US Department of Justice ii -- All withheld information exempt under b 1 and b 3 unless otherwnse noieg i 1 Approved for public release a 72National Secunty Divigren metre WE 3 Washington DC 20530 1 155% 1 r tat 3 24 LLif at in del September 9 2011 The Honorable John D Bates Presiding Judge United StatesForeign Intelligence Surveillance Court 333 Constitution Avenue NW Washington DC 20001 Dear Judge Bates The Government is pleased to provide certain additional information related to questions raised by the Court and discussed during the September 7 2011 11earing on the above captioned matters which are currently pending with the Court Total Items Collected Versus Total Items Puraed Between anuarv 1 and June 30 2011 S In its August 16 2011 Submission the Government advised the Court that it had identi ed 140 974 921 Internet com'municationsas having been acquired under section 702 both from NSA upstream collection and PRISM collection1 between January 1 through June 30 nd resent within the relevant NSA SIGINT Collection Source System of Record as of July 14 2011 Of these 127 718 854 or approximately 91% were acquired 'om PRISM collection and 13 256 067 or approximately were acquired through upstream collection The Court was also advised that the 140 974 921 did not include Internet communications that were acquired between January 1 and June 30 2011 but purged prior to July 14 2011 the date the sample was drawn In drawing the sample in this fashion it I collection refers to the ac i i ommunications from Internet service providers- 3 Classi ed by - eputy Assistant Reason Declassify NYT DOJ 16 CIV 7020_000164 All withheld information exempt under b 1 and b 3 unless otherwise noted Approved for public release was intent to capture for further manual review a tmly representative sample of Internet communications acquired through upstream collection Nevertheless in order to ensure that the Government drew an appropriately representative sample of Internet communications with which to conduct its manual review the Court requested to know the total number of Internet communications acquired by NSA during this six month period and the total numb er of Internet communications pu1 god during this six month period NSA reports that from January 1 2011 to June 30 2011 approximately 18 446 upstream transactions were acquired and thereafter purged from_ during that same time period 2 The 18 446 transactions we1e purged for various reasons such as a target traveling to the United States and othe1 matters more speci cally reported pursuant to Rule 13 b of the Rules of the Foreign Intelligence Surveillance Court including the Quarterly Reports Concerning Compliance Matters under Section 702 of FISA F01 example many related to two over- collection incidents previously reported to the Court on February 9 2011 and June 24 2011 Aside from the possibility of a ta1 get haveling to the United States as otherwise reported to the Court none of the transactions which were purged related to discovery of a wholly domestic communication acquired through its upstream techniques W3- NSA further reports that this information does not alter the statistically high degree of con dence e a simultaneous con dence level of 95% and statistical conclusions previously reported to the Court' 1n the Government s August 16 2011 Submission 3 '11 NSA Assesses that The1e is no Basis to Believe Any-of The 224 Unknowable Mu1t1-Commun1cation Transactions MCTs Include Wholly Domestic Communications 83 1 In its August 16th Submission the Government advised the Court that NSA conducted a manual review of a statistically representative sample of Internet communications acquired through NSA's section 702 upstream collection As explained 1n the August 16th Submission NSA identi ed 5 081 transactions within the representative sample as being MCTs NSA determined that of those 5 081 MCTs 4 847 contained discrete communications believed to be to 01 om pe1sons located outside the United States and thus not believed to contain any wholly domestic communications NSA further determined that 10 of the 5 081 MCTs appeaied to contain at least one wholly domestic communication However NSA was unable to de nitively determine whether the remaining 224 MCTs contained wholly domestic communications because those MCTs lacked information suf cient to positively identify the active user or 2 This number is over-inclusive because it includes all transactions purged during the period of January 1 to July 14 2011 some of which were acquired b'cfore January a As stated' 1n Appendix of the Government s August Submission 1 simple random serve d as the basis for conclusions about the true proportions of the 13 25 million-transaction universe That simple random sample of 50 440 transactions did not include any transactions purged prior to the date of the sample thus all of representations regarding the 13 25 million upstream transaction-universe are unaffected by the fact that the random sample similarly did not include transactions purged fro- prior to July 14 4 This gure 4 847 is the sum of 713 MCTs reviewed