It doesn't matter whether they created it. If your operations would suffer from the NSA having had access to this anywhere between 1 day and two years ago, then you have to assume they took advantage of it whether they created it or not, and you have to execute any damage control and mitigation procedures that you've created. I.e. assume your data has been read and used, and act accordingly.