Thirty years ago, the US didn't spy on the Kremlin because people working in the Kremlin had fewer rights than your local plumber, the US spied on the Kremlin because they had a legitimate strategic interest in knowing what was happening in the Kremlin. But the government has no legitimate interest listening to me talk to my wife on the phone. It just so happens that foreign vs. domestic is an easy dividing line between cases where the government could conceivably have a legitimate interest in spying on people and cases where they almost certainly do not.
Obviously they can technically, just like the Army could in theory shoot private citizens.
The NSA has claimed throughout that this is not what they're trying to do. Even their "untargeted" programs (when they can get authority to intercept data without a selector, such as overseas) are not to be used willy-nilly, and even their untargeted programs still seems to involve selectiveness from what I can tell.
E.g. the "200 million SMS messages per day" story from the other day represents ~3.3% of SMS traffic, despite not having selectors attached to that data interception.
Now I don't know that literally every program they have is never being used against private citizens. I would agree strongly with you that they should not be.
But the Internet is packet-switched, not virtual circuits, which means you can't simply install one tap for one IP address. The data needs to be seen before the event, not after it. Sometimes it's not possible to do the right filtering at the selection point itself (I would imagine this is the case with SMS), so you have to do the big data equivalent of map/reduce, and grab everything, collate it, and then filter it to see what comes up.
The problem is that it's a hard problem, with long-standing recriminations when they get it wrong (such as with the 2009 underwear bomber in the USA, who NSA had got shit on for missing completely; it was only luck that his mission hadn't succeeded).
