By law, the president and heads of intelligence agencies must keep the congressional intelligence committees informed of any "significant intelligence activity."
When is bugging the cellphones of significant allies not considered a "significant intelligence activity"? When it's part of an ongoing program, one that started at a time when Congress was rolling over for the executive branch, when war was afoot, when even senators and representatives briefed on the NSA's domestic surveillance program wanted plausible deniability?
There is no statutory requirement to brief the committees every time the NSA exercises its authorities. And the executive branch, until the past couple of years, has given the agencies wide latitude and been stingy with giving information to Congress. It defined "significant" quite narrowly. Generally, the agencies want to disclose more than they're permitted to. The more Congress knows about, the less trouble the agency heads will be in when programs fail, or leak, as they inevitably do.
In this case, we don't know what the NSA told President Obama about its activities, or whether those who briefed him regularly even considered a long-standing, close-hold program to bug a foreign ally all that significant. "By the way, Mr. President, just so you know, we're bugging Angela Merkel" is not a phrase that just comes up. The president doesn't get a lot of time to learn about these subjects, relying instead on learned aides and the good judgment of agency heads.
If no one at NSA ever presumed that the flap potential from an operation like this was huge enough to notify the new president, then those who accuse the NSA of buying into its own hubris are in good standing. The NSA has not thought strategically about the geopolitical and real-world ramifications of the enormous post-9/11 expansion of its power and capabilities, and the agency is going through hell right now because one of its own employees, for whatever reason, decided to call its bluff.
There is precedent for this. It was obvious to many NSAers in the 1960s that the agency's highly secret domestic mail and telegram collection programs were both plainly illegal and provided almost no intelligence value whatsoever. But the agency did not kill them until the Church Committee, well into the 1970s, started asking about them. Programs of dubious value (and in this case, obvious flap potential, not to mention illegality) were just left in place, because they could be left in place. They were secret and represented, at least internally, how powerful the NSA was. They were kind of like internal declarations of significance.
Bugging the phones of foreign leaders is not illegal, and there may have been a time when the risk of doing it was worth the reward to the policymakers who ordered it. But the NSA, for whatever reason, never reassessed this risk calculation, perhaps assuming that the secret would never get out, and so there really wasn't any need to tinker with a communications channel that might be important in the future.
And then it leaked.
And now President Obama, the policymaker, is screwed.