Second Circuit allows government to search electronic devices at the border | Hacker News Reader

Second Circuit allows government to search electronic devices at the border

knightcolumbia.org

130 pointsHotGarbage79 comments

Everyone please read Surveillance Self Defense from EFF [0]

My advice, take a burner phone to the airport (and elsewhere?), and since devices are subject to warrantless search anywhere and everywhere, via exceptions to the fourth amendment [1] (the constitution seems designed to be bent or outright ignored), keep your data at home and encrypted. The "cloud" is a government data supermarket.

For example.

> While the Fourth Amendment is the foundation, federal and state laws can add layers of complexity. For example, the Patriot Act expanded the government's ability to conduct surveillance and searches, particularly in national security cases, sometimes with a lower burden of proof than traditional criminal investigations.

MUCH lower.

[0] https://ssd.eff.org/

[1] https://uslawexplained.com/warrantless_search

When I travel internationally, I do not take any electronics with me.

If I need a cell phone, laptop, etc., then I will buy or rent something cheap at the destination.

I got into the habit while traveling back and forth the mainland China as it was our corporate policy (and we never brought any electronics back, either).

I tried that once.

Then when I tried to log in to my Gmail account at my destination, it flagged it as a suspicious login attempt and wouldn't let me in without entering a code they texted to my American phone number, which meant I was locked out of my email for the duration of the trip.

Plus travel day realities often require your phone and accounts - plane tickets, Uber/Lyft, hotel reservations or updates from Airbnb with check-in instructions, door codes, etc.

It's a tremendous challenge and hassle for any regular person. We really just need to push back on the government overreach. It's tragic that half of the Trump voters proclaim to be "small government" and "Don't tread on me" but then tolerate things like this. There's certainly a bipartisan group of people opposed that are large enough to effect change if we work together.

I 100% agree that the best solution would be for the law to catch up and actually treat privacy as a human right. Until that time there are things which, while challenging and a hassle, do help.

I would use the same sim-card in the burner phone. Any attack by the government that they can do with your real sim card can also be done through phone number spoofing.

For email, use unique emails (things like booking+youremail@...) for reservations/bookings/tickets and have those forwarded to a second email account that you want to use during the trip. It is already good privacy hygiene to use unique emails for all types of registrations, and you will have more control when services eventually have a leak.

> (things like booking+youremail@...)

This is so trivially easy to bypass. If you're a service selling email addresses, just strip off the booking+ part and you have the "real" email address.

All my sign-up email addresses are via a catch-all email, so I can just give a service "thisservice@mydomain.com", or "thatservice@mydomain.com", so I there is no single "real" email address, and I get to track who exactly is selling my email address. So far I haven't had problems with anyone spamming "anything@mydomain.com".

They can bypass it, and as the user you can also use any other sign or character that you want. If you email is foo@ then you can use the letter x, as registrationxfoo@. A popular choice for a company email is first.lastname@, so you can use a . for it, or the - character. + is just what some program, like procmail and Sieve, will recognize without much trouble.

Using a a catch-all email with your own domain works also perfectly fine. Doesn't work as well if there is multiple email users of that domain.

It isn't that they tolerate it, it simply doesn't affect them, so they don't care. Besides, it affects many they dislike, so that's always a bonus.

Remember, when ultra-partisans, of most political ideologies, demand rights and freedoms, there's almost always an implied "for me and mine" in there. Exceptions to this are extraordinarily rare, even more so nowadays.

>It's tragic that half of the Trump voters proclaim to be "small government" and "Don't tread on me" but then tolerate things like this.

Let's be real. Those people don't travel. They've never left the country, and most have likely never left their state, or even their hometown. I know a person like this - they refuse to fly on a plane to go anywhere because they are not allowed to bring their gun on the plane - they are a real "don't tread on me" 2nd amendment/NRA type. And they will never vote for anyone but a Republican no matter how bad things get.

