The National Security Agency's bulk telephone metadata collection program exposed by Edward Snowden is not authorized by the Patriot Act, a federal appeals court ruled Thursday.

Further Reading The good, bad, and the ugly of pending congressional surveillance bills

The decision (PDF) by the US Circuit Court of Appeals for the Second Circuit said the snooping program "exceeds the scope of what Congress has authorized." Both the Bush and the Obama administrations have cited the Patriot Act, adopted a month after the 2001 terror attacks, as the legal basis authorizing the spying that began in 2007.

The lengthy ruling comes as the section of the Patriot Act in question expires at month's end, and lawmakers are set to renew it outright or with a few limitations on the metadata collection program.

"The statutes to which the government points have never been interpreted to authorize anything approaching the breadth of the sweeping surveillance at issue here," the appeals court wrote.

The court noted that the Patriot Act gives the government wide powers to acquire all types of private records on Americans as long as they are "relevant" to an investigation. But the government is going too far when it comes to acquiring, via a subpoena, the metadata of every telephone call made to and from the United States, the court said.

The records demanded are not those of suspects under investigation, or of people or businesses that have contact with such subjects, or of people or businesses that have contact with others who are in contact with the subjects—they extend to every record that exists, and indeed to records that do not yet exist, as they impose a continuing obligation on the recipient of the subpoena to provide such records on an ongoing basis as they are created. The government can point to no grand jury subpoena that is remotely comparable to the real‐time data collection undertaken under this program.

The nation's telecoms forward to the National Security Agency the phone numbers of both parties in a call, calling card numbers, the length and time of the calls, and the international mobile subscriber identity (ISMI) number for mobile callers. The NSA keeps a running database of that information and says it runs queries solely to combat terrorism.

Further Reading If the Supreme Court tackles the NSA in 2015, it’ll be one of these five cases

Congressional opponents of the surveillance immediately applauded the ruling.

"This ruling affirms that the government does not have the authority to collect and retain the private telephone activity of innocent, law-abiding Americans," said Sen. Martin Heinrich (D-N.M.). "It should also give the president the confidence to finally end this overly broad program using his existing authority."

Sen. Ron Wyden, (D-Ore.) said, "This dragnet surveillance program violates the law and tramples on Americans' privacy rights without making our country any safer. It is long past time for it to end."

The court, meanwhile, sidestepped the issue of whether the spying was constitutional. Instead, it focused solely on whether it was authorized by the Patriot Act, as the Obama administration maintains.

The decision, in a case brought by the American Civil Liberties Union, sets aside a lower court's conclusion that the bulk metadata collection program was constitutional. The ACLU appealed that ruling, which resulted in Thursday's decision.

The three-judge appeals court panel, however, did not order the program to stop immediately. That's because Congress is debating the issue ahead of Section 215 of the Patriot Act expiring June 1. Whatever Congress decides, the court noted, can be revisited in court. And because of that deadline and the looming congressional dogfight over the program, the Supreme Court isn't likely to weigh in before the legislative process is resolved.

…we hold that the text of § 215 cannot bear the weight the government asks us to assign to it, and that it does not authorize the telephone metadata program. We do so comfortably in the full understanding that if Congress chooses to authorize such a far‐reaching and unprecedented program, it has every opportunity to do so, and to do so unambiguously.

It's not clear how the ruling will affect the Patriot Act debate. There are three key pieces of legislation pending. One proposal eliminates the bulk metadata program, one tinkers with it, and another allows it to continue, as is, through 2020.

Presumably, however, any attempt to keep the program running unabated would require Congress, as the court said, "to do so unambiguously."

"The current reform proposals from Congress look anemic in light of the serious issues raised by the Second Circuit," said Anthony Romero, the ACLU's executive director. "Congress needs to up its reform game if it's going to address the court's concerns."

Becky Bond, the vice president of CREDO Mobile phone company in San Francisco, said: "As a telecom that can be compelled to participate in unconstitutional surveillance, we welcome the federal court decision striking down mass collection of telephone metadata under Section 215 of the PATRIOT Act. This gives even greater urgency to our fight to stop Congress from reauthorizing the worst abuses of the PATRIOT Act, which are set to sunset June 1."

Senators Patrick Leahy (D-Vt.) and Mike Lee (R-Utah) used the occasion of the court's opinion to say the bulk collection program should end.

"Congress should not reauthorize a bulk collection program that the court has found to violate the law. We will not consent to any extension of this program," they said in a joint statement.