Attorney General approval is required in all cases, even emergencies.
USSID 18. Section 4 pertains to US citizens on US soil, information to, from or about.
Here is the declassified document, parts are redacted, what is here appears to be all that is in the public domain.http://www.gwu.edu/~nsarchiv/NSAEBB/NSAEBB23/07-11.htm
With regard emergency situations:
(3) In all cases where emergency collection is authorised, the following steps shall be taken:
(a) The General Counsel shall be notified immediately that the COLLECTION has started
(b) The General Counsel will initiate immediate efforts to obtain Attorney General approval to continue the collection. If Attorney General approval cannot be obtained within 72 hours, the COLLECTION will be terminated. If the Attorney General approves the collection, it may continue for the period specified in the approval.
That seems pretty clear, 72 hour limit on abtaining approval from the AG.
Without AG approval being sought within 72 hours, it's a federal offence (defined as such by the FISA regulations). With AG approval within 72 hours it's merely overstepping the intention of the lawmakers - it seems clear to me this was never intended for regular usage.
The facts aren't out yet, so innocence or guilt isn't known yet. I agree with the CRS report, it looks pretty damn fishy (paraphrasing).
The USSID defence has been presented in op-eds, not by the admin. I'm sure the admin have people who know a little about the law. Either they sought the AG approval or they didn't, if they had then why not issue a one-word statement 'it was legal because we sought the approval of the ag'?