BG - Your Electronic Device, Please: Understanding the Border Search Exception & Electronic Devices

so my talk today is about your electronic devices at the border kind of what's going on with the border search exception today is August fourth I don't know about any of you but I cannot believe summer is almost all over so a little bit about me oh no I went to the next of course keynote crashed on me so we're we opening Oh bomb I don't know what happened no I have this jinx guys that every time I present something goes wrong so that okay I have my one thing so hi guys it's August fourth so a little bit about me this is me at the lego robotics camp I think this is the first time I ever coded anything but

interestingly enough i went on a path to become a lawyer but after that I decided hey I'm going to go do some computer science so I'm at the University of Illinois in urbana-champaign getting my masters in computer science with focus and computer security in digital forensics I do all sorts of things around privacy etc etc but because I'm a lawyer I have to put this obligatory disclaimer to make sure you understand that i am not your lawyer that this presentation is not legal advice although i wish i could give all of you some interesting tidbits personalized to you unfortunately that would not be a good idea so not your lawyer not legal advice so i really like this photo I

think it's from the onion but no matter how you choose to re-enter exit the United States you will have to cross the border and that means that the border is kind of a heavily traveled piece of the United States so roughly 10 million out of four hundred and forty eight million people were inspected in 2002 so these are old numbers ten years old and were subjected to a more invasive secondary inspection so it's not just crossing the border but being pulled aside for a secondary inspection and then some more numbers here we have between October first 2008 and June second 2010 about 6,500 people had their electronic devices search when crossing the United States border so

this isn't you know 2008-2010 i can imagine now that people have more and more devices your company well I'm sure all your companies have been up to par for a while but as other companies have started issuing more and more electronic devices for their employees more people are carrying electronic devices and the search numbers have likely increased so what should you know when entering the United States well first of all the border the customs border search patrol considers 100 miles within the border the border of the United States and this also includes international airports and what this is this lovely pictures from the ACLU and one of the things I wanted to do to modify it is like find every

major international airport and then draw a hundred miles because I'm pretty sure that would be the entire United States but if you weren't aware the border also includes international airports so what is the border search exception well first of all officials rely on it to search review copy detained cell phones computers other electronic devices that means cameras etc without a warrant without suspicion and I'm sure you're all thinking well what about the Fourth Amendment and the interesting thing so before I go into you know what is the border search exception will do a little review about the Fourth Amendment the Fourth Amendment says the right of the people to be secure in their persons houses

papers and effects against unreasonable searches and seizures shall not be violated and no warrants shall issue but upon probable cause that means a neutral party must establish that there's some sort of probable cause to issue a warrant for an individual to be searched so that's the general rule that you have protection over your devices when you're within the United States what is probable cause and that's where you there there's a belief that a crime has been or is being committed and that the items that they're going to search or seas are connected to the crime so you know I have a law professor would probably get angry that I use these numbers there are no set numbers

for suspicion generally probable cause I would aim it at around forty five percent I think it's easier to so that means you don't even have to be fifty percent sure that something is there forty-five percent sure is fine worth noting is reasonable suspicion which if you're not familiar with will come up again and as you can see is the lower level of suspicion suspicion needed to get a warrant so I really like this cartoon anywhere else United States and it says be prepared for full body scans pat-downs etc so the border search exception is one of many exceptions generally there's not a search if informants wear a wire private actors decide to turn over information to the

government undercover officers phone companies internet or other companies you may have heard about this in the news as being a thing relied upon by the government to gather lots of information consent is also another where the the government doesn't believe it's a search or it's not does not constitute a search and then we have plain view and border search that fall under this also under these no warrant needed is the search incident to arrest which I'll briefly touch upon there's a question we can go freeform let's go they're not searches they're considered not searches by the courts and so plain view and border search it's kind of unfair for me to put this all on one slide because they

really are not a search and then exceptions to the search requirement but I thought it would give you any idea of kind of where the government can't read without award border search border searches are an exception to the Fourth Amendment so interestingly the border search exception has been around for a really long time Congress passed the act in July thirty-first 1789 not long after they passed the Fourth Amendment interestingly there was discussions about the border search as an exception prior to the Fourth Amendment even being past meaning they intended to this to be part of the Constitution and depending on how you interpret the Constitution many would argue this is the intention of the original founders and therefore

