Page 21 - pclob usa freedom

TOP SECRET//SI//NOFORN

was also possible for second-hop contacts to become first-hop contacts if they directly contacted
86
a FISA court-approved specific selection term. Because that individual would now be a first-
hop contact, NSA could seek CDRs for its contacts from all providers.
2. (U) Analyzing CDRs

(U) When NSA received valid CDRs, they were processed and placed into its
87
repository. NSA repositories are subject to access controls and cannot be directly reviewed by
NSA analysts. Rather, NSA analysts use software interfaces that validate what data they are
authorized to access, and return information from a repository in response to the analysts’
queries.
88
(U//FOUO) To view metadata records, NSA analysts use general metadata viewing tools,
including , which we refer to here as Tool 1. Tool 1 enables NSA analysts to query
one or more datasets to which they have access, including multiple types of NSA metadata
89
records. Primarily using Tool 1, NSA analysts can input different terms which they reasonably
expect to return foreign intelligence information and query those terms against several different
90
pools of metadata.

(U) Prior to the passage of the USA Freedom Act, CDRs were maintained in such a way
that NSA analysts could not query CDRs collected under the former CDR program alongside
91
other metadata records collected by NSA in Tool 1. NSA later determined that it could use a
single tool, Tool 1, it had earlier produced to search all metadata records the analyst was
authorized to review, though this was not caused by the passage of the USA Freedom Act.
92
Tool 1 allowed an analyst to search against all available metadata and to use all query terms at
93
once, saving time and providing insights that might otherwise be difficult to uncover.
(U) Using this tool to query different types of metadata, while operationally efficient, had
an anomalous side-effect for NSA’s efforts to count metadata query terms. A simple example
illustrates the anomaly: A query in Tool 1 about an email address and a US phone number could
automatically ping against CDRs obtained under the USA Freedom Act. This would count as

86 (U) Or Attorney General-approved under the emergency provision. See 50 U.S.C. § 1861(i).
87 (U) See NSA USA Freedom Act Transparency Report at 5–8; NSA briefing to the Board (Mar. 26, 2019).

88 (U) NSA briefing to the Board (May 23, 2019).
89 (U) NSA briefing to the Board (May 23, 2019).
90 (U) NSA briefing to the Board (May 23, 2019).
91 (U) NSA briefing to the Board (May 23, 2019).
92 (U) NSA briefing to the Board (May 23, 2019).

93 (U) NSA briefing to the Board (May 23, 2019).

18

TOP SECRET//SI//NOFORN