That apparent FISA warrant of October 2016 is what makes the surveillance look legal, since it was based on allegations regarding communications by a Russian bank with the Trump server. However, the CIA at that time had a program that mimicked Russian hacks. Thus, the affidavits filed to get the apparent October FISA warrant could well have been false, since they probably were based on the CIA's fake "Russian" communications with theTrump server.
It is a reasonable possibility. Once a FISA warrant was obtained, the monitoring agency got its pinkie in the tent, and then made an opening large enough to drive a tank through. One little surveillance request turned into an avalanche of intercepts and subsequent leaks. And all based on a suspicious pinging Russian bank server which may have been fraudulently created, but NONE of it based on actual RUSSIAN communications with Trump or his people!