Shutting down the NSA isn't the answer. We do need those orgs to keep operating for good reasons. Otherwise somebody who dislikes those orgs or has a grudge can shut the whole thing down by breaking the law (imagine a foreign agent playing the "long-con" and doing this).

The answer, as others have already said, is imprisonment of commanding officiers, supervisors, senators in charge of oversight committees, etc. Hold the people that make decisions accountable. Don't hold the entry-level engineers who had a family to feed accountable. Hold the people calling the shots accountable. 10 years in prison is a pretty good incentive for those in charge to make sure what they and their employees are doing is legal.

The org must be accountable for its actions (or inactions). It's the org's responsibility to make sure its agents don't mess up when acting under its authority. Hire employees who are trustworthy and competent, fire those who aren't, and provide training and oversight to ensure compliance. That's a reasonable minimum bar.

Separately, if a person breaks a law, they should be punished for that.

And remember, judgements incorporate circumstances and intentions when determining punishments. So a small non-profit that was trying its best but was still hacked by a nation-state would probably get a lighter punishment, just as accidental manslaughter usually receives a lighter sentence than pre-meditated murder.

An org is made up of people. You can't punish an org without punishing people. So you have to decide who to punish. Do you punish the entire population by removing an org that is there to protect them? Or do you punish the individuals inside and outside of the org that are responsible for making those bad decisions?

You have it backwards: the entire population is punishing the org for failing to protect them.

And yes, that hurts the population a little bit, just as imprisoning individuals hurts civic society and the economy.

To mangle a great line: we are entitled to rise and sleep under the blanket of the very freedom the NSA provides AND question the manner in which they provide it.

You cannot punish an org without punishing people. An org is not something with feelings and isn't sentient. The people within it are. To punish the org, you need to punish the people that make the decisions inside it. Shutting down the entire organisation doesn't hold anybody personally accountable. They'll just go and get jobs elsewhere. It is a silly concept.

If corporations are people, they need to face imprisonment and capital punishment, too eh? Charters can be suspended or revoked.

Except in rare circumstances, "collective responsibility" is very hard to prove in the courts of law.

When a large section of a society dislikes certain thing, yes, it is possible to prosecute groups. When is this possible? Crimes against humanity is one such example. Or going after mafia or biker gangs. Otherwise, at some time or another, it is very easy to convict influential sections of a society. That's why judges, lawyers are not keen to press charges against an individual just because such an individual is part of some kind of collective responsibility.

I'm not saying to punish a group of individuals individually, but to disband the group itself for a time.

If individuals also broke the law, then of course they should be punished accordingly.

I don't disagree with your original points. It is an issue of enforcement. Collusion between individuals or between groups is really hard to prove, except in war crimes/mafia wars/etc.