Yeah, and it was a fucking embarrassment to the NSA. Their security procedures were pretty lax, especially for a three-letter agency, but that seems par for the course given the budget climate in Washington.<p>But the difference was that in this case, the default policy is collection. If you collect everyone&#x27;s data, then no special effort has to be taken to snoop on an individual&#x27;s data (besides accessing it). There might be access logs; there might not be.<p>If there is a process that has to be followed to initiate data collection on a target, there will certainly be records of that process because they will be required to execute the process. It&#x27;s at least better than having everyone&#x27;s data sit in a datacenter somewhere ready to be searched by anyone with the proper security clearance.