Ultimately, he's commander in chief, and if we use the same approach as applied against Bush, then Obama is responsible.
One such lesson could be called the "Difference Between the Janitor and the Vice President," and it's a sermon Jobs delivers every time an executive reaches the VP level. Jobs imagines his garbage regularly not being emptied in his office, and when he asks the janitor why, he gets an excuse: The locks have been changed, and the janitor doesn't have a key. This is an acceptable excuse coming from someone who empties trash bins for a living. The janitor gets to explain why something went wrong. Senior people do not. "When you're the janitor," Jobs has repeatedly told incoming VPs, "reasons matter." He continues: "Somewhere between the janitor and the CEO, reasons stop mattering." That "Rubicon," he has said, "is crossed when you become a VP."
http://tech.fortune.cnn.com/2011/08/25/how-apple-works-insid...
Wrong title. He's responsible as the chief executive, not as the commander-in-chief, which refers to his civilian authority over the military. And yes, Obama is responsible for this. He said as much during the 2012 debates.
The NSA is subordinate to the DOD as part of the DOD's directive as a component of national defense, but it is separate from the military and Obama's derived responsibility for their actions comes from his leadership as a civilian over other civilians, not from his leadership as a civilian over military personnel.