Who's lying?
On Thursday, James Clapper, the Director of National Intelligence, wrote "The Guardian and The Washington Post articles refer to collection of communications pursuant to Section 702 of the Foreign Intelligence Surveillance Act. They contain numerous inaccuracies."[1]
Today, he released a fact sheet[2] which stated, among other things,
* PRISM is not an undisclosed collection or data mining program. It is an internal government computer system used to facilitate the government’s statutorily authorized collection of foreign intelligence information from electronic communication service providers under court supervision, as authorized by Section 702 of the Foreign Intelligence Surveillance Act (FISA) (50 U.S.C. § 1881a). This authority was created by the Congress and has been widely known and publicly discussed since its inception in 2008.
* Under Section 702 of FISA, the United States Government does not unilaterally obtain information from the servers of U.S. electronic communication service providers. All such information is obtained with FISA Court approval and with the knowledge of the provider based upon a written directive from the Attorney General and the Director of National Intelligence. In short, Section 702 facilitates the targeted acquisition of foreign intelligence information concerning foreign targets located outside the United States under court oversight. Service providers supply information to the Government when they are lawfully required to do so.
* The Government cannot target anyone under the court-approved procedures for Section 702 collection unless there is an appropriate, and documented, foreign intelligence purpose for the acquisition (such as for the prevention of terrorism, hostile cyber activities, or nuclear proliferation) and the foreign target is reasonably believed to be outside the United States. We cannot target even foreign persons overseas without a valid foreign intelligence purpose.
* In addition, Section 702 cannot be used to intentionally target any U.S. citizen, or any other U.S. person, or to intentionally target any person known to be in the United States. Likewise, Section 702 cannot be used to target a person outside the United States if the purpose is to acquire information from a person inside the United States.
[1] http://www.dni.gov/index.php/newsroom/press-releases/191-pre...
[2] http://www.dni.gov/files/documents/Facts%20on%20the%20Collec...
For other statements from the DNI, see http://www.dni.gov/index.php/newsroom/press-releases
The most likely explanation is that PRISM = FISA. The Washington Post article with the slides begins "Through a top-secret program authorized by federal judges working under the Foreign Intelligence Surveillance Act (FISA)..."
Now imagine how this works in practice. The FBI (not NSA, other articles have stated that the NSA works by handing a request off to the FBI to implement on domestic soil) comes to a tech company with a signed court order to hand over the user data for a user suspected of criminal actions. The tech company complies. The data is normalized and assembled on the NSA end, and then a realtime feed goes to the PRISM GUI where an analyst looks it over. At no point does the government ever reveal the name "PRISM" to the tech company - why would the NSA ever reveal top-secret codenames outside of the organization.
When the program is made public, it's the NSA side of the story that hits the papers. The tech companies have never heard of PRISM, they know that the NSA does not have boxes inside their datacenters, and the whole accusation seems ludicrous.
It's a mistake, when you find out that a secret has been kept from you, to assume that other people know about the secret as well, even if they were involved. The NSA is not in the business of telling businesses about confidential national security projects.
[1] https://twitter.com/ggreenwald/status/343470800784982016
Ninja edit: Also as another commenter pointed out, that $20-million figure could be for just one specific part of the program or what have you.
In fact I'd argue that Glenn's reputation is based more on being a "civil liberties watchdog" and far far less on actually being right in his reporting. So in that regard he's simply padding his rep even further.
This strikes me as pretty implausible; verifying the extent of their access to someone's gmail or facebook account seems like something the NSA should be able to do very easily. I think it's safe to assume that this part of the project is $20M, not that they have $20M worth of access to the internet.
For example, if PRISM is really just an internal NSA tool for interfacing, searching, storing etc information procured from these providers from different means (such as NSLs or FISA warrants), then obviously no company joined it. It's an internal tool! The idea of 'adding' just becomes ensuring normalization of data and other such 'mundane' things.
Note I say, 'for example'. Because amongst all the yelling about, we still don't actually know what the fuck PRISM actually is, and arguments just revolve around how charitable/cynical you are about the parties involved.
* An interface to fuse data received by court order from each site.
* A scraping tool to pull in open source data, possibly with seed accounts (i.e., a facebook account for each university) to give you better access.
* Scraping data on the wire to and from each service, at the level of the internet backbone