Just because the system described in the article exists, is there any reason to believe that it is PRISM? Couldn't PRISM be something the NSA is doing in addition to this?

Could it be both? Most network monitoring systems specifically don't want to modify the network data, so "direct access" is undesirable anyway. It seems Google, FB and others are compelled to duplicate all data (including real time data) specified in the FISA, which is basically everything, into these special portals. Then the agencies can access whatever they want carte blanche from the duplicate environments without alerting sysadmins on the production servers. And the CEOs can say they don't have direct access and haven't heard the word PRISM before.

> FISA orders can range from inquiries about specific people to a broad sweep for intelligence, like logs of certain search terms, lawyers who work with the orders said. There were 1,856 such requests last year, an increase of 6 percent from the year before.

From the NYT story seems that PRISM is more b) than a). However, I suppose the remaining questions are:

1) To what extent did these automated processes for reducing the burden of handling FISA requests enable the total quantity of data requested through FISA requests to increase? "Quantity has a quality all its own."

2) How extensive are these broad-sweep FISA requests now, and to what extent do they falsify the impression that FISAs are "lawful, specific orders about individuals" (Google), "orders for requests about specific accounts or identifiers" (Microsoft)? In other words, that each individual FISA request covers only one person or a handful of people, so for example the number of people intruded on by FISAs last year is some reasonably small multiple of 1,856?

3) To what extent could the compartmentalisation of FISA information to a few employees, combined with the streamlining process and broad FISA requests, mean that the CEOs have less awareness than they thought about just how broad the FISA net really casts by now? Or instead are they happy not to know, or happy to be able to pretend not to know?

In other words, is PRISM b) in principle but something closer to a) in practise, and if so who knew?

Automated system for NSL letters will work a lot like automated system for DMCA takedowns. And we know how fine that turned out.

Is mailing hard copies more secure? I tend to think of phone calls and hard copies as less secure.

I don't particularly mind the security implications of the technique. However, It certainly is less convenient if you are the recipient.

It's easy, we encode encrypted audio data in binary, print out the 0s and 1s on an eco friendly paper and send the bundle off in mail. It is pretty secure since they will be the only one with private key.</s>