You can bring a gun on the plane, you just need to have it in a locked case, and it can’t be a TSA lock. You also have to declare it and open the case for inspection when checking it.

It may be hard to bring it overseas though.

That isn't their deal. They want to bring their loaded gun on the plane with no restrictions, or they simply will not fly. Reason does not work with a person like this.

Well that’s unwise of them. I just wanted to clarify since some people don’t understand that you can fly with firearms. A lot of people who go to events like Defcon will pack a firearm as this prevents TSA from inspecting the bag without you present—at least that’s how it’s supposed to go, unless there’s a secret room where they have skilled lockpickers on standby.

When have trump voters ever been wise?

Have you ever actually spoken to a voter that matches the archetype you're describing?

Yes.

They are an in-law of mine, yes I've spoken to them. They want to bring their loaded gun on a plane with no restrictions - that is literally why they refuse to fly on an plane. Good for the rest of us, I guess.

You're not going to have any access to non-local data or services while traveling unless you set up a foreign office first (that's what we did).

Or go satellite which in someplaces is a major crime.

has anybody ever challenged the PATRIOT Act on compliance with the 4th Amendment?

Not that it really matters, with the current Supreme Court being what it is, but still...

The issue, as I understand it, is that someone with standing to sue over the 4th amendment would be prosecuted under a FISA court. Those cases due to how the court was created and structured, do not end up in front of the supreme court.

It's one of those weird things in the US constitution which allow for congress to create new federal courts which don't ultimately fall under the jurisdiction of the regular federal courts.

https://en.wikipedia.org/wiki/Jurisdiction_stripping

The FISA court only handles warrants, not prosecutions. Generally the only parties involved in a warrant request to a court (FISA or any other), are the judge and the government representative(s) seeking the warrant, though the court can pull in third-parties if it wants, e.g. for advice on legal questions.

A secret criminal prosecution trial would be unconstitutional under the Sixth Amendment ("In all criminal prosecutions, the accused shall enjoy the right to a speedy and public trial"). Though SCOTUS has unfortunately allowed for some classified material to be kept secret, sometimes (IIRC) even from the defendant and the jury, though usually this is ancillary stuff, not the direct evidence that would secure a conviction.

Warrants are what's at issue when the 4th amendment is in play. The thing you can't do when FISA issues a warrant is get the details about that warrant, who issued it, why it was issued. You can't even know that a FISA warrant was deployed against yourself.

Normal judicial warrants are public record.

The resources you link to are helpful; however, this is not really practical advice for most people most of the time. To the extent that our smartphones are a very helpful device to have in our day-to-day lives at home, they're even more useful in a foreign country where they become our only available computing device; indispensable for keeping in touch back home, navigation on unfamiliar transit systems, translation of unfamiliar languages, and so on.

Of course, with great effort and moderate expense, you could setup a burner phone with access to many of your same accounts and resources, but the more features you add to the burner phone, the more it begins to look like the device you're leaving "safe" at home.

I'm traveling overseas tomorrow and my partner and I will both be taking our phones with us as we do every day in our home country.

I find modern smartphones more and more unusable, both OS becoming more hostile towards the user, and applications widely moving to dropping logins in regular intervals. That has been happening for years already, so I slowly moved more and more stuff back to a computer.

By now I'm at a point where I no longer even backup my phone - there are a bunch of apps, but I can just install them and log in again on a different device as needed.

The final step to make it truly throwaway was me doing a custom matrix bridge for SMS earlier this year - I had voice routing setup for a while already. So now my old SIM cards are in a 4G modem at home, and the phone I carry around with me just has a data SIM. Huge quality of life improvement, as I can terminate as many numbers as I want there, and have access to both voice and SMS data from my computer as well.

How does this relate to travel? Are you saying that the modern smartphone drops logins so often that the burner is less of a burden? Or that you should just travel with a laptop? (which I do quite often, since a thin laptop takes so little space and weight)

Both. My standard phone defacto already is a burner phone, so I'd just either wipe it or pick something new up when travelling to that kind of countries.

