The National Security Agency is using its vast stores of communications data to build detailed graphs of Americans' social ties, according to a new report, raising new questions about the scope and legality of the spy agency's surveillance mission. A report published today by The New York Times says that since 2010, the NSA has been building a social graph capable of identifying Americans' associates, locations, and more. The agency is required to cite a foreign intelligence interest before running a query, but does not have to ensure that every email address and other piece of search data has a foreign origin.

The report, based on documents provided by former NSA contractor Edward Snowden and the Times' own interviews, describes how the NSA builds a detailed portrait of its targets by chaining together metadata from many different sources. "The agency can augment the communications data with material from public, commercial and other sources, including bank codes, insurance information, Facebook profiles, passenger manifests, voter registration rolls and GPS location information, as well as property records and unspecified tax data," the report says.

A metadata collection system that records 20 billion events per day

The use of metadata was prohibited until recently, when restrictions were lifted in the name of combatting terrorism around the globe. Previously, the metadata analysis was limited to foreigners.

The report says that a major tool used by the NSA to chain targets' contact information together is known as Mainway. In 2011, the Times says, Mainway ingested 700 million phone records every day. In August of that year, it began taking in an additional 1.1 billion cellphone records per day from an undisclosed US service provider. In its 2013 budget request to Congress, which Snowden disclosed, the NSA revealed that it intends to build a metadata collection system that records 20 billion discrete events per day and can process them for an analyst's review within an hour.

The Times obtained a top-secret document that describes how the NSA searches for 94 "entity types," such as phone numbers, email addresses and IP addresses, and correlates them with 164 "relationship types" to map its targets' connections. The report suggests that even though the content of the communications is not recorded, the NSA can still get detailed information about a person's friends, family, therapy schedule, or extramarital affairs.