There's also the game that they play where they spoof BGP announcements that cause routing changes for domestic traffic that makes it flow out and then back into the US, making it fair game for collection. Also, our Five Eyes partners aren't prohibited from collecting on US targets, and we all share.
Doesn't "receiving surveillance data about your citizens that your allies collected for you" also count as spying on your own citizens?
I'm not a lawyer but...
"You spied on me!" -"Relax, sweetheart... Of course I didn't spy on you. I got Mike to spy on you. Hey Mike!"