I did read your comment, where you pointed out that companies can challenge the nondisclosure provision. It doesn't say anything about challenging the order itself.
Edit: Also, regarding companies/citizens/foreigners, this is the NSA program under which it collects data from American companies and promises to only use it to spy on foreigners: "PRISM is a code name for a program under which the United States National Security Agency (NSA) collects internet communications from various U.S. internet companies ... U.S. government officials have ... defended the program, asserting that it cannot be used on domestic targets without a warrant"[1]
Edit: Also, regarding companies/citizens/foreigners, this is the NSA program under which it collects data from American companies and promises to only use it to spy on foreigners: "PRISM is a code name for a program under which the United States National Security Agency (NSA) collects internet communications from various U.S. internet companies ... U.S. government officials have ... defended the program, asserting that it cannot be used on domestic targets without a warrant"[1]
[1] https://en.wikipedia.org/wiki/PRISM_(surveillance_program)