[anonyfuss]

Or their marching orders are to provide live data collection on specific government-identified suspects, rather than live data collection on all users.

In which case, they could claim to be lawfully complying with information requests that are "not as broad", even if the system as designed makes it as easy for the NSA as hitting a "monitor this person" button.

It also wouldn't take vast systemic corporate knowledge. All centralized systems have centralized administrative control that allow for in-depth view and analysis of user accounts and data, and most large-scale systems have relatively powerful and easy-to-use tooling (especially to support customer service, sales, etc).

Complete access to those systems is generally restricted due to the likelihood for abuse, but there remain valid internal management reasons for such access.

Adding to those systems to allow the NSA unfettered (or barely fettered) access could be done without having to alert the entire organization that their internal management systems, which they built knowingly, and have no reason to distrust, have been subverted to allow for on-demand government spying.