Can the police locate suspects by scanning through all the phone numbers that pass through a certain area? Sure, but they’ll need a warrant first.

That’s according to a federal appeals court, which ruled Thursday that police must get permission from a judge to use “Stingray” devices, also called cell-site simulators, as part of their investigations. The simulators act like a cell tower, picking up the telltale identifiers that cell phones automatically broadcast when they pass near towers. Police can use that information to track the movements of criminal suspects. (One popular model is the StingRay, manufactured by Harris Corp., hence the nick name.)

But the devices have been controversial, and privacy advocates have fought to require a warrant before police can use them. Two appellate judges from the DC Circuit US Court of Appeals agreed, saying Thursday that the use of cell-site simulators is a police search and subject to the Fourth Amendment of the US Constitution. The third judge on the panel dissented.

“[T]he use of a cell-site simulator to locate a person through his or her cellphone invades the person’s actual, legitimate, and reasonable expectation of privacy in his or her location information and is a search,” Associate Judge Corrine A. Beckwith wrote in the majority opinion.

Critics also say the devices give police overreaching access to personal information — in part because the simulators can collect everyone in the area’s information, not just the phone number of a criminal suspect who might be in the neighborhood. Wednesday’s ruling doesn’t address this issue.

Tech Culture: From film and television to social media and games, here’s your place for the lighter side of tech.

Batteries Not Included: The CNET team shares experiences that remind us why tech stuff is cool.