A federal appeals court in New York City unanimously ruled Thursday that the National Security Agency's daily bulk collection of phone records was not legally authorized by the Patriot Act. So if the NSA’s bulk collection of domestic metadata is illegal, when will the program be dismantled?

That’s up to Congress. Turns out the ruling by the 2nd U.S. Circuit Court of Appeals doesn't stop the NSA from requiring companies like Verizon to provide information on all phone calls in the U.S. on a regular basis -- a program so controversial that whistleblowers Edward Snowden and Glenn Greenwald selected it as the first NSA program to highlight as part of leak disclosures that started in 2013. 

The records that the NSA collects are commonly called metadata. They do not contain the contents of the communication -- like what you said during a phone call -- but associated information, such as the length and time of a phone call, which is increasingly seen as just as invasive.

"This decision is part of a broad consensus in the courts that metadata includes sensitive info," said Patrick Toomey, a staff attorney at the American Civil Liberties Union. 

Expiration Date Nears

The reason the court punted on dismantling the program was because Section 215, the Patriot Act rule that supposedly enabled the program, is among three provisions of the law that are set to expire June 1.

"Because our decision is based on our reading of a federal statute, not the Constitution, Congress can in effect overrule it,” federal Judge Robert Sack of the appeals court wrote in a concurring opinion. He added that Congress might simply terminate the program.

While it might seem as if the winds in Washington are blowing that way, a few Senate Republicans have seized on the court decision as an opportunity to push back. Senate Majority Leader Mitch McConnell is fast-tracking a bill to reauthorize parts of the Patriot Act, including Section 215, as they currently exist, and publicly defended the NSA’s surveillance powers hours after the appeals court's decision.

If McConnell and the Senate Republicans were to reauthorize the Patriot Act with no changes, then the case would almost certainly be headed to the Supreme Court. And since the appeals court denied a preliminary injunction asking the end the program, the NSA’s bulk metadata collection program would continue until the nation’s highest court ruled, said David Fidler, a visiting fellow for cybersecurity at the Council on Foreign Relations. 

“The only way I see the Supreme Court hearing the case is if Congress is not going to change anything and it’s straight-up reauthorized,” Fidler said. 

However, the increased attention and debate resulting from the appeals court’s decision could lead to gridlock. If no reauthorization is passed, then the bulk collection program would cease to exist.

“One possibility is this decision produces deep disagreement between the parties that leads to nothing happening,” Fidler said. “I see it potentially energizing individuals in Congress who want to see the NSA’s surveillance capabilities to continue.”

Compromise Possible

Ultimately, both sides could end up compromising. The USA Freedom Act, a proposal backed by a long list of politicians and tech companies, including Google, Microsoft and Facebook, would still allow for metadata collection. But instead of companies turning over records en masse to the NSA, companies would retain the records, and the federal government would have to request files from them -- after first convincing a court that there was reason to believe that a specific search term, such as a name or phone number, could yield information about terrorism.

But even that doesn't please everyone. "Reforms on the table don't go nearly far enough. This decision makes clear we need even stronger restrictions on the data the government can collect," Toomey said. 

With the added attention on the debate from Thursday's ruling, the most likely outcome may be a compromise that leaves everyone dissatisfied -- from citizens, to NSA allies, to the companies that would likely have to hire employees and spend additional money to accommodate additional government records requests. 

“They could adopt a statute that doesn’t make anyone happy. There would be some access to metadata, but no bulk collection, and the companies would keep the metadata,” Fidler said. “This decision agitated existing controversies in politics.” 

There's a lot of ground to cover before June 1.