Could well be. (Though I'd assume that as long as a "virtual wiretap" is in place on an individual the NSA gets a firehose of everything which happens to that user account (or at least everything the FISA order permits) and then just filters out whatever doesn't interest it.) For my part I wouldn't be surprised if "The companies cannot see the queries that are sent from the NSA to the systems installed on their premises" just turns out to mean "The connection between the on-site server and Fort Meade is protected by SSL" (and probably dedicated fibre). To someone looking at the NSA as the bad wolf here it sounds like an odd thing to emphasise, but from the perspective of an actual NSA agent the security of these off-site servers handling top-secret material (in an environment full of highly-technical leftists and libertarians!) must be an obvious concern. Just for a start, you wouldn't want anyone at Google other than the appointed lawyers taking a look at what you're requesting surveillance on... But that's just a guess of course.