In cases like these you have to evaluate the probability of something bad happening times the magnitude of the harm (essentially the expected value). The NSA can do much more damage (excluding the fact that they can do similar damage even without having this information) than a random lowly criminal, however the likelihood they'll target a boring person such as me is much lower. So for me I'd be more worried about b. Of course, ideally I would rather not have to worry about either.
