If Courts Won't Protect People's Phones At The Border, Congress Needs To Act Now

from the it's-time-to-move-past-'but-the-border-tho' dept

Invasive searches of people's phones at border crossings and international airports have become standard operating procedure for US border control agencies. The usual justifications have been made: national security and preventing contraband from crossing the border.

Those claims may have some merit, but it doesn't explain why the number of invasive searches has exploded over the past few years, even though the number of border crossings hasn't. It also doesn't explain why agencies like Customs and Border Patrol (CBP) continue to claim the program is too important to be curtailed, yet somehow not important enough to be competently supervised or quantified.

For the most part, courts have agreed with the government's assertions that searching devices without warrants or (in many cases) articulable suspicion is just good national security work. Only one court has pushed back, requiring searches to be limited to rooting out suspected contraband, rather than just examining phone contents until agents find something to get reasonably suspicious about.

The Supreme Court said warrants are needed to search the contents of cell phones. Unfortunately, our nation's borders have long been considered blanket warrant exceptions -- an exception that extends 100 miles inland from every border and international airport. It also limited this to searches "incident to an arrest," and in many cases, people whose devices are searched at the border are never arrested.

This ruling tends to work well away from the border, since seizures of phones without an arrest is generally considered an obvious violation of rights, which makes any subsequent searches illegal. But this phrase doesn't do much to limit searches at the border where rights are assumed to be mostly waived, making the initial seizures lawful, paving the way for warrantless searches that may violate the Fourth Amendment, but in a place where courts have said violating the Constitution is cool and good.

And so the courts, having abdicated their checks and balances mandate, tell plaintiffs "hey, if this bothers y'all, maybe ask Congress to get it changed." Because if Congress says it's ok to waive all rights near the border, who are the courts to decide direct Supreme Court precedent applies to border phone searches?

Well, maybe the courts need to do a little local application because Congress can't be arsed. A bill to restore the Fourth Amendment at the border has been submitted and denied in the past. It's back again. Maybe this time -- given the increasing distrust of law enforcement and federal border control efforts -- it will get further than it has in the past.

Here's the EFF's summary of Ron Wyden's "Protecting Data at the Border Act," which (against all sanity) offers up the novel idea that the federal government should respect people's rights.

Unfettered border searches of electronic devices pose a significant threat to personal privacy. That’s why we urge Congress to pass the Protecting Data at the Border Act, a bill recently re-introduced by Sen. Ron Wyden (D-OR) and Sen. Rand Paul (R-KY) that would create a warrant requirement for these types of searches, thereby protecting our constitutional rights at the border.

As the EFF points out, this is the third attempt to restore the Fourth Amendment in the federal government's gray area -- the large parts of the United States known unofficially as the "Constitution-Free Zone." The bill wouldn't go so far as to enact a warrant requirement, but it does add a bunch of protections that currently don't exist.

Consent must be obtained in written form. No more Google Translate or pidgin Spanglish from border control officers who will take consent even if it's expressed with upside down question marks. And it's not all of the Fourth Amendment, but it's more than we have now: border control officers need to have probable cause someone committed a felony before seizing their device. If they don't have that, any post-seizure search would be a de facto rights violation.

There are also reporting requirements that mandate more transparency from border control agencies on searches and seizures of devices. And agencies are forbidden from retaining communications and data that can't be shown to be related to criminal investigations or charges.

It's not perfect but it's far more than we have now. And, if enacted, would curb CBP's thirst for warrantless searches, forbidding it from getting the boys in the boat to sail out on fishing expeditions just because. This is the third try for Wyden's bill. Let's hope it's the charm.

Filed Under: 4th amendment, border, border exception, border searches, cbp, device searches, protecting data at the border act, ron wyden

Private Prison Company On The Hook For Legal Fees After Suing Investment Group For Saying It Was Doing Stuff It Was Actually Doing

from the civics-obviously-not-its-strong-suit dept

Private prison company CoreCivic has just learned a civics lesson. [I'll show myself out.] Possibly a very expensive one.

Last March, it sued [PDF] Candide Group, an investment firm that "directs capital away from an extractive global economy towards investments dedicated to social justice and sustainability." CoreCivic was one company Candide reps wanted money directed away from, citing its participation in separating parents from children at our nation's borders. (But really only the Southern border if we're honest.) Candide also claimed CoreCivic lobbies for harsher sentencing and tougher immigration laws since both of those would naturally provide more business for CoreCivic.

CoreCivic's libel lawsuit said these two "falsehoods" were spread throughout the web via sites like Forbes and multiple social media platforms. It denied both assertions and said they were stated with a reckless disregard for the truth. Candide responded with an anti-SLAPP motion [PDF], which pointed out that not only could CoreCivic not prove the statements were false but also that it had filed its lawsuit past the one-year statute of limitations.

The motion worked. After some back and forth discussion about the merits of the arguments, the court disposed of CoreCivic's lawsuit with a very short dismissal [PDF] in November. The order doesn't say much but it says enough to indicate just how weak CoreCivic's allegations were.

