9th Circuit Appeals Court: 4th Amendment Applies At The Border; Also: Password Protected Files Shouldn't Arouse Suspicion
from the well-that's-a-surprise dept
Here's a surprise ruling. For many years we've written about how troubling it is that Homeland Security agents are able to search the contents of electronic devices, such as computers and phones at the border, without any reason. The 4th Amendment only allows reasonable searches, usually with a warrant. But the general argument has long been that, when you're at the border, you're not in the country and the 4th Amendment doesn't apply. This rule has been stretched at times, including the ability to take your computer and devices into the country and search it there, while still considering it a "border search," for which the lower standards apply. Just about a month ago, we noted that Homeland Security saw no reason to change this policy.Well, now they might have to.
In a somewhat surprising 9th Circuit ruling (en banc, or in front of the entire set of judges), the court ruled that the 4th Amendment does apply at the border, that agents do need to recognize there's an expectation of privacy, and cannot do a search without reason. Furthermore, they noted that merely encrypting a file with a password is not enough to trigger suspicion. This is a huge ruling in favor of privacy rights.
The ruling is pretty careful to strike the right balance on the issues. It notes that a cursory review at the border is reasonable:
Officer Alvarado turned on the devices and opened and viewed image files while the Cottermans waited to enter the country. It was, in principle, akin to the search in Seljan, where we concluded that a suspicionless cursory scan of a package in international transit was not unreasonable.But going deeper raises more questions. Looking stuff over, no problem. Performing a forensic analysis? That goes too far and triggers the 4th Amendment. They note that the location of the search is meaningless to this analysis (the actual search happened 170 miles inside the country after the laptop was sent by border agents to somewhere else for analysis). So it's still a border search, but that border search requires a 4th Amendment analysis, according to the court.
It is the comprehensive and intrusive nature of a forensic examination—not the location of the examination—that is the key factor triggering the requirement of reasonable suspicion here....For years, we've repeated two key arguments for why border searches of laptops and other devices should be illegal.
Notwithstanding a traveler’s diminished expectation of privacy at the border, the search is still measured against the Fourth Amendment’s reasonableness requirement, which considers the nature and scope of the search. Significantly, the Supreme Court has recognized that the “dignity and privacy interests of the person being searched” at the border will on occasion demand “some level of suspicion in the case of highly intrusive searches of the person.” Flores-Montano, 541 U.S. at 152. Likewise, the Court has explained that “some searches of property are so destructive,” “particularly offensive,” or overly intrusive in the manner in which they are carried out as to require particularized suspicion. Id. at 152, 154 n.2, 155–56; Montoya de Hernandez, 473 U.S. at 541. The Court has never defined the precise dimensions of a reasonable border search, instead pointing to the necessity of a case-by-case analysis....
- You mostly store everything on your laptop. So, unlike a suitcase that you're bringing with you, it's the opposite. You might specifically choose what to exclude, but you don't really choose what to include.
- The reason you bring the contents on your laptop over the border is because you're bringing your laptop over the border. If you wanted the content of your laptop to go over the border you'd just send it using the internet. There are no "border guards" on the internet itself, so content flows mostly freely across international boundaries. Thus if anyone wants to get certain content into a country via the internet, they're not doing it by entering that country through border control.
The amount of private information carried by international travelers was traditionally circumscribed by the size of the traveler’s luggage or automobile. That is no longer the case. Electronic devices are capable of storing warehouses full of information. The average 400-gigabyte laptop hard drive can store over 200 million pages—the equivalent of five floors of a typical academic library.... Even a car full of packed suitcases with sensitive documents cannot hold a candle to the sheer, and ever-increasing, capacity of digital storage.Huh. That last paragraph sounds a lot like my argument above. Very cool to see a court actually recognize this basic point. Considering it had been ignored for so long, I'd almost given up hope.
The nature of the contents of electronic devices differs from that of luggage as well. Laptop computers, iPads and the like are simultaneously offices and personal diaries. They contain the most intimate details of our lives: financial records, confidential business documents, medical records and private emails. This type of material implicates the Fourth Amendment’s specific guarantee of the people’s right to be secure in their “papers.”.... The express listing of papers “reflects the Founders’ deep concern with safeguarding the privacy of thoughts and ideas—what we might call freedom of conscience—from invasion by the government.”... These records are expected to be kept private and this expectation is “one that society is prepared to recognize as ‘reasonable.’”
