The National Security Agency is bound by legal constraints. It hasn't always followed the rules, to be sure. But when it does, are constitutional and statutory safeguards effective in protecting our privacy? This talk presents empirical computer science research on the NSA's legal restrictions, including results cited by President Obama's intelligence review group. We find that present limits on bulk surveillance programs come up far short. Authorities intercept international Internet traffic and enable the monitoring of ordinary Americans' online activities. The domestic telephone metadata program reaches much of the population, and allows for drawing extraordinarily sensitive inferences about medical conditions, firearm ownership, and more.