Today, the Senate Intelligence Committee will begin questioning Air Force Gen. Michael Hayden, nominated to be director of the Central Intelligence Agency, about the National Security Agency's collection of U.S. citizens' telephone records.

The scrutiny of the NSA is deserved, but the Senate and the American public may be missing a broader and more disturbing development. For the first time since the Civil War, the United States has been designated a military theater of operations. The Department of Defense -- which includes the NSA -- is focusing its vast resources on the homeland. And it is taking an unprecedented role in domestic spying.

It may be legal. But it circumvents three decades of efforts by Congress to restrict government surveillance of Americans under the guise of national security. And it represents a profound shift in the role of the military operating inside the United States. What's at stake here is the erosion of the principle, embedded in the 1878 Posse Comitatus Act, that the U.S. military not be used for domestic law enforcement.

When the administration declared the United States to be a theater of military operations in 2002, it created a U.S. Northern Command, which set up intelligence centers in Colorado and Texas to analyze the domestic threat. But these are not the military's only domestic intelligence efforts. According to the Congressional Research Service, the Pentagon controls "a substantial portion" of U.S. national intelligence assets, the traditional turf of the FBI and CIA.

In 2003, Congress created the job of undersecretary of Defense for intelligence to oversee the department's many intelligence bodies -- including a new entity called Counterintelligence Field Activity, or CIFA.

CIFA was ordered to maintain a "domestic law-enforcement database" on "potential terrorist threats" to U.S. military installations, and it began collecting information on U.S. citizens.

In 2005, a presidential commission suggested that CIFA, set up as a clearinghouse for information, be empowered to conduct domestic investigations into crimes such as treason, espionage and terrorism. Astoundingly, the commission declared that such an expansion of military powers would not require congressional approval; a presidential order and Pentagon directive would suffice. One Defense Department program feeding information to CIFA is TALON (Threat and Local Observation Notice), which is supposed to obtain data from "concerned citizens and military members regarding suspicious incidents" that could herald terrorist attacks. But the military appears to have interpreted its mandate broadly. A TALON report was filed on a protest against "war profiteering" by Halliburton, Newsweek reported. The protesters alleged the defense contractor overcharged for food for U.S. troops in Iraq.

Counterintelligence reports were also filed on New York University's OUTlaw, a decades-old organization of openly gay law students. "The term 'outlaw' is a backhanded way of saying it's all right to commit possible violence," concluded one misguided military investigator in a document obtained last month under the Freedom of Information Act." NBC reported that about four dozen TALON database entries on "suspicious incidents" were not about terrorism but about opposition to the Iraq war and military recruiting.

These misguided military forays into domestic surveillance harken back to Vietnam War-era abuses. This time, they are the result of a much broader intelligence-gathering effort by the military on U.S. soil. President Bush said last week, "We're not mining or trolling through the personal lives of millions of innocent Americans." But a 2004 survey by the General Accounting Office found 199 data-mining operations that collect information ranging from credit-card statements to medical records. The Defense Department had five programs on intelligence and counterterrorism.

The Defense Intelligence Agency, created in 1961 to provide foreign military intelligence, now uses "Verity K2" software to scan U.S. intelligence files and the Internet "to identify foreign terrorists or Americans connected to foreign terrorism activity," and "Inxight Smart Discovery" software to help identify patterns in databases. CIFA has reportedly contracted with Computer Sciences Corp. to buy identity-masking software, which could allow it to create fake websites and monitor legitimate U.S. sites without leaving clues that it had been there. The National Geospatial-Intelligence Agency is collecting data from 133 U.S. cities; intelligence sources told the Los Angeles Times that, when collection is completed, the agency would be able to identify occupants in each house, their nationality and even their political affiliation.

In 2002, the Defense Department launched the granddaddy of all data-mining efforts, Total Information Awareness, to trawl through all government and commercial databases available worldwide. In 2003, concerned about privacy implications, Congress cut its funding. But many of the projects simply transferred to other Defense Department agencies. Two of the most important, the Information Awareness Prototype System and Genoa II, moved to NSA headquarters.

The Pentagon argues that its monitoring of U.S. citizens is legal. "Contrary to popular belief, there is no absolute ban on intelligence" agencies collecting information on Americans or disseminating it, says a memo by Robert Noonan, deputy chief of staff for intelligence. Military intelligence agents can receive any information "from anyone, any time," Noonan wrote.

Throughout U.S. history, we have struggled to balance security concerns with the protection of individual rights, and a thick body of law regulates domestic law enforcement agencies' behavior. Congress should think twice before it lets the behemoth Defense Department into domestic law enforcement.

