As Americans wait for Congress to decide next month whether to renew the Patriot Act and the vast NSA metadata surveillance program it's made possible, a panel of three appellate judges has made the decision on its own: The Patriot Act, they've now ruled, was never written to authorize the sort of sweeping surveillance the NSA interpreted it to allow.

The United States Court of Appeals for the Second Circuit ruled on Thursday that the bulk collection of Americans' phone metadata by the NSA wasn't in fact authorized by section 215 of the Patriot Act, as the intelligence community has argued since the program was first revealed in the leaks of Edward Snowden two years ago. The ruling doesn't immediately halt the domestic phone records surveillance program. But if it's not overturned by a higher court it could signal the program's end—and it at least forces Congress to choose whether it wishes to explicitly authorize the program when the Patriot Act comes up for renewal on June 1st.

"We hold that the text of § 215 cannot bear the weight the government asks us to assign to it, and that it does not authorize the telephone metadata program," the ruling reads. "We do so comfortably in the full understanding that if Congress chooses to authorize such a far-reaching and unprecedented program, it has every opportunity to do so, and to do so unambiguously. Until such time as it does so, however, we decline to deviate from widely accepted interpretations of well‐established legal standards."

The ruling comes as the latest surprise development in a lawsuit from the American Civil Liberties Union against the Office of the Director of National Intelligence that immediately followed Edward Snowden's revelations of the NSA's mass domestic surveillance under the 215 section's purported authorization. The lawsuit had been dismissed by a lower court in 2013, but the three appellate judges overruled decision.

Since it was first revealed, the 215 metadata surveillance program has been under attack from privacy advocates, and even the White House has said it's exploring alternatives to the current system of collecting every American's phone records. In a statement responding to the ruling, a spokesperson for the National Security Council writes that it's already looking at a replacement for the program. "The President has been clear that he believes we should end the Section 215 bulk telephony metadata program as it currently exists by creating an alternative mechanism to preserve the program’s essential capabilities without the government holding the bulk data," writes the NSC's assistant press secretary Ned Price. "We continue to work closely with members of Congress from both parties to do just that."

But the new court ruling will nonetheless have real significance for Congress's upcoming decision as to whether and how to reform the Patriot Act. A reform bill known as the USA Freedom Act, which would limit the 215 metadata collection, has advanced in the House. But that bill has been opposed by Republicans.

Now, says Cato Institute privacy researcher Julian Sanchez, reform is almost inevitable. "This changes the calculus. You now have a federal appellate court saying that the statute in its current form does not authorize this program. If the program needs to continue, it may not be allowed under a straight reauthorization," Sanchez says. "If your goal is to preserve this program, reform becomes the surest way to preserve some version of it."

The judges point out that most members of Congress weren't even aware of the program.

In addition to questioning the program's authorization, the ACLU has also argued that the program violated Americans' fourth amendment rights to protection from warrantless search and seizure. But the judges were careful not to address that constitutional argument. Instead the court narrowed its ruling to state only that the hoovering up of every Americans' phone metadata is beyond the scope of what the US Congress had in mind when it passed section 215 of the Patriot Act after September 11, 2001.

Despite its reluctance to rule the NSA's metadata program unconstitutional, the ruling seems to recognize the invasive potential of a system that monitors who calls whom, rather than the content of those calls. "That telephone metadata do not directly reveal the content of telephone calls," it reads, "does not vitiate the privacy concerns arising out of the government’s bulk collection of such data."

A call to a single‐purpose telephone number such as a “hotline” might reveal that an individual is: a victim of domestic violence or rape; a veteran; suffering from an addiction of one type or another; contemplating suicide; or reporting a crime. Metadata can reveal civil, political, or religious affiliations; they can also reveal an individual’s social status, or whether and when he or she is involved in intimate relationships.

Even so, the ruling notes that such metadata isn't owned by the individuals whose privacy is at stake. Instead, it's held by phone carriers, leaving it open to what's known as the "third-party doctrine," the legal argument that Americans don't have an expectation of privacy for records held by a third party, and thus they don't have protection under the fourth amendment. The ruling declines to contradict that argument.

Instead, it attacks the notion that Congress ever intended to authorize such a sweeping, mass collection of metadata. As the judges read the Patriot Act, they say it's intended for targeted investigations in a specific cases, not dragnet surveillance with no limits in time or target.

"The government effectively argues that there is only one enormous 'anti‐terrorism' investigation, and that any records that might ever be of use in developing any aspect of that investigation are relevant to the overall counterterrorism effort," the ruling reads. "The records demanded are not those of suspects under investigation, or of people or businesses that have contact with such subjects, or of people or businesses that have contact with others who are in contact with the subjects – they extend to every record that exists, and indeed to records that do not yet exist, as they impose a continuing obligation on the recipient of the subpoena to provide such records on an ongoing basis as they are created."

The ruling notes that the Office of the Director of National Intelligence, the defendant in the case, had argued that Congress had implicitly approved the mass metadata collection when it reauthorized that section of the Patriot Act in 2010 and 2011. But the judges point out that most members of Congress weren't even aware of the program, and that showing it had truly been authorized would require evidence of explicit discussion, not closed-door hints and whispers.

"Such expansive development of government repositories of formerly private records would be an unprecedented contraction of the privacy expectations of all Americans," the judges write. "Perhaps such a contraction is required by national security needs in the face of the dangers of contemporary domestic and international terrorism. But we would expect such a momentous decision to be preceded by substantial debate, and expressed in unmistakable language."

Congress will have its chance to make that decision in "unmistakable language" in less than a month, when the Patriot Act comes up again for renewal. In a statement, Senator Ron Wyden says that it should take this opportunity to end the program altogether. “This dragnet surveillance program violates the law and tramples on Americans’ privacy rights without making our country any safer. It is long past time for it to end," writes Wyden, a member of the Senate Intelligence Committee who has been a longtime critic of the 215 program. "Now that this program is finally being examined in the sunlight, the Executive Branch’s claims about its legality and effectiveness are crumbling. The President should end mass surveillance immediately. If not, Congress needs to finish the job and finally end this dragnet.”

Ruling on NSA 215 Metadata Surveillance