
Border Search of Electronic Devices – CBP Directive [pdf] - troydavis
https://www.cbp.gov/sites/default/files/assets/documents/2018-Jan/cbp-directive-3340-049a-border-search-electronic-media.pdf
======
coldcode
We really need a definitive SCOTUS ruling that searches of electronic devices
violate the Constitution but if course we will never get that far. The intent
of border searches originally was to identify goods being brought into the
country to avoid paying duties or fees or being brought in illegally.
Searching an electronic device is more akin to demanding to see what words are
on a piece of paper you have in your pocket. Obviously the reason to search
electronic devices is for political purposes like finding terrorists or
illegal porn which is not what the Constitution is talking about.

~~~
pas
Taxes, levies, excises, duties, substance schedules and a lot of other things
are just implementations of political purposes/ideas.

Of course the difference between search for economic (tax evasion) control vs
search for security (written/recorded "thought crime") control is the
important difference here.

------
provost
Section 5.3 pertains to requesting passcodes, and that an Officer may ask you
for the passcode (I don't see anything about individuals being obligated --
though see 5.3.4, which could be interpreted by "legal remedies"). However,
section 5.3.3 says:

> If an officer is unable to complete an inspection of an electronic device
> because it is protected by a passcode or encryption, the Officer may, in
> accordance with section 5.4 below, detain the device pending a determination
> as to its admissibility, exclusion, or other disposition.

Section 5.4 elaborates further.

Also, I found 5.1.2 interesting:

> Officers may not intentionally use the device to access information that is
> solely stored remotely. To avoid retrieving or accessing information stored
> remotely and not otherwise present on the device, Officers will either
> request that the traveler disable connectivity to any network (e.g. by
> placing the device in airplane mode), or, where warranted by national
> security, law enforcement, officer safety, or other operational
> considerations, Officers will themselves disable network connectivity.

~~~
smoyer
My employer made me sign an agreement that states (among other things) sharing
passwords/passcodes is not allowed and that termination is a potential result
of a violation of this policy. I'm going to keep my job and not unlock the
whole-disk crypto protecting the data on my drive.

Since I work for an educational institution, there is potentially FERPA
protected data on my drive. In some instance we also deal with HIPPA data.
It's also interesting because my password manager stores it's data as
encrypted files on that drive (mirrored from the cloud). I'm certainly not
unlocking that either.

~~~
forapurpose
(IANAL.) Employment agreements generally are not enforceable when they
conflict with the law, AFAIK. The security guard might be required to never
open the door, but when a police officer or court gives them a lawful order to
open it, they open it or go to jail. I doubt they could be fired for opening
it in that circumstance; your employer cannot require to you violate the law.

Another way of looking at it: You can write whatever you want on paper and
sign it, but that doesn't make it enforceable. You could sign a document that
makes you a slave or puts up your children as collateral for your ISP bill,
but those agreements would be scrap paper (or evidence for the prosecutor).

~~~
sandworm101
Not scrap. They do evidence an intention to pay. They are an acknowledgement
of the debt. The individual clauses may be struck as illegal, but the documemt
and signatures are still a thing.

------
illirik
One thing to note: "This directive governs border searches of electronic
devices -- including... at the extended border." The "extended border" extends
a hundred miles from what we normally consider the border; the authorization
for customs agents to conduct warrantless searches in the Immigration and
Naturalization Act allows them "within a reasonable distance from any external
boundary of the United States," and the Attorney General defined that distance
as a hundred miles. The Supreme Court disagrees (Almeida-Sanchez v. U.S., U.S.
v. Martinez-Fuente), and has ruled that border searches can only be done,
well, at the border. Under this directive, an importer/exporter headquartered
in downtown San Diego would be subject to these searches... a bit scary if the
Supreme Court ever overturns its earlier border search decisions.

~~~
ComputerGuru
Yes, it’s indeed over the top. Here’s a map by the ACLU:
[https://goo.gl/images/HpPYby](https://goo.gl/images/HpPYby)

~~~
tptacek
It is indeed over the top. Almost too much to believe. Oh, wait. _It is too
much to believe_.

This notion that any place within 100 miles of a border is a "4th Amendment
Free Zone" is an urban legend. The ACLU should stop spreading it.

