Travelers worrying about having their smartphones or other electronic devices searched at the border can breathe a small sigh of relief: Customs agents may be more limited than previously thought in their ability to browse the contents of your phone.
Border officials can only look through the portions of your phone in which data has been kept locally on the device’s physical storage, according to a letter from Customs and Border Protection to a top U.S. senator, Ron Wyden (D-Ore.). The letter was first reported by NBC News.
Under the policy, while a border search can legally include any downloaded text messages, contacts or notes on a device, it puts off-limits any search that would require a border official to request data from a remote server — that is, social media accounts, online storage services or other “cloud-based” applications.
The letter from CBP Acting Commissioner Kevin McAleenan is dated June 20. Wyden’s office received it on June 24, and released it in advance of a nomination hearing for McAleenan that was supposed to take place Thursday but was later postponed.
“In conducting a border search, CBP does not access information found only on remote servers through an electronic device … regardless of whether those servers are located abroad or domestically,” McAleenan wrote in response to a series of questions Wyden sent in February. “Instead, border searches of electronic devices apply to information that is physically resident on the device during a CBP inspection.”
CBP’s inspection practices have been the subject of mounting scrutiny this spring over reports that some travelers, including U.S. citizens, have been asked to hand over their devices or unlock them for border agents. Officials have also shown increased interest in travelers’ social media accounts, with U.S. Homeland Security Secretary John Kelly telling lawmakers in February that foreign travelers should be prepared to surrender their social media passwords. That proposal is still pending, analysts say.
The reports have contributed to widespread uncertainty over what searches are and aren’t beyond the pale, with groups such as the American Civil Liberties Union saying they have received “a lot of questions” over the issue. Different rules for citizens and non-citizens have also complicated matters.
In general, years of case law have allowed the border area to become a place where even the typical constitutional protections for U.S. citizens are weaker. For example, authorities do not require a warrant to search goods or materials entering the country. Citizens may legally refuse to unlock their smartphones for border officials, McAleenan reiterated in his letter to Wyden, and the officials cannot deny entry to U.S. citizens. But their electronic devices can legally be detained.
In April, CBP issued an internal memo highlighting that cloud-based data was off-limits to border searches, according to McAleenan’s letter. The agency’s memo, he said, “remind[ed] its officers of this precise aspect of CBP’s border search policy.”
Privacy advocates welcomed McAleenan’s clarification, but warned that unlike law, the CBP policy can easily be changed to become more intrusive.
“Furthermore, this policy is at odds with recent broad expansions of CBP collection of social media information, which can enable the agency to access, store, and analyze a significant amount of data on travelers and their connections, revealing highly personal information,” said Drew Mitnick, policy counsel at the digital rights organization Access Now. “Moreover, if CBP officers are not permitted to seek data stored in the cloud, it makes the case even weaker for them to seek travelers’ passwords, as Secretary Kelly has proposed.”
Wyden, along with Sen. Rand Paul (R-Ky.), have been leading lawmakers opposing what they view as an overly expansive search power by the government at the border. The pair have introduced a bill that could make it a crime to conduct an electronic border search without probable cause.
“I appreciate Mr. McAleenan provided substantive responses to my questions, particularly when it comes to limits on searching data stored in the cloud,” Wyden said in a statement Friday. But, he added, CBP should take additional steps, such as not conducting searches unless officials have “reasonable suspicion” about a person or item.