CBP Directive 3340-049B: Border Search of Electronic Devices
cbp.gov
cbp.gov
I love all the instances where it says, we will not do this or infringe in this way... unless it is a matter of national security, which we don't have to disclose to you. So basically, do what you want as long as you write it up properly.
And this part: 5.3 Review and Handling of Passcode-Protected or Encrypted Information 5.3.1 Travelers are obligated to present electronic devices and the information contained therein in a condition that allows inspection of the device and its contents. If presented with an electronic device that is protected by a passcode, encryption, or other security mechanism, an officer may request the individual's assistance in presenting the electronic device and the information contained therein in a condition that allows inspection of the device and its contents. Passcodes or other means of access may be requested and maintained for the duration of the search if needed to facilitate the examination of an electronic device or information contained on an electronic device, including information on the device that is accessible through software applications present on the device that is being inspected or has been detained, seized, or retained in accordance with this Directive.
I had thought (and Supreme Court ruled) you could not be compelled to unlock an encrypted device, which is why I always powered mined down before crossing. That goes against the obligated to present devices in a condition that allows inspection portion.
Does that apply to non-citizens? If a CBP officer doesn't like you as a non-citizen, like your lack of cooperation during an interview, they could just deny your visa and your entry into the US. If you're a citizen, they can't deny your re-entry. They can delay you for however long and ruin your day and even keep your devices, but you get to go home.
Don't worry, they're working on ending birthright citizenship
The U.S. isn't China or the UK.
In my experience, Australia was the most difficult country to get into as they are (now) very careful about bringing in any plant seeds or fruit, but the security staff were very friendly and helpful. I had to spend a while explaining that I did have some bananas in my bag previously which was why the cute sniffer dog was interested in it.
https://www.libertyhumanrights.org.uk/advice_information/exa...
Wasn't. Past tense.
Under what grounds?
I'm not saying that I agree with it, it's just the way it is
Spiteful border agents is not a new thing (I love the URL shortening).
>Does that apply to non-citizens? If a CBP officer doesn't like you as a non-citizen, like your lack of cooperation during an interview, they could just deny your visa and your entry into the US.
That's exactly what "you could not be compelled to unlock an encrypted device" means? You won't get sent to the gulag for refusing to, but entry into the US was always conditional with very little room for recourse if the border agent doesn't like you.
or that their investigation took longer than the duration until your intended flight,
but, no, they can’t legally refuse you from flying without cause or suspicion.
Saying "they can deport you" without specifying whether the hypothetical "you" is a citizen or not means you did not answer the question.
Not that you have to answer a stranger's question, but I thought I would clear the confusion in the hope it may be helpful.
Not always.
They must admit you, but they can arrest you one second later
Yes, I know, they can theoretically do whatever they want, but realistically it would take the most spiteful of spiteful agents to arrest you without cause (just because you refused to unlock your device). Just the act of doing this would create a lot of extra work and paperwork for the agent that most of them are not going to want to deal with. Plus, asserting your rights is a sign to them that you aren't a pushover and aren't going to get trampled on easily. The bullies prefer easier targets, usually.
Not sure about today specifically, but it is pretty relevant with the World Cup starting in 2 weeks
There are consequences for not decrypting, though: for a U.S. citizen, they can seize your stuff for up to 5 days. For non-citizens, they can elect to not let you in.
Concerning "obligated", I would point out that regulations aren't laws. Governing bodies can say whatever they want, but that doesn't make it so. For instance, the TSA continues to publicly insist that ID (especially "Real" ID) is required to fly within the U.S., but it's not.
Explain, please, because you seem to be implying that someone can board a plane from New York to LA without being legally required to show any identification.
Yes, things have changed in that time with regard to the zealousness of the TSA, but the laws and regulations behind them have not.
"In fact, the TSA does not require, and the law does not authorize the TSA to require, that would-be travelers show any identity documents. According to longstanding practice, people who do not show any identity documents travel by air every day – typically after being required to complete and sign the current version of TSA Form 415 and answer questions about what information is contained in the file about them obtained by the TSA from data broker Accurint…."
https://papersplease.org/wp/2020/05/19/tsa-tries-again-to-im...
https://papersplease.org/wp/2024/03/18/buses-trains-and-us-d...
https://en.wikipedia.org/wiki/Freedom_of_movement_under_Unit...
ezpz
The best time to plant a tree is 10 years ago. The second best time is today.
