Without knowing anything about the nature of the requests it doesn't tell us anything. Imagine there are something like 800 actual terrorist suspects - people

Without knowing anything about the nature of the requests it doesn't tell us anything. Imagine there are something like 800 actual terrorist suspects - people who have been identified via human intelligence, e.g. Known to have met with terrorist cells, visited training camps, etc. Of 10,000 requests, it's easily possible that the vast majority could be simply following up on the immediate network surrounding those people - e.g. 'Suspect X called person Y, person Y is new to us, let us check whether person Y is linked to other suspects by phone or email'. Requests like that would be made using a boilerplate form, and would be correctly rubber-stamped as long as they were closely connected to suspects identified by other means. We should expect many of those kinds of requests to be being generated every day by analysts. The .03 needs to be put in the context of the number of non-routine requests that are being approved. It doesn't seem at all unreasonable that for every 10,000 boilerplate followups generated by desk clerk analysts, there are 10 more speculative ones generated as a result of more specific investigations, and of these 30% are deemed overreaching. The vast majority of requests are likely to be boring inquiries generated by bureaucrats following procedure, rather than Jack Bauer like rogues constantly overstepping their authority.