Electronic devices often retain sensitive and confidential information far beyond the perceived point of erasure, notably in the form of browsing histories and records of deleted files. This quality makes it impractical, if not impossible, for individuals to make meaningful decisions regarding what digital content to expose to the scrutiny that accompanies international travel. A person’s digital life ought not be hijacked simply by crossing a border. When packing traditional luggage, one is accustomed to deciding what papers to take and what to leave behind. When carrying a laptop, tablet or other device, however, removing files unnecessary to an impending trip is an impractical solution given the volume and often intermingled nature of the files. It is also a time-consuming task that may not even effectively erase the files.
In this case, they also noted that part of the forensic analysis of the computer involved restoring deleted files, and note:
It is as if a search of a person’s suitcase could reveal not only what the bag contained on the current trip, but everything it had ever carried.The court is equally worried about the fact that the device is often just a portal to cloud based services, and how a search of a device might lead to access to that data, even if it's been snug and secure "in the cloud" the whole time, rather than crossing the border:
With the ubiquity of cloud computing, the government’s reach into private data becomes even more problematic.12 In the “cloud,” a user’s data, including the same kind of highly sensitive data one would have in “papers” at home, is held on remote servers rather than on the device itself. The digital device is a conduit to retrieving information from the cloud, akin to the key to a safe deposit box. Notably, although the virtual “safe deposit box” does not itself cross the border, it may appear as a seamless part of the digital device when presented at the border. With access to the cloud through forensic examination, a traveler’s cache is just a click away from the government.Of course, this doesn't mean that no searches can ever take place. Instead, they just need to be "reasonable" and live up to the standards of the 4th Amendment. In fact, in this very case they still say that there was "reasonable suspicion to conduct the initial search, and that appears like it may be a legitimate claim (the guy had a previous conviction for child molestation, which the agents believed -- incorrectly, but they believed it at the time -- was for child porn). But for everyone else, where there is no reasonable suspicion, our 4th Amendment protections just got stronger (at least if you're entering the country in an area covered by the 9th Circuit (covering California, Alaska, Arizona, Hawaii, Oregon, Nevada, Washington, Idaho and Montana).
There's one other important part of the ruling as well. In discussing the "reasonable suspicion" the court agrees it was there because of the prior conviction, as well as the fact that guy was travelling from Mexico which is "a country associated with sex tourism." However, the government also argued that password protected files gave them reasonable suspicion, and thankfully the court slaps them down:
To these factors, the government adds another—the existence of password-protected files on Cotterman’s computer. We are reluctant to place much weight on this factor because it is commonplace for business travelers, casual computer users, students and others to password protect their files. Law enforcement “cannot rely solely on factors that would apply to many law-abiding citizens,” ... and password protection is ubiquitous. National standards require that users of mobile electronic devices password protect their files.... Computer users are routinely advised—and in some cases, required by employers—to protect their files when traveling overseas....There are some dissenting opinions, basically suggesting that this upturns more settled law, but the majority ruling makes a strong case for why the Supreme Court has actually not really directly answered this question before, but has tiptoed carefully around it. Still, it seems likely that there will be an appeal to the Supreme Court, so this probably isn't over yet. Hopefully, the Supreme Court will uphold this important ruling, and recognize that we don't give up our 4th Amendment rights at the border.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: 4th amendment, border search, border searches, computers, dhs, ice, passwords, privacy, reasonable suspicion
Reader Comments
Subscribe: RSS
View by: Time | Thread
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
Re: Re: Re: Re:
[ link to this | view in chronology ]
Re: Re: Re: Re:
No one is saying that border searches are illegal.
What we are saying is that border searches are not exempt from the Fourth Amendment.
[ link to this | view in chronology ]
There's probably a down side we don't see yet.
[ link to this | view in chronology ]
Re: There's probably a down side we don't see yet.
[ link to this | view in chronology ]
Re: There's probably a down side we don't see yet.
[ link to this | view in chronology ]
Holy crap!
Mike! Did you get this from Bizzaro world or something?!
[ link to this | view in chronology ]
Re: Holy crap!
[ link to this | view in chronology ]
Re: Re: Holy crap!
[ link to this | view in chronology ]
This is huge
I want to see this brought up in an argument against efforts to access old emails stored at 3rd party servers without a warrant. Emails don't stop being personal papers after 180 days.
[ link to this | view in chronology ]
Wait, a sane circuit court?!