I have nothing to hide, but still no intention to provide my passcode.
That said, the whole thing is overreach in any democratic society.
1. You don't fuck around with Australian customs agents. Ever.
2. They make every other country look like complete lightweights, Americans and EU included. These guys will fine you AU $500 for half an eaten apple in your bag.
Tip for travelers to Australia/New Zealand: If you have something that is stated on the declaration form, just answer yes. Provided it's not some totally illegal substance, they'll inspect the items and if it's not allowed past the border it'll be seized without penalty. Someone will correct me if I'm wrong, but I believe in some few cases, you can even pick it up on your return.
If it's something like large amounts of cash, goods, alcohol or cigarettes, you may have to pay a tax or import fee and answer a few questions. Just don't be a dimwit.
That seems entirely appropriate, no? Produce crossing international borders like that can be a huge problem.
Customs agents are always given broad discretion and generally care about something.
Most normal folks will never intact with these issues. The last time I travelled internationally, they weren’t even doing secondary customs screening upon return to the US.
Ideally we should be able to just snapshot everything and then restore from that state. Kind of like EC2 or Digital Ocean
Also they'll detain you for having a suspicious burner phone and interrogate you about your social media etc.
What I want is to get my home screen back exactly as I left it: I've not found anything able to pull it off on Android though.
Ideally it would be an exact flash image of the phone.
Unfortunately, I don't know of any other app that does this on an unrooted phone.
AFAIK iPhone backups, if restored on the exact same device (i.e. a CPU with the correct decryption key embedded in it) will restore almost everything, including authenticator apps.
The only realistic option for Android is a separate "burner" device.
It's very patchy, and many (most?) apps opt out, so it's functionally useless.
???
Are American made operating systems (Android, iOS, Windows, Mac) so full of 0days that the Chinese are burning them on random travelers? This just feels like either severe paranoia and/or chinese/american psyop, making people think that China has some magic hacking power.
You could make an argument about the security of the modem of your devices, as that was often a target due to it not being particularly secure and it having wide access to your device, but I believe that started changing some years ago when this started being a more widely reported issue.
Protections at the U.S. border and within the U.S. are actually pretty good. Much of Europe isn't as good. Hell, the British will throw you in jail for refusing to unlock.
This also happens in many other countries
Source? Are we talking on random travelers, or targeted individuals? I seriously doubt china is doing the former, and I also seriously doubt the US doesn't engage in the latter.
I believe in politically sensitive areas like Xinjiang it happens to everyone. A past employer gave specific advice regarding Hong Kong as well.
I think the key thing as a traveller isn’t the righteousness of China vs. US. It’s the chilling effect on travel and trade.
We really depend on these devices that have access to vast scopes of personal and other data. That sexy text you got a year ago is still in your text message store and may be a problem in some places.
TBH, I don't know what the US does or doesn't do, and if I was visiting the US as a citizen of another country, I'd think about risks from the perspective of my experience.
So, yeah, savvy companies have had these policies for like twenty years now.
So long as only a few countries are doing this, it might seems doable. If everyone starts doing it, international travel becomes rather annoying to say the least. Realistically I think at some point a detente might want to be reached, with everyone agreeing not to search everyone else's electronics.
But "law enforcement" is specifically exempt?
https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
Search by border officers may very well be GDPR breach for that controller if there was data of EU data subjects, but I don't think there is currently any case law around it.
Edit: the first directive apparently was from 2009: https://www.jdsupra.com/legalnews/new-policy-for-device-sear...
Your personal papers are perfectly safe and subject the fourth amendment protections in your rented apartment. But most digital materials are considered to have been shared with a third-party if you store them on Google Drive.
My feeling about this stuff personally is that the biggest issue is that stuff that happens in electronic devices is different in a modern sense than what anyone intended in the past. If you could figure out a way to make my personal property as it exists on a foam or another device, the same as the personal property that’s in my desk at home or the trunk of my car then technology would be able to solve a lot of these problems. I think the custom thing is a more nuance conversation. I don’t understand the theory of it enough, but intuitively it seems ridiculous that a CBP officer has the ability to legally go through 30 years of my pictures in my Apple album because I happen to be crossing a border.
