For that matter, how can they identify any individual as a US citizen when the commercial systems they're monitoring (phone, email, etc) often don't know? What about foreign workers on visas, or US expats abroad, or simple business travelers.