You'd think that in an article about someone "breaking the law" you'd learn about a court of law determining that fact. Otherwise, at least in this country, "innocent until proven guilty". It's part of the journalistic unwritten rules to add "allegedly" in such a title.
What we learn instead is that an internal audit found that the Secret Service and ICE broke some internal DHS policy and generally internal policies are stricter than laws (otherwise they wouldn't be needed).
The actual law appears to be complex, as the article itself states later:
Legislators recently have tried to make CSS usage clearer. In 2021, US Senator Ron Wyden (D-OR) and a bipartisan group of other lawmakers introduced a bill, the Cell-Site Simulator Warrant Act, requiring the government to obtain a warrant to deploy a CSS device.
"Current federal, state, and local policies regulating Stingrays are confusing and inconsistent, opening the door to abuse and unconstrained, invasive surveillance by law enforcement," the Project on Government Oversight (POGO) said in support of the bill.
The bill never made it out of committee.