A highly classified court order, leaked to the British paper The Guardian and published on Wednesday, details a practice civil libertarians have long feared: indiscriminate surveillance of U.S. citizens. While on its surface, this order — which authorized the secretive National Security Agency to collect data on phone calls placed by Verizon customers for a period of three months — seems blatantly illegal, the reality is that Congress has been enabling and legalizing such surveillance for years.

The NSA was collecting so-called metadata:  information about call duration, location, and numbers, but not the identities of the callers or the content of their conversations. It was not wiretapping or eavesdropping as they’re traditionally known. This type of data is most useful for pattern analysis, which might be clarified to focus on an individual or a group of individuals, but to collect the content of their conversations the NSA would need another warrant.

The last time the NSA came under fire for its surveillance of Americans was in 2005, when the New York Times broke the story that the NSA had been collecting data on American citizens without a court order. Though Bush administration officials insist the collection was instrumental in breaking up terrorist plots, it also marked a new expansion of NSA authority – directly listening to American citizens.

Many viewed the NSA eavesdropping, enabled without much protest by US telecom companies, to be patently illegal. In order to protect telecoms from legal reprisals by angry customers, Congress passed, in 2008 amendments to the Foreign Intelligence Surveillance Act, a retroactive legal immunity protecting them from lawsuit.

Those changes to FISA had a rippling effect on the government’s ability to collect information on citizens. The NSA spied on Americans without even seeking a warrant, but instead of punishing them or the companies who assisted them, Congress instead gave them the go-ahead. In other words, they set a new norm that made it okay for an intelligence agency to seek data about Americans.

But 2008 wasn’t the first or even the last time Congress approved expansive surveillance authorities. In the original 2001 USA PATRIOT Act, the law permitted the government to collect data previously forbidden. During the Bush administration, scandals erupted over the Department of Justice Office of Legal Counsel issuing secret interpretations of U.S. law – torture, extraordinary rendition, surveillance and drone strikes all are supported by secret legal arguments locked up in the White House.

Rather than challenging the administration’s authority to secretly interpret and enact laws, however, Congress instead twice authorized them to keep everything a secret. Last year, Ron Wyden, a Democrat on the Senate Intelligence Committee, tried to prohibit secret legal rulings. He got voted down. That same year Senator Jeff Merkley, also a Democrat, added his own amendment to the renewal of the 2008 wiretapping law. His amendment was voted down by a strong margin in both parties.

So this latest outcry over expansive surveillance is really the culmination of over a decade of lawmaking. All three branches of government – the court order was approved by a FISA court – and both parties, in two administrations, have agreed consistently to enable and protect the practice.

An action’s legality does not make it wise. While extensive datasets are useful for doing pattern analysis, there is a legitimate fear that the government is expanding the terms of its surveillance unreasonably. That is an important debate that should have happened publicly already – back in 2001, or 2008, or 2012. Neither Congress nor the White House helped its cause by doing everything so secretively.

But the place where this broad, legal surveillance can be reined in is Congress, since they passed the laws to begin with. Congress created this mess, and they should be the ones to clean it up.

Joshua Foust is a freelance journalist based in Washington, DC. He was previously a military intelligence analyst. His website is joshuafoust.com.

AP Photo/Dima Gavrysh, File