Something missed in this is that prior to the NSA, surveillance was an active thing. It's now a passive thing. Instead of saying "hey, let's go bug MLK's hotel room" the act is now "hey, let's parse MLK's cell phone recordings for the past three years and see if we can find anything." That's why everything but the last point - "law" - is moot. Yeah, the NSA can't really get into TOR now but only a fool plans based on the current capability of an organization with unlimited storage. And really, even the "law" part of it is moot, because the NSA is already in violation of their charter.
What is your perspective on meshnets and darknets? Only connecting to others in a group or people you individually trust seems like a fantastic way to avoid being monitored. I'm aware that encryption can be broken with time, but if you change the encryption key at timed intervals, it would be rather difficult to crack the network. I've actually been thinking about creating a Hubski darknet which trusted Hubski users could connect to. Thoughts?
I've been very optimistic about the capabilities of darknets/meshnets, especially cjdns, since it is simple to implement and still a very well thought out way of routing and building a network. But I think the major flaw of darknets and meshnets is that the usefulness of a network depends partially on the number of users. The more users, the more connectivity, speed and activity. It's the reason why people use facebook, and not a competing social network: because everyone is on facebook. There has not been a darknet/meshnet that has been widely adopted, thus the usefulness of the information that can be found on such a network is limited. It's kind of a self fullfilling prophecy, and until the majority of people start to care about a mode of networking that is more secure I think that these kinds of things will remain a thing of hobbyism/nerdy passtime. Same thing with encrypted email, file encryption, etc.
When I say "OPSEC" what do you hear? Technically speaking, "operational security" means "not drawing attention to yourself." That's the real drawback of PGP, TOR, burners, encryption and anonymity of any kind: it announces "I HAVE SOMETHING I DON'T WANT YOU TO KNOW ABOUT." Note that the Universal Declaration of Human Rights - of which the US is a signatory - enshrines everyone's right to privacy. However, if you're dealing with the world's largest haystack you're going to be drawn to the shiny parts. Encryption is shiny. Even if you've got nothing going on, you're basically double-dog daring someone to get up in your business. True - they probably won't be able to. Right now. But everything you don't encrypt suddenly becomes more interesting. Your bank doesn't encrypt your records - in fact, they're required by law to report large cash transactions. Your phone company doesn't encrypt your calls - and associating a credit card number with a phone with an IP is the simplest thing when you're The Man. So you're left in a position of encrypt all the things in order to not draw attention to yourself or sliding under the radar and banking on the fact that in a haystack the size of Venus your little needle just isn't that noteworthy.