News that AT&T, Verizon and BellSouth gave customer records to the National Security Agency has set off a heated debate over the intricacies of espionage law. But legal or not, this sort of spying program probably isn't worth infringing our civil liberties for -- because it's very unlikely that the type of information one can glean from it will help us win the war on terrorism.

If the program is along the lines described by USA Today -- with the security agency receiving complete lists of who called whom from each of the phone companies -- the object is probably to collect data and draw a chart, with dots or ''nodes'' representing individuals and lines between nodes if one person has called another.

Mathematicians who work with pictures like this are called graph theorists, and there is an entire academic field, social network analysis, that tries to determine information about a group from such a chart, like who the key players are or who the cell leaders might be.

But without additional data, its reach is limited: as any mathematician will admit, even when you know everyone in the graph is a terrorist, it doesn't directly portray information about the order or hierarchy of the cell. Social network researchers look instead for graph features like ''centrality'': they try to identify nodes that are connected to a lot of other nodes, like spokes around the hub of a bicycle wheel.

But this isn't as helpful as you might imagine. First, the ''central player'' -- the person with the most spokes -- might not be as important as the hub metaphor suggests. For example, Jafar Adibi, an information scientist at the University of Southern California, analyzed e-mail traffic among Enron employees before the company collapsed. He found that if you naively analyzed the resulting graph, you could conclude that one of the ''central'' players was Ken Lay's secretary.

And even if you manage to eliminate all the ''central players,'' you may well still leave enough lesser players that the cell retains a complete chain of command capable of carrying out a devastating terrorist attack.

In addition, the National Security Agency's entire spying program seems to be based on a false assumption: that you can work out who might be a terrorist based on calling patterns. While I agree that anyone calling 1-800-ALQAEDA is probably a terrorist, in less obvious situations guilt by association is not just bad law, it's bad mathematics, for two reasons.

The simplest reason is that we're all connected. Not in the Haight-Ashbury/Timothy Leary/late-period Beatles kind of way, but in the sense of the Kevin Bacon game. The sociologist Stanley Milgram made this clear in the 1960's when he took pairs of people unknown to each other, separated by a continent, and asked one of the pair to send a package to the other -- but only by passing the package to a person he knew, who could then send the package only to someone he knew, and so on. On average, it took only six mailings -- the famous six degrees of separation -- for the package to reach its intended destination.

Looked at this way, President Bush is only a few steps away from Osama bin Laden (in the 1970's he ran a company partly financed by the American representative for one of the Qaeda leader's brothers). And terrorist hermits like the Unabomber are connected to only a very few people. So much for finding the guilty by association.

A second problem with the spy agency's apparent methodology lies in the way terrorist groups operate and what scientists call the ''strength of weak ties.'' As the military scientist Robert Spulak has described it to me, you might not see your college roommate for 10 years, but if he were to call you up and ask to stay in your apartment, you'd let him. This is the principle under which sleeper cells operate: there is no communication for years. Thus for the most dangerous threats, the links between nodes that the agency is looking for simply might not exist.

If our intelligence agencies are determined to use mathematics in rooting out terrorists, they may consider a profiling technique called formal concept analysis, a branch of lattice theory. The idea, in a nutshell, is that people who share many of the same characteristics are grouped together as one node, and links between nodes in this picture -- called a ''concept lattice'' -- indicate that all the members of a certain subgroup, with certain attributes, must also have other attributes.

For formal concept analysis to be helpful, you need much more than phone records. For instance, you might group together people based on what cafes, bookstores and mosques they visit, and then find out that all the people who go to a certain cafe also attend the same mosque (but maybe not vice versa).

While researchers at Los Alamos National Laboratory have used this tool to sift through hundreds of terrorism-related reports -- and find connections that human analysts could not have found easily -- it's still dangerous to rely on the math.

This is because, as Kennedy and Lincoln assassination buffs know, two people can be a lot alike without being the same person. Even if there is only a 1 in 150 million chance that someone might share the profile of a terrorist suspect, it still means that, in a country the size of the United States, two people might share that profile. One might be a terrorist, or he might be Cat Stevens.

This isn't to say that mathematicians are useless in fighting terrorism. In September 2004 -- 10 months before the bombing of the London Underground -- Gordon Woo, a mathematician and risk-assessment consultant, gave a speech warning that London was a hotbed of jihadist radicalism. But Dr. Woo didn't anticipate violence just using math; he also used his knowledge of London neighborhoods. That's what law enforcement should have been doing then and should be doing now: using some common sense and knowledge of terrorists, not playing math games.

Math is just a tool. Used wisely, math can indeed help in warfare: consider the Battle of Britain, won in part by breaking the German codes. But use it unwisely -- as seems to be the case here -- and your approval ratings might just hit a new all-time low.