Whoever said that crime doesn’t pay, never broke the law for the National Security Agency.

According to documents leaked by NSA whistleblower Edward Snowden, the spy agency forked over millions of dollars to several major Internet companies after some of their surveillance work was ruled illegal. But the real puzzle is why the web giants—which include Google, Yahoo, Microsoft and Facebook—were entitled to the money in the first place.

According to a brief article in a secret NSA newsletter dated December 2012, “last year’s problems resulted in multiple extensions to the certifications’ expiration dates which cost millions of dollars for Prism providers to implement each successive extension – costs covered by Special Source Operations.” SSO, according to Snowden, is the agency’s “crown jewel” that handles “corporate partnerships” with telecoms and Internet providers.

The problems referred to concerned the October 3, 2011 ruling by the Foreign Intelligence Surveillance Court (FISC) that NSA snooping aimed at foreigners abroad violated the Fourth Amendment by sweeping in too many wholly U.S. Internet communications—56,000 per year for 3 years. Chief Judge John Bates also criticized the agency for misrepresenting the actual scope of a major program for the third time in three years.

Although federal law requires the government to pay compensation “at the prevailing rate” to companies for “providing information, facilities or assistance” in complying with surveillance, it is unclear why the companies incurred any costs, much less millions of dollars, simply to extend some expiration dates.

In fact, an older secret newsletter, dated October 2011 and written within days of Judge Bates’s ruling, indicates that the transition to new certificates was already nearly complete: “All Prism providers, except Yahoo and Google, were successfully transitioned to the new certifications. We expect Yahoo and Google to complete transitioning by Friday 6 October.”

Neither the NSA nor the tech companies could explain what happened at a cost of millions of dollars—or if anything happened at all. Because of the secret nature of the NSA budget, independent oversight of program level spending is basically impossible, creating rich opportunities for fraud and abuse.

Google—whose corporate motto is the faux-hip slogan “Don’t Be Evil,”—and the other firms also have some explaining to do. Since June 6, when The Guardian first revealed the existence of the NSA snooping, the companies have denied any knowledge of it and insisted that they do not actively participate in surveillance, handing over user data only in response to specific legal requests from the authorities.

In a statement Friday, Google repeated that it has “not joined Prism or any government surveillance programs,” but refused to answer questions about the October 2011 ruling or the certification issue. The other named companies issued similar statements.

-Matt Bewig

To Learn More:

NSA Paid Millions to Cover Prism Compliance Costs for Tech Companies (by Ewan McAskill, The Guardian)

Internet Companies Paid Millions for Spying Work (by Nick Divito, Courthouse News Service)

N.S.A. Said to Have Paid E-Mail Providers Millions to Cover Costs From Court Ruling (by Charlie Savage, New York Times)