Report: CBP's Border Device Search Program Is An Undersupervised Catastrophe
from the scattershot-security dept
The CBP is searching more devices than ever and ramping up an "extreme vetting" program that includes biometric scans, demands for social media account passwords, and more intrusive searches across the board. As the number of device searches continues to increase, the agency's technical chops and and internal oversight aren't keeping pace.
That's according to recently-released Inspector General's report [PDF], which finds little to like about the CBP's search processes and policies, other than they occasionally manage to catch criminals attempting to enter the US. The CBP's Office of Field Operations is supposed to be taking charge of device searches, ensuring they're done effectively and intelligently. So far, it appears the OFO has taken a hands-off approach to management, resulting in bad practices and worse security.
[B]ecause of inadequate supervision to ensure OFO officers properly documented searches, OFO cannot maintain accurate quantitative data or identify and address performance problems related to these searches. In addition, OFO officers did not consistently disconnect electronic devices, specifically cell phones, from networks before searching them because headquarters provided inconsistent guidance to the ports of entry on disabling data connections on electronic devices. OFO also did not adequately manage technology to effectively support search operations and ensure the security of data.
Here's the kicker: the OFO is so laid back it still hasn't begun to address a problem raised by the Inspector General more than a decade ago.
Finally, OFO has not yet developed performance measures to evaluate the effectiveness of a pilot program, begun in 2007, to conduct advanced searches, including copying electronic data from searched devices to law enforcement databases.
Considering the pace of technology development, the OFO has managed to put the CBP more than a decade behind. Playing catch up now will probably bring them to five years behind schedule sometime within the next couple of years and ahead of the office's baseline expectations sometime around never.
These device searches can be intrusive. In some cases, devices are held for months as the agency performs forensic searches and analyzes the data. These intrusions need to be justified, but the IG found CBP officers can hardly be bothered to do the paperwork.
We reviewed 194 EMRs [Electronic Media Reports] and identified 130 (67 percent) that featured one or more problems, which totaled 147 overall.
The DHS's own search policies say device searches will be limited to data at rest, unless a deeper search can be justified. The OIG says none of the 154 EMRs compiled before the DHS reiterated this rule in April 2017 contained any evidence data connections were disabled before searches were performed.
This lack of care undercuts one of the arguments the DOJ offered when fighting against a warrant requirement for phone searches: that criminals could destroy evidence on a seized device using remotely-triggered software. The CBP either doesn't think this is a possibility or it sincerely doesn't care if it's jeopardizing its own searches. Either way, it does nothing to give the government's overdramatic assertions any more credibility.
The list of bad news goes on and on. The CBP failed to renew licenses for forensic software, resulting in the inability to perform advanced searches for period of months. It also ignored retention policies, allowing data copied from people's devices to sit around on external storage devices indefinitely. As the OIG points out, this isn't just a policy violation. It's also a security issue. Agents could peruse communications and data they have no business looking at and the theft of a storage device could result in unauthorized disclosures of travelers' data.
If there's a silver lining, it's that the CBP concurs with the IG's determination that it sucks. There's been no pushback from the agency -- only vows to make the needed improvements. But that's tempered by the fact the CBP still hasn't begun to address issues raised by the OIG in 2007. These recommendations will likely put the agency even further behind the technological curve, raising the chance of criminals and terrorists escaping detention and increasing the risks posed to travelers that their data might be abused by the CBP, or worse, some rando who happens to walk off with an unguarded USB stick.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: 4th amendment, border search, dbp, device search, ofo, search
Reader Comments
The First Word
“I doubt it's completely random. I think the statistics probably show that some ethnicities are likelier to have their devices dumped than others.
Subscribe: RSS
View by: Time | Thread
Or as is coming to light, the government seems to like to have vast troves of information about citizens that they can troll at their leisure to 'encourage' people to cooperate.
See also: What was the first date the feds had info on Aaron Swartz, nope it was years before that.
[ link to this | view in thread ]
I’m not surprised
And this has been going on for years. It’s not just a Trump or Obama problem. We are talking about a government that was unsuccessful at running a brothel in Nevada.
[ link to this | view in thread ]
Re: I’m not surprised
[ link to this | view in thread ]
Re: I’m not surprised
[ link to this | view in thread ]
Get a USB Kill device.
[ link to this | view in thread ]
Re: I’m not surprised
Yup, and I wish more people understood this.
It is a human problem and all society everywhere has these same problems. Some try to work out methods of mitigating the issues that arise while others sweep it under a rug and hope no one notices because they are too lazy or something, maybe they are on drugs.
[ link to this | view in thread ]
Re: Re: I’m not surprised
As if it ever did. History shows an almost complete lack of concern for the less fortunate from our and other governments.
[ link to this | view in thread ]
Similarly, some at borders have to open their baggage!
We must do away with all nations and borders. The recent UN pact will enforce that and unlimited immigration too.
[ link to this | view in thread ]
Re: TERRORISTS!!!!!!!!!!!