we should abide by it there are lots of good reasons for the border search but in particular electronic devices are causing some interesting issues to arise so there's a government interest generally in protecting the United States protecting what comes into its border is being able to do random searches which is codified in the statute here which basically gives the border agents the actual authority to go through your stuff and search you when you reach the border so the border search exception or the birders search doctrine has been expanded generally although it was a limited exception the court expanded the doctrine in 1977 in United States v Ramsey the court ruled that border searches have been

considered reasonable even before the adoption of the Fourth Amendment and there's never really been any additional requirement that the reasonableness of a border search depend on the existence of probable cause and since 1977 the border search doctrine remains pretty much undeveloped so if they find that a search is considered routine it's basically no form of suspicion is needed at the at the border to do the search so what's routine now courts rarely find that the border search early find that the border search is not routine meaning most of the searches that are happening at the border a court is going to agrees or routine but are there any limits on this seemingly very broad doctrine good news strip and

cavity searches are you need reasonable suspicion so if we go back to that chart I had a I don't know if 20 slides ago five slides ago basically that's thirty five percent or thirty percent probable cause which is needed for a warrant is about forty five percent so just for a non routine stripper cavity search you need the lowest form of suspicion to actually conduct that search which is kind of shocking but at least it is limit on this broad search yes um no yes yeah it's not like the government can go in and say hey we're going to every fifth person is now subject to a cavity search therefore it's routine privacy rights seem to be like that sometimes

but that is not exactly how routine works as far as border or TSA claims so oh no guys okay oh it's a short connection don't touch it no I lost my place the border search is permissible may be an invalid where consideration of race the purpose of delay or manifestation of ill will so the courts are going to say if you're pulling out every person because of their gender maybe because of their age or their race a court could find that that is invalid when it might otherwise be permissible so let's go roughly into what is routine because I'm sure you're going you know has this thing that's happened to me is it routine so not routine strip or cavity

searches raised purpose of delay amount of station of ill-will which I talked about fingerprinting photographing physical force for asking searching us groups of US citizens are all considered routine luggage personal belongings jackets waltz etc and electronic devices are also all considered routine so basically very very broad yes physical force I believe that is you know forcing you to comply if you're resisting probably the court didn't I mean this case in particular I'm not I haven't read in a long time but generally they can use force to force you to comply to a search even if that means putting you in handcuffs etc so what are the rationals to protect the United States well violent jihadist material

information about cyanide nuclear material video clips of explosive devices pictures etc child pornography IP rights violations possibly in the future depending on how law center goes hopefully not but those are some considerations but generally the idea is just to protect the United States I really like this photo this is a border official searching individual the insides of each pepper I guess there was some sort of smuggling that happened where they were hiding there have been some very clever creative ways to hide things while crossing the border do a google image search it's kind of worth chuckling about so again I want to reemphasize the US citizen had returning to the US date has the same Fourth

Amendment rights as a foreign citizen none so you've left you're trying to come back in your on the border you basically are treated just like everyone else and you have no rights at the border with regards to the Fourth Amendment so a lot of people say why do I care I have nothing to hide which they're always one of those in the group but border searches can compromise sensitive professional information trade secrets attorney-client or doctor/patient communications personal correspondent and documents a really interesting thing about this is as an attorney the border you can't claim attorney-client privilege at the border to stop them from searching or looking through something so you are putting potentially at risk client data or whatever you may

have that might be covered under attorney-client privilege at risk by bringing it across the border if they choose to search you because some border official could be rummaging through and photocopying taking those documents etc which you may not have access to in the future if there's a delay so part of the border searches that they can take and copy and hold on to documents and other possessions that you may have with you while crossing the border for what they say is a reasonable period of time but that's been as high as 40 50 60 days so if they're important client documents you may not have them so I think that's really an important thing to press that

even something as high regard as attorney-client here is still under the subject of the border search exception so the Supreme Court of the United States has been giving various indicators that there is going to be a shift in the way that electronics are handled with regards to the law first of all it's great to see that one of the justices understand that the Fourth Amendment is being affected by the advance of Technology and I thought that was worth pointing out so a certain electronic device different well it implicates different privacy concerns than the search of containers many of you have heard the general it's a gateway to other devices you all carry lot electronics I'm sure you all know the

