N.S.A., Reined In, Still Collected 151 Million Phone Records in ’16

WASHINGTON — The National Security Agency vacuumed up more than 151 million records about Americans’ phone calls in 2016 via a new system that Congress created to end the agency’s once-secret program that collected Americans’ domestic calling records in bulk, a new report disclosed on Tuesday.

The report, an annual surveillance review published by the Office of the Director of National Intelligence, offered the first glimpse of how the new system, created by the USA Freedom Act of 2015, is working. It showed that the agency was still gathering a large number of calling records under the replacement system.

Since the terrorist attacks of Sept. 11, 2001, the N.S.A. has been gathering large amounts of communications metadata — records showing who contacted whom, but not what they said — and using it to find hidden associates of known terrorism suspects.

After that program came to light via the 2013 leaks by the former intelligence contractor Edward J. Snowden, Congress enacted the Freedom Act to end the bulk collection but preserve the program’s analytical capabilities. Under the new system, phone companies turn over specific records: the calling histories of people suspected of terrorism links and everyone with whom they have been in contact.

The N.S.A. took in the 151 million records despite obtaining court orders to use that system on only 42 terrorism suspects in 2016, along with a few left over from late 2015, the report said. The volume of records was apparently a product of not only the exponential math involved in gathering years of phone records from every caller a step away from each suspect, but also because of duplication: A single phone call logged by two companies counted as two records.

Alex Joel, the chief civil liberties and privacy officer at the Office of the Director of National Intelligence, acknowledged that the number of targets seemed small “when compared to the very large number of call detail records generated by those targets.”

But, underscoring the duplication in the records, he said, “We believe the number of unique identifiers within those records is dramatically lower.”

If the number of calling records gathered by the program was surprisingly high, another important number disclosed in the report was remarkably low: Federal Bureau of Investigation agents working on ordinary criminal cases — as opposed to foreign intelligence matters — only once in 2016 searched for and read private email messages involving an American suspect that the N.S.A. had collected via its warrantless surveillance program.

The size of that number may have policy implications as Congress prepares to take up legislation later to reauthorize the law on which the warrantless surveillance program is based, the FISA Amendments Act. That law, which is set to expire at the end of 2017, permits the N.S.A. to gather from phone and internet companies, without warrants, the messages of foreigners abroad — even when they communicate with Americans.

Privacy advocates have raised alarms about the government’s ability to search the raw repository of emails for information it can use against Americans, a practice they call a “backdoor search loophole” in the Fourth Amendment. They want Congress to require a warrant for such searches.

The government had not previously said how often the F.B.I. carries out such searches in criminal cases, but in November 2015, a judge ordered the bureau to track such successful queries, leading to the finding that there had been only one in 2016.

Importantly, however, the government did not reveal how often F.B.I. agents had searched for and retrieved Americans’ information within the warrantless surveillance repository while working on foreign-intelligence cases, like terrorism, espionage, and banned weapons proliferation, and transnational crimes like drug trafficking and hacking. The bureau has said it does not track such queries, but a senior intelligence official said the number is believed to be significantly higher than one.

Intelligence agencies with access to raw email messages gathered via the warrantless surveillance program, like the N.S.A., the C.I.A., and the National Counterterrorism Center, do track their searches for Americans’ information within the repository. The report said that in 2016, agencies other than the F.B.I. used 5,288 search terms associated with Americans for such queries.

The report also offers a look at how often intelligence reports written by the National Security Agency for dissemination elsewhere within the government used incidentally collected information about Americans gathered via the warrantless surveillance program. The identities of Americans are supposed to be camouflaged in the reports, unless those identities are necessary to understand foreign intelligence.

The topic of these concealed names and whether to reveal them, known colloquially as unmasking, has received greater attention since Representative Devin Nunes, the California Republican who leads the House Intelligence Committee, said he had learned that Obama White House officials had requested the unmasking of certain people who were associated with the Trump campaign.

President Trump went further, suggesting without evidence that Susan E. Rice, who served as national security adviser under President Barack Obama, might have committed a crime by doing so. Ms. Rice has called the accusation “absolutely false” and portrayed her unmasking requests as a routine part of her job, which required understanding intelligence.

According to the report, the N.S.A. distributed 3,914 reports last year containing information about Americans gathered via the warrantless surveillance program. Within those, 1,200 reports originally had unmasked identities, and the N.S.A. unmasked Americans’ identities in 1,934 reports in response to requests. By contrast, in 2015, 2,232 unmaskings were requested.

Another highlight in the report was the number of foreigners abroad who have been targeted for warrantless surveillance under the FISA Amendments Act program, which can be used for any foreign intelligence purpose, not just counterterrorism. The number of targets continued to grow in 2016, topping 106,000 — up from about 94,000 in 2015, it said.

But the government’s use of two other surveillance-related powers has dropped, the report said. One type that dropped was its use of “pen register/trap-and-trace” orders to collect metadata about particular targets’ communications. The government obtained such intelligence court orders for 456 targets in 2015, but only 41 in 2016.

The government also used fewer national security letters, a kind of administrative subpoena that lacks court oversight, to request subscriber information about who is using email and phone accounts. The government used that authority to make 48,642 requests in 2015, but only half that many in 2016.

The report did not explain what was behind those falling numbers.