Update 2013-06-07: at the time that we wrote this post [2013-03-06], we asked Google whether its Transparency Report included data about secret FISA court orders that would send data to the NSA. The response we received was extremely vague, but seemed to possibly be "no". In the wake of yesterday's revelations that the NSA was harvesting data from Microsoft, Yahoo!, Google, Facebook, AOL, PalTalk, Skype, Youtube and Apple, Google has now clearly confirmed that the numbers in its Transparency Report do not include the number of orders or targets for NSA surveillance.
This makes sense to me. It's highly illegal, to the point of treason and violating national security, to even acknowledge the existence of a FISA request, PRISM or otherwise. No one involved in the entire FISA request would be able to reveal that to even a coworker, let alone the public, under penalty of 20 years to life in prison.
Furthermore, the NSA strictly forbid employees who complied with FISA requests to even speak of it to high ranking chief executives. In other words, it's highly likely even the CEOs didn't know a great extent of the FISA requests flowing through their networks.
They could have worded it as "This report might not include certain requests whose secrecy is mandated by the law, like FISA requests. Google does not confirm nor deny having received such requests."
If they didn't receive any, I assume they can disclose that. I'm really not sure what this means, to be honest. Was anyone speculating that Google never received a FISA request of some sort? Does anyone know how common it is to send out such request to a company?
However, it's grossly misleading to release aggregate statistics without even a mention of the fact that, should other avenues of requesting and/or retrieving data exist, that those are not included in the totals.
I'm not sure if I can assuage your anger, but the Transparency Report is upfront that there are reasons not all requests for user data are disclosed. The data isn't purported to be comprehensive, though we'd like it to be as comprehensive as possible.
This is exactly the reasoning I've heard from people at Facebook in the past week for why they don't release a transparency report. They said that any report they'd release would be complete bullshit because of these FISA requests.
Are you suggesting that they shouldn't have a transparency report at all unless everything is on the table? I disagree. They aren't even allowed to mention FISA so they don't, and they don't have to disclose anything.
Edit: also as someone already commented here: they do mention that the data is 'not comprehensive'.
https://www.eff.org/deeplinks/2013/03/new-statistics-about-n...