Nofollow is simply about whether a link passes PageRank, not about whether someone else can crawl it.
Google has said, and I believe them, that Googlebot doesn't crawl nofollow links, even for discovery. That said, Google certainly keeps track of those links, and if a page is found by other means (which is more likely to happen than not... nofollow is not a good way to block a page), Google can easily associate the source and destination urls, and it will list the nofollowed links as backlinks in WMT. We've had some discussions on that here, but it's too late at night for me to look for them.
Payday Loans... ranking almost entirely on comment spam with "nofollow" tags in links.
Depends on whether the backlink tool you use offers fresh data. Usually there are some hacked .gov or .edu sites in the mix, and the ranking domain or subdomain gets burned pretty quickly. Back in the April 2012 Google Updates thread, on April 24th and 25th, we discussed a specific spam example that was being widely discussed around the web. On page 20 of 30 (set at 30 posts per page), irishsolar and I compare backlinks we see. He was looking at OSE and I was looking at Majestic....
I also discuss the ranking mechanism, which is akin to Google bombing, and usually requires on word of a query phrase to exist on the destination site. It doesn't necessarily have to be body text. Let's not have specifics on the Payday loan sites. My point in mentioning this is that somewhere in the mix, at least in the fresh data, there are backlinks that pass PageRank.
2. PRISM - putting aside the politics what is clear is the NSA rely on Google to tell them what's happening online. As a collector of data to the US Government you need to be crawling everything you can. So you follow all links.
Yes, let's keep politics out of this. I think you're making a bunch of unfounded assumptions about what Google does supply to NSA, in my opinion overestimating quite a bit, and then jumping to conclusions from your assumptions. A discussion of Google and NSA is political, and is outside of the scope of the Google SEO forum. Here's a thread which leads to three other WebmasterWorld threads on the topic...
Europe's Commissioner Demands Answers Over PRISM Data Surveillance [webmasterworld.com...]