DHS, CBP Admit They Have No Legal Authority To Access Americans' Social Media Accounts

from the CBP-reminded-of-this-2-months-after-Wyden's-letter dept

Since at least 2009, the DHS has asserted a legal right to copy/search the contents of anyone's electronic devices at the border. Its privacy assessment said no one has much privacy, at least not near US borders. Building on years of judicial national security deference, the DHS has recently expanded its searches of electronic devices, eliminating most of its adherence to the Fourth Amendment in the process. If your devices wander into the country's Constitution-free zones, you can expect to suffer diminished expectations of privacy.

Noting that border searches of electronic devices were increasing exponentially (more searches in February 2017 alone than in all of 2015), Senator Ron Wyden did two things: introduced a bill creating a warrant requirement for border electronic device searches and asked the CBP (Customs and Border Protection) about its new demands for social media/email account passwords.

The DHS has responded [PDF] to Wyden's questions, and the answers are a bit surprising.

U.S. border officers aren't allowed to look at any data stored only in the "cloud" — including social media data — when they search U.S. travelers' phones, Customs and Border Protection acknowledged in a letter obtained Wednesday by NBC News.

The letter (PDF), sent in response to inquiries by Sen. Ron Wyden, D-Ore., and verified by Wyden's office, not only states that CBP doesn't search data stored only with remote cloud services, but also — apparently for the first time — declares that it doesn't have that authority in the first place.

This admission about a lack of legal authority contradicts the assertions made in its 2009 Privacy Impact Assessment, which placed CBP agent hunches above anything resembling reasonable suspicion or probable cause. But the answer aren't quite as clear-cut as it might appear from the NBC New summation.

With or without legal authority, the CBP is still performing searches of thousands of devices. Returning US citizens aren't exempted from these searches. They are often free to go, even if their devices might need to be left behind so the CBP can search/copy the device's contents. This may be done without reasonable suspicion because, as the letter puts it, any device might hold evidence of criminal activity (terrorism, smuggling, and child porn are specifically named).

What the CBP cannot do -- at least according to this letter -- is retrieve information and data not stored on the phone itself. But this would only prevent CBP officers from accessing cloud-based storage. Much of the information contained in email and social media accounts is not stored locally, but there's no practical way to separate local/cloud data when officers have access to the entire device. The letter appears to indicate officers need to restrict their searches to SMS messages, call logs, and photos/videos stored on the device.

How this operates in practice is another matter. The letter states CBP cannot demand passwords/pins from American travelers, but points out this may result in their electronics being detained indefinitely even as the citizens themselves are free to go. It says CBP officers have been instructed to stay away from social media/email accounts, but the April 2017 "reminder" appears to be the direct result of Wyden's probing questions, which were sent to the DHS at the end of February. What CBP was doing before the senator started asking questions is anyone's guess, but anecdotal evidence suggests CBP is treating US citizens as badly as it does foreign visitors.

What isn't in the letter is a direct response to Wyden's question about the number of US citizens subjected to these intrusive searches. The DHS claims not to have this information on hand but has promised to turn over some data later this year.

In the meantime, American citizens are receiving only slightly better treatment than arriving foreigners. Assertion of rights are the border will often be taken as unprompted admission of guilt. While the CBP may not have a legal basis to demand access to social media accounts, it does appear its demands for access to people's phones isn't stifled by many legal hurdles. Considering most phones/laptops contain social media account info, it's up to Americans to believe the CBP isn't accessing data it's been told to stay away from.

Filed Under: 4th amendment, cbp, cloud, device searches, dhs, laptop searches, local storage, privacy

DHS Reveals Some Data On Border Laptop Searches

from the was-that-so-tough? dept

The Department of Homeland Security has pushed hard for the past few years to make sure it retains the right to search your laptop at the border with no real limitations. It is, indeed, (as defenders of this policy always like to point out) established law that the border is not in the country, so Constitutional 4th Amendment rights do not apply. That still doesn't make it right. I, like many others, would not have a problem with searches due to probable cause. Nor do we have any real problem with searches of physical luggage at the border. But a blank slate, seems like a bit much -- for a few reasons. First, the purpose of a border search is to see what you're bringing into the country. But, when it comes to digital data, no one's bringing it across the border to get it into the country. You could just send it over any number of internet protocols to get it into the country without using a laptop. So, the very rationale doesn't make sense. Second, when people travel, they specifically pick and choose what physical goods to put into their luggage. With a computer, the situation is the opposite. You automatically bring everything (including, potentially access to remote drives).

Still, DHS has insisted it wants to keep this right, even as some politicians have looked to protect against laptop searches at the border. Earlier this year, DHS put out slightly clearer rules, but which still allowed for no probable cause in doing a search.

One big question hanging over all of this, however, was how often such searches took place. Thomas O'Toole alerts us to a new DHS report that finally reveals the numbers -- and, it's at least marginally good news: these sorts of searches happen very rarely. That's a good thing and suggests that the policy isn't widely abused:

Of the more than 144 million travelers that arrived at U.S. ports of entry between Oct. 1, 2008 and May 5, 2009, searches of electronic media were conducted on 1,947 of them, the DHS said.

Of this number, 696 searches were performed on laptop computers, the DHS said. Even here, not all of the laptops received an "in-depth" search of the device, the report states. A search sometimes may have been as simple as turning on a device to ensure that it was what it purported to be. U.S. Customs and Border Protection agents conducted "in-depth" searches on 40 laptops, but the report did not describe what an in-depth search entailed.

I'm certainly happy to see that such a policy is used so rarely, but I still question why it should be used at all.

Filed Under: border patrol, homeland security, laptop searches

DHS: Laptop Border Searches Are Bad... Except When We Do It

from the that-may-change-soon dept

The Department of Homeland Security has been actively (though with really weak arguments) defending its policy of searching laptops at the border, even without probable cause. Yet, at the very same time that it was staunchly defending the policy and refusing to testify in front of Congress over it, it was also issuing a report warning international travelers not to take laptops, since foreign governments often search them. You see, when foreign governments do it, it's evil espionage. But when we do it, it's for our own security:

"Foreign governments routinely target the computers and other electronic devices and media carried by U.S. corporate and government personnel traveling abroad to gather economic, military, and political information."

Either way, it looks like DHS's own freedom to search laptops without probable cause may soon get curtailed. The Senate has been making noise for a while about introducing a bill to reign in the laptop searches, and Rep. Loretta Sanchez introduced some legislation in the House last week that would establish clear rules, compared to the anything goes policy currently in existence. Kind of sad that we need special legislation to make it clear that the 4th Amendment should apply at the border, but such is life these days.

Filed Under: 4th amendment, border, laptop searches, privacy, probable cause

EFF Asks Congress To Look Into Border Searches Of Laptops

from the some-rules-would-be-nice dept

Last month yet another court ruled that border patrol guards could search the data on mobile phones and laptops without any probable cause. This was troubling for a variety of reasons, since it basically gives them access to all sorts of things that one would have a normal expectation of privacy over. It's quite different than, say, a stack of papers you have brought with you while traveling overseas. In those cases, you made the proactive decision to take those files with you. Yet, since your computer stores everything, you're exposing much more, and doing it without making the proactive decision to bring those files with you. It's also not clear how this applies to network drives. For example, I store some files on a network drive that appears as just another drive off of my laptop, even though it's not in the laptop itself. Can a customs agent start searching that drive as well? This raises some serious concerns, and the EFF is now demanding some Congressional oversight concerning how these laptop and mobile device searches take place, even suggesting that laws be put in place to prevent the abuse of power by customs agents.

Filed Under: border, customs, eff, laptop searches
Companies: eff