The controversial collection of millions of Americans’ phone records by the National Security Agency isn’t authorized by the Patriot Act, a federal appeals court ruled Thursday, the Wall Street Journal reports.