AFTER the terrorist attacks of September 11th 2001, most Americans seemed content to pare back some civil liberties in return for potential security. An increase in snooping and secrecy became the norm. But after revelations of widespread spying by the National Security Agency (NSA) that were leaked by a former contractor, and the harsh treatment and verdict handed down to Bradley Manning, an army private who released more than 700,000 classified files to WikiLeaks (see article), American public opinion is shifting.

The NSA is now freshly on the back foot after significant details about a system to glean e-mail and web traffic, called xKeyscore, were exposed by the Guardian on July 31st. The NSA confirmed the system’s existence, and said safeguards existed to prevent misuse. Yet legislators are increasingly uneasy. Days earlier, a bipartisan bill that would have cancelled funding for a secret programme that collects the mobile-phone records of most Americans was defeated by a margin of just seven votes.

At a Senate hearing on July 31st one of the government’s leading intelligence lawyers, Robert Litt, said the administration was “open to re-evaluating” that programme. The administration also declassified three documents: the order from the FISA court (a secret court, set up under the Foreign Intelligence Surveillance Act in 2007, to oversee America’s spies) to collect phone records, and two memos to Congress, from 2009 and 2011, that explained the programme and the policies in place to prevent misuse of the information.

Those programmes and many others were disclosed by Edward Snowden, who left his plush life as an IT administrator for the NSA in Hawaii to bring the mass surveillance to the public’s attention. Though he is now in Russia, where he has been granted temporary asylum, he has already chalked up one small victory. When the American authorities needed to renew the phone-data surveillance order in July, they did so openly—in a bow to public pressure—rather than through the secret FISA process.

Fans of Mr Snowden worry that his disclosures will inspire little lasting reform. James Clapper, America’s director of national intelligence, has kept his job despite admitting that he gave erroneous answers to Congress about the scale of the surveillance. European governments, outwardly furious about operations targeting their own offices, have nonetheless helped American authorities encircle the fugitive who revealed them. Yet the disclosures have also encouraged a welter of legal suits from civil-liberties groups. And it may be that the NSA has indeed broken the law.

Many of the activities exposed by Mr Snowden—hacking into Chinese computers, bugging the offices of European officials—though ungentlemanly, are not illegal in America. Yet two programmes in particular look vulnerable to legal challenges. The first is the collection of Americans’ phone records—not the content of a call but details of who rang whom, when and for how long. Since 2007 the FISA court has approved requests for all such data from American phone companies. It does so under the Patriot Act, which lets spooks apply for records that are “relevant” to a national-security investigation.

The spies claim that all the data are relevant. “You need the haystack to find the needle,” says the NSA’s director, General Keith Alexander. Officials claim they need to obtain all records (and store them for five years) because the phone companies themselves do not keep them for long enough. In the past, the government identified suspects and then obtained the data, says Stewart Baker, a former NSA official. In the “collection-first” model, the records are obtained but examined only once targets are identified. “Both models end up in much the same place,” he explains.

Critics disagree. Deeming everything “relevant” renders the word meaningless—though it was placed in the Patriot Act in 2006 to put limits on snooping. The soundness of the procedures subsequently used to examine the data is beside the point. “So they take good care with the records they illegally obtain? That makes no sense. It’s still illegal,” says Christopher Sprigman, a law professor at New York University.

Snoops doggedly dogged

A constitutional challenge is also possible. Last year, in a case involving tracking a vehicle by GPS, the Supreme Court suggested that collecting lots of records is different from gathering a handful and may require stronger legal safeguards. Similar reasoning may apply to collecting the metadata of all calls, even if a more limited collection is legal.

The second programme under scrutiny is PRISM, through which spies monitor content, such as e-mail and Facebook messages, which are sent or received by foreigners. This includes communications which Americans send to those under surveillance—a cohort likely to have exploded in size after the FISA Amendments Act (FAA) of 2008 gave spooks broad freedom to monitor non-citizens abroad.

The FAA states that spies may not “intentionally acquire” communications wholly between Americans. But under the NSA’s rules, agents need determine only a 51% probability that the conversations they capture feature at least one foreign party, according to the Washington Post. That suggests they obtain a lot of purely domestic chatter. Moreover, intelligence officials seem to skirt the rules by claiming that the information is acquired only when it is analysed by an agent during an investigation, not when it is intercepted and stored.

Civil-liberties groups filed suits against these programmes when their existence was only rumoured. But these failed because they could not prove surveillance had taken place. Now that they can, some of these challenges may move forward.

Political challenges will continue in parallel. Ron Wyden, a Democratic senator from Oregon who has long championed privacy, called on lawmakers to tighten the legal wording of the Patriot Act and the FAA. Mr Clapper himself admitted in a letter to Mr Wyden and other senators on July 26th that there were “compliance problems” in the phone-record programme.

Mr Snowden justifies his disclosures by arguing that the infrastructure of mass surveillance should not be built beyond public oversight. Yet the legality of these programmes affects how his acts will be judged. If at least some of the surveillance is illegal, he has a better claim to be seen as a whistle-blower exposing wrongdoing by the authorities. America, after all, was founded on bucking unjust government. If the surveillance is lawful, there is more cause to pursue him vigorously. The forum that judges him today is the court of public opinion. And that opinion is in flux.