Oh, it's from the 9th Circuit you say? Well that explains everything!
The West Coast of the United States tends to be saner when it comes to things involving computer-related tech. [Exhibit A: Ron Wyden]
With the exception of California and their constant "We must violate everyone's privacy FOR TEH CHILDRENS" routine.
Now the big question is whether or not this'll get appealed on the grounds of "But, but, TERRORISM!"
The Zen Master says, "We'll see."
[ link to this | view in chronology ]
Re: Wait, a sane circuit court?!
[ link to this | view in chronology ]
What Lawyers/Judges who understand computers?
[ link to this | view in chronology ]
What a great article to kick off the weekend!
[ link to this | view in chronology ]
"There are no "border guards" on the internet itself..."
You already covered the NSA wiretap rooms in San Fran. The border guards are there not to remove data from laptops, but for surveillance of it. You know anything going through those telecom trunks are stored for later retrieval for evidence, if deemed necessary.
So yes, there are border guards on the internet. I really wish you would stop saying otherwise. Or at the very least, tell me those NSA taps are now gone.
[ link to this | view in chronology ]
Re: "There are no "border guards" on the internet itself..."
Encrypted streams, OTOH, are much, much harder to deal with. Unless the NSA has a specific reason to target your communications, no one is looking at them as it is still far to expensive (in terms of compute power) to decrypt all encrypted streams just to have a look.
It's pretty much the difference between a post card and a letter in an envelope crossing the border....
And, BTW, if the NSA has a reason to target your communications, nothing you as an individual can do will stop them, not even RFC 1149.
[ link to this | view in chronology ]
Re: Re: "There are no "border guards" on the internet itself..."
May pigeons poop all over there cars, sheets and heads!
[ link to this | view in chronology ]
The Tit Watchers were better
The Tit Watchers were so much better.
http://web.archive.org/web/20050331092230/www.nice-tits.org
They will be missed.
[ link to this | view in chronology ]
Re: "There are no "border guards" on the internet itself..."
[ link to this | view in chronology ]
En Banc
I wouldn't have bothered, except that the term was defined and defined incorrectly. Or rather, defined correctly for all but the singular exception that happens to be the relevant one here.
In any case, en banc does still carry the far stricter weight of correctness of a thorough judicial review and decision.
[ link to this | view in chronology ]
Re: En Banc
Wait, so the smaller panel doesn't have to worry about making a thorough review and correct decision??
[ link to this | view in chronology ]
This should be good
[ link to this | view in chronology ]
Well, now they might have to.
TOP SECRET
Memo to all border agents;
Effective immediately, there will be a policy change in regards to searches of electronic devices. Since the court has ruled that you need reasonable suspicion to search an electronic device, all agents are hereby instructed to make up a reason before performing such a search.
Department of Homeland Security
Furthermore, they noted that merely encrypting a file with a password is not enough to trigger suspicion.
You know, Hiding a file on a modern computer isn't hard at all, today's users are just too clueless about their computers to know any better than storing possibly incriminating files in My Documents. Encrypt the file, name it something like syscore.dmp and drop it into one of the OS directories 2-3 levels deep. Nobody will ever find it unless the file is huge and they run a scan of the used space on the drive.
[ link to this | view in chronology ]
Re:
Or use TrueCrypt and make a hidden volume.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Sounds like we've got a Techdirt reader on the bench...
[ link to this | view in chronology ]
in other words, as not searching wont help you, then searching wont help or hurt you, so we can do it anyway just in case we perhaps find something that might help us accuse you of possibly having done something at sometime, maybe! just like everything else today, guilty unless able to prove innocence as well as guilty just because we can charge you
[ link to this | view in chronology ]
Run for the Border
[ link to this | view in chronology ]
Re: Run for the Border
[ link to this | view in chronology ]
Even with 4th amendment rules applying, presenting yourself at the border, as a member or contributor to something like Wikileaks, with encrypted files on your laptop will still be enough to qualify for a full search. Each piece in and of itself is not a trigger, but combining the person and the situation may be enough.
It really isn't any different from a convicted gang member, walking down the street with a gun shaped item under his shirt tucked into his pants. You cannot just randomly search a gang member, and you may or may not be able to merit it based on the shape of a bump in the clothing, but together it may be reasonable cause.
All the 9th circuit ruling really does is make the border agents justify at a basic level why they are looking at things. It's a big change in theory, but not really a big change in practical terms. Remember, the border agents can still refuse you entry for any reason at all, and they can still bar you from future entry without having to actually prove anything.
