Early in the week, things were looking good for the National Security Agency. 60 Minutes gifted the government an hour-long infomercial, and the newly completed report from a review board that the White House stacked with a handful of intelligence insiders was rumored to have proposed only cosmetic reform. Even so, the administration had decided to keep the report private until January, when President Obama plans to lay out what changes, if any, he’ll make to the intelligence programs.

By Wednesday afternoon significant cracks had opened in the NSA’s defenses. The first came courtesy of Judge Richard Leon, a George W. Bush appointee who ruled Monday that the bulk collection of telephone records “almost certainly” violates the Constitution. The second appeared when the administration decided to release the forty-six recommendations made by the President’s Review Group on Intelligence and Communications Technologies to the public.

In more than 300 pages, the panel argues for reforms to the nation’s intelligence apparatus that are far more comprehensive than expected. It calls for the government to shift its database of call records to private companies, and to strengthen the criteria that make such data available for search; for changes to the structure of the NSA and the Foreign Intelligence Surveillance Court (FISC) that rules on the agency’s requests for surveillance authority; for the government to “make clear” that it will not undermine global encryption standards; and for greater protections for foreigners, including an extension of the Privacy Act of 1974 to non-US persons.

“There is a lot in this report for a reformer to like,” Senator Ron Wyden, one of leading advocates for reform, said in a statement. Senator Mark Udall, another critic of the NSA, called the recommendations “sweeping,” and said, “They generally embrace the reforms that I have been advocating for several years, in many cases against vociferous opposition from the Administration.”

Neither ruling ensures substantive changes within the NSA. An appellate court could overturn Judge Leon’s opinion. Obama may ignore the recommendations, which still leave open substantial holes. The report fails to address the legality of the NSA’s programs, from both constitutional and statutory perspectives. Many of the recommendations are strong in theory, and short on detail of how they could be enforced in light of the agency’s repeated willingness to bend the rules to suit its needs.

Taken together, though, the court ruling and the panel’s recommendations undermine the government’s defense of its surveillance activities in powerful ways. Both challenge assertions that the data dragnet is a national security imperative; that the record of our phone calls is only a benign dump of data rather than key points in the constellation of our daily lives; that security and civil liberty are at competing ends of a policy stick; and that the greatest threats facing US citizens are from traitorous leaks and media misrepresentation, rather than the surveillance programs in question.

“We cannot discount the risk, in light of the lessons of our own history, that at some point in the future, high-level government officials will decide that this massive database of extraordinarily sensitive private information is there for the plucking,” the report reads. “Americans must never make the mistake of wholly ‘trusting’ our public officials.”

The report should embarrass public officials and legislators who have tried to preserve the NSA’s data collection programs, which Judge Leon called “almost Orwellian.” Senator Dianne Feinstein, the Democrat in charge of the Intelligence Committee, and others have spent months arguing that the phone records program should be enshrined in law, for the paradoxical reasons that metadata is both essential to national security and trivial when it comes to individual privacy. “The assumption behind the argument that meta-data is meaningfully different from other information is that the collection of meta-data does not seriously invade individual privacy. As we have seen, however, that assumption is questionable,” the report reads. Critically, the review confirmed that the information gained from the phone metadata program “was not essential to preventing attacks and could readily have been obtained in a timely manner” by other means. The panel concluded, “There is no sufficient justification for allowing the government itself to collect and store bulk telephony meta-data.”

As privacy advocates have pointed out, it isn’t clear that directing telecom companies or a third party to store communications records will be meaningfully different from the government maintaining such a database itself, because the records would still be available for query if authorized by the FISC.

The report’s essential contribution may not be its specific policy recommendations, but rather the doubt it introduces about the way business is conducted across an entire agency. Five people close to the intelligence community and the administration served on the review board, and prior to the release of the report there was widespread concern that the lack of distance between the reviewers and the White House would defang the recommendations. That makes the panel’s uneasiness with the state of affairs all the more remarkable. Obama may not heed its recommendations, but it will be increasingly difficult to argue that there is nothing to see here.

The specter of Edward Snowden haunts the report, although he isn’t mentioned. A footnote argues that an Obama directive that extended some protection to whistleblowers “does not go far enough,” and recommends creating a pathway for whistleblowers to report to a new Civil Liberties Oversight Board. Still, the report notes that “the potential danger of leaks is more serious than ever,” and emphasizes the damage that can be done by a “disloyal employee.” Several of the recommendations center on containing this “insider threat,” including restricting access to classified information, seemingly to prevent a future Snowden. But the report does far more to vindicate Snowden as a whistleblower than to condemn him for a betrayal. Its very existence signifies the importance of his disclosures.

The report is a confirmation of pathology, not a perfect prescription. As such it underscores the need for Congress to advance its own reforms. Many of the recommendations align with legislation pushed by the pro-reform coalition that stretches from libertarian Justin Amash to progressive John Conyers in the House, and from Rand Paul to Patrick Leahy in the Senate. Now that Judge Leon and the review panel have cracked the veneer of ordinariness that the administration has worked to paint over the NSA’s activities, there is more space for a discussion of what happens next.