Similar for a notebook - I'd travel with an empty one, restore it after arriving, and wipe it again before leaving. I have infrastructure in place to make that easy and secure for me to do.

> the more features you add to the burner phone, the more it begins to look like the device you're leaving "safe" at home.

Wouldn't a sensible way to do this be to create an encrypted backup of your device on a VPS, then restore it to the "burner phone" once you're on the other side of the border, and wipe the device again before you come back?

The idea being that whenever you're at the border crossing, the device contains nothing, and the passphrase for the backup is in your head.

I don't dispute the beneficial OPSEC here but it does nothing to reduce the burden.

> Of course, with great effort and moderate expense, you could setup a burner phone with access to many of your same accounts and resources, but the more features you add to the burner phone, the more it begins to look like the device you're leaving "safe" at home.

The trick is to have alternate accounts, and not have your "real" ones configured as you transit sensitive locations like borders. Once you're past, download your apps and log in to your real accounts.

With LLMs that's even easier. I suppose you could set one up to populate your fake Facebook account with convincing, up-to-date "local sports team" fan activity.

Don't call attention to yourself, make noncompliance look like compliance.

"Hey Mr. Border Guard, this is a burner phone, have at it!"

"Okay can you login to your email for me? If not I'm going to have to keep you here until you do."

You have to set up trivial, low value “burner” email that you use for your emailing activity when overseas, and other related social media accounts, and make sure to keep them “warm”.

A spare old Pixel or iPhone SE is $20-$50 you can use for this purpose.

If you’re talking about a US citizen returning home, they can’t hold you indefinitely. If you disagree, I challenge you to find a counter example.

All bets are off if you’re a non-citizen entering another country, it depends on the laws and customs there.

Doing a bit of research, this applies to what’s considered a “manual search” as in a CBP agent spending time manually looking at your phone. It does not appear to allow (or speak to?) plugging your phone into forensic tools for a deeper inspection.

Not great, but I think that’s what’s being specifically adjudicated here.

They still cannot deny an US citizen entry if you decline to unlock your phone, though they may confiscate your device. I don’t know if they would then be allowed to do deeper forensics without a warrant.

Since removing a nation-state rootkit is not structurally possible, how is this any different from requiring the device to be forfeited? If all search == seizure and destruction, does that change the legal basis?

> Since removing a nation-state rootkit is not structurally possible,

on an iPhone, DFU-flash (using apple configurator) reads NO state from the phone and overwrites ALL state. Nowhere for rootkit to live. If you are worried, do that.

I thought this was already allowed and the norm for many years?

You are right. What most people don’t understand however is that “the border” extends for 100 miles

https://www.aclu.org/know-your-rights/border-zone

This effectively means border patrol can do whatever they want in areas that do not involve a border crossing and involve citizens just living their normal lives

That concerns more than 220 million people in the USA, who can be arbitrarily stopped in the street and searched.

Be afraid...

...which is about 2/3rds the population of america.

Note also that that 100 miles _is a radius around your nearest international airport_ and need not be what you think of as a border, i.e. a line drawn between two land masses.

This is not correct, it’s a common but false misunderstanding. The text of the law does not support this and the ACLU/EFF don’t see it as a likely problem.

People should stop repeating this claim or it will become one of those “folk truths” that eventually becomes accepted and real.

You are correct; I was wrong on this one! I’d read it so many times and far enough back, coupled with DHS’s general attitude of “we’ll do what we want”, that I’d taken it as true. Delighted not to be right here.

Of course, as it is, the 100 mile zone is already absurd enough!

Please cite a reputable source for this claim. Preferably a SCOTUS ruling.

it's not just a device problem, the whole constitution is suspended 100 miles around the entire border of the US, we have no rights

(look at FLORIDA, the entire state!)

