Three powerful members of the House judiciary committee said James Cole, the US deputy attorney general, was “not entirely accurate” in testimony describing limits on the National Security Agency’s powers to surveil the US Congress.

The letter from former committee chairman Jim Sensenbrenner, oversight committee chair Darrell Issa – both Republicans – and New York Democrat Jerrold Nadler, came as the Obama administration saw a new front open up in the battle over its surveillance powers: a class-action lawsuit filed by Senator Rand Paul, a 2016 presidential contender, who said he plans to contest the bulk collection of US phone records “all the way to the supreme court.”

Cole told the House judiciary committee on 4 February that while the NSA “probably” collects the phone records of members of Congress – a subset of the dragnet the NSA casts on practically all US phone data – the NSA only studied those records when it has “reasonable, articulable suspicion” of a number’s connection to terrorism, a restriction imposed by the secret surveillance court overseeing the NSA.

Sensenbrenner, Issa and Nadler wrote to Cole on Wednesday for a public clarification of the statement, which they described as “not entirely accurate” – and in doing so drew attention to a little-noticed procedure used by the NSA.

NSA collection and potential analysis of congressional phone records “raises grave separation of powers concerns for the executive branch to interfere with the private communications of the legislative branch without congressional knowledge,” the legislators wrote.

The NSA’s analysis of a number for which it possesses “reasonable articulable suspicion” is not limited to that number. The agency has been permitted for years to conduct what is known as a three-hop analysis, in which it traces not only the calls sent and received by the phone number, but all the calls sent and received by those numbers and then all the calls sent and received by those.

“The NSA looks at individual numbers when it has low-level, particularized suspicion, but it looks at millions more with no suspicion of wrongdoing whatsoever, some of whom may well be members of Congress,” the legislators wrote to Cole.

NSA analysts move the associated numbers into a database known as the “corporate store”, where further analysis of the phone records does not require any “reasonable articulable suspicion” of connection to terrorism, and no court order is needed for further study.

“After collecting and analyzing these call records, the NSA would transfer the results to the so-called ‘corporate store’, a separate database that analysts were permitted to search without any showing of particularized suspicion,” the three legislators wrote.

While there have been relatively few disclosures around the NSA’s “corporate store”, the US government’s independent Privacy and Civil Liberties Oversight Board flagged it as vast and problematic in its January assessment of the bulk phone records program.

The approximately 300 searches NSA performed in 2012 of domestic phone records would indicate that the store contains “records involving over 120 million phone numbers” just for one year, the board found, where the NSA can apply the “full range of analytic tradecraft” to the records, regardless of whose they are or if their owners have any suspicion of connection to terrorism.

Analysts are permitted to “query the records in the corporate store with terms that are not reasonably suspected of association with terrorism. They also are permitted to analyze records in the corporate store through means other than individual contact chaining queries that begin with a single selection term: because the records in the corporate store all stem from RAS-approved [reasonable articulable suspicion] queries, the agency is allowed to apply other analytic methods and techniques to the query results,” the board found.

The Privacy and Civil Liberties Oversight Board recommended that the NSA be required to show reasonable articulable suspicion of connection to terrorism before it can sift through phone records in the corporate store.

In January, President Obama announced that, as an interim step toward a privatization of the NSA’s phone records database, the NSA would have to apply to the Fisa court before it can search the metadata trove, and that permissible analysis of numbers with reasonable articulable suspicion be limited to two “hops” instead of three.

Obama did not order any restrictions on the corporate store.

A Justice Department official said department leadership was reviewing the legislators’ letter.

The Obama administration’s difficulties on Capitol Hill over surveillance were compounded on Wednesday with word that Paul had filed his long-anticipated class action suit over the bulk collection.

“We believe this might be the largest class action lawsuit ever filed on behalf of the Bill of Rights,” Paul said, flanked by former Virginia attorney general Ken Cuccinelli and Matt Kibbe of the conservative action group Freedom Works.

“We are requesting a ruling confirming that the blanket collection of Americans’ telephone metadata without reasonable cause violates the fourth amendment of the US constitution, and requiring that these programs be halted immediately and that all previously collected data be purged from government databases,” Paul, Cuccinelli and Kibbe explained in a Wednesday CNN op-ed.