increased privacy concerns but generally if you think about when the the border search exception was created it was whatever you could carry with you on your person or whatever you were shipping in a shipping container and that was being searched nowadays it's kind of a gateway into other people's lives as well as items or things that you may keep on other computers on the cloud etc and so do the traditional rationales that were created around the Fourth Amendment's border search exception really still applied to electronic devices I also really like this picture so they hold a lot of things so US Customs and Border Protection they can read search copy retain i said this for a brief

reasonable amount of time at an offsite location which means you will lose access to them for a period of time if you do not have another copy again it's unclear how privileged documents are handled sometimes i've read that they will handle them in a special way but once they leave your possession how can that be guaranteed so the customs border control or patrol encounters encryption or technical difficulties well generally the data the device is sent to other agencies to help unclear of cooperating agencies can keep that data indefinitely so you can imagine you have an encrypted computer you're like you know good luck you my computer's encrypted they will likely if they choose take that device

make a copy of the image or image the computer and possibly give it to other devices to try to crack what happens with the copy that is made is also unclear so they can be kept for weeks and subject to forensic searches but what a will point is this an extended border search and you know if it's an extended border search and that goes you know along the lines like a strip searches next border search you need reasonable suspicion and so what at what time does that really cross over the system is also bizarrely easy to bypass the u.s. mail has pretty heightened protections they need a warrant to get access to first class mail granted it's x-rayed

and photographed etc there are certain things that do happen to it as it travels but for a while journalists were recommending people who were fearful and traveling with the border with sensitive documents to just mail them to their sell themselves because it was less likely that that would be subject to a search don't know if that's necessarily true but it seems like it's an interesting you know problem that exists here where the protections exists in some forms but not on the others so will it change before I go into the will it change I'm going to go through this really quick outline there are two cases I'm going to talk about one is a Ninth

Circuit case which is California Nevada Arizona Washington Oregon and maybe some place else that ruled it that that they decided in 2013 of March they submitted it to review for this to the Supreme Court and it was denied so the holding for this case stood and then another court decision involving the search incident to arrest so another exception meaning they could search your electronic devices when you were arrested was granted review by the Supreme Court just four days after cotterman was denied which i think is very indicative to the way the court is thinking so finally Riley was decided in June of last year and so I'll go over what all those cases are but i think

this timeline is really important samba point back to it so the unbound court said a person's digital life ought not to be hijacked simply by crossing a border so you can guess the outcome of this case it was in phase ever of increasing protections so a little bit about cotterman a howard caravan was driving to the united states from mexico when he arrived u.s. customs border control they seized his laptop in a response to an alert for a fifteen-year-old condec conviction for child molestation customs border border protection denied cotterman 48 hours or detained excuse me cotterman 48 hours but the initial border search turned up nothing they found nothing however they decided to collect his laptop anyways to

conduct a more thorough forensic examination about a hundred and seventy miles from where the device was seized and where he was driving across the border it was during that search the forensic search that child pornography images were discovered so cotterman attempted to suppress the evidence because of a warrantless search of his computer at the border arguing that it violated the Fourth Amendment the district court disagreed but eventually the Ninth Circuit on Bach said that this was not okay and that the border is not a place where anything goes so generally the government said that we have to account for the fact that more and more people are taking electronic devices across the border we have to be more

protective or more cognizant of the type of information that is on these devices and so they're taking into the rights here of Fourth Amendment or the Fourth Amendment rights of travelers so here's the Ninth Circuit we are in the 9th circuit now so we have a heightened when you travel internationally in our in or out to any airport or any border along Mexico or Canada there is a heightened suspicion needed for forensic examination so it's not really clear what the court means by forensic examination same one here do forensics so you guys would probably be able to articulate the point at which you know it crosses over the courts who don't have technical backgrounds it may be a

little more difficult so they can likely still just inspect a cursory inspection click around the computer etc which I'm sure that anyone doing forensic is cringing because now someone's clicking around so but they only need a reason else is reasonable suspicion to actually escalate that to forensic examination so bringing out my chart again because I think it's really important to emphasize how little suspicion is needed even though it's heightened so I really like this quote passwords and encryption or kind of a big thing right now if anyone's following the news and password protection alone of the files does not give rise to reasonable suspicion so it was really great for the court to preemptively kind of say just password

