NSA paid tech firms over Prism, says latest Snowden leak

Google, Facebook, Yahoo, and Microsoft all received money to cover costs related to surveillance requests, the UK's Guardian reports, citing documents provided by former contractor Edward Snowden.

 And the NSA worked to rejigger its 

Tech firms including Google, Facebook, Yahoo, and Microsoft received money from the National Security Agency to cover legal-compliance costs related to the NSA's Prism surveillance program, according to the latest Edward Snowden documents published by the UK's Guardian newspaper.

A 2011 ruling by the Foreign Intelligence Surveillance -- or FISA -- Court found unconstitutional the NSA's inability to collect foreign Internet data without also collecting domestic data. And the NSA worked to rejigger its systems to bring them in line with the law. (The 2011 ruling was released this week as the result of a Freedom of Information Act lawsuit by the Electronic Frontier Foundation.)

The Guardian says of the new Snowden documents:

An NSA newsletter entry, marked top secret and dated December 2012, discloses the huge costs [the NSA compliance effort] entailed. "Last year's problems resulted in multiple extensions to the certifications' expiration dates which cost millions of dollars for Prism providers to implement each successive extension -- costs covered by Special Source Operations," it says.

Special Source Operations, described by Snowden as the "crown jewel" of the NSA, handles all surveillance programs, such as Prism, that rely on "corporate partnerships" with telecoms and Internet providers to access communications data.

The Guardian says the revelation "raises new questions" about tech companies' relationships with the NSA. Yahoo and Microsoft, however, say, as they've been saying, that they're simply complying with the law.

"Microsoft only complies with court orders because it is legally ordered to, not because it is reimbursed for the work," a company spokesperson said. "We could have a more informed discussion of these issues if providers could share additional information, including aggregate statistics on the number of any national security orders they may receive."

The spokesperson also pointed to an item in an FAQ tied to Microsoft's 2012 Law Enforcement Requests Report:

Does Microsoft charge law enforcement for providing data and content?

Yes. Pursuant to the Electronic Communications Privacy Act, Microsoft is entitled to seek reimbursement for costs associated with compliance with a valid U.S. law enforcement request. We only charge U.S. law enforcement entities pursuant to industry rates and only in an attempt to recover some costs associated with the need to comply with U.S. legal demands. We do not, however, charge in emergency situations or in known child exploitation investigations.

Yahoo, for its part, said in a statement that "Federal law requires the US government to reimburse providers for costs incurred to respond to compulsory legal process imposed by the government. We have requested reimbursement consistent with this law."

Facebook told the Guardian it had "never received any compensation in connection with responding to a government data request."

And Google sent the following statement to the Guardian: "We await the US government's response to our petition to publish more national security request data, which will show that our compliance with American national security laws falls far short of the wild claims still being made in the press today."

All 4 firms are among the 63 companies, trade groups, and civil liberties groups that are signatories of a letter that calls on President Barack Obama and Congress to allow Internet and telecommunications companies to offermore details about US government requests for user information. And Google, Microsoft, and Yahoo are involved in individual efforts to win this right.

Suspicion over the involvement of tech firms in the Prism program were fired up by the initial reports about Prism in The Guardian andThe Washington Post, which said the NSA had "direct access" to company servers. CNET's Declan McCullagh subsequently reported that there was no evidence of wholesale access to company servers.

Update, August 24 at 8:41 a.m. PT: A Google spokesperson provided the following statement late Friday evening: "We have not joined Prism or any government surveillance programs. We do not provide any government with access to our systems and we provide user data to governments only in accordance with the law." The spokesperson also pointed to Google CEO Larry Page's June 7 blog post about Prism and Google's involvement with government requests for data, and to the company's open letter asking the government to let Google publish information on how many requests it receives.