Of course they claimed after being exposed that these programs are legal, but I think lawless is apt as these agencies don't consider the law as a boundary they need to respect.
I was asked for an example of the organization being lawless, I gave a concrete example of the organization failing the most basic of accountability measures: Being asked under oath about their processes. The leader of the organization lied. I think that's a decent indictment of the organization.
Citation needed