Kudos, Virginia, land of spies! The state has enacted a privacy law requiring a warrant for state and local law enforcement content surveillance and location tracking. The statute explicitly includes a warrant requirement for police use of controversial cell site simulator or stingray technology, which allows cops to bypass phone companies and track phones directly.

Unfortunately, state legislatures cannot prevent federal authorities from using stingrays to track people without warrants. When state and local authorities are deputized as federal agents under task force operations, they may decide to use the federal standard when conducting investigations. That means there might be times when state and local cops, working under federal authority, still use stingrays without warrants.

Virginia's new law is nonetheless a huge step in the right direction. But like Edward Snowden said this morning at SXSW, good surveillance statutes only matter if there's rigorous independent oversight and accountability. Part of the danger inherent to stingray technology is that it allows police to skirt any engagement with outside entities. When using these tools, cops don't have to ask AT&T or Verizon for phone records or real time tracking data; they simply take out their machine and go and get the data themselves. For that reason, it's especially important for outside agencies to monitor and audit how these technologies are used.

All those caveats aside, big congratulations to privacy advocates in Virginia, not least of them my colleagues at the ACLU. This is a huge victory for privacy. We need many more, in every state and in congress. Forward!

Read the text of the bill.

UPDATE: I want to clarify why this legislation is important, despite the federal jurisdictional issue I reference above. Local law enforcement nationwide are using stingrays to track and monitor people in routine drug investigations that have nothing to do with federal agencies. We know this because of specific data disclosed by the Tacoma police department. We can safely assume Tacoma is not alone. Therefore even though this Virginia legislation, like all state bills, won't stop the FBI or DEA from warrantlessly tracking you, it will nonetheless have a major impact—and not just on specific investigations, but on the political climate. Add enough heat to that climate and it might even reach Washington, DC.