A multitude of issues have been tendered on defendants’ motion to dismiss and to strike the complaint for defamation. It turns out, however, that CoreCivic, Inc., did, in fact, operate detention facilities for parents separated from their children pursuant to the Border Patrol’s family separation policy. Thus, even though CoreCivic did not operate the detention facilities in which the children themselves were housed, CoreCivic did house the other half of the afflicted families or at least some of them. Therefore, the allegedly defamatory statements were true enough under the First Amendment and under California defamation law. Truth being a defense, the complaint is DISMISSED WITHOUT LEAVE TO AMEND. It is unnecessary to reach the remaining issues tendered. All other motions are DENIED AS MOOT.

Anti-SLAPP laws work. CoreCivic didn't like being publicly criticized, especially by an entity that could shift investors' money elsewhere. That these actions may have damaged CoreCivic's future profitability isn't really relevant -- at least not when its allegations of libel couldn't be sustained.

Whatever money is now leaking from CoreCivic is going to be (mildly) compounded by its inability to recognize largely truthful statements as protected speech, rather than the defamation it clearly desires them to be. The court says [PDF] Candide is entitled to collect legal fees from CoreCivic -- an important facet of any good anti-SLAPP law. Candide's legal reps are asking for about $165,000 in fees. However, the tail end of the order suggests it won't be nearly that much.

First, defense counsel’s hourly rate is inflated way beyond the amount charged to the client. The anti-SLAPP attorney’s fee provision protects defendants from shouldering the costs of meritless litigation so fees should be limited to what actually “compensate[s] a defendant for the expense of responding to a SLAPP suit,” and not result in a bonus for attorneys.

[...]

Second, defense counsel spent too long on the motion to strike, especially in light of the experience and expertise of the attorneys which should have allowed them to make quicker work of this matter. Especially where hourly fees are high, there is “an expectation that [counsel] will complete tasks efficiently and that its more senior attorneys will limit their involvement to tasks requiring their level of expertise.”

All anti-SLAPP motions are not created equal, but Judge William Alsup says this one is not that much more equal than others.

Other courts have determined a reasonable time expenditure for an anti-SLAPP motion to be between 40 and 75 hours, not 407.9 hours as here.

Whatever fees are eventually settled on, this case highlights the importance of having a strong anti-SLAPP law to work with. Without it, this case could have gone on for several more months and even a clear win for defendants would rarely result in fee shifting. CoreCivic sued because it didn't like being criticized for doing things it was actually doing. A suit like this is designed to silence critics and deter others from making similar statements. If a defendant bleeds long enough, an eventual victory is ultimately meaningless. The damage has been done and the threat remains.

Filed Under: anti-slapp, border, defamation, detention centers, prisons, private prisons, separated families, slapp, statute of limitations
Companies: candide, corecivic

Court Says Lawsuit Over CBP Searches Performed 90 Miles From The Border Can Proceed

from the prepare-to-be-discovered,-CBP-officers! dept

An ongoing federal lawsuit is challenging the CBP's decision to turn supposed border control efforts into easy drug busts for local cops.

A New Hampshire man is challenging the checkpoints set up by the CBP nearly 100 miles from any border in New Hampshire. The CBP apparently decided to spend a couple of years camped out on I-93 (from 2017 to 2019), 90 miles away from the nearest border.

The 90 mile marker is significant. Anything within 100 miles of a US border is still considered a "border" (even if it's an international airport located further than 100 miles inland from any natural border). Inside this Constitutional gray area, rights are malleable. In many cases, they're almost nonexistent. But the challenge raised here addresses what the CBP is doing and how it has nothing to do with any border protection or customs efforts.

Jesse Drewniak has sued the CBP, along with an agent and supervisor, for an apparently unlawful search that resulted in a small amount of hash oil being recovered from his car and, more significantly, some criminal charges from local prosecutors.

Drewniak's case cites a New Hampshire court's decision [PDF] that found in favor of another person caught in the CBP's inland dragnet. As cars waited to be cleared by CBP officers, other officers ran dogs around their cars. Alerts resulted in searches. And these searches often resulted in drug cases handed over to local law enforcement.

As the New Hampshire court points out, this violates New Hampshire's constitutional protections. And it has nothing to do with the CBP's stated reasons for setting up a checkpoint 90 miles from the Canadian border. Here's what happened at the inland checkpoint in 2018, which was apparently the CBP's standard M.O. for the two years the checkpoint remained active.

The defendants' vehicles were searched by the CBP at the secondary processing area resulting in discovery of illegal controlled substances. That contraband was then turned over to the WPD, which resulted in these prosecutions. None of these searches or seizures was sanctioned by a warrant. As a result of these searches, forty-four individuals, including the defendants in these cases, were charged with possession of small amounts of controlled substances - mostly marijuana.

But this was not why the checkpoint was set up. The CBP claimed it was to find individuals smuggling in Canadians (??!?!?).

The CBP agents testified that the primary purpose of the searches at the checkpoints was to discover human beings that had entered or remained in the United States illegally.

But that's not what the CBP spent its time doing. And that's not what it told local law enforcement when it first erected its checkpoint. Instead, it collaborated with law enforcement to set it up with easy drug busts and excuses for warrantless searches.