* https://www.wired.com/2008/10/aclu-assails-10/

* https://www.aclu.org/documents/know-your-rights-100-mile-bor...

* https://www.congress.gov/crs_external_products/R/HTML/R46601...

And the "border" in this case includes a 100 mile circle around any international airport

It does not, this is not in the law. This is a false misunderstanding that somehow keeps getting propagated. A few civil rights people have looked into it and don’t see it as a likely problem, and there haven’t been cases where the government was able to use this argument.

So store your data in a secure location and only access it with devices if your a journalist?

Isn't it telling that if your immediate thought is to subvert said LAW? That doesn't seem to be serving the people then does it, but the state. The state is supposed to serve its people

I assume journalists would already do this actually maybe they don't?

There dosent appear to be any import/export controls on the current internet is there?

If they say import export control gives them the right to search citizens maybe they should be aware of this giant gapping hole that the internet created 30+ years ago?

How is the law subverted if one doesn't make all data immediately available?

I mean, that's what the State tells you to stop uprising, but there has never in history been a state that served the people it governed, it serves the people who govern. It's all just big gangs with weapons, and sometimes one gang takes over another's territory. Everything else is window dressings to prevent other gangs from forming.

Is it a visual search, or do they make a copy of all your data?

It probably depends how pissed off you made the officer at the border if he just wants to thumb through some recent text messages and photos to see if you're doing Crimes or if they're gonna go take it to the Cellebrite UFED in the backroom and dump it out.

In other words... whom (or what) was perceived to have pissed in the CBP officer's Wheaties this morning? We'll never know what grudges he holds to make his decision.

This case is about a “visual search” as in CBP agent going through your photos. Not forensic tools copying / analyzing all the data

The article is not that clear in one way. Does this only apply to non-US Citizens ?

Anybody crossing the border. The justification is that the government's constitutional right to control imports overrides the 4th amendment right to privacy.

>“The border-search exception is grounded in the recognized right of the sovereign to control, subject to substantive limitations imposed by the Constitution, who and what may enter the country.” Id. at 620. Because “[t]he Government’s interest in preventing the entry of unwanted persons and effects is at its zenith at the international border,” United States v. Flores-Montano, 541 U.S. 149, 152 (2004), “searches made at the border, pursuant to the long-standing right of the sovereign to protect itself by stopping and examining persons and property crossing into this country, are reasonable simply by virtue of the fact that they occur at the border,” Ramsey, 431 U.S. at 616.

https://ww3.ca2.uscourts.gov/decisions/OPN/24-960_complete_o...

So the argument is basically that Americans already consent to allowing customs to search anything and everything that they are physically bringing across the border, whether a US citizen or not, and now that is also affirmed to include the digital contents of electronic devices.

Worse though, is that the definition of border is hella loose. CBP can be many MANY miles away from an actual border and do this.

100 miles to be clear. So many major cities are free reign. Entire counties.

https://www.aclu.org/know-your-rights/border-zone

from https://www.help.cbp.gov/s/article/Article-1253?language=en_...

> Immigration Officers, without a warrant, may "within a reasonable distance from any external boundary of the United States...board and search for non-citizens in any vessel within the territorial waters of the United States and any railcar, aircraft, conveyance, or vehicle. 8 CFR 287 (a)(1) defines reasonable distance as 100 air miles from the border.

from https://www.aclu.org/know-your-rights/border-zone

> Nearly two-thirds of the U.S. population, over 213 million people, reside within the region that CBP considers falling within the 100-mile border zone, according to the 2020 census. Most of the 10 largest cities in the U.S., such as New York City, Los Angeles, and Chicago, fall in this region. Some states, like Florida, lie entirely within this border band so their entire populations are impacted.

Even worse: The Trump administration claimed international airports as part of the border. (I saw that once, months ago. I do not know what the legal state of that claim is, or even whether it is currently part of their theory of what they are allowed to do.)

