“We were surprised to learn that IRS investigators may be using these devices,” Mr. Grassley, Iowa Republican, and Mr. Leahy, Vermont Democrat, wrote in the letter. “While the devices can be useful tools for identifying the location of a suspect’s cell phone or identifying an unknown cell phone, we have previously expressed concerns about the privacy implications of these devices.”

Cell site-simulators work by mimicking cellphone towers to trick cellphones to connect to them, enabling investigators to obtain identifying information about the phones and their locations. Law enforcement officers often deploy the suitcase-sized StingRays by hauling them around in vehicles as they drive through neighborhoods looking for a suspect’s phone, scooping up data on the cellphones of any passers-by in the process.

Mr. Koskinen testified Tuesday before the Senate Finance Committee that the devices are only used in criminal investigations and not for any civil matters.