Hacker News Reader

Comment by meri_dian | Hacker News Reader

If they can search your bags without a warrant at the border, why can't they search your phone or laptop?

Edit: Contraband can be both physical and digital. If the government can conduct searches for physical contraband then searches for digital contraband in certain circumstances like border crossings seems reasonable.

View on HN

I like to think of it in terms of house keys.

It's one thing if a border guard inspects your house key you brought along, analyzes for dangerous substances, drugs, etc.

It's another if they clone that key and have someone drive out to inspect your house with it.

To me, your house in this scenario is your entire collection of private data accessible online / remotely (finances, taxes, possibly the private data of others -- possibly even portals to HIPAA/other PII data of a more commercial nature).

Assuming you agree that it is unfair to let the border search data outside of the phone, then it gets still more problematic.

One of the tricky aspects here is that it seems you can be detained / intimidated if you refuse to decrypt / unlock your device (as a US citizen re-entering your own country). I think you're getting at the idea that the phone/laptop is a physical device and should be searchable like any other object -- and, I think that's fairly reasonable. The problem is that the border guard can also "compel" you to decrypt that device / log in to it if you've put these measures in place. People have been forcibly detained for refusing to cooperate [1], even being put into a chokehold [2].

I respect that some amount of extra search power is required at borders -- but that power must be reasonably scoped (and in this case, I'd say it is not).

[1] http://www.cnn.com/2017/02/13/us/citizen-nasa-engineer-detai... [2] https://www.nbcnews.com/news/us-news/american-citizens-u-s-b...

"possibly even portals to HIPAA/other PII data of a more commercial nature)."

You bring up a good point about HIPAA. I work in health care and we are allowed to keep a work email client on our phone provided that we keep control of our phone at all time (to keep PHI/HIPAA info safe). A border agent searching through my phone could be considered a HIPAA violation and would have to be reported. Not sure if anything would come out of it fine wise for the company but it would still be a nightmare for compliance.

One interpretation is that you're responsible for someone else breaking the law. If it's a violation, then the border guard committed the violation.

Another interpretation is that you cannot possible obey the law. If the border guard has the legal right to demand access to the HIPAA protected data, and you can't legally give him access... then the law enforcement officials are forcing you to break the law.

With no punishment for them, of course.

There's one set of rules for normal people, and another for law enforcement. How does this keep me safe?

"One interpretation is that you're responsible for someone else breaking the law. If it's a violation, then the border guard committed the violation."

The problem with that is that they aren't a covered entity and thus shouldn't have access to the data. Because they aren't a covered entity HIPAA rules do not apply to them.

Your phone / laptop is now digitally connected to everything in your life.

Giving access of that over to a government agent is like handing them a diary of everything you ever thought, a list of everyone you ever met, a record of everywhere you ever went, a list of every book you've ever read, a list of every medication you've ever taken, a list of every game you've ever played, a list of every off-color joke you've ever cracked with friends, etc.

Would you hand that over on paper?

Many of which fit the legal definition of papers:

http://legal-dictionary.thefreedictionary.com/Paper

which are protected from being searched by the fourth amendment:

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

(I quoted the modern legal definition of papers, but the proper thing to look up is the colloquial definition of papers at the time the constitution was written. Does anyone have a good reference for how the founders of the US would have used the word "papers"? It clearly included legal and accounting documents, but e.g. was it broader than that?)

Another thing that contains all those same things is "your brain." It's harder to get the facts out of it, but those TSA interview rooms represent an attempt. If that is allowed, then I don't see what's better/worse about searching your digital exobrain instead. Either way, you're handing over "you" on a silver platter.

Answer one: speed

Assuming you have perfect recall, and answer all of their questions truthfully, it will still take time for them to troll through all of your memories and actions.

They can do the same with a telephone / laptop in minutes.

Answer two: perfect recall

You can't recall everything perfectly, and you don't write everything down. So after a while, they won't have anything to go on. "What did you do in Thailand last Wednesday?" ... "I dunno, I got drunk with my friends?"

Versus "we searched your phone and you took pictures last Wednesday of someone who looks underage. Please turn around for the handcuffs".

