I think targeted surveillance is not enough - if you find a suspect, I think you need to take the bulk surveillance data and look at what that person communicated in the past and whether he is indeed a suspect, not just watch him only from this point on.

Considering the bulk approach is what they've been doing for 10 years or more and terrorist attacks continue to happen, usually by people the intelligence agencies already identify as risks, it doesn't seem to be at all effective.

The bulk approach leads to a saturation of data. That doesn't make things easier, it complicates them.

Isn't that what startups do these days? Collect every piece of damn information from each user visiting their site? Log when they hover over a link and all?

Morals aside, startups are after typical behavior. When you do analytics, you normally want to discover things something between 5% to 90% of your users. Most companies even have problem for getting into that 5% limit because it is too small.

Terrorists are a few hundred, spread through the billions of people. Or, on the same kind of numbers, around 0.0000001% of the people the NSA spies on.