The sunset of several Patriot Act provisions today marks a change in the politics of national security. Despite the ongoing threat of terrorist attacks by Al Qaeda, ISIS, and others, many ambitious members of Congress just sided against national-security hawks and showed that unprecedented authorities passed after 9/11 can go away.

That is a significant reversal, but it’s not enough.

America’s legislature had spent more than a decade enabling and then deferring to national-security officials, and previously renewed the Patriot Act with little trouble. So it is reasonable for civil libertarians to celebrate the today’s sunset as a symbol of a new era in national security politics and even a portent of future victories. This time, fear-mongering about wildly exaggerated threats did not win the day.

But the sunset is wholly inadequate as a substantive reform to surveillance policy, for it does little to prevent the national-security state from collecting huge amounts of information with inadequate oversight, including much of the data that it collected under just-expired Patriot Act provisions.

Here’s how the Obama Administration might proceed absent additional reforms: