Page 12 - pclob usa freedom

TOP SECRET//SI//NOFORN

(U) The USA Freedom Act amended Section 215 to expressly bar the government from
using FISA’s business records collection authority for bulk collection of CDRs—that is,
collection not based on a “specific selection term” (such as a phone number) or individualized
suspicion. NSA no longer obtains CDRs in bulk from providers.
34
(U) At the same time, the USA Freedom Act also allowed the government to continue to
obtain CDRs on a broader basis than other business records. Specifically, it authorized the
government to compel providers to produce both “a first set of call detail records using the
specific selection term” and “a second set of call detail records using session-identifying
35
information . . . identified by” the first request. Put simply, the USA Freedom Act enabled the
government to collect CDRs within two hops of a specific selection term on an ongoing basis.

(U) By statute, a specific selection term must be a term that “specifically identifies an
36
individual, account, or personal device.” In practice, NSA does not use names or “accounts” as
specific selection terms, and instead uses terms associated with particular electronic devices,
such as phone, IMSI, and IMEI numbers.
37
(U) To obtain a court order compelling providers to produce CDRs, the USA Freedom
Act requires the government to identify a “specific selection term” and demonstrate reasonable
articulable suspicion to the FISA court that the term is associated with a foreign power or agent
of a foreign power that is engaged in international terrorism or activities in preparation for

record’ (A) means session-identifying information (including an originating or terminating telephone number, an
International Mobile Subscriber Identity number, or an International Mobile Station Equipment Identity number), a
telephone calling card number, or the time or duration of a call, and (B) does not include (i) the contents . . . of any
communication; (ii) the name, address, or financial information of a subscriber or customer; or (iii) cell site location
or global positioning system information.” 50 U.S.C. § 1861(k)(3).
34 (U) See 50 U.S.C. § 1861(c)(3) (“No order issued under this subsection may authorize the collection of tangible
things without the use of a specific selection term that meets the requirements in subsection (b)(2).”); see also
discussion of “bulk collection” in footnote 9 above.
35 (U) 50 U.S.C. § 1861(c)(2)(F) (“An order under this subsection . . . shall . . . (iii) provide that the Government
may require the prompt production of a first set of call detail records using the specific selection term . . . [and] (iv)
provide that the Government may require the prompt production of a second set of call detail records using session-
identifying information or a telephone calling card number identified by the specific selection term used to produce
call detail records under clause (iii)[.]”).
36 (U) 50 U.S.C. § 1861(k)(4)(B) (“For purposes of an application submitted under subsection (b)(2)(C), the term
‘specific selection term’ means a term that specifically identified an individual, account, or personal device.”).

37 (U) 2014 Board Report at 26; NSA Civil Liberties and Privacy Office, Transparency Report: The USA
FREEDOM Act Business Records FISA Implementation 4 (Jan. 15, 2016); see also NSA briefing to the Board (Jan.
23, 2019); Part III(A).

9

TOP SECRET//SI//NOFORN