For what us ordinary people know, there are "selectors", something similar in purpose to regular expressions, that can filter out data out of the streams (not just raw IP communications, but also phone call metadata and PIR datasets from airlines) for storage and human inspection. Think of stuff like the phone numbers, names or email addresses of known or suspected "terrorists", drug dealers, organized criminals, or whomever else ends up on one of the flag lists.