by NSA as containing a tasked selector as the active user- and 4 134 MCTS reviewed by NSA as containing discrete communications believed to be to or from non targeted persons located outside the United States See August 16th Submission at 5 nn 15 8c 16 61381481145111 I 2 NYT DOJ 16 CIV 7020_000165 All withheld information exempt under b 1 and b 3 unless otherwise noted Approved for public release masseuse am determine the active user s location Nevertheless NSA asserted that it had no basis to believe any of these 224 MCTs contained wholly domestic communications Except as noted below in analyzing each single discrete communication within these 224 MCTS to determine whether any were wholl domes 10 erienced considered all technical data such as W present within the MCTs performed the same sort of technical analysis NSA would perform before tasking an electronic communications account address identi er in accordance with its section 702 targeting procedures and scrutinized the content of each discrete communication for an information which would be indicative of the location of the communioants such as Despite this exhaustive review NSA was unable to positively determine whether any of the remaining 224 MCTS contained Wholly domestic communications However based upon the totality of the information reviewed NSA had no analytical basis to believe that any of the 224 MCTS contained wholly domestic communications More Speci cally in addition to the content analysis described above for all 224 MCTs NSA performed the same sort of technical analysis NSA would perform before tasking an electronic cormnunications account address identi er 1n accordance with its section 702 at etin iocedures for all available accounts addressee identifiers included 1n the MCT - within the MCT for 183 of the 224 MCTs referenced ust 16th Submission i e In all instances where location information was available for such accounts addresses identi ers NSA assessed that at least one communicant of each discrete communication within these MCTs was located outside of the United States Despite this intensive review NSA was unable to conclusively determine whether any of the 224 MCTs contained Wholly domestic communications However based upon the totality of the analysis described aboveand in the Government s August 16th and August 30th Submissions NSA assesses that it is highly likely that each discrete communication included in these MCTs includes foreign cornmunicants althdugh given the absence of certain technical identifying data NSA Cannot state'this conclusively Nevertheless NSA believes that its manual review of the content of each discrete communication contained within these MCTS at a 5 As previously explained to the Court the same sort of technical analysis was not performed for 23 of the 224- MCTs because although part of the sample drawn on July 14 2011 these 23 MCTs had been purged andfor placed on Master Purge List subsequent to the date of the sample As noted during the Sc temb er 7 hearing the majority of these 23 MCTs 19 had been purged subsequent to July 14 as part of the overcollection incident previously addressed in the Government s June 1 Submission See also Government s August 16th Submission at 8 The technical analysis was however performed on each selector available within the 18 of the 224 MCTs that could not be further characterized by NSA See id However for these MCTs not all commun'icant accountladdress identitiers were available because each of these MCTs contained corrupted data to varying degrees 3 NYT 00 1 16 CIV 7020_000166 All withheld information exempt under b 1 and b 3 unless otherwise noted Approved for public release sea-SEW minimum support its assessment that there is no basis to believe any of these 224 MCTs include wholly domestic communications 11H Regarding the Possibility of Wholly Domestic Abouts Communications Among gm Single Discrete Communications not Further Analyzed Durinthe NSA Manual Review In its August 16 2011 Submission the Government advised the Court that of the 50 440 transactions reviewed 45 359 approximately 90% wow detelmined to be single discrete communications Because focus during the manual review was the assessment of MCTs the Court was rrther advised that after determining that a transaction was a single discrete communication to from or about a tasked selector no further analysis of these transactions was done by As in the case of MCTs the possibility does exist that in certain limited circumstances single discrete abouts communications acquired via section 702 upstream collection could be wholly domestic in nature For this possibility to be realized a conununication s sender and all intended recipients must be located in the United States the communication must contain a section 702 tasked selector and it mus Furthermore as described in the Govemment s June 1 2011 Submission in 'ven the wa in whic the communicatior eater detail On the basis of the foregoing and experience collecting Internet communications NSA had assessed that it would be extremely unlikely for its upstream collection of