Twelve Years after Attack, It’s Time to Rein in Surveillance State