When the Snowden leaks first revealed the National Security Agency's web surveillance systems, it came with a mystery. According to documents published by Snowden, the NSA voluntarily ended bulk collection of web metadata in November of 2010, but the agency's capabilities didn't seem to suffer as a result. Why was the agency so calm about shutting down one of its broadest-reaching surveillance tools?

A new report from The New York Times offers a compelling answer: the NSA just moved the collection overseas. Under the new system, the agency is able to collect the same data — sometimes concerning American citizens communicating with other American citizens — outside of US borders, making FISA approval and other constitutional protections unnecessary.

That shift has long been suspected by experts, but it's confirmed by an NSA inspector general's report obtained by the Times through a Freedom of Information Act request. According to the report, one of the reasons for shutting down the program is that "other authorities can satisfy foreign intelligence requirements." Those other authorities likely refer to the Special Procedures Governing Communications Metadata Analysis (or SPCMA), which allows for contact-chaining from data collected overseas, outside of FISA authority.

In both cases, the NSA is concerned with internet metadata — a record of the websites and services a person connects to, but not the data transferred once the connection is made. In practical terms, that allows intelligence agencies to look for everyone who's visited a particular website, or connected to an encrypted service like Telegram. The UK government has recently pushed to expand web-record collection through the Investigatory Powers Bill, a move that has been widely criticized by privacy advocates. In one statement, Edward Snowden referred to the records as "like a list of every book you've ever opened."