PCLOB members questioned the limits of the NSA's authority to collect telephone and other records. "One question is, what's next? What could be next?" said board member James Dempsey. "What if the government decided it wanted to go back and start using [the Patriot Act to collect] Internet metadata?"
Dempsey asked if the NSA could use the same rationale it has used to collect telephone records to collect U.S. residents' Internet records.
Section 215 of the Patriot Act allows the NSA to collect tangible business records, Litt said. "It's not clear to me that the same legal authority could be used with respect to Internet service providers," he said.
The NSA had to provide evidence to the FISC that the bulk collection of telephone records was relevant to its antiterrorism efforts, Litt added. "We'd have to make that same showing to the court for another category of data," he said.
The FISC also put significant limitations on the NSA's use of the telephone data, he added. Any other bulk records collection program would face the same scrutiny, he said.
Intelligence officials told the board that NSA employees can only query the bulk telephone records for cases of counterterrorism, and those queries can only be more widely disseminated in a terrorism case.
Board member Patricia Wald asked if the NSA's search capabilities were mainly limited "to the technological capability of your search instruments," and not legal controls. "Can that be further expanded if new technological tools would allow you greater search capacity in this or other bulk programs?" she said. "Could the haystack be made as big as the technology tools you have [allow]?"
The FISC has considered the NSA's technological capabilities, but the court has not given the agency automatic authority to move forward as technology advances, said the DOJ's Wiegmann. "You have to look at all of the other factors the court considered," he said. "How important is the information? How necessary is it to get the information?"
Sign up for CIO Asia eNewsletters.