In a new letter, Customs and Border Patrol (CBP) has answered some questions posed months ago by Sen. Ron Wyden (D-Ore.) about the agency’s policies when it comes to searches of digital devices at the border. However, that letter appears to have raised even more questions.

As Ars reported previously, there is a very broad exception to the Fourth Amendment at the border that allows officials to conduct warrantless searches. If your device is locked or encrypted and you refuse to assist agents’ attempts to open it, the device can be seized.

The recently published letter from CBP reiterated what federal officials have said before: electronic border searches are extremely rare, and the government claims the legal authority to compel assistance to open a device (including forcing someone to hand over their password). But it also distinguishes between data held on the phone and data held in the cloud.

The document, which was written by Kevin McAleenan, the current acting head of CBP, continues:

CBP’s authority to conduct border searches extends to all merchandise entering or departing the United States, including information that is physically resident on an electronic device transported by an international traveler. Therefore, border searches conducted by CBP do not extend to information that is located solely on remote servers. I appreciate the opportunity to offer that clarification.

The phrase "located solely on remote servers" seems like it's a step toward privacy, but it's unclear what the statement would mean in practice. After all, many modern apps—notably social media, e-mail, or messaging apps—keep data on remote servers, but a smartphone often also keeps a local copy of the message or relevant data. Plus, if the phone is on and not otherwise in airplane mode, it’s likely going to be able to connect to the Internet and automatically pull the latest data.

As Matt Blaze, a cryptography professor at the University of Pennsylvania tweeted:

Yes, in particular, if cached local copies of data don't count as "remote" here, it's meaningless for things like email. — matt blaze (@mattblaze) July 14, 2017

Similarly, the American Civil Liberties Union recommends that travelers put their phones in airplane mode.

This is important news for travelers – people entering the country should put their phones in airplane mode. https://t.co/ebblXhoaii — ACLU National (@ACLU) July 13, 2017

Even this suggested method is unlikely to be foolproof. If the recent story of a California man who consented to his phone being searched at San Francisco International Airport is any guide, when border agents took his phone away from him, he had no way of knowing what data—"located solely on remote servers" or otherwise—was accessed.

In a statement sent to Ars, Sen. Wyden expressed dissatisfaction about the agency’s response.

"It flies in the face of Americans’ expectations of Constitutional protections for Customs to conduct warrantless, suspicionless searches of Americans’ devices at the border," he wrote. "That’s why I wrote the Protecting Data at the Border Act. I appreciate Mr. McAleenan provided substantive responses to my questions, particularly when it comes to limits on searching data stored in the cloud."

"However, it’s critical that CBP revise its policies immediately while Congress works to enact my law," Wyden continued. "CBP should take four steps right now: First, start tracking the number of Americans searched and type of device searched; Second, amend its policies to require reasonable suspicion prior to search; Third, fully inform Americans of their rights and CBP’s authorities before searching or requesting assistance to search a device; and finally, continue to educate officers as to the fact that they cannot search any cloud information at the border."

CBP did not immediately respond to Ars’ request for comment.