It's not legal.  He was snooping in your account for personal reasons, not professional ones.\n\nReport him to the NSA.  They'll definitely want to know one of their employees is a security risk like this.  I don't know exactly who you should talk to so contact Public and Media Affairs at 301-688-6524 or send e-mail to nsapao@nsa.gov and ask generally where you would report misconduct of an employee.\n\nIt goes without saying that you should cease all contact with this person.  If he continues to harass you, get a restraining order.