While German noted that the NSA has reported multiple instances of unauthorized access by employees to the antiterrorism databases, Edgar defended the self-reporting. "It's an indication of a compliance system that's actually meaningful and working," he said. "If you had a compliance system that said there was no violation, there were never any mistakes, there was never any improper targeting that took place ... that would an indication of a compliance regime that was completely meaningless."
The mass data collection combined with better data analysis tools translates into an "arms race" where intelligence officials try to find new connections with the data they collect, said Ashkan Soltani, a technology and privacy consultant. New data analysis tools lead intelligence officials to believe they can find more links to terrorism if they just have "enough data," but that belief is "too much sci fi," he said.
"This is the difficult part, if you're saying that if we have enough data we'll be able to predict the future," the ACLU's German said.
Many U.S. intelligence officials are suspect of tech vendor claims about predictive analysis, Edgar countered. However, link analysis -- the tracking of suspects through communications with other known criminals or terrorists -- is a "very powerful tool," he said. It may be possible to use sophisticated cryptographic techniques to do that kind of analysis without the bulk collection of phone records, he said.
"The [internal] compliance regime is not the best answer for privacy," Edgar said. "The best answer is not to take the data in the first place, then you don't have to worry about compliance."
The ACLU has concerns about link analysis, because it creates a massive list of suspicious people that overwhelms investigators, German said. "What link analysis creates is suspicion upon the people that suspicious people are linked to," he said. "That growing cloud of suspicion can never been cleared."
Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is email@example.com.