Criminal penalties cannot be levied against organizations, only the individuals that make up those organizations. The NSA might say, "Well, I was only following orders," but that wasn't a cogent defense at Nuremberg and it's not a cogent defense now. Given that prior NSA director (Hayden) threatened to resign rather than implement similar schemes, it seems that Alexander is indeed culpable.