The Privacy and Civil Liberties Oversight Board just issued a report on the NSA’s metadata driftnet.
They have concluded that it is both ineffective and illegal:

An independent federal privacy watchdog has concluded that the National Security Agency’s program to collect bulk phone call records has provided only “minimal” benefits in counterterrorism efforts, is illegal and should be shut down.
The findings are laid out in a 238-page report, scheduled for release by Thursday and obtained by The New York Times, that represent the first major public statement by the Privacy and Civil Liberties Oversight Board, which Congress made an independent agency in 2007 and only recently became fully operational.
………
The program “lacks a viable legal foundation under Section 215, implicates constitutional concerns under the First and Fourth Amendments, raises serious threats to privacy and civil liberties as a policy matter, and has shown only limited value,” the report said. “As a result, the board recommends that the government end the program.”
………
But the privacy board’s report criticized that, saying that the legal theory was a “subversion” of the law’s intent, and that the program also violated the Electronic Communications Privacy Act.
“It may have been a laudable goal for the executive branch to bring this program under the supervision” of the court, the report says. “Ultimately, however, that effort represents an unsustainable attempt to shoehorn a pre-existing surveillance program into the text of a statute with which it is not compatible.”

The ruling was not unanimous, the two members, both alumni of the ferociously corrupt and incompetent Bush DoJ, Rachel L. Brand and Elisebeth Collins Cook, both thought that everything was all hunky dory, with Ms Cook letting loose this bit of completely moronic insanity:

Still, in her dissent, Ms. Cook criticized judging the program’s worth based only on whether it had stopped an attack to date. It also has value as a tool that can allow investigators to “triage” threats and provide “peace of mind” if it uncovers no domestic links to a newly discovered terrorism suspect, she wrote.

Translation: Just because spying on the whole country hasn’t yet worked, doesn’t mean that at some point there might be a chance of it doing something good.
To paraphrase Jimi, excuse me while my head explodes.
Meanwhile, Ars Technica goes a bit further down into the weeds, and covers some important minutae:

The Thursday PCLOB report only addresses critiques of the Section 215 program, but it notes that a future report will address problems found in Section 702 of the Foreign Intelligence Surveillance Act Amendments Act (FISA AA). Meanwhile, the report describes the rules for targeting non-Americans outside the United States. The government argues that PRISM and related spying programs targeting non-Americans outside the United States are authorized under Section 702.
………
The report goes into great detail explaining both the mechanics of the bulk metadata collection program and how it began. It also emphasizes that under the Section 215 program, the NSA does not collect cell-site location information (CSLI), which can be used to provide geographic information about a call.
However, the report ominously notes:

In the past, the NSA has collected a limited amount of cell site location information to test the feasibility of incorporating such information into its Section 215 program, but that information has not been used for intelligence analysis, and the government has stated that the agency does not now collect it under this program.

The PCLOB concluded, as Ars has previously, that by allowing analysis of up to “three hops,” this could potentially encompass around half the population of the United States:

If the NSA queries around 300 seed numbers a year, as it did in 2012, then based on the estimates provided earlier about the number of records produced in response to a single query, the corporate store would contain records involving over 120 million telephone numbers.

The PCLOB also notes that there is a significant difference between using phone calling data to follow up on a reasonable suspicion, and collecting information on every phone call made in the country.

Still, I don’t expect anything but minor cosmetic changes.

Full report after the break: