For every 1 million Americans whose records were turned over to NSA, the telcos could be liable for $1 billion in penalties, plus attorneys fees. You do the math.

Here's why:

1. It violates the Stored Communications Act. The Stored Communications Act, Section 2703(c), provides exactly five exceptions that would permit a phone company to disclose to the government the list of calls to or from a subscriber: (i) a warrant; (ii) a court order; (iii) the customer's consent; (iv) for telemarketing enforcement; or (v) by "administrative subpoena." The first four clearly don't apply. As for administrative subpoenas, where a government agency asks for records without court approval, there is a simple answer - the NSA has no administrative subpoena authority, and it is the NSA that reportedly got the phone records.

2. The penalty for violating the Stored Communications Act is $1000 per individual violation. Section 2707 of the Stored Communications Act gives a private right of action to any telephone customer "aggrieved by any violation." If the phone company acted with a "knowing or intentional state of mind," then the customer wins actual harm, attorney's fees, and "in no case shall a person entitled to recover receive less than the sum of $1,000." (The phone companies might say they didn't "know" they were violating the law. But USA Today reports that Qwest's lawyers knew about the legal risks, which are bright and clear in the statute book.)

3. The Foreign Intelligence Surveillance Act doesn't get the telcos off the hook. According to USA Today, the NSA did not go to the FISA court to get a court order. And Qwest is quoted as saying that the Attorney General would not certify that the request was lawful under FISA. So FISA provides no defense for the phone companies, either.

A Washington Post poll shows that the majority (63%) of Americans are ok with the cyber and wiretapping efforts of the NSA. A higher majority are ok if their personal calls were collected by the NSA. Americans are apparently willing to sacrifice privacy for security.