Within the US, the NSA operates with legal impunity. It is beyond the reach of the law. At least so long as it's acting under official mandate -- rogue agents are apparently sanctioned if pursuing information for personal reasons. If caught.
Outside the US, NSA operates with the diplomatic and military support of the US. It's not a matter of an individual hacker, but "an international incident" should something arise. There's some risk that an agent or operative (non-agency employee acting on behalf of the NSA) could be caught, but that would vary by field of operations and relations between that country and the US.
And for such cases as in NSA, where the actions, though technically illegal, were clearly intended by the leadership - "sanction" can easily mean an official written reprimand stating "this is not acceptable", followed by a cash bonus and a promotion.
Outside the US, NSA operates with the diplomatic and military support of the US. It's not a matter of an individual hacker, but "an international incident" should something arise. There's some risk that an agent or operative (non-agency employee acting on behalf of the NSA) could be caught, but that would vary by field of operations and relations between that country and the US.