The government’s warrantless collection of emails and other Internet data for national security purposes is lawful, but searching that information for Americans’ communications raises constitutional privacy questions, a federal appeals court in New York ruled Wednesday.

At issue is an appeal by a former Brooklyn man who pleaded guilty to supporting a foreign terrorist group and now is seeking to overturn his conviction, saying the evidence against him was obtained through warrantless surveillance that violated the Fourth Amendment.

The surveillance program in question, sometimes referred to as PRISM, is used by the National Security Agency to gather intelligence on foreign targets. It allows the NSA to gather data from American tech companies under court oversight but without individual warrants.

The U.S. Court of Appeals for the 2nd Circuit is now the second appeals court to rule that this form of surveillance is lawful. But it is the first to state that querying the stored data has “important Fourth Amendment implications” — and that doing so should be seen as a separate act from collection that must be “reasonable” under the Constitution.

The defendant, Agron Hasbajrami, was arrested in 2011 as he attempted to board a flight to Turkey. The government alleged Hasbajrami, an Albanian who became a lawful permanent resident in 2008, was seeking to join a terrorist organization in Pakistan and fight against U.S. forces. He pleaded guilty in 2013 and was sentenced to 15 years.

He was informed in 2014 that the government had used evidence gathered through warrantless surveillance to conduct its investigation of him. A lower-court judge allowed him to withdraw his guilty plea to challenge the surveillance, but eventually found the surveillance lawful. Hasbajrami appealed that decision, which led to Wednesday’s decision by a three-judge panel.

In targeting people overseas, the U.S. government sometimes obtains the emails of Americans in communication with the target. The government calls this “incidental” collection.

“The primary issue, affecting the bulk of the evidence against Hasbajrami, is whether the incidental collection of the communications of United States persons, without a warrant, violates the Fourth Amendment,” the ruling said. “We conclude, as did the district court, that such collection is lawful.”

But data-gathering is not the only issue, the court said.

PRISM collection takes place under Section 702 of the FISA Amendments Act, a 2008 law that the intelligence community considers its most valuable foreign intelligence gathering tool. (FISA stands for Foreign Intelligence Surveillance Act.) Hundreds of millions of emails are gathered annually through PRISM.

“If such a vast body of information is simply stored in a database, available for review by request from domestic law enforcement agencies solely on the speculative possibility that evidence of interest to agents investigating a particular individual might be found there, the program begins to look more like a dragnet, and a query more like a general warrant,” the court said.

The panel sent the case back to the lower court to rule on three questions: What evidence relevant to Hasbajrami was obtained by querying the database? Did any of those queries violate the Fourth Amendment? And did any such violation lead to his conviction?

“The decision recognizes the threat that NSA mass surveillance poses to Americans’ privacy, and the urgent need for stronger safeguards,” said Patrick Toomey, a staff lawyer for the American Civil Liberties Union. “Critically, the court holds that the government does not have carte blanche to amass Americans’ emails and phone calls and search through them at will.”

Some lawmakers have pressed to require that the government obtain warrants to search the Section 702 database for Americans’ communications — what they call a “backdoor search.” The government maintains no warrant is necessary to query data it already gathers lawfully.