For that matter, how can they identify any individual as a US citizen when the commercial systems they're monitoring (phone, email, etc) often don't know? What about foreign workers on visas, or US expats abroad, or simple business travelers.
We expats abroad are not protected. I guess we're just not loyal enough.