In general, I have everything to hide from state actors with near-infinite resources, zero accountability, a deep understanding of the law (i.e. how to get you for almost anything), and their own personal agenda to push.

They should need to prove to me why they need to look at my stuff.

You can plead the 5th. Your phone cannot.

Exactly. All the more reason to make sure the 4th is upheld.

It really isn't.

Because that's presumably to prevent you from importing physical contraband into the country. Checking your internet connected device for contraband makes zero sense.

Could they make the argument that they're checking for malicious software/viruses/other bad stuff that could be a threat to Americans?

What year is this? That kind of stuff can just be transferred via the Internet. It doesn't have to physically be transferred across the border.

Then we better put up a great firewall.

Also... Malware is not illegal. Using it can be.

Then "randomly" and arbitrarily searching people's devices as they cross the border isn't really an efficient way to do it, unless you also set up an intrusive firewall to "protect" the U.S. from malware.

I mean, not really unless they open it up and run antivirus software on it.

And even then it would only find things they already know exist, which would mean they're already in the country more than likely.

Contraband can be both physical and digital. If the government can conduct searches for physical contraband then searches for digital contraband in certain circumstances like border crossings seems reasonable.

Contraband can be digitally transmitted without physically traversing a border. Given this, what purpose is there to performing extended searches (potentially of cloud / remote data) at the time of border crossing?

This opens a door to unlimited search power at US borders against US citizens. There is already a 100-mile inland range where your can be searched without a warrant around our borders -- we are only going to make this worse by extending that range into all of our private digital data.

I posted a house/key analogy just now that may help clear up the distinction between physical and digital data search. Just to be clear, I'm actually ok with border guards physically inspecting my electronics. I am not ok with them compelling me to login to them, decrypt them, or otherwise hand them over my social media / banking logins / etc.

Keep in mind, we're talking about US citizens re-entering their own country here. I think this is a key point.

It could make sense for foreign visitors (to check for intended visa violations, etc.)

But there is no reason to search the devices of U.S. citizens and lawful permanent residents, who are already authorized to live and work in the U.S. These people would have no reason to break immigration law. And if the government is searching digital content for evidence of other unlawful activity, they should have to get a warrant.

Keep in mind that any digital content you can bring through a border port-of-entry, you can also just send it via the Internet.

The idea of digital contraband is anathema to a free society.

One big difference is that digital searches aren't limited to stuff you're bringing with you -- they want to search your entire past history in terms of email, social media, etc.

Another big difference is the purpose of the search in the first place. We search for physically dangerous items to protect people, or unlawful items for customs reasons. The case for physically dangerous data and unlawful data is much less clear cut.

The real reason for searching your devices seems to be related to profiling you as a person in order to determine if they want to let you in, which is a completely different purpose than searching your bags.

It depends on the reasonableness of the search. Physically inspecting bags to prevent agricultural products and weapons is both more effective at protecting the country, and less invasive into the personal lives of the travelers. Searching your phone is not just what you are carrying with you, but your entire connected life. Because the CBP is doing so few of these searches already there is little reason that they cannot get a warrant in cases where there is a real reason further search is needed.

In a world without the Internet, sure. But in the one we live in, it seems trivial to "sneak" digital contraband into the United States.

Sensitive information that someone is reluctant to send over the internet may be stored on a hard drive and exchanged in person.

Fair, but data can be encrypted in an air-gapped machine and then sent over the Internet, too. Unless you have diplomatic cover (and privilege from being detained or searched), I would argue that carrying in person is higher risk.

Checking for digital content at the border doesn't really make sense, given the Internet. Especially as applied to U.S. citizens and permanent residents, who are already authorized to work and live in the U.S. and therefore should have no motive to break immigration laws. If this is not a purely immigration inspection at the border, then the government should get a warrant.

It's complicated by your phone or laptop also being a gateway to a much larger digital footprint. My phone has some information stored locally, but it also has the keys to all my online accounts.

If I carry a key to my home safe with me across an international border, that doesn't give the government the right to seize that key and search my safe but that's effectively what they're doing with digital searches.

Reply on news.ycombinator.com