Well I'm not an NSA engineer but I can imagine complex real-time analysis of streaming data, think processing 400+GbE link data. It quickly becomes too much too store, analysis could impose sequential packet dependencies.