single discrete communications to result in the acquisition of wholly domestic communications and not at a rate higher than Wholly domestic communications may be contained within MCTs acquired through upstream collection To investigate this further in response to the Court s questions between the close of the September 7 2011 hearing and the submission of this correspondence an experienced team of NSA rapidly worked through a 48-hour period to evaluate the 45 359 single discrete communications described above As a result NSA was able to conclude baSed on technical analysis that 41 272 of these communications were not wholly domestic in nature The findings of technical analysis revealed that 4 087 of these single discrete communications lacked information suf cient for NSA to immediately identify the active user through technical means as reasonably believed to be located outside the United States 6 NSA manually reviewed each'of these 4 087 transactions to attempt to determine the nature of the communication as either to from or about tasked selector Only 25 of the 4 087 transactionsreviewed appeared to bee communication not speci cally to or 'om a 6 More speci cally 10 628 featured a tasked selector as the active user who by operation of the NSA targeting procedures is a person reasonably believed to be located the United States 2 239 featured an active user that was not a tasked selector but nonetheless an electronic account address identi er reasonabl believed to be located outside the United States 3 926 feature and 2 79 featured NYT DOJ 16 CIV 7020_000167 All withheld information exempt under b 1 and b 3 unless otherwise noted Approved for public release tasked selectdr 7 NSA then subjected all available Selectors within those 25 abouts communications to the same sort of technical analysis they would perform before tasking an electronic aceountfaddress identi er in accordance with its FAA section 702 targeting procedures to attempt to determine the location of the communicants within those 25 communications is additional technical analysis was performedon all of the single discrete communications that appeared to be a communication about target between two or more non-tasked Notably none of the reviewed transactions featured an accountiaddress identi er that resolved to theUnited States Further each of the 25 communicatidns contained location information for at least one account address identi er such that were able assess that at least one communicant for each of these 25 communications was located outside of the United States Given the United States status as the world s premier electronic communications hu and further based on knowledge of Internet routing patterns the Government has already asserted that the vast majority of communications between persons located in the United States are not routed through servers outside the United States the Government s June 1 2011 Submission at 11 As a practical matter it'is a Common business practice for Internet and web service providers alike to attempt to deliver their customers the best user experience possible by reducing latency and increasing capacity Latency is determined in part by the gec graphic a1 distance between the user and the server thus providers frequently host their services on servers close to their users and users are frequently directed to the servers closest to them While such practices are not absolute in any respect and are wholly contingent on potentially dynamic business practices of particular service providers and users 9 if all parties to a- communication are located in the United States and the required services are available in the United States in most instances these communications ill be rou wholly within the United States 7 More speci cally 20 of these transactions featured a I transactions included a po en a a erna accoun a resses 1 entriers or current NSA targets a To determine the location of these communicants NSA performed the same sort of technical analysis it would perform before tasking an electronic communications account address identi er in accordance with its FAA section 702 targeting procedures 9% - 9 Accordin to NS NYT DOJ 16 7020_000168 All withheld information exempt under b 1 and b 3 unless otherwise noted Approved for public release - will be ltered out by IP lters even if they contain a 702 tasked selector and i These additional clari cations support the Government s conclusion detailed in the 30 August Notice of Clari cations to the Court that acquisition of foreign intelligence information through upstream collection including the acquisition of MCTs is 1easonable and consistent with the Act and the Fourth Amendment NSA has reviewed this letter'and con rmed its accuracy U The Government would like to thank both you and your staff for your consideration of- the Govermnent Certi cations and the complex factual and legal questions related thereto Shauld the Court have any additional questions cornments or concerns please do not hesitate to contact me U Sincerely 10 6 and National SecurityDivision NYT DOJ 16 CIV 7020_000169