me

Follow us on Twitter: PCLOB_Gov

Background 

The Privacy and Civil Liberties Oversight Board (Board) has issued its oversight report on the government’s 

operation of the call detail records (CDR) program under the USA Freedom Act. The NSA suspended its 

use of this program in early 2019 “after balancing the program’s relative intelligence value, associated 

costs, and compliance and data-integrity concerns caused by the unique complexities of using these 

provider-generated business records for intelligence purposes.” After suspending the program, NSA 

ultimately deleted the CDRs collected under the Act, with the exception of data referenced in 

disseminated Intelligence reports or used for mission-management purposes.

The Board completed this comprehensive review to provide transparency and clarity for the public. The 

Board secured the declassification of several important, never previously disclosed facts about the 

program. This additional information should enhance the public’s understanding of the government’s 

implementation of the CDR program. 

The Board also has issued an unclassified version of the report to the public and a classified version of this 

report to Congress to assist Members as they consider whether to extend the USA Freedom Act before 

the authority sunsets next month. The report provides a detailed understanding of the CDR program and 

the privacy and civil liberties risks associated with the program. 

What was the Intelligence Value of the CDR Program?

Newly declassified facts are bolded:

• NSA acquired landline and wireless phone call records under the USA Freedom Act. NSA used 

the CDR program in response to a terrorist attack or a known terrorist threat. For example, NSA 

produced intelligence reports that were derived in whole or in part from the CDR program in its 

analysis of the 2016 Pulse nightclub shooting in Florida, and the Ohio machete attack that same 

year. 

• The USA Freedom Act CDR program cost the government approximately $100 million. Under the 

program, NSA produced 15 intelligence reports. 

• Of the 15 reports citing USA Freedom Act CDRs, the FBI received unique information from two 

of the intelligence reports. 
What do we Know About the Compliance Issues NSA Faced?

• The program experienced a series of compliance incidents and data-integrity programs that led 

NSA to issue about a dozen notices to the FISA court since 2016. The Board reviewed each of these 

notices.

• While the Board secured declassification of many facts related to compliance issues NSA faced, 

some of those facts remain classified. These classified facts have been transmitted to Congress. 

• NSA took steps to remedy its compliance incidents, including notifying appropriate oversight 

entities, imposing additional limits on data requests, and deleting erroneously obtained data.

• Based on a review of the data, the Board determined that the compliance incidents were 

inadvertent, not willful.

What are the Board's Key Findings?

• The Board did not issue recommendations in this report. Board Members, however, wrote 

separately addressing the issues raised by the facts related to the implementation of this 

authority.

• Chairman Klein wrote a separate statement containing his additional views. Board Members 

Felten and LeBlanc wrote a separate statement containing their additional views and disagreeing 

with the Board’s constitutional analysis. Moreover, Board Member LeBlanc joined the report only 

for Its transparency value but disagreed with the Board's additional conclusions. Board Members 

Bamzai and Nitze wrote a separate statement containing their additional views. 

• The Board found that the CDR program was constitutional under settled Supreme Court 

precedent. The Board also found that NSA’s collection of two hops of CDR data on an ongoing 

basis was statutorily authorized.

• Based on their separate statements, Board Members concur with NSA’s decision last year to halt 

the collection of CDRs.

• The Board found no abuse of the program, nor did it find any instance in which government 

officials intentionally sought records that they knew were statutorily prohibited.

• The Board found no evidence that NSA received any of the statutorily prohibited categories of 

information, such as name, address, financial information, cell-site location, or global positioning 

system information from providers during the program’s operations.