They were aware of the fact that the United States Attorney would not prosecute individuals for small amounts of drugs even before they set up the checkpoints. They then reached out to State law enforcement to ascertain whether they would prosecute the drug charges. From the facts of the instant cases it is patently clear that the primary purpose of WPD being present at the checkpoint in August to accept the illegal drugs confiscated by the CBP searches in order to prosecute the defendants on state drug charges. CPB Officer Labaff testified that the WPD, "was there to take the marijuana that was seized." It also appears that there were times when the WPD actually seized the contraband from the defendant's vehicle. Officer Labaff testified that if a local law enforcement officer was not able to take possession of the confiscated illegal drugs that evidence would have been transported to a federal processing center with no criminal charges filed. In addition to taking possession of the evidence the WPD performed other functions such as traffic control or supervision of the detainees. The Court finds that the State and federal authorities were absolutely working in collaboration with each other. The CBP agent in charge of the checkpoint operations, Paul F. Kuhn, wrote to the Woodstock Chief of Police, Ryan Oleson, "Without you folks we would have been hamstrung."

As the court noted then, this is impermissible. Federal agencies aren't supposed to abuse their constitutional exceptions to discover evidence local law enforcement wouldn't be able to obtain without violating rights. The CBP has almost no restrictions when it comes to searches within the "Constitution-free" zone. However, any similar suspicionless searches by local law enforcement would result in Fourth Amendment violations. For the CBP to run drug dogs around cars (supposedly to search for smuggled individuals) and turn over any "alerts" to local cops is basically laundering rights violations to give locals "clean" searches and seizures. The court says this is the "reverse silver platter" (the opposite of the "silver platter" therory: i.e., someone agreeing to search every computer they repair and turn over anything suspicious to law enforcement so investigators can avoid warrant requirements by abusing the "private search" exception). In this case, the CBP used border search exceptions to discover drug violations that locals then acted on.

The CBP knew this was wrong. The Supreme Court itself said otherwise.

In City of Indianapolis v. Edmund, the United States Supreme Court argued that the primary purpose of a motor vehicle checkpoint cannot be the random detection of criminal activity such as drug detection.

That's why CBP agents talked to local cops first and secured their cooperation. This greased the constitutional violation wheel. And things took off from there.

The New Hampshire court called the CBP out on its bullshit.

The testimony of the CBP officers revealed that there were numerous, "non-productive alerts," by the dogs at the checkpoints which extended the duration of the stops for those individuals but resulted in no evidence of a crime being found. The primary purpose of detecting illegal aliens could have, in most cases, been accomplished by a mere visual inspection of the interior of the vehicle and a brief interrogation of its occupant(s ). If those measures then resulted in a reasonable articulable suspicion of criminal activity then the dog searches would have been warranted. In fact, the testimony of the CBP officers revealed that no "concealed humans" were found.

And any time the CBP claims it's setting up an inland checkpoint to search for smuggled humans (especially near the northern border), everyone should know it's bullshit.

CBP Officer Qualter testified that he has never located a "concealed human" in a motor vehicle in his seventeen years of service.

The court found in favor of the drug defendant, ruling the CBP's use of drug dogs to find violations for the locals to prosecute was illegal under New Hampshire law, if not under the US Constitution itself. That ruling -- handed down last August -- has paid off. The current federal lawsuit moves forward. And the CBP is forbidden from engaging in this unconstitutional bullshit until the federal court has a chance to examine the merits of the case.

Officer Qualter wants the court to forbid discovery in this case, presumably because he's failed to discover a single concealed human no matter how many unlawful checkpoints he's worked at. His argument -- what there is of it -- says his attempt to raise a qualified immunity defense might be harmed if the plaintiff was able to discover further facts about his work with the CBP.

LOL. Maybe so. But the court points out [PDF] lots of precedent saying discovery is allowable in these cases. Qualified immunity might be a shield against accountability but it's not an all-purpose tool that can be wielded to disrupt the normal progress of litigation. While it does offer a quick escape from some lawsuits, it's not something that can be used to escape further examination of facts when warranted. Qualter's motion has been denied, along with his presumption he'd be able to press the QI eject button prior to the plaintiff's request for more (presumably damning) information on Qaulter's CBP work. The order is denied

The CBP can continue to abuse its power to protect the border. But it shouldn't be blowing tax dollars on helping local law enforcement dodge constitutional protections. That's what it appears to have been doing in New Hampshire. And if it's doing it there, it's doing it elsewhere.

Filed Under: 100 miles, 4th amendment, border, cbp, checkpoints

Location Data Obtained By CBP Comes From Phone Apps, Is Capable Of Tracking People On Both Sides Of The Border

from the what-Carpenter-decision? dept

More details are coming out about federal law enforcement's purchases of location data from data brokers. In February, the Wall Street Journal reported ICE and CBP were both purchasing large amounts of data from Venntel, using this information to track down people in this country illegally. Supposedly the data was "anonymized," which the CBP felt was enough to dodge any Constitutional concerns. Of course, the more data you have, the easier it is to de-anonymize it. And if it was truly anonymous and unable to be converted into traceable human beings, there would be no reason for ICE and CBP to be purchasing it.

