What should be the limits of government spying on citizens, residents, and foreigners?

I have been getting into arguments with my friends about the ethics of Edward Snowden's whistleblowing and the ethics of NSA spying on foreigners. My friends say Snowden's disclosure is evil because it undermined legitimate spying the NSA does for national security. Cited in particular was Snowden's disclosure that the NSA was spying on the work of a Chinese information-technology firm. I replied that if the NSA had probable cause to suspect that the Chinese IT firm was contributing to a military threat against the USA, I would support the spying, but that the Chinese firm being in IT is not sufficient to justify spying on it. I added that it was highly inappropriate for the NSA to spy on Angela Merkel's phone calls and that the NSA inappropriately spied on attendees of the Copenhagen climate conference to give President Obama the upper hand when negotiating the climate treaty. I then posed to my friends this question: "How far does the NSA have to go in what it does, before you say it has stepped over the line?" But it occurred to me that I don't have a set-in-stone answer to my own question. I don't know how far the NSA should go, other than that I generally think that the NSA should only invade the privacy of specific people and only if it has probable cause to believe they pose a military threat to the USA. So how far should the NSA go? What is and isn't fair game when it comes to NSA spying -- not merely in the case of American citizens and residents but also in the case of foreigners?