protecting your files or if they're doing a cursory search and they don't find anything that that having a file that's encrypted or password protected isn't going to escalate that to reasonable suspicion for a forensic search so the Department of Homeland Security was not thrilled they claim that a low standard of protection is going to actually be operationally harmful and this may be true I mean I don't know i don't work for DHS but i can imagine it is going to make some cases lives more difficult because they won't be able to do any searches basically on a gut feeling so really quickly I'm going to talk about Riley V California and kind of why it matters in

this context so right now the whole United States border except for the Ninth Circuit you need no suspicions Ninth Circuit you need reasonable suspicion for a forensic examination so in Riley the police located two guns and subsequently arrested Riley for possession of firearms Riley had his cell phone in his pocket when he was arrested so gang you Unit detective analyzed the videos and photographs of Riley making gang signs Riley Riley was then subsequently tied to two shootings with ballistic etc and Riley move to have this evidence suppressed so here the the police officers relied on the fact of this other exception called the search incident to arrest meaning they can search anything on your person for the

officers safety and for evidence preservation during an arrest and so Riley disagreed with this and said no my cell phone is different it does not actually constitute any harm to the police officer and any evidence on there the the search without the warrant isn't quite warranted because there are ways that evidence could be preserved but besides just invasively going through the phone so the court rejected the government's argument and basically for the first time in a very long time if not ever a very long time said that cell phones were a different type of container that they held different types of information so they said cell phones different in both a quantitative and qualitative sense from other objects

that might be kept on them the rest these persons in case law generally all containers are treated the same you can have a box and it's treated the same as a little box it can say drugs on the side or you can say innocent on the side and you know all containers are generally treated the same here the court is saying no the cell phone is different so is it really different the data user views on many modern cell phones may be in fact not stored on the device itself so they're not just searching the phone that's on the person but a data that is stored on another phone and the court really struggled with us they didn't like the idea that

it wasn't information necessarily stored on the phone and that would be unclear to the officer actually doing that examination that that would be true so

cell phones as you guys all know are designed to take advantage of cloud computing and for the most part it's turned on instantly we had the celebrity hack if that's what we'll call it where you know individual celebrities didn't even know their phones are being synced and so this is really problematic and the court realizes that there are different privacy aspects around here that might expose more information to the government than was traditionally then traditionally existed because you can imagine if you were going on an international trip you weren't bringing with you all of your family photos but now it's so easy and with increased storage why not see a question the court completely agreed with you yes that is

true so the court completely agreed and said that the original rationales about this exception don't exist with regards to cell phones and that there are other exceptions that exist that would still protect the offers officer if need be for example there's the exigent circumstances exception which says you know if the officer sinks that thinks that there is a exigent exigent circumstance that might need an immediate search they can't go get a warrant for example they may think the phone is going to set off a bomb and they really like believe it and they can show retro actively that they believe that and they had then they can go and search the file so if they really

thought that the device was harmful they don't need search incident to arrest they have other circumstances and other exceptions which they can use so again rationale to protect the United States I'm bringing up this slide again because I want you to think about here we have the United States Supreme Court overturn or modify the exception the search incident to arrest exception saying that the search of cellphones didn't fit the traditional rationales and the question is will the court feel that way about the search of electronic devices at the border and that's unclear however border searches of containers at the border that's that's really repetitive excuse me on that one and have traditionally justified on the

grounds that the search incident to arrest doctrine is very similar safety and the discovery of contraband so digital devices can contain a vast amount of private information which alters the unfundamentalism out weapons so the supreme court specifically said cell phones with incident to arrest we don't really know if computers fall under that it's likely that the whole term electronic devices might be clarified it's a really good argument but generally if they're feeling like a cell phone is this portal that they would feel similarly about computers and hopefully extend that as well to the border so I talked about this earlier but exigent circumstances still available so what does Riley tell us about the state of searches of

