Of course, if you buy an iPhone in Europe, and you want to use it any significant manner, you're getting spied on by US agencies as well:
- GPS: the wifi and celltower db queries that optimize the service are transferred into a foreign country.
- use Siri: uploads your whole address book to US servers before use
- use iCloud tabs: every URL you visit it uploaded to Apple's US servers
- turn on the only cloud backup solution available on the device, and all your data, including every SMS, every call and all your most private notes and photos are also transferred into the foreign country of the US, with a chance of it being analyzed by certain agencies.
In other words, this might qualify as getting spied on as well.
- GSM/CDMA: location and communications peers can be tracked neatly, over time, forever, in a manner that can be used to easily determine social interactions even based on proximity. Data very frequently extracted from your carrier for 'outsourced billing' purposes to Mossad/NSA via http://amdocs.com/
These are cases of making trade-offs for capability, not outright malware. And why limit it to the iPhone? Do you honestly believe Google is capturing less information?
Whereas if you buy an Android phone in Europe, you know for certain that your data and behavior are being examined by Google, and are available to US agencies.
> NSLs exist, and is there any reason to believe they're not enforceable for non-US data?
Given the pains the NSA took (no matter how tortured the logic got), to keep trying to claim they weren't spying on Americans [except when they talked to non-Americans, or talked to someone when outside the US, or when an otherwise American communication got routed outside the US, or they accidentally included American data in a sweep "targeted" at non-American data, etc.]... I think we have plenty of evidence that the opposite is true.
Assuming the data is available in the US (so no other country can get in the way), it's easier to demand non-US data than it is to demand US data. Don't forget: part of the detestable legal rationalizations behind this surveillance is that non-US people have no Fourth Amendment rights - eliminating many classes of potential or actual legal barriers.
- GPS: the wifi and celltower db queries that optimize the service are transferred into a foreign country.
- use Siri: uploads your whole address book to US servers before use
- use iCloud tabs: every URL you visit it uploaded to Apple's US servers
- turn on the only cloud backup solution available on the device, and all your data, including every SMS, every call and all your most private notes and photos are also transferred into the foreign country of the US, with a chance of it being analyzed by certain agencies.
In other words, this might qualify as getting spied on as well.