Or each company sets up a continuous mirror. NSA has direct access to the data without (legalistically) direct access to the servers. Everybody's happy except

Or each company sets up a continuous mirror. NSA has direct access to the data without (legalistically) direct access to the servers. Everybody's happy except democracy. Not that I think this is the case - I suspect your scenario is what at least Google is doing. But if it's set up as an API (they submit a search query, Google approves it or even rubber stamps it in many cases, the query is run, the results sent to the dropbox), then the PRISM description is pretty accurate.