The second kind of CSLI is "prospective" or “real-time.” Law-enforcement agents might ask a mobile provider for a phone’s current location or its upcoming week of pings. They might also demand that the provider send a ping to the phone right now, generating its own record of CSLI. This type of search usually does require a warrant.

The third type of CSLI is called a "tower dump," and it works more like a dragnet. Authorities will ask a provider for all the CSLI from a tower or towers from a certain period, then comb through that looking for a common number. (They’d be investigating a question like: Which cellphone numbers were near this bank an hour before or after it was robbed?) Hanni Fakhoury, a senior staff attorney at the Electronic Frontier Foundation, told me there was very little case law on this kind of search, but that, in the one relevant court ruling he knew of, a warrant was not required.

With the second general method—surveilling a phone on their own—law enforcement appears to have fewer options. Officers might turn to a "Stingray"-like device: a physical antenna that pretends to be a cellphone tower and which can intercept a phone’s signals. Just by being nearby, Stingrays can pinpoint a phone’s physical location and even record the numbers it’s calling. Stingrays can’t access the content of a communication.

Last week, the U.S. Department of Justice announced new limits on the federal government’s use of Stingrays. Chief among these is that, except in "rare" emergency circumstances, the feds will now seek a warrant before turning on a Stingray.

These new rules, however, don’t apply to state or local law enforcement. That’s a big deal. The American Civil Liberties Union believes that agencies in at least 21 states have access to Stingrays, including city police departments in California, Texas, Florida, New York, and Illinois. And last month, USA Today revealed that municipal use of Stingrays in cities like Baltimore was much more common than previously believed. (Earlier this year, a city official had revealed that the department used its Stingray more than one and a half times per day since 2007.)

Stingrays are expensive, costing between $100,000 and $400,000. There’s an affordable solution, though: In August, The Wall Street Journal reported that local departments were instead buying a kind of mini-Stingray, called "Jugulars" or “Wolfhounds.” These smaller, handheld devices only go for around $6,500. They don’t work exactly like the Stingrays do—instead of actively spamming an area with a stronger signal, mimicking a cellphone tower, they listen in on signals the cellphone is already sending—but they have many of the same capabilities.

When used at the state or local level, neither Stingrays nor Wolfhounds require a warrant.

Part of the problem of laying out all the government’s options for surveillance is that the government keeps its tools close to the chest. For many years, local departments declined to release information about Stingrays—sometimes even withdrawing evidence from a trial—because of non-disclosure agreements they had signed with the FBI and the Harris Corporation, the technology’s manufacturer.