This started long before Bin Laden suddenly made 'terrorism' a household word. Americans who went to the middle east after the 1991 war to rebuild damaged facilities were warned that when coming back into the country, they would be searched for pirated software. This was back in the days when getting bootleg software meant having to personally know someone ... or buying it in Middle East countries where bootleg software was sold openly for little more than the cost of the blank disks. One thing that was never explained of course, was how Customs authorities could tell the difference between legally licenced and pirate software, either as disk backups or installed on a computer. But regardless, the threat worked, and most people were too scared to play that sort of Russian Roulette.
[ link to this | view in thread ]
Re: Similarly, some at borders have to open their baggage!
But Mom! ... everyone else is doing it!!!
Everything or nothing arguments rarely have a leg to stand upon.
[ link to this | view in thread ]
Re: Get a USB Kill device.
[ link to this | view in thread ]
Re: Re: Similarly, some at borders have to open their baggage!
All may contain contraband. All may legally be examined and seized by any country.
It's amazing that you comment twice without knowing the most elementary facts of the topic.
[ link to this | view in thread ]
Re: Re: TERRORISTS!!!!!!!!!!!
[ link to this | view in thread ]
Re: Get a USB Kill device.
Seriously.
If I want to transport something and I know I'll have problems if I carry it, I SHIP it instead.
Yeah, I'd be "in the right" to argue with customs or whoever if I decided to travel with the item(s), but I'm not nearly masochistic enough to want to waste hours and probably have the item(s) confiscated anyway, then have a court battle to get them back (when they've probably already been stolen and sold on ebay....).
[ link to this | view in thread ]
[ link to this | view in thread ]
Re: Re: Re: Similarly, some at borders have to open their baggag
I realize that human activities are not necessarily logical in most all countries however the fact that something is done, whether officially allowed or not, is not in itself indicative of whether said practice makes any sense.
Your childish argument proclaiming the practice to be commonly accepted everywhere and therefore we should also ... is a bit lacking in the supporting evidence area. I have read the specious arguments in favor and did not find any compelling reasons for violating the forth amendment.
What other elementary facts do I not understand? Will there be a test?
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
Re: Re: Re: TERRORISTS!!!!!!!!!!!
[ link to this | view in thread ]
Re: Re: Re: Similarly, some at borders have to open their baggag
[ link to this | view in thread ]
Re: Re: Re: Re: Similarly, some at borders have to open their ba
So do buttocks, lets not give them any ideas.
[ link to this | view in thread ]
Re: Re: Re: Re: Re: Similarly, some at borders have to open thei
They've already had that idea (and the related idea to bill the victims for those searches).
[ link to this | view in thread ]
I recently traveled from US to Canada and back with 3 others carrying probably 3 devices each.
No one got out of the car, no on asked for devices, just - have a nice day.
[ link to this | view in thread ]
In these 10+ years....
WHAT HAVE THEY FOUND??
What Have they stopped?
[ link to this | view in thread ]
Re:
Of course nothing was found and we were sent on our way. I chalked it up as terror theater (not security theater, the random nature of the stops does nothing but incite fear in all travelers, precisely the goal of terror organizations).
[ link to this | view in thread ]
Re: Re:
I doubt it's completely random. I think the statistics probably show that some ethnicities are likelier to have their devices dumped than others.
[ link to this | view in thread ]
"We'll get right on that... eventually... probably..."
If there's a silver lining, it's that the CBP concurs with the IG's determination that it sucks. There's been no pushback from the agency -- only vows to make the needed improvements.
Saying 'we'll get better, promise' is utterly meaningless since there's no time-table and no-one interested in actually holding them to it. It costs them nothing to say that they'll do it if they never actually follow through, and given the line immediately after that...
But that's tempered by the fact the CBP still hasn't begun to address issues raised by the OIG in 2007.
... I'd say their interest in actually doing something about the plethora of flaws plaguing the agency is in the 'zero to none' range.
[ link to this | view in thread ]
Re: Re: Re: Re: Similarly, some at borders have to open their ba
Sarcasm?
[ link to this | view in thread ]
Re: Re: Re: Re: Re: Re: Similarly, some at borders have to open
[ link to this | view in thread ]
Re: Re: Re:
Their self fulfilling prophesy about where all the crime is being committed is proven because they only look where they say they will find it.
[ link to this | view in thread ]
Re: In these 10+ years....
Stopped: giving a shit
[ link to this | view in thread ]
Re: Re: Re: Similarly, some at borders have to open their baggag
[ link to this | view in thread ]
Re: Re: TERRORISTS!!!!!!!!!!!
So there were drives being traded and cycled around, but ZOMG PIRACY BAD!!!!!! kept anyone from scanning them for virii so systems kept getting reinfected over and over and over.
But hey we totally protected Hollywood from the evil boogeymen and it only cost us our liberty and security... that was a fair trade off wasn't it? Just because you leg got blown off doesn't mean we should have human compassion & put every first run movie at your finger tips to remind you people back home care... we might lose a dollar.
[ link to this | view in thread ]
Re: I’m not surprised
Then you look at Congress & totally understand why they thought people would still turn out in droves.
[ link to this | view in thread ]