Law enforcement agencies around the country are using a powerful tool to sweep up data—the stingray, a cell-site simulator that poses as a mobile phone tower and tricks phones into transmitting location and other information.

There are a lot of privacy-related questions to sort out about how cops gather and use the data. The Justice Department has issued a new policy setting guidelines for its own agents, but the rules don’t go far enough for privacy hawks. 

The Justice Department’s new policy requires its agents to obtain search warrants supported by probable cause before using the devices in domestic criminal investigations, with some possible exceptions, such as exigent circumstances.

Under the policy, stingrays can’t be used to collect the contents of any communications, including data stored on the phone, such as e-mails, text messages, contact lists and images, according to a Sept. 3 DOJ statement.

The department has also imposed data handling requirements, such as requiring all data to be deleted as soon as a mobile device is located, and it established an auditing program to ensure data are appropriately deleted.

But while the warrant requirement is a “positive first step,” the policy “leaves the door open to warrantless use of Stingrays in undefined ‘exceptional circumstances,’ while permitting retention of innocent bystander data for up to 30 days in certain cases,” Nathan Freed Wessler, staff attorney for the American Civil Liberties Union’s Speech, Privacy, and Technology Project, said in a Sept. 3 statement. 

Regardless of the steps the DOJ is taking, they don’t apply to other law enforcement agencies. The policy doesn’t apply to other federal agencies or state and local law enforcement bodies that receive federal funds to purchase stingrays, Wessler said.

So what other law enforcement officials use stingrays? In addition to other federal agencies like the National Security Agency, the ACLU has identified at least 54 agencies in 21 states and the District of Columbia that own the simulators.

To keep up with the constantly evolving world of privacy and security, sign up for the Bloomberg BNA Privacy and Security Update.