In view of the recent court decision regarding the Fourth Amendment and the US border, many wonder what practical steps they can take to protect their data.

Background

Judge Nina Morrison, of the Eastern District of New York, ruled that Customs and Border Patrol needs probable cause and a valid warrant to seize and search travelers’ cell phones.

The ruling—at least in the Eastern District of New York—is a major blow to federal agents, who have long maintained that the Fourth Amendment does not apply at the border. As a result, it has become increasingly common for individuals to be forced to hand over their device and passcode, giving agents the ability to peruse their private information. In many cases, agents have made full copies of the contents of a person’s phone before returning it.

Judge Morrison’s ruling joins a number of similar decisions, helping set a legal precedent that may one day provide nationwide protection for travelers and their private data.

Why It Matters

Unfortunately, a number of the cases that have tackled the issue of data privacy at the border have involved individuals engaging in despicable behavior. For example, the plaintiff in the case before Judge Morrison was accused of possessing child sexual abuse material.

Criminal behavior is far from the only reason for protecting one’s data at the border, however. In fact, there are many legitimate reasons why perfectly law-abiding citizens should be concerned. Below are just a few examples.

Journalists

As Judge Morrison noted in her ruling, journalists have increasingly been targeted by CBP agents intent on searching their devices. This has especially been true among journalists who write about privacy and other politically sensitive topics. As Judge Morrison described, this action appears to be a coordinated effort to surveil journalists.

After formal complaints were filed regarding a series of such incidents in 2019, it was revealed that they may not have been the isolated acts of individual border agents who suspected that a particular traveler’s device contained contraband but instead part of a targeted effort to surveil journalists in particular: a non-public CBP database that contained the names of journalists covering migration issues and which pushed “alerts” to flag those journalists for secondary screening when they returned from international travel.

Judge Morrison goes on to say that this kind of surveillance, whether coordinated or not, severely undermines the ability of journalists to do their job.

And even without the specter of a larger, insidious effort targeting journalists at the border, there remains a considerable and undue risk that — without the safeguards of a judicial warrant — journalists’ sources in and outside the United States will be fearful of relaying information about matters of public concern to them.

Medical and Science Professionals

Medicals professionals are bound by law to protect their patients’ privacy. What happens, however, when agents seize a doctor’s devices, devices which may contain sensitive information?

Similarly, what about a scientist en route to a conference with sensitive research in their possession?

Entrepreneurs and Executives

Entrepreneurs and corporate executives often have access to sensitive information and corporate, and it’s not uncommon for them to bring projects with them so they can continuing working while traveling.

Unfortunately, under CBP’s interpretation of the law, such individuals could see their life’s work literally ripped from their hands and copied by other individuals. While that doesn’t mean the US government is going to steal their intellectual property, government agencies are no more immune to outside hackers or internal corruption than any other organization.

In short, once an individual loses control of their information, all bets are off on what may happen to it.

Religious Leaders

Religious leaders are another demographic that often are privy to private information, with a moral and ethical responsibility to protect the privacy of individuals who have confided in them. If a religious leader’s devices are confiscated, unlocked, and copied, is there any guarantee that sensitive information contained on those devices will remain private?

Other Considerations

As the above examples show, there are any number of situations—far more than what has been covered here—in which violating travelers’ privacy can have profoundly negative implications. And none of the above examples address the emotional toll of having one’s private data accessed by complete strangers, something Judge Morrison made special note of.

A person’s search history can reveal the questions that keep him up at night, including questions he might be too ashamed to ask his spouse or doctor. Data on a person’s cell phone may reflect information about her that is so private, she would not disclose it to her therapist or closest friend. It is not just that cell phones often contain intimate information available in microscopic detail — the number of steps the phone’s user took that day and where she took them, the results of recent blood work in the application where her doctor uploads all her medical records, or the calendar reminder for a meeting with her local Alcoholics Anonymous chapter or prayer group. It i s that the details, taken together, can provide a kaleidoscopic view of the user’s whole life.

In view of what’s at stake, what can travelers do?

Practical Steps to Protect Your Data

The first thing travelers must do is realize they must be proactive in protecting their data, especially in jurisdictions that are not covered by favorable decisions, like Judge Morrison’s. Unfortunately, this may at times result in a fair amount of inconvenience, but not nearly as much as losing control of one’s private data and having to deal with the fallout.

Below are a few steps travelers should consider taking.

Limit the Number of Devices

One of the biggest precautions travelers can take is limiting the number of devices they bring when traveling. A single smartphone is much easier to protect than a smartphone, tablet, and computer. The more devices that are in play, the more attack vectors agents have to compromise an individual’s privacy.

Disable Biometrics In Favor of Passwords/Passcodes

While fingerprints and facial recognition are convenient ways to unlock a device, they also represent a legal gray area.

A number of courts have ruled that law enforcement cannot force a person to hand over their password or passcode. Some of those courts, however, have ruled that biometric security measures do not have the same legal protection, meaning there is more of a legal basis for agents to force a user to provide a fingerprint or facial recognition unlock.

As a result, it’s better to simply disable biometrics and rely on good old-fashioned passcodes when traveling.