The exact issue we're talking about here has been tried all the way through
the Supreme Court, which found that the border search exemption only applies
to people with some nexus to an actual border crossing.

~~~
dragonwriter
> The exact issue we're talking about here has been tried all the way through
> the Supreme Court, which found that the border search exemption only applies
> to people with some nexus to an actual border crossing.

Wrong. It found that warrantless “border” searches on public highways leading
to it away from the Mexican border were legal based on either perceived
ethnicity of drivers or passengers or even no individualized basis for
suspicion. No nexus between the searched person or vehicle and an actual
border crossing beyond being on a road which eventually led to or away from
the Mexican border is required.

It's true that the only places that the decision applies to are _public
highways_ , not (e.g.) the interior of residences or businesses, so it's not
_any_ place. But it's pretty extensive.

~~~
tptacek
Which case are you referring to?

Also, I can't tell if you're nitpicking my summary or if you actually do
believe there's a 100-mile-wide Constitution-free zone hugging the US border.

~~~
dragonwriter
> Which case are you referring to?

Martinez-Fuerte.

> Also, I can't tell if you're nitpicking my summary or if you actually do
> believe there's a 100-mile-wide Constitution-free zone hugging the US
> border.

“100-mile Constitution-free zone” is a simplification that, like any
simplification, is somewhat inaccurate; there is a broad (unclear as to it's
maximum limits, the 100 miles is current executive policy) in which the courts
have allowed, in fairly broad circumstances, substantially lower standards for
search and seizure than are otherwise Constitutionally applicable in the US,
rendering the protections of the Fourth Amendment in practice much weaker.

~~~
tptacek
You should re-read it, because it explicitly rebuts the argument you're
making. It holds specifically that Almeida-Sanchez stands, and that:

 _In Almeida-Sanchez v. United States, supra, the question was whether a
roving patrol unit constitutionally could search a vehicle for illegal aliens
simply because it was in the general vicinity of the border. We recognized
that important law enforcement interests were at stake, but held that searches
by roving patrols impinged so significantly on Fourth Amendment privacy
interests that a search could be conducted without consent only if there was
probable cause to believe that a car contained illegal aliens, at least in the
absence of a judicial warrant authorizing random searches by roving patrols in
a given area. Compare 413 U.S. at 413 U. S. 273, with id. at 413 U. S. 283-285
(POWELL, J., concurring), and id. at 413 U. S. 288 (WHITE, J., dissenting). We
held in United States v. Ortiz, supra, that the same limitations applied to
vehicle searches conducted at a permanent checkpoint._

It allowed the actions in this case specifically because _they were not
searches_ , in the same sense as a traffic stop is not a search, and the
police, having pulled your car to the side of a city street for having expired
tags, cannot without probable cause demand that you open your trunk to allow
inspection.

~~~
tptacek
You got kind of quiet there. :)

------
baxtr
The number of searches has increased quite a bit from 2016 to 2017

[https://www.cbp.gov/newsroom/national-media-release/cbp-
rele...](https://www.cbp.gov/newsroom/national-media-release/cbp-releases-
updated-border-search-electronic-device-directive-and)

------
qrbLPHiKpiux
The best way is not to travel with anything that is not needed.

Use cloud services and a disposable OS.

The best way to play their (CBP) game is not to play. Don’t have anything
available for them.

~~~
nabeards
Is there any way to quickly wipe and restore a full macOS? or other OS for
that matter? As someone who travels, well, all the time, it seems a massive
amount of overhead at the moment.

If everything is in the cloud, that means I have to be sure to have fast,
reliable internet at my destination (which is definitely not always the case).
And any way I can think of to securely travel with a copy of my data is just
the same problem: the CBP can request I unlock the other device.

Ideally, we just wouldn't be able to be compelled to unlock our data, without
the high probability of being forced to hand over the device because of our
refusal. How is this not a violation of the Fourth Amendment? It's frustrating
in the least.

~~~
cypherpunks01
Chrome is the only OS that makes this ridiculously easy, I think..

~~~
gcb0
only because chromeos is so crippled.

this is like suggesting a kids toy in the shape of a power tool is easier to
repair than a proper power tool. while true, you can't do the same tasks with
the kids toy.

------
natch
Never is there any mention that by accessing the device of person A, the
officer may be violating the rights of all people (say persons B, C, and D)
who have shared information in confidence with person A.

This includes getting access to my family photos. I don’t want an officer, who
self selected by applying for a job that he knows will give him access to
family photos, to get access to my family photos, because what kind of person
applies to that job?

~~~
b4lancesh33t
There is not generally a right to confidentiality of information you share
with a third party. There are a few exceptions (spouses, doctors, lawyers,
among others). If party A shares information with party B outside one of these
protected relationships, then I guess A's rights will not be violated if their
information is discovered in party B's possession, whether or not party B
shares that information voluntarily. (All subject to the search of B's
information being constitutional.)

