Looks like surveillance defenders just lost their main talking point in defense of the NSA's (formerly) secret phone and data tracking programs: Najibullah Zazi, the would-be New York City subway bomber, could have easily been caught without PRISM. That's according to a devastating rebuttal from the Associated Press out Tuesday, which further explains that those employing the Zazi defense didn't even get the details right on the attempted plot in the first place. 

In case you missed the Zazi subplot in the massive NSA story that's been dominating headlines for the past week, a quick primer: Last Thursday, Representative Mike Rogers referred to an unspecified terrorist attack that was thwarted by the blanket surveillance programs revealed by the Guardian and the Washington Post. That planned attack, it turned out, was Zazi's al-Qaeda backed pan to bomb the NYC Subway system. Defenders of the NSA programs, like Rogers, have been pushing that story ever since. For example, here's Sen. Dianne Feinstein on ABC's "This Week," talking about Zazi as a phone tracking success story: 

"The second is a man who lived in colorado, who made the decision that he was going to blow up a new york subway, who went to a beauty wholesale supply place, bought enough hydrogen peroxide to make bombs, was surveilled by the FBI for six months, traveled to go to new york to meet with a number of other people who were going to carry out this attack with him." 

As the AP points out, it looks like Feinstein misspoke there. It's PRISM, not the phone tracking program, that officials are saying led to Zazi's capture, according to declassified documents addressing the investigation that were released in the wake of the NSA news last week. And it gets worse for Team NSA: even before Feinstein et al. took to the Sunday talk shows, many had already raised credible doubts about the necessity of PRISM in the Zazi investigation, including Adam Goldman, who co-bylined today's AP story: 

Which brings us to the Associated Press takedown. Zazi, as Goldman and Matt Apuzzo explain, was foiled when officials intercepted an email to a Yahoo email address in September of 2009. It looks like they did use PRISM to capture the incriminating missive, but here's the thing: they didn't have to. Although 2007 and 2008 laws gave the FBI the go-ahead to monitor email accounts linked to known terrorists without a warrant, investigators would have easily gotten a warrant to monitor the account in question anyway: 

"To get a warrant, the law requires that the government show that the target is a suspected member of a terrorist group or foreign government, something that had been well established at that point in the Zazi case."

In other words, the Zazi plot does little to justify blanket surveillance of millions of phone and email accounts without a warrant, because authorities found the email address they needed without PRISM, and could have monitored that account without it, too. 

But, hey, NSA defenders are going to get at least one more big chance to mount a defense of the agency's massive data tracking programs: the ACLU filed suit against the NSA on Tuesday, claiming that the programs violate the First and Fourth amendments, along with Section 215 of the Patriot Act itself. Or, they could mount their new defense in response to one of the other pending lawsuits against them for PRISM-like programs, like the two pending lawsuits filed by the Electronic Frontier Foundation before last week's news even broke.