""The phone companies may already have data retention obligations under the Communications Act, but there's no additional obligation as a result of USA Freedom having passed," says Jennifer Granick, director of civil liberties at Stanford University's Center for Internet and Society.
What's new under the law, she says, is an obligation to provide a "two-hop function," identifying people two steps — or "hops" — removed from the target. With court approval, the NSA gets the phone records of a targeted individual; then every number in contact with that individual; and then every number in contact with that wider circle.
"Now the phone companies will be the place where that analysis of who's in contact with whom is taking place," Granick says."