relating also (for example) to emails, texts and VOIP (voice over internet
protocol) telephony.151
(b) Types of provider: The PCLOB report states that those telephone records
are obtained from “certain telephone companies in the United States” (p. 8),
apparently including landline providers (p. 23). But the report does not
specify (any more than does IOCCO in the UK) whether records were
obtained from mobile providers, and if so to what extent. US “current and
former officials” were quoted in February 2014 as saying that the NSA was
only collecting “between 20 and 30 percent” of US call data, the shortfall
reflecting “Americans’ increasing shift from landline to cellphone use”.152 The
President’s Review Group on Intelligence and Communications Technologies
similarly recorded that “the meta-data captured by the program covers only a
portion of the records of only a few telephone service providers”.153
(c) Categories of records: The records collected under the s215 power, again
according to PCLOB, typically included “the date and time of a call, its
duration, and the participating telephone numbers”. They did not include cell
site location information.154 The UK category of “traffic data”, to which each
of the current s94 directions relates, is potentially broader: in particular, it
extends to location data and other related material.155 Under the Bill, the
power will continue to extend to “any communications data”, with no statutory
exclusion even for ICRs.156
(d) Permitted uses: The only purpose for which “NSA analysts were permitted
to search the s215 calling records housed in the agency’s database” was “to
conduct queries .. designed to build contact chains leading outward from a
target to other telephone numbers”, on the basis of “a reasonable, articulable
suspicion (RAS) that the number is associated with terrorism”.157 But as
demonstrated by IOCCO’s reference to “complex analysis” (8.29), and by the
fact that no RAS is required under current UK law or under the Bill, UK
analysts have a considerably wider range of uses for their records.
(e) Scale of use: The scale of use of the two programmes is very different. In
2012, the NSA (which is a foreign-focused organisation) queried only “around
151
152
153
154
155
156
157
See draft Bulk Acquisition code of practice, March 2016, 2.13.
Ellen Nakshima, “NSA is collecting less than 30% of US call data, officials say”, Washington
Post, 7 February 2014.
“NSA Report: liberty and security in a changing world”, December 2013, chapter 3, p.57.
PCLOB section 215 report, p. 22.
IOCCO July 2016 report, 8.3 and 8.34.
Though internet connection records are not currently acquired under the bulk acquisition power
in s94: fn 85 above.
PCLOB section 215 report, pp. 27, 9. Contact-chaining enables analysts to retrieve the
numbers directly in contact with the seed number (“the first hop”) and also numbers in contact
with those numbers (“the second hop”). A third hop was formerly allowed as well.
59