Page 84 - pclob usa freedom

TOP SECRET//SI//NOFORN

have no reason to investigate B until second-hop data shows that B, too, is communicating with
C. Or consider that second-hop data may reveal a hub-and-spoke organization to a terrorist
network, with an intermediary in communication with other parties of interest whose call records
the government does not have. Contact chain analysis could give investigators the ability to
identify the relevant persons within a network—leaders and critical individuals worthy of further
investigative time and resources.

(U) Consider, as well, that in areas where the government is required to obtain orders
from the FISA court for collection, multi-hop collection may allow the government to acquire
information faster and more efficiently than single-hop authorities. With regard to the FISA
court: there are, no doubt, salutary benefits to requiring the government to express in writing its
justifications for surveillance and to seek approval from an independent entity before obtaining
sensitive data. Yet, as the Board’s report explains, the drafting and approval process for
applications to the FISC can take “days or weeks.” 359 And we wonder if the time lost and the
resources required might not sometimes deter investigators from seeking perfectly lawful and
appropriate orders. By allowing more data to be acquired with fewer FISA court applications,
multi-hop collection lessens these potential drawbacks and carries efficiency advances as
compared to single-hop authorities—even in spaces in which equivalent data may be
theoretically available under other authorities.

(U) All this is not to say that multi-hop analysis is without its costs. Like for any national
security program, policymakers have to weigh the resources required to run multi-hop analysis
against its intelligence value. They also should consider that by its nature, multi-hop analysis
inevitably results in the collection of an exponentially larger amount of data than single-hop
analysis. Just imagine for a moment all the numbers you dial—and that dial you—ranging from
restaurants from which you order takeout, to banks with whom you check your account balance,
to telemarketers who call you unannounced. Then imagine all of the numbers that those numbers
call and all the other people who call those numbers. Even when the CDR program operated as
designed, multi-hop collection acquired all those numbers—along, of course, with the numbers
of terrorists A, B, and C in the examples above.

(U) The difficulty of quantifying costs and benefits in this area is not a unique feature of
multi-hop programs. Indeed, more often than not people disagree in good faith about the relative
costs and benefits of particular intelligence programs. On rare occasions, though, the balance
will be fairly apparent—as it was to NSA (and to us) in the case of the USA Freedom Act CDR
program. The value of multi-hop analysis in the abstract may be substantial; the value of this
particular multi-hop program, in our view, was not.

359 (U) See Part II(A).
81

TOP SECRET//SI//NOFORN