A federal appeals court ruled on Thursday that the National Security Agency's bulk collection of U.S. phone records is illegal, dealing a startling blow to the program just as Congress is weighing reforms to surveillance authorities.