U.S. District Court Judge Richard Leon’s decision on Monday finding that the NSA’s telephony metadata program is likely unconstitutional is a welcome and important recognition that advances in digital technology require advances in Fourth Amendment doctrine if we are to preserve the privacy that the framers sought to protect. In particular, Judge Leon reasoned that the Supreme Court’s analog-era ruling that the Fourth Amendment does not restrict the government’s access to phone “pen register” data – the numbers you call, when you call, and how long you talk – does not necessarily govern whether the NSA’s collection of all Americans’ phone records for five years constitutes an unconstitutional invasion of privacy. The sheer quantity of data that the NSA gathers – about every phone call and text that every American engages in every day, maintained in a massive NSA database for five years – coupled with the ease of collecting, storing, and analyzing that digital data by computer, makes the NSA program qualitatively different from the simple collection of phone data on a single user over a limited period of time that the Supreme Court addressed in 1979.

Some of the difference is illustrated by a revealing portion of Judge Leon’s opinion that explains the vast scope of the NSA’s searches under the program. The government routinely defends the NSA program by claiming that while it collects data on everyone at the front end, it only searches that data on a limited basis on the back end – when an NSA analyst develops “reasonable suspicion” that a particular phone number is connected to a terrorist organization. The NSA reports that in 2012, it searched the data base in this way on only about 300 occasions. This back-end limit, the NSA argues, makes the program reasonable, and more tailored than the front-end collection of everybody’s phone records might first appear.

But Judge Leon trenchantly demonstrates that the NSA’s focus on the number of 300 searches is profoundly misleading. The agency’s “contact-chaining” searches almost surely involve reviewing the calls of several million Americans. Under the program, the government may search not only for all phone numbers that have connected with the initial suspect number, but for all numbers two and three “hops” removed from the initial number. Thus, on the second “hop,” the agency may search for all phone numbers that have called or received calls from all the numbers that connected to the initial number. And for the third “hop,” the NSA may then review all numbers that have communicated with those numbers. Using the conservative estimate that any given caller will have called or received calls from 100 different numbers over five years , you are quickly talking about the NSA reviewing records of calls of a million Americans in a single search.

As Judge Leon explains:

This means that if a search starts with the telephone number (123) 456-7890 as the ‘seed,’ the first hop will include all the phone numbers that (123) 456-7890 has called or received calls from in the last five years (say, 100 numbers), the second hop will include all the phone numbers that each of those 100 numbers has called or received calls from in the last five years (say, 100 numbers for each one of the 100 ‘first hop” numbers, or 10,000 total), and the third hop will include all the phone numbers that each of those 10,000 numbers has called or received calls from in the last five years (say, 100 numbers for each one of the 10,000 ‘second hop’ numbers, or 1,000,000 total).

Thus, 300 searches could easily amount to the NSA examining 300 million phone numbers – about the same number as there are people living in the United States. If you add to this calculation the possibility, indeed likelihood, that any of the numbers identified in the first two hops is a business, such as a pizza restaurant that easily receives more than 100 calls a day, the numbers expand exponentially – not based on any criminal or even suspicious activity, but based on the wholly innocent activity of ordering a pizza.

And, Leon notes, once the NSA gathers all these numbers together –encompassing millions of innocent Americans – it can then run searches on that database (which the NSA calls the “company store”) without any reasonable suspicion or judicial oversight whatsoever.

Moreover, the only check on the initial numbers used to start the “contact-chaining” is an NSA official’s “reasonable suspicion” – unreviewed by a court — that the number is linked to a terrorist organization. “Reasonable suspicion,” a term of art in Fourth Amendment jurisprudence, is a notoriously low threshold of suspicion. It’s what the police need to stop you on the street temporarily to ask you a few questions. It is the standard that has led to hundreds of thousands of stops every year on the streets of New York City, only about two percent of which ever result in the discovery of contraband. That’s the only limitation on the government mining its data trove of every phone call made and every text sent by every American in the last five years.

Doesn’t sound too reasonable to me.