Page 23 - pclob usa freedom

TOP SECRET//SI//NOFORN

3. (U) Access Controls, Logs, and Data Deletion

(U) Access to NSA systems that contained USA Freedom Act information was
controlled. 102 NSA systems are built to ensure that only users with a valid mission need and
appropriate training are allowed to access stored foreign intelligence information. 103 For back-
end systems not accessible to analysts, including System 1, only particular authorized users can
access those systems or files. 104 Thus, a pool of analysts had the training and authority to query
CDR program records in Tool 1, and a smaller number of technical personnel were able to view
records that arrived in System 1, including those that failed NSA’s initial validation check. 105

(U) Subject to certain exceptions, NSA minimization procedures required NSA to
eventually destroy records obtained under the USA Freedom Act. 106 The minimization
procedures required NSA to promptly destroy records that were determined not to contain
foreign intelligence information. 107 No CDRs were destroyed under this provision. 108 Records
collected under the program were otherwise scheduled to be destroyed after five years. 109 This
was to be accomplished by deleting them from the internal metadata repository and any other
pertinent systems. However, some residual information would remain, such as documentation
that a provider had produced CDRs. 110 Additionally, the minimization procedures allowed NSA
to retain CDRs that were the basis of an approved dissemination—that is, intelligence reporting
circulated to other agencies. 111 In practice, NSA deleted all USA Freedom Act CDRs in 2018
and again in 2019; however, CDRs that were used in intelligence reporting were not deleted,
though those records were no longer available in the internal metadata repository. 112
B. (U) Compliance and Data-Integrity Challenges

(U) Between early 2016 and mid-2019, the government filed approximately a dozen
notices to the FISA court regarding compliance and data-integrity issues experienced while

102 (U) NSA briefing to the Board (Jan. 23, 2019).
103 (U) NSA briefing to the Board (Jan. 23, 2019).
104 (U) NSA briefing to the Board (Jan. 23, 2019).
105 (U) NSA briefing to the Board (Mar. 26, 2019).
106 (U) NSA Minimization Procedures for CDRs.

107 (U) NSA Minimization Procedures for CDRs at 7.
108 (U) NSA briefing to the Board (May 23, 2019).
109 (U) NSA Minimization Procedures for CDRs at 7.
110 (U) NSA briefing to the Board (Jan. 23, 2019).
111 (U) NSA Minimization Procedures for CDRs.

112 (U) See note 2.

20

TOP SECRET//SI//NOFORN