Testifying to Congress, National Security Agency Deputy Director Chris Inglis discussed how the NSA might use a “three-hop” query to decide who to investigate. What this means is that the NSA can examine people who communicate with the terrorists (one hop) and then everyone who communicates with that person (two hops) and then everyone who communicates with anyone in that second circle (three hops).
Here’s how that might play out in the real world. Let’s say your buddy’s a journalist who interviews—not a terrorist—but the friends and family of a dead terrorist (as the New York Times did when they ran a story on Samir Khan). That right there is two hops. So they’ll automatically investigate your buddy’s data, even though he didn’t actually talk to a terrorist. But because the NSA uses a three-hop system, they would then examine your data, as well as that of anyone else your buddy happened to call, email, or IM.
But let’s take this farther. Let’s say that your buddy happened to actually interview a suspected terrorist. That’s one hop. You’re the second hop, along with everyone else your buddy spoke to. The third hop is all of your friends and family, and the friends and family of everyone else who ever spoke to your buddy.
Washington’s Blog lays out the math: “If the average person calls 40 unique people, three-hop analysis could allow the government to mine the records of 2.5 million Americans when investigating one suspected terrorist.”