Surveillance program that gathered Americans’ phone data was illegal, court finds