It's a confusing headline. What the NSA does is probably illegal in every country but the US, but the implication is it's illegal in the US.

It's probable they do things that are illegal under US law, but I doubt this is one of them.

The concept of legality gets awkward when talking about the military force of a nation, but even in the United States there are limits to what the military (NSA, DOD, etc.) are authorized to do. Though the matter at hand could be framed as a matter of 'economic security' to the US, it is unclear that such an argument is sound. And if that argument is not sound, the consequences that stem from the US military being involved in the domestic law enforcement of another state against their will are not desirable to the US from a policy perspective.

Though NSA's actions may or may not be illegal in the US, there are other standards used to judge or analyze military action in the global economic marketplace.

I don't know enough about US law, but if the president is required (at least in theory) to receive authorisation from congress before (or after) attacking an enemy nation, is there not some equivalent requirement for using the military apparatus against an ally?

Perhaps the constitution allows the president to do whatever he or she wants with the military (as long as it is within the historic bounds of what militaries do) without triggering the need for congressional approval unless it reaches a "state of war" at which point people might actually start dying.

That would seem like the sort of practical level of discretion that a country would give its executive branch, but I can't help thinking that there could or should be some law somewhere that gave the president's actions against allies some type of legislative basis, so that voters had an idea of how the president would use these secretive powers, and could hold the executive to account at the ballot box.