"Sixteen months before the attacks on America, our organisation was running a new method of finding terrorist networks that worked on focusing on ‘smart collection’. Their plan was rejected in favour of a much more expensive plan to collect all communications from everyone."

“The US large-scale surveillance plan failed. It had to be abandoned in 2005. Checks afterwards showed that communications from the terrorists had been collected, but not looked at in time.”

“This is the research we did online for the 9/11 attacks ... we gave this briefing internally at the CIA, they said, 'how'd you know all this stuff?' because at the same time one of the emails had the date ... 9/11 as the attack date that was given”

“Incompetence at this scale, when they're doing things at this scale, is really dangerous, you could end up on a kill list without knowing what the criteria is to get on there or what the criteria is to get off.”

“In the early summer, the Russians started to train or exercise along the border with Czechoslovakia. I started looking at the communications they were using to move around and that's when I started to pick up some very small number of unique things that was different from a normal training programme. So I started to capture that, and I said: it's obvious that they're going to invade. It was only two days later that they actually invaded”

“This approach costs lives, and has cost lives in Britain because it inundates analysts with too much data. It is 99% useless. Who wants to know everyone who has ever at Google or the BBC? We have known for decades that that swamps analysts,”

“Since '1' identifies anyone in the regional zone 1 of the world, that's the US, Canada and some of the islands - it's right there in the front of your white pages book ... all they have to do is use that as a base of knowledge to go in to their entire database and count all of the phone numbers there that had a one in them, right-and then the ones are in the United States and then they'd have a count of how many Americans are in the database and how often each one's there. And yet they claim they can't do that, which is false. You can do the same thing with email, with service providers, IPs and things like that.”