This is what I find particularly disturbing:
But James Clapper, the director of national intelligence, said the program targets only foreigners. “It cannot be used to intentionally target any U.S. citizen, any other U.S. person, or anyone located within the United States,”
Which begs the question: what protections are in place to keep it from "unintentionally" getting data from US citizens? I'm betting on "nothing", personally (though I have no doubt the official answer is, "That's classified; trust us").