Justices say security service can’t continue to gather location data without law