from the well-that's-a-surprise dept
Here's a surprise ruling. For many years we've written about how troubling it is that Homeland Security agents are able to
search the contents of electronic devices, such as computers and phones at the border, without any reason. The 4th Amendment only allows
reasonable searches, usually with a warrant. But the general argument has long been that, when you're at the border, you're not in the country and the 4th Amendment doesn't apply. This rule has been stretched at times, including the ability to take your computer and devices into the country and search it there, while still considering it a "border search," for which the lower standards apply. Just about a month ago, we noted that Homeland Security saw
no reason to change this policy.
Well, now they might have to.
In a somewhat surprising 9th Circuit ruling (en banc, or in front of the entire set of judges), the
court ruled that the
4th Amendment does apply at the border, that agents do need to recognize there's an expectation of privacy, and cannot do a search without reason. Furthermore, they noted that merely encrypting a file with a password
is not enough to trigger suspicion. This is a huge ruling in favor of privacy rights.
The ruling is pretty careful to strike the right balance on the issues. It notes that a
cursory review at the border is reasonable:
Officer Alvarado turned on the devices and opened
and viewed image files while the Cottermans waited to enter
the country. It was, in principle, akin to the search in Seljan,
where we concluded that a suspicionless cursory scan of a
package in international transit was not unreasonable.
But going deeper raises more questions. Looking stuff over, no problem. Performing a forensic analysis? That goes too far and triggers the 4th Amendment. They note that the location of the search is meaningless to this analysis (the actual search happened 170 miles inside the country after the laptop was sent by border agents to somewhere else for analysis). So it's still a border search, but that border search requires a 4th Amendment analysis, according to the court.
It is the comprehensive and intrusive nature of a forensic
examination—not the location of the examination—that is the
key factor triggering the requirement of reasonable suspicion
here....
Notwithstanding a traveler’s diminished expectation of
privacy at the border, the search is still measured against the
Fourth Amendment’s reasonableness requirement, which
considers the nature and scope of the search. Significantly,
the Supreme Court has recognized that the “dignity and
privacy interests of the person being searched” at the border
will on occasion demand “some level of suspicion in the case
of highly intrusive searches of the person.” Flores-Montano,
541 U.S. at 152. Likewise, the Court has explained that
“some searches of property are so destructive,” “particularly
offensive,” or overly intrusive in the manner in which they
are carried out as to require particularized suspicion. Id. at
152, 154 n.2, 155–56; Montoya de Hernandez, 473 U.S. at
541. The Court has never defined the precise dimensions of
a reasonable border search, instead pointing to the necessity
of a case-by-case analysis....
For years,
we've repeated two key arguments for why border searches of laptops and other devices should be illegal.
- You mostly store everything on your laptop. So, unlike a suitcase that you're bringing with you, it's the opposite. You might specifically choose what to exclude, but you don't really choose what to include.
- The reason you bring the contents on your laptop over the border is because you're bringing your laptop over the border. If you wanted the content of your laptop to go over the border you'd just send it using the internet. There are no "border guards" on the internet itself, so content flows mostly freely across international boundaries. Thus if anyone wants to get certain content into a country via the internet, they're not doing it by entering that country through border control.
We'd never seen a court even seem to acknowledge that content on devices is different than contents in a suitcase... until now. One interesting tidbit, is that they specifically note that "secure in their papers" part of the 4th Amendment, while noting that what's on your device is often like your personal "papers."
The amount of private information carried by
international travelers was traditionally circumscribed by the
size of the traveler’s luggage or automobile. That is no
longer the case. Electronic devices are capable of storing
warehouses full of information. The average 400-gigabyte
laptop hard drive can store over 200 million pages—the
equivalent of five floors of a typical academic library....
Even a car full of packed suitcases with sensitive documents
cannot hold a candle to the sheer, and ever-increasing,
capacity of digital storage.
