According to a recent report, the NSA has thousands of partner companies.

If there really are thousands of partners, then the NSA has seriously scaled up their ability to process incoming data from heterogeneous sources. They'd clearly like to be able to ask for and integrate data from any company with user data.

So why are startups off the hook in all our discussions? "We can't trust any big company" leads me to "I can't trust any startup, either."

The way I see it:

1. Google, Yahoo, and Twitter especially have demonstrated they have the resources and will to fight some FISA/NSL requests in court, even if they lose. I don't know any startups that have demonstrated either. 2. Google, Microsoft and Facebook are publishing precise numbers on public requests by the world governments and ranges of numbers for FISA and/or NSL requests. I don't know any startups that provide any numbers. 3. All the named companies have issued official denials: denials these companies are all prepared to see used as evidence against them in lawsuits by users all over the world. These companies are putting something on the line by issuing falsifiable statements, statements which if falsified greatly endanger the company's business. Which startups have issued denials of involvement in PRISM? 4. All the named companies have major cloud computing resources in the US, forcing them to contend with requests from the US government. But if a startup uses AWS, GAE, or Heroku, it's just as vulnerable. So which startups don't host in the US at all? That will make them more trustworthy. 5. Google and Facebook have made major privacy blunders in trying to launch new products. We can't ignore this. The startup world makes privacy blunders as well, but they're treated differently when they do. Big companies get more media coverage and stick around to take the heat. Startups can pivot.