~~~
datenwolf
That really depends on the jurisdiction. For example in Germany it is illegal
to share pictures of persons not being yourself without the other party's
agreement. Google Translate does a decent enough job on the German Wikipedia
entry:

[https://translate.googleusercontent.com/translate_c?depth=1&...](https://translate.googleusercontent.com/translate_c?depth=1&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=de&sp=nmt4&tl=en&u=https://de.wikipedia.org/wiki/Recht_am_eigenen_Bild_\(Deutschland\)&usg=ALkJrhiC80DjHDXQOU5_czR98VrQL8tlkQ)

~~~
loeg
The article in discussion is the US CBP, so the jurisdiction is pretty clearly
the US and not Germany.

------
dang
Related: [https://www.npr.org/sections/thetwo-
way/2018/01/05/576139303...](https://www.npr.org/sections/thetwo-
way/2018/01/05/576139303/u-s-customs-and-border-patrol-sets-new-rules-for-
searching-electronic-devices) via
[https://news.ycombinator.com/item?id=16086700](https://news.ycombinator.com/item?id=16086700)

------
yborg
Ignorant question for those who have had to transit the US border (it has been
many years for me) - are these device searches now routine? I.e. do they
automatically request access to any locked smartphone, etc?

~~~
paulsutter
From [https://www.cbp.gov/newsroom/national-media-release/cbp-
rele...](https://www.cbp.gov/newsroom/national-media-release/cbp-releases-
updated-border-search-electronic-device-directive-and):

> In FY17, ... Approximately 0.007 percent of arriving international travelers
> processed by CBP officers (more than 397 million) had their electronic
> devices searched

I would guess devices are searched at the border for parallel reconstruction
(to find information they already know without disclosing details about
surveillance)

~~~
tptacek
You would guess that based on what evidence? Just first principles, in the
sense that if you ran an DOJ and a CBP with what you believe the same
objectives as the real DOJ and CBP, that's what you'd do?

~~~
paulsutter
Two reasons:

(1) There were posts on HN around the time of the Snowden news of border
agents presenting private emails, in one instance someone was traveling as a
tourist but had email inviting them to perform as a musician

(2) In individual stories I read of searched phones, the agent already knew
where to look (for example, went directly to an app with discussion arranging
paid hookups)

We already know that parallel reconstruction is common for surveillance used
by law enforcement (DEA, local police using Stingray, etc) so that seems more
believable than random spot checks on .007% of people.

~~~
tptacek
We know that parallel reconstruction is "common"? Can you back that up with
evidence?

~~~
paulsutter
Google “parallel reconstruction stingray” or “parallel reconstruction dea”

Nothing prevents police or prosecutors from using inadmissible evidence, they
just can’t produce it in court.

~~~
tptacek
That's categorically false.

[https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree](https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree)

~~~
paulsutter
You should read your own link. Parallel reconstruction is an explicit
exception to that rule. I would be thrilled if you can debunk parallel
reconstruction, but that doctrine is the very reason for it.

From your link:

“The doctrine is subject to four main exceptions. The tainted evidence is
admissible if:

\- it was discovered in part as a result of an independent, untainted source”

~~~
tptacek
We're mis-communicating. You said:

 _Nothing prevents police or prosecutors from using inadmissible evidence,
they just can’t produce it in court._

That statement by itself is clearly false. The police cannot illegally search
you and use that evidence as a means to find additional evidence, and then
present that evidence in court as if it was untainted.

What I gather you meant now was that _parallel construction_ allows them to do
this. Parallel construction is the process by which unlawful evidence is used
to _direct the attention_ of LEOs, who, after plainly observing some other
crime or probable cause indicator, then conduct a search.

I know what parallel construction is, but what I do not know is why you
believe the process is common. Do you have any evidence for the frequency with
which it is used? The revelation that it had ever happened was a major news
story just a few years ago. Is it your belief that it was common practice, and
that even though there are something like 500,000 working law enforcement
agents in the US, somehow the secret never got out until recently?

To be very clear: I believe parallel construction has happened and will happen
again in the future, but I do not believe it is routine or that any process at
CBP is tuned to amplify it.