This led to some Congressional scrutiny. The House Committee on Oversight and Reform opened up an investigation into federal agencies' purchases of location data from Venntel. This investigation didn't stop the CBP from re-upping its contract with the now-controversial broker and continuing to explore the edges of this legal gray area.

A couple of months later, it was revealed the IRS was also buying location data from Venntel, presumably in hopes of tracking down tax cheats. This led to Senators Ron Wyden and Elizabeth Warren asking the IRS's oversight to look into this. The Inspector General has already replied, stating an investigation is underway to determine whether the IRS's warrantless acquisition of this location data complies with the Supreme Court's Carpenter decision, which enacted a warrant requirement for cell site location data.

More documents obtained by Motherboard explain where all this controversial data is coming from. It's not Google or cell providers' towers, but from any phone app that harvests location data for their multiple Big Data overlords.

U.S. Customs and Border Protection (CBP) bought access to "global" location data harvested from ordinary apps installed on peoples' phones, meaning it could track devices even outside of U.S. borders, according to a document obtained by Motherboard.

[...]

"I know I could find signals in non-U.S. territory but they may have been U.S. users/devices," a former worker for Venntel, the company that CBP bought the location data from, told Motherboard.

This explains CBP and ICE's interest in this particular data. Looking for illegal entrants gets a whole lot easier when you can start tracking them from the other side of the border. It's far more useful to these agencies than it is for the IRS, which apparently couldn't find the suspect it was looking for in Venntel's database.

This is also why CBP feels compelled to keep throwing money at a vendor targeted by a Congressional investigation and (indirectly) by IRS oversight. It's too valuable not to have, no matter what the Fourth Amendment implications are.

Filed Under: 4th amendment, border, cbp, data, ice, location data, location info, phone apps

CBP Privacy Impact Assessment Says It Can Pull All Sorts Of Data And Communications From Peoples' Devices At The Border

from the Privacy-Impact:-YES dept

The CBP is going to continue fishing in people's devices, despite federal courts (including the Ninth Circuit Court of Appeals) telling it that suspicionless device searches are unconstitutional. The agency will just have to come up with something approximating suspicion to do it. Its latest Privacy Impact Assessment of its border device search policy gives it plenty of options for continuing its practice of performing deep dives into devices it encounters.

Travelers heading to the US have many reasons to be cautious about their devices when it comes to privacy. A report released Thursday from the Department of Homeland Security provides even more cause for concern about how much data border patrol agents can pull from your phones and computers.

In a Privacy Impact Assessment dated July 30, the DHS detailed its US Border Patrol Digital Forensics program, specifically for its development of tools to collect data from electronic devices.

The number of device searches performed at the border has been increasing exponentially. The DHS has amped up this program in very recent years. In 2015, the CBP searched less than 5,000 devices. In 2018, it searched 33,000.

The Impact Assessment [PDF] leaves the agency with plenty of options for warrantless searches. First of all, being anywhere near a border (in which "near" means "within 100 miles" and "border" means any port of entry, including actual ports and international airports) subjects people and their devices to additional scrutiny without any need to establish reasonable suspicion. As a border control and security agency, the CBP has the power to engage in a number of searches, detainments, and interrogations without worrying too much about Constitutional rights.

Going beyond that, the CBP can also badger people into consent. This is sometimes obtained by telling people they're free to go but their devices aren't. Considering how important some of these are to everyday life, people at checkpoints may agree to a search rather than lose the only thing connecting them to friends, family, legal assistance, job opportunities, bank accounts, employers, etc. The CBP can also search any device it considers "abandoned" without suspicion or probable cause. Finally, if there's no other good reason to do so, the CBP can claim "exigent circumstances" demanded warrantless access. In far too many cases, exigent circumstances just means the government has decided to apologize to a court later rather than ask for permission first.

Here's everything the CBP can pull from a device with or without a warrant:

• Contacts
• Call Logs/Details
• IP Addresses used by the device
• Calendar Events
• GPS Locations used by the device
• Emails; • Social Media Information
• Cell Site Information
• Phone Numbers
• Videos and Pictures
• Account Information (User Names and Aliases)
• Text/chat messages
• Financial Accounts and Transactions
• Location History
• Browser bookmarks
• Notes
• Network Information
• Tasks List

Does this impact privacy? Hell yeah it does! Will the CBP be changing anything about it? Nope. Sorry about that people whose rights we've decided are less important than protecting this nation from incoming visitors and immigrants less likely to be carrying the coronavirus than the proud Americans they'll be encountering once they cross the border. The privacy risk is "mitigated" because [drum roll] the CBP has released this document declaring all the privacy-violating it will be doing:

CBP has provided notice and transparency about its digital forensic program and border search authority by publicly releasing the policy for these searches and publishing this and corresponding PIAs.

Fantastic.

More good news: the DHS and CBP have been unable to show these additional device searches have resulted in additional border security. The program is an unsupervised mess that violates rights without delivering corresponding gains in border protection.

