Actually, it says "US persons", because it includes more than just citizens. But it isn't technically a law unless it's changed in the last several years. It is legally binding though. However, it isn't prohibited in all circumstances, and much of what they've been doing isn't really surveillance in the sense that they didn't monitor actual conversations. I flew intelligence and surveillance missions in the Air Force and I was subject to those restrictions. The exceptions were incredibly stringent and the oversight extremely heavy when exceptions were granted. The issue here is whether or not the current administration abused the modified restrictions put in place after 9/11. It doesn't look good.