved, then everyone else could make their own judgement about what levels of risk they were willing to accept and our governments could act accordingly.

Of course, the problem is that with such obvious asymmetry of information and power, and with the biased perspective that often seems to result from working in an environment where your job is to deal with the worst of humanity every day, it's rather unlikely that we'll actually get an honest and realistic assessment of the situation and the true risks involved (both from the bad guys and from any unintended consequences of the measures that are supposed to protect us from those bad guys).

We elect our representative (partly) for this reason. One of the advantages of a parliamentary democracy is that members of the parliament could in theory be cleared for full access to information and then could in theory provide the needed oversight. One of the issues for me about the way that GCHQ in the UK and the NSA in the US operate is that this democratic oversight has either been absent or has been ignored. Furthermore the massive data collection programs that these agencies run will allow them to manipulate politicians (which I assume is already done). Also the oversight measures that have been proposed so far are in the UK are totally laughable.