Finally, [CBP's] OFO [Office of Field Operations] has not yet developed performance measures to evaluate the effectiveness of a pilot program, begun in 2007, to conduct advanced searches, including copying electronic data from searched devices to law enforcement databases.

The DHS still isn't checking to see if warrantless device searches are making the nation safer and doesn't plan to in the future. The pot that is never watched troubles no one when it fails to reach a boil.

There are no changes to auditing and accountability as it relates to the new tools.

¯\_(ツ)_/¯

Oh well... carry on, I guess.

Filed Under: 4th amendment, border, cbp, devices, privacy

Bill Introduced To Create A Warrant Requirement For Border Device Searches

from the 4th-amendment-matters dept

With a great deal of luck, we may finally get a bit more respect for Constitutional rights at the border. The Supreme Court may have ruled that searches of cellphones require warrants, but that ruling doesn't apply within 100 miles of any US border (that includes international airports). Warrantless device searches happen regularly and with increasing frequency.

So far, courts have been hesitant to push back against the government's assertions that border security is more important than the rights guaranteed by the Constitution. And if the courts do feel something should be done to protect US citizens and foreign visitors, they feel it should be done by Congress, not by them.

So, it's good to see Congress may actually do something about this. Jack Corrigan of Nextgov has the details:

Sens. Ron Wyden, D-Ore., and Rand Paul, R-Ky., on Wednesday introduced legislation that would increase digital privacy protections for U.S. residents crossing the border and limit the situations in which agents could legally seize their devices. If enacted, the Protecting Data at the Border Act would curb law enforcement’s extensive authority over electronic information at the border.

Rep. Ted Lieu, D-Calif., introduced a companion bill in the House.

The bill [PDF] would institute a warrant requirement for border device searches, which is a really weird sentence to type considering the Supreme Court of the United States of America instituted a warrant requirement for device searches five years ago. But there it is: an attempt to codify a SCOTUS decision so it's respected by US government agencies.

It also prevents border agents from denying entry to anyone refusing to disclose passwords or unlock devices during screening. It also blocks them from detaining anyone for more than four hours in hopes of turning denials into consensual searches.

Unfortunately, there are some loopholes. And one of those is sizable. "Emergency situations" allow border agents to bypass the Constitutional niceties. One of those is an old -- and super-vague -- favorite:

[c]onspiratorial activities threatening the national security interest of the United States

That's the catch-22. The law can't pass without this exception and it's this exception that will be abused the most. But the institution of a warrant requirement will force the government to put a little more effort into its "national security" hand-waving if it hopes to use evidence pulled from devices in court.

Also important is the institution of documentation procedures for consent searches. It won't be enough for officers to claim detainees volunteered passwords or otherwise agreed to have their devices searched. They'll need to have the whole thing documented and the form signed by the detainee. Every device search must be documented as well, whether or not a forensic search was performed.

It's a good bill, national security exception notwithstanding. But it's being lobbed into an unwelcoming political arena. President Trump is still demanding a wall and has declared a national emergency simply because he wants to discourage immigrants from coming to this country. Border security is national security, according to this administration, even when there's little evidence showing immigrants are more likely to commit acts of terrorism, never mind regular crime. This administration and those backing it (and they are many) are more than happy to suspend the Bill of Rights at the border for as long as they're in power. That's the reality of the situation.

While this bill would bring border agencies into alignment with Supreme Court precedent, it's highly unlikely this won't be rejected by the President if it even manages to make it that far.

Filed Under: 4th amendment, border, border search, cbp, device searches, warrants

Fourth Amendment Gets A Small Boost At The Border From Fourth Circuit Appeals Court

from the better-than-maintaining-the-status-quo dept

The Fourth Circuit Appeals Court has handed down a decision [PDF] suggesting the Fourth Amendment might still provide some minimal protection at our nation's borders. Most rights are considered to be waived -- especially those affecting privacy -- thanks to a prevailing national security interest that is seldom challenged by courts. Two years ago, a California federal court looked at the Supreme Court's Riley decision (which instituted a warrant requirement for cellphone searches) and decided that simply didn't apply within 100 miles of US borders.

This precedential decision doesn't cut the government quite as much slack. While it recognizes border security is a national priority, it's not as quick to give federal agencies a free pass on Fourth Amendment exceptions. The underlying facts make it a less-than-ideal challenge, but even so, the court finds enough to work with in the Riley decision to suggest not all border searches should be suspicionless.

Hamza Kolsuz, the appellant, had been caught twice exiting the country with firearms parts in his luggage. Those incidents occurred in 2012 and 2013. The parts were seized both times, with federal agents explaining licensing requirements but choosing not to arrest Kolsuz for violating federal law.

In 2016, the same thing happened again. Agents searched his luggage and found firearms parts. One agent then performed a cursory examination of the phone Kolsuz was carrying. This search the court has zero issues with. It's easily covered by the border search exception.

At a border – or at a border’s “functional equivalent,” like the international airport at which Kolsuz was intercepted – government agents may conduct “routine” searches and seizures of persons and property without a warrant or any individualized suspicion.