The nature of the contents of electronic devices differs
from that of luggage as well. Laptop computers, iPads and
the like are simultaneously offices and personal diaries. They
contain the most intimate details of our lives: financial
records, confidential business documents, medical records
and private emails. This type of material implicates the
Fourth Amendment’s specific guarantee of the people’s right
to be secure in their “papers.”.... The
express listing of papers “reflects the Founders’ deep concern
with safeguarding the privacy of thoughts and ideas—what
we might call freedom of conscience—from invasion by the
government.”... These records are expected to be kept
private and this expectation is “one that society is prepared to
recognize as ‘reasonable.’”
Electronic devices often retain sensitive and confidential
information far beyond the perceived point of erasure,
notably in the form of browsing histories and records of
deleted files. This quality makes it impractical, if not
impossible, for individuals to make meaningful decisions
regarding what digital content to expose to the scrutiny that
accompanies international travel. A person’s digital life
ought not be hijacked simply by crossing a border. When
packing traditional luggage, one is accustomed to deciding
what papers to take and what to leave behind. When carrying
a laptop, tablet or other device, however, removing files
unnecessary to an impending trip is an impractical solution
given the volume and often intermingled nature of the files.
It is also a time-consuming task that may not even effectively
erase the files.
Huh. That last paragraph sounds a lot like my argument above. Very cool to see a court actually recognize this basic point. Considering it had been ignored for so long, I'd almost given up hope.
In this case, they also noted that part of the forensic analysis of the computer involved restoring deleted files, and note:
It is as if a search of a person’s suitcase could reveal not only
what the bag contained on the current trip, but everything it
had ever carried.
The court is equally worried about the fact that the device is often just a portal to cloud based services, and how a search of a device might lead to access to that data, even if it's been snug and secure "in the cloud" the whole time, rather than crossing the border:
With the ubiquity of cloud computing, the government’s
reach into private data becomes even more problematic.12 In
the “cloud,” a user’s data, including the same kind of highly
sensitive data one would have in “papers” at home, is held on
remote servers rather than on the device itself. The digital
device is a conduit to retrieving information from the cloud,
akin to the key to a safe deposit box. Notably, although the
virtual “safe deposit box” does not itself cross the border, it
may appear as a seamless part of the digital device when
presented at the border. With access to the cloud through
forensic examination, a traveler’s cache is just a click away
from the government.
Of course, this doesn't mean that no searches can ever take place. Instead, they just need to be "reasonable" and live up to the standards of the 4th Amendment. In fact, in
this very case they still say that there
was "reasonable suspicion to conduct the initial search, and that appears like it may be a legitimate claim (the guy had a previous conviction for child molestation, which the agents believed -- incorrectly, but they believed it at the time -- was for child porn). But for everyone else, where there is no reasonable suspicion, our 4th Amendment protections just got stronger (at least if you're entering the country in an area covered by the 9th Circuit (covering California, Alaska, Arizona, Hawaii, Oregon, Nevada, Washington, Idaho and Montana).
There's one other important part of the ruling as well. In discussing the "reasonable suspicion" the court agrees it was there because of the prior conviction, as well as the fact that guy was travelling from Mexico which is "a country associated with sex tourism." However, the government also argued that password protected files gave them reasonable suspicion, and thankfully the court slaps them down:
To these factors, the government adds another—the
existence of password-protected files on Cotterman’s
computer. We are reluctant to place much weight on this
factor because it is commonplace for business travelers,
casual computer users, students and others to password
protect their files. Law enforcement “cannot rely solely on
factors that would apply to many law-abiding citizens,”
... and password protection is
ubiquitous. National standards require that users of mobile
electronic devices password protect their files.... Computer users are routinely advised—and in
some cases, required by employers—to protect their files
when traveling overseas....
There are some dissenting opinions, basically suggesting that this upturns more settled law, but the majority ruling makes a strong case for why the Supreme Court has actually not really directly answered this question before, but has tiptoed carefully around it. Still, it seems likely that there will be an appeal to the Supreme Court, so this probably isn't over yet. Hopefully, the Supreme Court will uphold this important ruling, and recognize that we don't give up our 4th Amendment rights at the border.
Filed Under: 4th amendment, border search, border searches, computers, dhs, ice, passwords, privacy, reasonable suspicion