[ link to this | view in chronology ]
Re:
Last I heard, Wikileaks hasn't officially been declared a terrorist or criminal organisation by the US. Sure the US has obviously gone after it, but just saying you're a member of Wikileaks isn't the same as saying you're a member of the Mafia or Al'Qaeda.
Oh and can you elaborate on the convicted gang member? Not being USian, I'm not up to date on gun ownership laws. I assume here that the guy is an ex-convict, being out on the streets. I remember seeing a video recently where a random member of the public was stopped by cops merely for having a gun, and he was able to successfully argue to them that simply seeing that he has a gun is not enough grounds to justify a stop and search. Do ex-cons lose the right to own guns after being released from prison?
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re:
I recall a spoof Not The Nine-O-Clock News sketch from my youth where "Constable Savage" detained a suspect for "Possession of thick rubbery lips and wiry black hair" and "looking at me in a funny manner". You appear to be suggesting a similar standard of suspicion.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
"While the United States Constitution's First Amendment identifies the rights to assemble and to petition the government, the text of the First Amendment does not make specific mention of a right to association. Nevertheless, the United States Supreme Court held in NAACP v. Alabama that the freedom of association is an essential part of the Freedom of Speech because, in many cases, people can engage in effective speech only when they join with others."
http://en.wikipedia.org/wiki/Freedom_of_association
[ link to this | view in chronology ]
Re: Re: Re: Re: "Freedom of association" is not found in the US constitution.
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: "Freedom of association" is not found in the
It does apply, the government is not allowed to block you from their twitter accounts, However social media sites, like place of assembly, like pubs and cafes in real space, can ban you for many reasons, so long as it not based on race, gender or other protected class.
Note you do not open your home to everyone just because you use it for a meeting of a swing circle, or any activist group.
[ link to this | view in chronology ]
The initial search turned up nothing, and they justified the second search on his prior conviction creating a reasonable suspicion. I don't think that's reasonable at all. He was returning from a vacation in Mexico with his wife. Why does the 15 year old conviction create suspicion?
[ link to this | view in chronology ]
Wait -- what?
[ link to this | view in chronology ]
Cursory review?
[ link to this | view in chronology ]
Potential for disaster
[ link to this | view in chronology ]
Cotterman
Can they take it away and send it off to a lab to be flyspecked? Yes, if they have a reasonable suspicion. The suspicion doesn't have to be right, and it doesn't necessarily have to be based on accurate information. And, even though juries are admonished not to draw conclusions about the guilt of someone claiming Fifth Amendment protections against self-incrimination, the authorities are permitted to assume that someone who won't hand over the encryption keys has something to hide. That itself is not enough, but, when combined with other suspicions about what that something is can form part of the basis for the required reasonable suspicion.
This decision doesn't actually do a whole lot to advance privacy. The government must have at least some reasonable suspicion, but that's all, in the border setting. If they search any way, in any prosecution you can object to the introduction of evidence. Always assuming that circumstances such as being unable to afford a good lawyer don't lead you to plea bargain.
What if you and your stuff are entirely clean of any wrong doing? You may get your stuff back. It might be in working order. You could get an apology/have a nice day form letter. Some of your stuff might go viral. You might have a case against someone for something, but mostly you've been screwed without much hope of redress.
The merits of border searches can be argued while waiting for the cows to come home, but we shouldn't think of this case as a great victory for e-privacy.
[ link to this | view in chronology ]
Re: Cotterman
But will if be free of spyware?
[ link to this | view in chronology ]
Jurisdiction?
[ link to this | view in chronology ]
Re: Jurisdiction?
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
99.999999% of Indecent images are NOT transferred by cross-border travel via physical computers into nor out of the USA though they have been transferred via CD/DVD (though that is very rare nowadays).
Though reading your wall of text it is obvious you most likely work or are highly involved in the industry that has sprung up to profit substantially via the new post 9/11 Border Protection regime of the USA.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
http://www.youtube.com/watch?v=u4Ku17CqdZg
[ link to this | view in chronology ]
Re:
Let's say you get stopped for speeding. If there's no evidence or reason to believe that you've done anything worse than speeding, then he has no legal right to search your car without your consent. If, however, he sees an opened whiskey bottle on the passenger seat, that would give him the legal right to search your car even over your objections.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Foreign politics
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]