Setting the “100 mile” thingamajig aside - why wouldn’t you consider an international airport part of your border? It is a port of entry.

The problem is the 100 mile rule, which effectively puts most of the population under the purview of border control measures.

Apart from that, an airport is a comparatively small area of land that is magnitudes easier to monitor than a border that only exists as a thousands of miles long line on the map, therefore the 100 miles rule should not be applied. And everyone getting off an international flight in the USA has already been searched multiple times.

I can't find any definitive information on this. Disturbing if true.

I can't supply you a reference. It was... maybe 4 to 6 months ago? Border Patrol was doing something more than 100 miles from the border, and a reporter asked them what their justification was for being active that far inland, and the Border Patrol spokesperson said "international airport".

I mean, that could have been just one person's attempt to justify them operating outside their legal authority. Or it could have been what they were told to say, meaning it was somewhat more official policy (or at least official smokescreen du jour). At any rate, it has been claimed, at least once, not in court but to the press.

If so this was an individual claim, it’s not known to be official policy, the law doesn’t support it, and it hasn’t been used as a successful argument in court. This claim comes up regularly but it’s a misinterpretation/rumor. People should stop repeating it or it will become one of those “folk truths” that eventually becomes accepted and real.

It's not a folk truth that I saw it, in a mainstream news report, said by a Border Patrol employee to justify their actions more than 100 miles from the border. That's not a misinterpretation; that really happened. At least once.

I would be delighted for it to not have been an actual administration claim, ever.

Fair, I have no doubt that someone has falsely claimed it in order to do an illegal search, but it still is a false claim and (based on current understanding of the law) would not hold up in court.

As it is the 100 mile zone sweeps in most of the population.

Near the top of the article:

“Today’s decision leaves Americans’ most sensitive information open to search at the border without any suspicion at all,”

I think this is just an extension of a general we, as government officials protecting American freedoms, can do what we want and will justify it later if we have to policy.

It should probably be noted that this specific case led to a conviction of an actual crime (Bank fraud and money laundering).

East Germany built a wall to keep their citizens "free" of "fascist elements"...

You understand that no one actually believed that lie. It was built to stop people from running to west Germany.

> It should probably be noted that this specific case led to a conviction of an actual crime (Bank fraud and money laundering).

That's pretty much irrelevant to the discussion. Of course a lot more crimes would get prosecuted if we lived in a total police state.

I think it is important because the case was not about guilt or innocence. It was about the governments right to search without any cause. If the case was about whether there was enough cause for the search we would be having a much different discussion here.

I should probably have said this in my original comment.

doesn’t this affirm an existing ruling in a different appeals circuit or the Supreme Court?

This is a blatant and direct violation of the Fourth Amendment.

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

This has not been true since 1977 at the very least, but Fourth Amendment exception at the border has been around for longer than even that.

My understanding is that SCOTUS has held since the 50s that 'the people' means people inside the country, and a border does not count as being granted entry into the country yet, therefore the Constitution doesn't really apply, especially for non-citizens.

https://supreme.justia.com/cases/federal/us/345/206/

> (c) Although a lawfully resident alien may not captiously be deprived of his constitutional rights to due process, the alien in this case is an entrant alien or "assimilated to that status" for constitutional purposes.

And another gem from the same case that is recently all the more relevant:

> Nothing in the Constitution requires admission or sufferance of aliens hostile to our scheme of government.

Meaning they can seize all your stuff and deport you if you criticize the government. Also, immigration lawyers are part of the Executive branch.

You literally have more rights if you successfully cross illegally. This only harms people crossing the legal way. Illegal crossers who are later arrested have protection - any search will require probable cause and a warrant.

And in response, every other country will start ejecting US citizens after rummaging though their meaningless online critiques of the glorious leader.

People did not think this policy through fully. =3

People did not think this policy through fully.

It seams more likely that it was thought through and officials just don't care.

Reply on news.ycombinator.com