Not much Fourth to be had there and the underlying circumstances -- the discovery of more firearms parts being moved out the country without proper export licenses -- gave the agents more reasonable suspicion than they actually needed.

But it wasn't the only search performed on Kolsuz's phone. An offsite forensic search followed the airport search.

At that point, CBP Special Agent Adam Coppolo initiated the second search of Kolsuz’s phone, this one commonly known as a “forensic” search. Coppolo first transported the phone approximately four miles from Dulles to the Homeland Security Investigations office in Sterling, Virginia. There, Computer Forensic Agent Michael Del Vacchio attached the phone to a Cellebrite Physical Analyzer, which extracts data from electronic devices, and conducted an advanced logical file system extraction. The phone remained in airplane mode throughout, so the forensic examination did not reach data stored remotely – or “in the cloud” – and was instead limited to data stored on the phone itself. Even so, the data extraction process lasted for a full month, and yielded an 896- page report that included Kolsuz’s personal contact lists, emails, messenger conversations, photographs, videos, calendar, web browsing history, and call logs, along with a history of Kolsuz’s physical location down to precise GPS coordinates.

This search was challenged, with Kolsuz arguing the phone was no longer being searched under the border exception, but rather as "cident to arrest," subject to the Supreme Court's Riley decision. The court agrees… to a point. It doesn't find that taking the phone offsite for a deeper search affected the "border search" nexus. The search was still related to the transnational crime of weapons smuggling. It's the intrusiveness of the search that troubles the court.

We also agree with the district court that under Riley, the forensic examination of Kolsuz’s phone must be considered a nonroutine border search, requiring some measure of individualized suspicion.

It's not quite a warrant requirement, but it does suggest federal agents should no longer perform highly-intrusive searches without justification. However, the court won't go as far as to institute a warrant requirement.

What precisely that standard should be – whether reasonable suspicion is enough, as the district court concluded, or whether there must be a warrant based on probable cause, as Kolsuz suggests – is a question we need not resolve: Because the agents who conducted the search reasonably relied on precedent holding that no warrant was required, suppression of the report would be inappropriate even if we disagreed.

It's not a hugely helpful decision but it does show this court isn't willing to allow the border search exception to continue to expand, swallowing up the few shreds of Fourth Amendment that remain. Forensic searches must be justified with at least particularized reasonable suspicion, which is more than other courts have been willing to hold.

Filed Under: 4th amendment, 4th circuit, border, border exception, device searches, forensic search, hamza kolsuz, privacy

CBP Warrantless Device Searches Continue To Increase And New DHS Guidance Isn't Going To Bring That Number Down

from the visit-a-country-with-zero-rights-without-even-leaving-the-country! dept

The DHS made two significant announcements late last week, both dealing with the CBP's warrantless searches of electronic devices at the border. The first was a bit of info, showing the exponential increase in device searches in 2016 (jumping from 5,000 in 2015 to 20,000 in 2016) is part of a trend, rather than an anomaly. Searches increased another 59% in 2017, rising to 30,200 total.

The DHS and CBP also released statements justifying the ongoing increase in warrantless searches.

"In this digital age, border searches of electronic devices are essential to enforcing the law at the US border and to protecting the American people," John Wagner, a deputy executive assistant commissioner at Customs and Border Patrol, said in a statement.

[...]

CBP's authority for the border search of electronic devices is and will continue to be exercised judiciously, responsibly, and consistent with the public trust," he added.

These statements are empty and useless. We had just as much of a "digital age" in 2015 and yet searches occurred far less frequently. There seemed to be no less law enforcement happening and no less "secure" as a nation than we are now. In fact, we may have been more secure with fewer searches as we hadn't yet shifted towards a more antagonistic relationship with the rest of the world, starting with our southern bordering neighbor.

It's also difficult to square claims of "judicious, responsible" use of device search authority with the exponential leap in number of devices searched and the DHS's open admission it lacks legal authority for some of the searches its agencies perform.

Accompanying the release of 2017's search numbers, the DHS released updated guidelines on border device searches. The guidelines roughly align with answers delivered by the DHS to Sen. Ron Wyden in response to questions about its warrantless device searches.

The CBP still has carte blanche access to devices of foreigners entering or leaving the country. Its ability to access devices carried by Americans is only slightly more limited. Anything residing on a device can be accessed by CBP officials without a warrant or even reasonable suspicion. From the CBP's search guidelines [PDF]:

Border searches of electronic devices may include searches of the information stored on the device when it is presented for inspection or during its detention by CBP for an inbound or outbound border inspection. The border search will include an examination of only the information that is resident upon the device and accessible through the device's operating system or through other software, tools, or applications. Officers may not intentionally use the device to access information that is solely stored remotely. To avoid retrieving or accessing information stored remotely and not otherwise present on the device, Officers will either request that the traveler disable connectivity to any network by placing the device in airplane mode), or, where warranted by national security, law enforcement, officer safety, or other operational considerations, Officers will themselves disable network connectivity. Officers should also take care to ensure, throughout the course of a border search, that they do not take actions that would make any changes to the contents of the device.

