....Officials said they believe that the 48 known problems may be the tip of the iceberg in an internal oversight system that one of them described as "shoddy."

The Patriot Act lowered the necessary findings for obtaining records though National security letters.

The USA Patriot Act, enacted after the 2001 attacks, eliminated the requirement that the FBI show "specific and articulable" reasons to believe that the records it demands belong to a foreign intelligence agent or terrorist.

....Now the bureau needs only to certify that the records are "sought for" or "relevant to" an investigation "to protect against international terrorism or clandestine intelligence activities."

As to what the FBI did wrong:

...Fine found that FBI agents used national security letters without citing an authorized investigation, claimed "exigent" circumstances that did not exist in demanding information and did not have adequate documentation to justify the issuance of letters.

....In an unknown number of other cases, third parties such as telephone companies, banks and Internet providers responded to national security letters with detailed personal information about customers that the letters do not permit to be released. The FBI "sequestered" that information, a law enforcement official said last night, but did not destroy it.

The FBI also didn't report all requests to Congress:

Fine's audit, which was limited to 77 case files in four FBI field offices, found that those offices did not even generate accurate counts of the national security letters they issued, omitting about one in five letters from the reports they sent to headquarters in Washington. Those inaccurate numbers, in turn, were used as the basis for required reports to Congress.