While driving to work, you're stopped at a checkpoint. Customs and Border Protection (CBP) agents use drug-sniffing dogs to search your car. Your phone and laptop are confiscated, and agents demand your passwords. No warrant has been issued for this search, and probable cause is not required. Your fourth amendment rights do not apply. This is legal.

In 1953, the Department of Justice amended §287.1 of Title 8 of the Code of Federal Regulations, authorizing border patrol agents to search and interrogate, without warrant, any person within a 100-mile radius of United States borders. Originally designed to identify and detain persons suspected of being in the U.S. illegally, the scope of Title 8 continues to widen. Last year, CBP set up a checkpoint on I-93 in Woodstock, NH - approximately 75 miles from the Canadian border, to arrest citizens for drug possession. ACLU lawyer Buzz Scherr commented on the search.

"You know, what's so interesting in this case is the Chief of Police of Woodstock [Ryan Oleson] who was there afterwards said to the press, 'This was great - we got to go around the constitution because we had the feds do it - we wouldn't be able to do this by ourselves. But having that border patrol there allowed us to do it.' That was his statement to the press."

A Growing Threat To Civil Liberties

In Woodstock, police relied on a technique known as parallel construction in which law enforcement builds a second criminal investigation to conceal how the original investigation began. Although illegally obtained evidence (wiretaps, phone records, informant tips) may be thrown out in court, a second investigation may produce enough legal evidence to charge the suspect.

This week, the CBP issued Directive 3340-049A, Border Search Of Electronic Devices with instructions for border patrol agents to seize, search, and detain computers, tablets, phones, "and any other communication, electronic, or digital devices". The document reads like swiss cheese - a series of policy loopholes and vague language which gives the CBP broad, unchecked authority.

Under §5.2, information identified as protected by attorney-client privilege must be reviewed in coordination with the Associate/Assistant Chief Counsel Office, and business or commercial information is to be protected from unauthorized disclosure, but information "carried by journalists" receives neither protection.

§5.1.4 states that "advanced searches" - in which external equipment is used to download and store information from a device - must receive supervisory approval, "at the Grade 14 level or higher (or a manager with comparable responsibilities)." §5.1.5 then eliminates that requirement,

"In circumstances where operational considerations prevent a supervisor from remaining present for the entire advanced search, or where supervisory presence is not practicable, the examining Officer shall, as soon as possible, notify the appropriate supervisor about the search and any results thereof."

§5.4.1.1 and §5.4.1.2 define strict time limits for detention and destruction of seized information, yet §5.5.1.3 contradicts such data protections, noting,

"Nothing in this Directive limits the authority of CBP to share copies of information contained in electronic devices (or portions thereof), which are retained in accordance with this Directive, with federal, state, local, and foreign law enforcement agencies to the extent consistent with applicable law and policy."

Protecting Your Data

In 2017, CBP agents searched 30,200 devices, including those belonging to American citizens, a 60% increase from the previous year. When traveling abroad, citizens should avoid taking their phones and laptops with them. Instead, travelers should use burner phones and secondary laptops which can be easily wiped before handing them over.

"§5.3.1 If presented with an electronic device containing information that is protected by a passcode or encryption or other security mechanism, an Officer may request the individual's assistance in presenting the electronic device and the information contained therein in a condition that allows inspection of the device and its contents. Passcodes or other means of access may be requested and retained as needed ..."

CBP cannot force citizens to hand over passwords, but they can detain you and your devices for a limited time. Be prepared to stand your ground only if you understand the consequences of defying a federal agency, and treat any device which has left your supervision as potentially compromised.

CT, DE, FL, HI, ME, MA, NH, NJ, NY, RI, VT

It is estimated that two thirds of Americans live inside Title 8's constitution-free zone, which includes New York City, Los Angeles, Chicago, Houston, Philadelphia, Phoenix, San Antonio, San Diego, and San Jose. Eleven states are completely inside the zone.

According to the ACLU, CBP has established over 170 checkpoints inside the country. And while checkpoints are not supposed to be used for warrantless searches, they often are. Motorists who encounter these agents have the same choices faced by international travelers: keep dummy devices on you at all times or use encryption, stand your ground, and face detention.

Editorial Disclosure: Nefarious Laboratories has developed a comprehensive Digital Security & Training service for journalists, activists, and political campaigns.

Published January 10, 2018

We depend on the support of readers like you to fund research initiatives and product development.