As the ability to perform surveillance on members of the public expands, laws and regulations must be reconsidered with these new capabilities in mind if just outcomes are to be maintained. Laws, regulations, and punishments that were just and reasonable when one expected to learn about and prosecute one offender in -say- a million are likely unjust and unreasonable when one expects to learn about and prosecute every single offender. [2]
[0] See also Section 16 on numbered page 236 of [1]
[1] <https://govtrackus.s3.amazonaws.com/legislink/pdf/stat/1/STA...>
[2] Yes, there are offenses -such as murder- for which this doesn't hold. I'd expect that these are the minority of offenses.
We need a constitutional amendment that says "we really mean it" with respect to the 4th and 9th amendments, explicitly including personal digital data and criminalizing general surveillance. With fangs.
The border search exception was designed by the framers.
I'd go further and argue that law enforcement and other government agents should be absolutely prohibited from accessing ordinary people's data [0] stored with or collected/computed by a third party without first getting a warrant or other such authorization from The Court. It has been ages since most of that sort of data could reasonably be considered «incidental business records», and how the law treats it absolutely needs to be updated to match the reality of how regular people's day-to-day interactions with third parties have changed.
[0] ...or metadata...
As I'm sure you know, chronic exhaustion and overwork is insidious and impairs your ability to recognize that you're affected by it. Even those of us who very definitely know better than to get caught by it sometimes get caught by it... and getting sufficiently out from under it to even recognize that you've been substantially impaired by it (let alone fully recover from it) takes more time than one might expect.
My reply is attached to the comment it was intended to be attached.
5.3.2 "Passcodes or other means of access may not be utilized to access information that is only stored remotely."
One easier way to do that is to use a Chromebook Public Session with a VPN, then connect to SaaS or a hosted desktop in your jurisdiction.
EFF to 4th Circuit: Electronic Device Searches at the Border Require a Warrant
That basically encompasses two thirds of the population.
The last two years have demonstrated a radical need to curtail that range of authority and shift from it being vaguely specified to a concrete legislative specification.
Even ten miles seems (pardon the pun) borderline excessive. There is no reason CBP can't hand off stuff to local, county, state, or federal domestic law enforcement. We have no shortage whatsoever of law enforcement in this country and they're able to communicate inter-agency better than ever via cell phone, tools like slack/teams, text messages, email, and long distance digital radio systems.
Maybe in the 1950's when all they had were shitty radios given them that sort of range was appropriate. Not anymore.
There's a 100 air mile border definition that's material to immigration enforcement (with complicated limitations). It does not determine where searches under the border search exception can occur.
The dispute (it's not really a dispute, there's a line of SCOTUS precedent explicitly about this question) is whether a 25-100 mile zone extends outwards the airport customs gates. No.
No one in this subthread has claimed that but you.
We're talking about this: https://www.congress.gov/crs-product/R46601#_Ref40429957
CBP partly justify the invasion of privacy by citing a supposed reduced expectation of privacy when traveling. But people whose data is caught up on the devices of others are not the ones traveling, but they are still having their messages read and photos copied.
Except for the parts that say "we get to be even more invasive for 'national security concerns'" and that they can compel you to provide a password, this doc seems mostly reasonable if you accept that they can search you. Then again, it's not clear _why_ they should be able to search your devices. There are no foreign pests nor WMDs that exist as documents on a device. This is clearly just the government being nosy because they think they can.
> 5.1.4 An officer may perform an advanced search of an electronic device only in instances in which there is reasonable suspicion of activity in violation of the laws enforced or administered by CBP or, in the absence of individualized reasonable suspicion when there is a national security concern.
In this climate, the qualifiers in 5.1.4 should be assumed to apply 100% of the time.
So, if you bring a device, be prepared to either unlock it and hand it over to be mirrored or abandon it and deal with whatever consequences fall out of that decision.
I'm probably never leaving this shithole again but, if I do, I'm coming and going empty-handed.