Somewhere in Russia, Edward Snowden is smiling. On January 17, about eight months after Snowden’s initial disclosures of National Security Agency spying run amok, President Obama gave a major speech in which he acknowledged the risks to privacy the NSA’s activities pose and announced changes designed to limit those risks. The changes do not go nearly far enough, so Snowden’s smile may be tempered. But none of these changes would have happened had it not been for the leaks.

So long as the NSA programs remained secret, Obama maintained them, the federal courts blessed them and Congress authorized them (albeit unwittingly for most members). Now that the programs have been exposed, Obama has promised to rein them in, the courts have begun to question their constitutionality and Congress is considering a slew of bills to reform them. Funny how transparency works.

Snowden can’t take all the credit, of course. Organizations dedicated to protecting privacy, including the ACLU, the Electronic Privacy Information Center, the Electronic Frontier Foundation and the Center for Democracy and Technology all played outsize roles, before and after Snowden’s leaks, underscoring the importance of privacy and the risks that new technologies pose. And of course the press, including The Guardian, The Washington Post and The New York Times, along with journalists Glenn Greenwald and Barton Gellman, have used Snowden’s documents to expose and explain what the agency has been doing. Americans from the right and the left have voiced concerns, which have been amplified in turn by the rest of the world—not surprising, as the vast majority of the NSA’s targets are foreign nationals.

But privacy advocates will have to keep pressing their cause if they want real reform. The changes Obama announced are only a first step. They are more than cosmetic, but they leave largely intact the system of dragnet surveillance the NSA piloted. True reform would replace that mass surveillance with a more targeted approach, one that authorizes intrusive surveillance when the agency has reason to suspect a person of wrongdoing or of being a foreign agent, but not otherwise.

Obama sees the problem but is unwilling, or unable, to provide an adequate solution. He admitted that the digital age presents profound challenges to privacy: “The power of new technologies means that there are fewer and fewer technical constraints on what we can do. That places a special obligation on us to ask tough questions about what we should do.”

And Obama pointedly rejected the argument that if phone companies and Internet service providers have our digital information, there is no reason the government shouldn’t also have it. This is the argument the Supreme Court accepted in 1979 in Smith v. Maryland, when it ruled that the government could obtain a person’s phone calling records without constitutional limits. Obama rightly insisted that there is a big difference between Verizon knowing that information and the government knowing it: “All of us understand that the standards for government surveillance must be higher. Given the unique power of the state, it is not enough for leaders to say: trust us, we won’t abuse the data we collect.”

Obama called for closer judicial oversight of NSA searches of telephone metadata; for a panel of independent lawyers to defend privacy before the secret foreign intelligence court; and for extending some privacy protections enjoyed by US citizens to foreign nationals. But his reforms leave in place the NSA’s bulk collection of telephone data from every American’s every phone call, as well as its sweeping authority to intercept electronic communications of people it believes to be foreigners abroad without any basis for suspecting them of wrongdoing. And Obama did not even mention—much less suggest an effort to rein in—the NSA’s vacuuming up of massive amounts of data from Google and Yahoo communications hubs overseas, or its collection of massive amounts of cellphone-location data and e-mail address books, all without any statutory limits.

Obama sought to assure his listeners that the NSA would not spy on ordinary people doing nothing wrong. But that’s false. The whole point of the programs he has left in place is to conduct dragnet surveillance of ordinary people engaged in no wrongdoing—in the hope that if the NSA casts its net wide enough, it may capture a terrorist.

So Obama acknowledged the problem—and for that, Snowden and privacy advocates deserve our thanks. But the president failed to solve it. Fortunately, it seems no one was fooled. The speech received a cool reception from most overseas and US commentators, and a USA Today poll reports a majority disapproves of the NSA programs. The debate will continue. Congress is considering dozens of bills that would go further, and several legal challenges are pending in the courts. If we are to preserve privacy in the digital age, we must insist that Obama’s speech be understood as the beginning, not the end, of NSA reform.