While the NSA can no longer scoop up everyone's info, phone companies have to keep call and text metadata, including phone numbers, call duration and number of characters in texts, under the new law. The NSA can then put in a request to access all the records of its targets and everyone they've been in contact with. Before the agency can get those records, though, the Foreign Intelligence Surveillance Court has to agree that the main target can reasonably be linked to terrorist activities.

Since the whole process sounds quite complex, these new numbers have alarmed privacy advocates. Robyn Greene from Washington-based Open Technology Institute told Reuters that "[t]he intelligence community's transparency has yet to extend to explaining dramatic increases in their collection." Office of the Director of National Intelligence spokesperson Timothy Barrett, however, defended the NSA and said that it "has not altered the manner in which it uses its authority to obtain call detail records."

It's unclear if the agency found loopholes in the law it can exploit, but the sudden spike in the number of records it collected could be attributed to several things. To start with, the way the new rules work means a single request could generate massive amounts of data. For instance, the report says the agency only put in a request for 40 targets in 2017, and yet those produced 534 million logs, because the NSA got access to the records of every single person they've been in contact with. Further, there could be a lot of duplicates in that pile, since every single telecom keeps its own documentation. Due to those factors, Barrett said he expects the stats in the report to "fluctuate from year to year."

In addition to revealing how many metadata records are now in the NSA's hands, the report also contains information on the agency's other surveillance activities. The number of people targeted by court-approved wiretaps apparently dropped from 1,687 in 2016 to 1,337 in 2017. However, the NSA's warrantless surveillance targets, noncitizens overseas whose data the agency gets from American tech corporations like Google, went up from 106,469 to 129,080.