electronic devices well the courts analysis also suggests that it will balance the individual's privacy interests against the government's interest in crime prevention well we don't know however is whether the Fourth Amendment protects from warrantless searches of all data stored in a cell phone or whether it's limited to information traditionally considered private such as private emails and confidential documents we also don't know whether the Fourth Amendment applies to non-physical intrusions of a cell phone such as the collection of metadata so some real momentum some real quick thoughts on Forest decryption and password disclosure so I've given a talk on this topic at shmoocon which if you'd like more information on that I'd suggest watching that but what's really

interesting and worth pressing is that the Fourth Amendment warn't exception in contrast to the Fourth Amendment wore an exception the fifth privilege against self-incrimination has no warrant exception that meaning the border search exception isn't something that applies to your rights against self-incrimination those always exist even at the border and so if they do come across your computer with a password and tell you you must a crypt or you must turn over your password if you believe you are in a circumstance in which you can say that you do not want to reveal this information in fear of incriminating yourself which you do not have to be guilty to invoke that right and you can invoke it at any time you

don't even have to be party to an investigation you can do that and that the border search exception doesn't prevent that so I'm actually going through my sides pretty quickly so we'll have lots of time for questions in case anyone has any but let's say you've been pulled aside for secondary screening how would you interact anyone can be detained so don't take it personally maybe you're detained a lot it happens be polite courteous and professional I cannot stress enough just in day two days the more difficult you make it for them the more difficult you're going to make it for yourself and the harder it would be for a lawyer potentially in the future to argue on your behalf that you

are complying that you are being a good citizen and you don't want to give ammo in a situation to make it worse so yeah

we can talk about that after so don't lie and don't obstruct an investigation I guess the general thing is they can detain you longer they can seize more of your devices maybe they wouldn't have seized your devices and now they are and they're going to keep them for 30 days because they can they can make your life difficult if it gets if it escalates you possibly could be violating other statutes other cry committing other crimes and that could fall into problems for example if you punch the cause somes officer now we're that's you know gonna be problematic um I would hope not but you never know finally protect your data encrypt your hard drive you guys

know all these things you don't carry less I think that's always a big thing and back up back up back up because you never know if you might not have access to that device and I think I'll just say a really quick thing if you're interested about what's going on in this area Lord porches had a lot of issues when she was doing various documentaries on the Iraq war and Afghanistan and she was seized 40 times in six years and she foiled all of the documents about her with regards to the border search and they turned back six documents and for someone detained 40 times in six years you can imagine there's more than six

documents about you and the electronic frontier has filed a suit asking for more information about that and so if you're interested about that I would encourage you to do google search because it's quite interesting and remember refusal to cooperate here's I pre answered your question lengthy questioning denial of entry into the United States I guess they could say you can't come back in and so protect your ways that prevent awkward confrontations with border customs patrol you know if if you think that something looks suspicious and you're not committing a crime you know or whatever it may be you know just be careful about what you bring you don't want to have that awkward confrontation where you're

saying no I'm not going to decrypt and maybe you really have nothing worth hiding but any natural person and it's not necessarily right but it's going to say well I'm going to keep asking questions I want to know more yep I am NOT a border specialist in this sense in like in rien immigration or emigration but I can imagine they can detain you and keep you out of the United States for a period of time the the border checkpoints in the United States 100 miles in are problematic in the sense that it's something that customs and border control and Department of Homeland Security have established but not neces something that the courts have recognized is truth so

it doesn't necessarily mean you don't have rights there but it does mean it is a really gray area and it will probably end up being either you comply or it turns into a court battle I don't know it's kind of just a gray area because they can claim a hundred miles but the courts don't necessarily recognize the border as a hundred miles there are multiple justifications for why they set those up and you know there they exist so they must be there for a reason because it seems like a lot of staffing for nothing yeah in the back I [Music]

don't know the answer to that question will go back to my map oh I'm on questions now I'm sorry they were going to have a mic come around and I impromptu you guys started asking questions right when I was done I'm so a lot of these technical what if questions in law school they teach you its it depends there's not really a good answer or a solid answer I can give you with a lot of these questions they're all circumstantial the law is very gray the law is basically made around this based on incidents as they happen and as people pursue individual cases wait I'll try to be good can you go to the mic

because I know the the people in the recording are going to be month oh wait I don't know