Log Out of Cloud Accounts

Most modern devices should be viewed as a doorway to an individual’s life, rather than the destination itself. In other words, with the rise of cloud computing, most users don’t just keep everything on a single device. Instead, that device is often connected to any number of cloud services that contain infinitely more data than resides on the device alone.

In fact, this concern was specifically mentioned by the Ninth Circuit Court in one of its rulings (via the Electronic Frontier Foundation).

With the ubiquity of cloud computing, the government’s reach into private data becomes even more problematic. In the “cloud,” a user’s data, including the same kind of highly sensitive data one would have in “papers” at home, is held on remote servers rather than on the device itself. The digital device is a conduit to retrieving information from the cloud, akin to the key to a safe deposit box. Notably, although the virtual “safe deposit box” does not itself cross the border, it may appear as a seamless part of the digital device when presented at the border.

Because of this, it’s important to log out of any cloud services before traveling, that way agents cannot gain access to the data stored on those accounts, even if they gain access to the device’s contents.

Importantly, this also means making sure that passwords to online accounts are properly cleared before traveling. Otherwise, agents could still gain access.

Use Full Disk Encryption

Every major operating system—Linux, macOS, Windows, Android, and iOS—provide the option for full disk encryption (FDE), with some enabling it by default. This is different than encrypting specific folders, such as a user’s home directory, and is far stronger.

Power Off Devices Rather Than Suspend

Travelers should make sure that devices are powered off when crossing a border, rather than merely suspending them. This is especially true of computers, but applies to mobile devices as well.

While computers, phones, and tablets have login screens designed to protect data when a device is suspended, or the screen is locked, these measures are not foolproof. There are a number of ways that lock screens can sometimes be bypassed.

As a result, for the best protection, it’s a good idea to completely power devices off.

Use Secure Boot On Windows and Linux Computers

Travelers should make sure Secure Boot is enabled on computers. Secure Boot is designed to protect the boot process and ensure that no outside software is introduced in an effort to gain access.

In many cases, Secure Boot is enabled by default, but one should check their UEFI settings to be sure.

Use Panic Mode, Lockdown Mode, or Duress Code

Most mobile devices have some form of feature designed to shut down the most vulnerable forms of attack. This is useful for those situations when a traveler must keep their phone while traveling.

For example, iOS has Panic Mode that disables facial recognition and fingerprint scanning, requiring the user enter a passcode. When the feature is activated, via Settings > Emergency SOS, a user can tap the power button five times to activate it.

Android has a similar feature called Lockdown. A user can simply hold the power button down and choose Lockdown from the on-screen popup.

GrapheneOS—a security hardened version of Android used by Edward Snowden, yours truly, and many other journalists—takes things a step further with a duress code. In other words, a user can set a duress code in GrapheneOS that can be given to someone instead of the phone’s real passcode. When the duress code is entered, the phone immediately and securely wipes all data from itself.

Legal Steps to Protect Private Data

While the above steps are practical measures travelers can take, there are legal factors to consider, as highlighted by the Electronic Frontier Foundation (EFF).

As the EFF highlights, even in areas not covered by the recent favorable court rulings, the border is not completely a legal Wild West.

However, the U.S. border is not a Constitution-free zone. The powers of border agents are tempered by our Fourth Amendment right to digital privacy, our First Amendment rights to speak and associate privately and to gather the news, our Fifth Amendment right to freedom from self-incrimination, and our Fourteenth Amendment right to freedom from discrimination.

The EFF goes on to point out that travelers must be aware of the distinction between routine searches and non-routine ones. For example, it is completely normal and routine for agents to search one’s bags or belongs, either via a metal detector or manually.

In contrast, the EFF maintains that searching, let alone copying, the contents of one’s digital devices constitutes a non-routine search, a position that at least some court decisions have supported.

In view of these issues, what should a person do?

Do Not Be Quick to Waive Constitutional Rights

The EFF makes the case that travelers—especially US citizens—should not be quick to waive their constitutional protections.

The constitutional protections described above can be waived. For example, the Fourth Amendment allows law enforcement officials to search people or their property if those people voluntarily consent to the search.

That said, whether consent is truly “voluntary” depends on the totality of the circumstances, such as the nature of the questioning and the youth of the person being questioned.66 There is a strong argument that a traveler’s compliance when border agents demand the unlocking of a device, the device password, or social media information, should never be treated as voluntary consent. Border screening is an inherently coercive environment, where agents exercise extraordinary powers, and travelers are often confused, tired after international travel, and/or rushing to make a connecting flight.

However, courts may rule otherwise. It is possible that if you unlock your device, and agents then search your device, a court will rule that you consented to the search. It will depend upon the totality of the unique circumstances surrounding your particular border crossing.

…the best way to avoid an inadvertent “consent” to search is to decline to unlock your device, provide the device password, or provide any social media information.

The EFF’s report is well worth a read, and goes into detail on the various factors that come into play when the individual is a foreign visitor or a permanent resident.

Conclusion

Until legislation or a Supreme Court ruling provides clear guidelines and protections that apply nationwide, the border will continue to be a gray area that affords more protections in some regions than in others.

To be forewarned is to be forearmed, and nowhere is that more true than when it comes to protecting one’s private data.

Following the steps in this article, as well as the excellent EFF report, can help travelers be as well-equipped as possible to protect their data at the border.

EFF Full Report.