This week saw unprecedented revelations of the inner workings of GCHQ and its financial relationship with the United States National Security Agency. They have raised the question of who checks that what the government's secret communications service is doing is within the law and in line with what citizens in a democratic society might expect. More practically, how do the systems of oversight already in place work? Are they fit for purpose?

To take a job at GCHQ is to surrender many things people value: being able to gossip about work with friends, to have personal privacy – which is abandoned under the developed vetting regime – and to earn reasonable levels of pay. The reward is to work on extremely interesting projects: developing technologies to capture high-speed internet traffic and subsequently analysing it for "customers". Can you discover weaknesses in smartphones so that you can eavesdrop at will? And how do you cope with the ever-increasing quantities of routinely used encryption? To aid your quest you are given wonderful techie toys, powerful computers, exotic operating systems, deep packet inspection kits – devices that would make geeks in the outside world deeply envious.

A feature of the behaviour of many of the elite recreational hackers who have been caught has been dissociation of the thrill of breaking into systems or developing malware from the impact on their victims. That must also be the concern about GCHQ, a closed world full of ever-changing techno thrills but hardly focused on the broader consequences.

So who exactly is watching these potentially all-seeing watchmen? First in line are GCHQ's own legal advisors, who interpret the Intelligence Services and Regulation of Investigatory Powers Acts (ISA and Ripa). Among the concerns here are the scope of the warrants needed to authorise bulk collection and storage of data, and lax interpretations of data protection and human rights law. The latest batch of documents from Edward Snowden certainly seem to indicate the NSA values the "flexibility" of UK law.

The next layer of oversight is the foreign secretary, who signs off on the warrants. But politicians don't necessarily have deep knowledge of the ethics and practicalities of intelligence collection. And proper accountability is impossible if parliamentary questioning is limited because of "ongoing security issues".

This takes us to the intelligence services and surveillance commissioners, both of whom are retired judges, each with a very small staff. But their role is to audit for compliance with ISA and Ripa, not to ask more fundamental questions on the implications of technological change.

That leaves the parliamentary intelligence and security committee, which perhaps does have the remit but lacks the background and resources to know what questions to ask. Of its nine current members only two, Malcolm Rifkind and Lord Butler, have had much direct operational experience of the agencies. And no member has much knowledge of how technology continues to transform intelligence gathering and analysis.

The world of GCHQ and the NSA is constantly changing. Legislation and oversight mechanisms that once may have looked as though they achieved a reasonable balance between intelligence agency powers and individual privacy no longer do so – now that vast quantities of data are generated by individuals and businesses, routinely captured and stored by the agencies and then subject to detailed and intrusive analysis.

The really probing questions are not being asked. The reason? Neither within the culture of GCHQ nor at any of the levels of oversight is there a proper appreciation of a need to consider whether the intrusion is justified by the threats we face. This should worry us all.