so those are all good questions with a lot of complicated answers first of all with resetting your phone or wiping your computer there are evidence destruction laws if you knowingly erase or get rid of evidence that or information that you think might be evidence to a case in the future you could be violating one of those laws if you have nothing on your computer that might be evidence and you're just deleting it because you're deleting it to avoid an awkward encounter that might be different it's really really hard to say as far as recording officers if you politely asked to record the conversation many courts have held that you have a First Amendment right to record government

officials and their capacity as a government official a lot of them are governed by state law but at the border there's there's a good chance that that's protected by the First Amendment the problem is that they've already seized your phone at that point so trying to record might be difficult there's a story about Laura Poitras where they denied her a crayon or a pencil to take notes of the names of the officers in which she was being questioned by so if you are in a situation where you're under secondary screening it's definitely where you know I think my last slide here you know write down their names write down any questions you may have etc document

and file a complaint and it seems like not a great solution that's probably the best and most legal solution that you can go by yeah I've not it yep so when you get into this kind of scenario with with secondary screening and in the in the scenario where they're taking their devices do they typically record those interviews with you are those recorded and Captain can those be reference later if it does go to court probably depends on where and when I can imagine a lot of it is recorded but I can't say for sure because there isn't a record of every one ever gone under screening any other questions you mentioned that you might have a First Amendment right to record

your encounters at the border every US border I've ever crossed has had signs instructing you not to engage in any kind of recording are those just intimidate or e or is it unsettled as a question unsettled yes whether or not just powering off or enabling encryption on your device would be the same as basically disrupting no I think there's a distinction to be made there how they handle it is really it's hard to tell you know the these are a lot of great questions with a lot of what-ifs and the law is very gray what does exist are these various rights in which you can assert after the fact ordering it while it's happening sometimes they will disagree with where

you're right stand which is unfortunate but as you can see in cotterman stand in Connor mins case they took his computer they did a forensic examination and after the fact he argued that he had this rate and created the case law and so it's not perfect they already know knew he had these images I think he actually still ended up going to jail but they did throw out that piece of evidence and violate in for violating the Fourth Amendment or I think what they ended up holding is that they still had reasonable suspicion because he had this prior conviction so any yes uh not that I know of but there are a lot of Courts so possibly but not that I know

of recently with regards to this issue Oh yep this is a little off topic you said that for attorney-client privilege that the border search does not provide protection you're not protected in attorney-client privilege ways during a border search so does that mean that something that was discovered during that border search is now totally admissible in court even if it was between attorney and client no but with attorney-client is once the cats out of the bag it's hard to put it back in so you don't ever want to expose that information ever so the privilege exists you can accidentally release attorney-client privileged information or it can accidentally be discovered or it can be discovered illegally etc but doesn't just because

it's been found doesn't mean that privilege disappears there are ways in which you can waive that privilege but in this case the concern is that that information is now in the hands with other agencies with other groups and you don't know where it's going and so as an attorney you want to be cognizant of that most likely but I can't say positively one hundred percent so to sum up is it true that they cannot force you to enter a password now we're certain doctrines of that is unsettled law as well but a couple of courts have held that yes in fact you have a Fifth Amendment projection from putting in your password because it comes from the

contents of your mind so let me just distinguish that really quickly from fingerprints to unlock devices they can force you to put your finger on a device to unlock that does there is no privilege that you can but if you had something locked with a physical lock they could force you to open it with a key you had yes and I see that where you're getting with the distinction I have this is kind of this is very off topic but there there are problems with that distinction with regards to encryption because you know you can always kind of point to a key but generally your password has to be you know the contents of your mind is what's

protected for turning over documents and with regards to the document active document production which is what's happening when you're turning over a password those privileges or rights may still exist if it's a key so it's it's a it's a more blurry concept than just physical key verses password okay do you know how the US border search exception and all the stuff we've talked about here it compares when you're talking about other countries like how do other countries do it are things vastly different see similar when you enter their country you are under their law so the UK has been having a lot of discussions about the law and encryption and force decryption when you enter the UK if they

ask you to decrypt you musta crypt there is no Fifth Amendment right against self-incrimination that you can assert so you are now under their laws and so I think you know when you if you go to a country you say this like UK border and you know you're there like they make it very clear that you are no longer you know in international waters or in your own country so I think that's it thank you very much guys [Applause]