Indeed, but my point is, in addition to be worth a lot, it's difficult to implement, and it's very fragile. Every time they use it, they gamble its secrecy, hence its effectiveness. So they won't use it for petty reasons, only for genuine national security matters.

The problem isn't that NSA works on ensuring national security: it's that the scope of what they consider national security, and thus justifies extra-legal measures in their eyes, grows unreasonably, becoming a threat to the robustness of democracy.

A spy agency's ideal environment is totalitarian, not democratic. For a starter, they're scared of free speech and accountability. There must be counter-powers, cancelling their natural tendency to push towards totalitarianism (this is in no way specific to the USA).

> If they decide they don't like you there are all sorts of other ways [than courts] they can screw with you.

Yes, but those ways don't scale. You can screw with a couple of people you dislike, but not with hundreds or thousands of people simultaneously.

Bureaucrats have expertize, inertia, the ability to sabotage many things, long term stable positions, and care about how things actually are, rather than how they look to the average voter. In many cases, including this one IMO, politicians have the appearance of control, but very little actual latitude in practice.

If you want a cruel but funny illustration of this, may I suggest that you read [http://www.amazon.com/The-Complete-Yes-Minister-ebook/dp/B00...] or watch [http://www.amazon.com/Open-Government/dp/B0015KOTY2] Yes Minister? It compellingly illustrate how an administration can manipulate a politician, what they call the "house training" of a minister.

That said, politically originated policy turned the FISA Court into a Star Chamber making Supreme Court type decisions, and broadened the scope of NSA's role from spying on the Russians to spying on humanity.

Politicians can curtail those activities as well, either by making explicit policy changes, or by defunding things strategically. It requires courage.

That is true, but it's true for every attacker, not just the government, which changes the situation quite a bit. There is a very strong incentive for security experts to look very carefully at every patch to, say, OpenSSL. Few things are better marketing for a security firm than revealing a critical hole in security infrastructure.

In fact, the high price of such an exploit on the black market works in our favour as well. Tons of black-hats are looking for holes, and when they find and sell one, the subsequent exploitation is bound to raise some red flags and eventually point white-hats in the right direction.

Basically, "You can fool all the people some of the time, and some of the people all the time, but you cannot fool all the people all the time"

Suddenly, Dijkstra's insistence on developing the proof together with the program and providing it to any interested person doesn't seem to be the ridiculous idea that some people consider it to be, does it?

-- Don Knuth