The new rule released yesterday governing when the Department of Justice can investigate journalists seems like a dollop of progress with a sizeable helping of potential concern. The attorney general does, however, deserve credit for some progress on fixing the issues that led to the Associated Press subpoena and James Rosen controversies last year.

First, let me lead with two biggish problems. The rules have a couple of vague national security exceptions, which are separate from carve-outs for "death" or "serious bodily harm." Generally speaking, laws protecting the press yield to the latter, which should also cover the former. (Presumably, death or serious bodily harm will follow from a grave threat to national security.) Listing them separately could suggest that national security harm means something other than a physical threat to American persons or property. This opens the door to abuse.

Additionally, the rule does not cover the use of "national security letters" in terrorism and intelligence cases, which can be used broadly to secure transactional information and can come with a gag on the recipient (currently subject to First Amendment challenge). This also could be a serious failing.

On the flip side, the rule does adopt our primary recommendation, which was to require notice to the news outlet in many more cases before issuing a subpoena to a third-party record holder. One of the biggest problems with the sweeping subpoenas of the AP reporters' phone records was the lack of advance notice to the AP, which would have allowed it to go to court to challenge the request before release of the phone records.

Under the new rule, the attorney general would personally have to approve a delay in notice, and would only be able to do so only if he or she, "for compelling reasons," determines that notice would "pose a clear and substantial threat to the integrity of the investigation, risk grave harm to national security, or present an imminent risk of death or seriously bodily injury." In other words, notice would be presumed unless the Justice Department can articulate a specific harm. That's the opposite of the previous rule.

Again, that "grave harm to national security" exception is troublingly undefined, but the presumption in favor of notice is clearly an improvement. The rule also, with respect to the "integrity" exception, expressly states that mere delay of the investigation does not qualify as harm, an important fix.

Additionally, the rule laudably clarifies that the government may not pretend to suspect reporters of a crime because of activity within the scope of their job. Previously, an obscure law created a perverse incentive for federal investigators seeking a search warrant in leaks cases to allege that a reporter to whom classified information had been leaked was complicit in an Espionage Act violation. That was the James Rosen problem.

But there are a couple of other random issues. There's an odd carve-out for subpoenas and other demands for information from comments pages on news websites and other third-party content over which the outlet doesn't exercise editorial control before it goes up. Given modern blogs, wikis and social media, to name just a few types of sites and services dependent on third-party content, this could be a gaping hole in the rule.

At the end of the day, however, these new rules seem to be slightly more than half a loaf. The "suspect exception" fix is tangible progress, and the notice requirement, if used properly, will help prevent a future fishing expedition, like we saw in the AP case.

The new rule is better than "better than nothing," but definitely not a panacea.