CBP officers can also perform "advanced searches." These involve imaging device contents and possible access of remote storage. Again, the CBP claims it needs no warrant to perform these searches, only reasonable suspicion. The guidance makes no mention of the Supreme Court's Riley decision, likely interpreting the decision to apply only to searches incident to arrest, rather than border inspections of "containers" and their "contents" under multiple court-granted warrant exceptions.

Yes, the CBP still equates phones and laptops to suitcases and personal effects. One of the statutes listed in its defense of warrantless access to electronic device contents refers to the CBP's right to search "persons, baggage, and merchandise" entering or leaving the country.

On top of that, the CBP continues to insist all travelers must unlock or decrypt devices/accounts so contents can be inspected. The CBP says it can use external hardware to crack devices and/or detain locked devices indefinitely if travelers aren't compliant. None of this requires a warrant. Nor does it even require reasonable suspicion. All the CBP needs to justify these seizures and searches is a traveler's refusal to hand over passwords or PINs.

Unbelievably, this new guidance is an improvement. Prior to this, the DHS and CBP weren't even limiting their searches to the low bar of reasonable suspicion. So, while the new guidance is earning limited praise from privacy and rights activists, it's also gathering plenty of criticism. Ron Wyden, who was instrumental in getting the DHS to concede its social media account searches had no legal basis, offered up a golf clap for the DHS's new guidance, along with a warning he would continue seeking a legislative end to the "Constitution-free" zone in which the CBP does all of its intrusive work.

“I’ve said it before and I’ll say it again: Americans’ Constitutional rights shouldn’t disappear at the border. By requiring ‘reasonable suspicion’ before conducting forensic searches of Americans’ devices at the border, Customs and Border Protection is beginning to recognize what the Supreme Court has already clearly stated that ‘digital is different.’ It is my view that Americans will be safer when time and resources are spent on searching people with an actual cause...”

“However, there’s more work to do here. Manually examining an individual’s private photos, messages and browsing history is still extremely invasive, and should require a warrant. I continue to believe Americans are entitled to their full Constitutional rights, no matter where they are in the United States. That’s why Senator Paul and I last year introduced the Protecting Data at the Border Act, which would end the legal Bermuda Triangle at the border and require warrants for law enforcement officials to search Americans’ phones and laptops at the border.”

Filed Under: border, cbp, customs, device searches, dhs

2009 DHS Document Says Border Patrol Can Search/Copy The Contents Of Your Device Just Because It Wants To

from the all-about-that-privacy-you-won't-be-allowed dept

FOIA clearinghouse MuckRock has scored another revealing document, this time from Customs and Border Protection. As we're well aware, the US border isn't technically considered to be part of the United States, at least not as far as the Constitution is concerned. All bets are off, 4th (and others) Amendment-wise. If you're traveling with anything -- whether its a vehicle, suitcase or laptop -- expect it to be searched.

What MuckRock has obtained is the DHS's Privacy Impact Assessment of the CBP's search policies. The only thing seen of this near-mythical document to this point has been a two-page summary of the report's contents, released nearly three years after its border search policy went into effect.The assessment basically says privacy will be severely impacted… and not much else. To do otherwise is to open the borders to terrorists, illegal immigrants, drug runners, child porn traffickers... at least according to the talking points. If you're none of the above, you're not exempt from in-depth warrantless searches of your person and belongings, including laptops and other electronic devices.

Based upon little more than the opinion of a single US Customs and Border Patrol (CBP) officer, any device can be searched and its contents read. With approval from a supervisor, the device can be seized, its contents copied in full, or both.

These opinions, also known as "gut feelings" and "mental coin tosses" (the latter extremely popular with the TSA's Behavioral Detection Officers), are all it takes to initiate a very intrusive search.

Part of this we can blame on the courts and their deference to national security fears.

Under DHS authorities to conduct border searches, travelers' electronic devices are equally subject to search as any other belongings because the information contained in them may be relevant to customs and immigration inspection processes and decisions. While the terms "merchandise" and "baggage" are used, the courts have interpreted border search authorities to extend to all of a traveler's belongings, including electronic devices and the information in such devices.

Beyond the hunches that trigger warrantless searches of electronic devices, the CBP also has the authority to demand travelers translate foreign languages and/or decrypt files.

Demand for Assistance: During a border search, ICE and CBP have specific statutory authority to demand assistance from any person or entity. For searches of electronic devices, CBP or ICE may demand technical assistance, including translation or decryption or specific subject matter expertise that may be necessary to allow CBP or ICE to access or understand the detained information.

In some cases, travelers will be notified that their device has been searched. In others, the CBP and ICE will withhold this information from the person who owns the searched device. This includes cases where the agents image the entire contents of the device in order to perform a search later. In fact, in most cases where this is done, the person is cut out of the informational loop.

Instead of detaining the electronic device, CBP or ICE may instead copy the contents of the electronic device for a more in-depth border search at a later time. For CBP, the decision to copy data contained on an electronic device requires supervisory approval. Copying may take place where CBP or ICE does not want to alert the traveler that he is under investigation; where facilities, lack of training, or other circumstances prevent CBP or ICE from performing the search at secondary inspection; or where the traveler is unwilling or is unable to assist, or it is not prudent to allow the traveler to assist in the search (such as providing a password to log on to a laptop).