~~~
paulsutter
I don't want to debate the meaning of the word "common", but given the number
of Stingers in use, and their NDA prohibiting disclosure, I think it's naive
to assume that parallel reconstruction is rare. And yes, that's just my
opinion.

When the police find a guy carrying $500,000 in his car, do you really think
that was random chance?

> That statement by itself is clearly false.

No the statement is true. Detectives act on hearsay evidence all the time
(which is inadmissible). They use everything they know about a suspect to
drive an investigation.

Inadmissible means only that it can't be presented in court. While a jury must
ignore inadmissible evidence, police have no such requirement. Most of their
work is outside the courtroom, the trial is just the presentation at the end.

------
troydavis
Section 5.1 (page 4) describes new rules for US CBP searches:

“Officers may not intentionally use the device to access information that is
solely stored remotely. Officers will either request that the traveler disable
connnectivity to any remote network…”

~~~
brndnmtthws
So it sounds like a workaround is to avoid storing any data locally on the
device. I wonder how effective that would be in practice. It might raise some
suspicion if you unlocked your phone and they discovered you were logged out
of everything, and there was nothing on the phone.

~~~
jsjohnst
> It might raise some suspicion if you unlocked your phone and they discovered
> you were logged out of everything, and there was nothing on the phone.

There are countries[0] I travel to where that’s exactly what they find,
essentially a freshly wiped phone. Hasn’t raised suspicion yet.

[0] it’s also how I travel to certain security conferences. Buy a
used/refurbished device before, use for duration of event, sell immediately
after.

~~~
mysterypie
> _sell [device] immediately after_

I've heard people say that if their laptop or phone were searched out of their
sight by border officials, they'd sell it afterward.

But is it ethical? I think this meat might be contaminated; I'm not going to
risk eating it, so I'll sell it.

~~~
gradschool
I'd consider it my lucky day and auction it off to security researchers.

------
whisk3rs
What is the most effective way to encourage our elected representatives to
correct this potential for violation of our rights?

------
OliverJones
Are there any devices offering a silent panic passcode? It would be convenient
for travelers if "123456" unlocked the device and "987654" erased local
information and unlocked the device.

That way a properly backed up device could be carried across a border with
risk only of inconvenience, not of data loss.

(The passcodes I showed are my passcodes. :-) Nobody else use them, OK?)

~~~
robbiet480
IANAL but previously when I have heard that question the common response is
"this can later be considered intentional destruction of evidence and/or
obstructing justice and can also be used as grounds for further detention
because you must have something to hide"

EDIT: Also a commenter below reminded me that not obeying any order given to
you by CBP/law enforcement is a direct violation of previously agreed to rules
of the trusted traveler programs (Global Entry/TSA Pre, maybe even CLEAR?)
which would cause you to be removed from any/all of those programs.

~~~
mindslight
If you are opting into these "programs", you are already part of the problem.

~~~
ilkan
With the opt-in... 30mins to cross a border. Without it.. slowdowns, flagging,
questioning, etc... could be 6 hours. If one is travelling for business,
opting out is not realistic.

~~~
mindslight
We all sell out every day; might as well be on the winning team!

------
CharlesMerriam2
TL;DR: Some businesses will forego an option to connect with a US supplier
rather than try to send a lawyer through customs.

------
shiado
Does anybody know if there is an equivalent to Hidden Volumes for an OS? It
would be pretty cool if you could give a password for your machine that loads
up a default OS installation, or maybe some configurable fake user to make
things look more 'legit'.

------
aerodog
So what do we do if the CBP asks us to hand our devices over? Is there any way
we can tell them to fly a kite?

~~~
jsjohnst
Are you a US Citizen? Are you willing to temporarily (temporarily in this case
is not implying a _short_ duration, btw) lose your device? Are you able to
waste time (as in hours or unlikely but possibly days) at CBP defending your
rights without negative repercussions (as in missed flights, possibly missed
work, missed family obligations, etc)?

If the answer is yes to all, then sure, _politely_ refuse and stand your
ground until you get your way. I try to make sure I can answer all yes when I
travel, but the last one isn’t always possible.

~~~
shiftpgdn
Also, note that refusal to comply with ANY direction by CBP results in
permanent unappealable revocation of trusted traveler status.

~~~
jsjohnst
Fair point

------
philip1209
Attorney-client privilege is interesting. What happens if you say that you
have emails and voicemails from an attorney?

~~~
rocqua
As I read it, they essentially promise not to look at it.

------
Havoc
They're on to me and my evil attempt to smuggle lolcats into the US