And, again, this sort of detainment/search can be triggered by nothing more than an agent's feelings about the person being vetted. And while a CBP officer may have to check with a supervisor before imaging a device, ICE agents are able to self-approve intrusive searches and seizures.

As federal criminal investigators, ICE Special Agents are empowered to make investigative decisions based on the particular facts and circumstances of each case. The decision to detain or seize electronic devices or detain, seize, or copy information therefrom is a typical decision a Special Agent makes as part of his or her basic law enforcement duties. However, although no additional permission is required at this stage, Special Agents must comply with precise timeframes and supervisory approvals at further stages throughout each border search.

While there are oversight guidelines in force, they aren't set in motion until after the copying/searching has already been performed.

As the PIA notes later, the DHS's agencies don't care whether it's papers in a briefcase or the entirety of your digital life housed within a smartphone. Either way, it claims to have the right to search, seize and copy data without probable cause. Or so it did until recently.

The 9th Circuit Court's 2013 decision on border searches of electronic devices undercuts a lot of the assertions in this 2009 DHS document. Most importantly, the decision forces the government to stop pretending the contents of a laptop or cellphone are no different than the contents of a briefcase or suitcase. (h/t to Daniel Nazer for pointing out this superseding decision)

The amount of private information carried by international travelers was traditionally circumscribed by the size of the traveler’s luggage or automobile. That is no longer the case. Electronic devices are capable of storing warehouses full of information. The average 400-gigabyte laptop hard drive can store over 200 million pages—the equivalent of five floors of a typical academic library.... Even a car full of packed suitcases with sensitive documents cannot hold a candle to the sheer, and ever-increasing, capacity of digital storage.

The nature of the contents of electronic devices differs from that of luggage as well. Laptop computers, iPads and the like are simultaneously offices and personal diaries. They contain the most intimate details of our lives: financial records, confidential business documents, medical records and private emails. This type of material implicates the Fourth Amendment’s specific guarantee of the people’s right to be secure in their “papers.”.... The express listing of papers “reflects the Founders’ deep concern with safeguarding the privacy of thoughts and ideas—what we might call freedom of conscience—from invasion by the government.”... These records are expected to be kept private and this expectation is “one that society is prepared to recognize as ‘reasonable.’”

This decision partially restores the Fourth Amendment to the Constitution-free Zone -- at least the portion covered by the Ninth Circuit. The decision doesn't forbid these searches. It just holds them -- and the CBP/ICE -- to a higher standard than agents' hunches.

So, in all the principles (transparency, minimization, information safeguards) listed in the DHS's 2009 Privacy Impact Assessment of warrantless border searches, there's not a single one devoted to warrants, warrant requirements or establishing reasonable suspicion. It took a court to reach that obvious conclusion and it took a court's explanation as to why a laptop isn't a briefcase to force the CBP to stop behaving like a law unto itself in the Ninth's jurisdiction. A privacy impact assessment that doesn't mention Fourth Amendment implications is a waste of 50 sheets of paper.

Filed Under: 4th amendment, border, dhs, download, laptops, privacy, search

Canadian Border Patrol Charge Traveler With 'Obstruction' For Refusing To Give Up His Phone Password

from the don't-travel-to-canada dept

I've traveled to many different countries in my life and the only time I've ever had any trouble at all at a border crossing was flying into Canada for a conference one time. I was pulled out of the line and sent to a special side room where I was quizzed about the real reasons I was coming to Canada. They couldn't believe I was speaking at a conference, because I didn't have a paper invite, and had to dig through my emails to show them it in email (thankfully, I stored my emails locally and didn't need internet access). When I tell that story it shocks some people, as Canada has always had a reputation as a fairly easy border to cross -- especially for Americans.

But apparently the Canadians are stepping up their crazy antagonism at the border. The latest story involve Alain Philippon, a Canadian citizen who was returning from a trip to the Dominican Republic. Upon landing in Halifax he was ordered to cough up the password to his smartphone, and upon refusing, was charged with obstructing border officials:

A Quebec man charged with obstructing border officials by refusing to give up his smartphone password says he will fight the charge.

[....]

Philippon had arrived in Halifax on a flight from Puerto Plata in the Dominican Republic. He's been charged under section 153.1 (b) of the Customs Act for hindering or preventing border officers from performing their role under the act.

According to the CBSA, the minimum fine for the offence is $1,000, with a maximum fine of $25,000 and the possibility of a year in jail.

In the US, there have been a number of cases concerning searches of computers and electronic devices at the border, with an unfortunately large number saying that you really don't have privacy rights at the border. Of course, it's not universal, as at least one important court has ruled otherwise. Up in Canada, however, there apparently hasn't been much caselaw on this issue, so assuming Philippon fights this, it could make for a very interesting case.

Filed Under: alain philippon, border, border search, canada, encryption, mobile phone, passwords, privacy