Not many Americans realize, or think about the fact, that when they enter or exit the United States they essentially do not have any right to privacy. What this means, as a practical matter, is that Customs and Border Protection agents may freely search the electronic devices of Americans without a warrant or even a reasonable suspicion. Moreover, CBP agents may require Americans to decrypt encrypted information, provide passwords and/or use their biometrics to open their electronic devices for Agents.
In the wake of a recent United States Supreme Court decision in which the Court for the first time recognized the volume of an extremely personal nature of the information contained in such devices, CBP has now issued revised guidance for its agents to access and search such devices. The Directive in which the guidance is contained (CBP Directive No. 3340-049A), explains, "as a policy matter, this Directive imposes certain requirements, above and beyond prevailing constitutional and legal requirements, to ensure that the authority for border search of electronic devices is exercised judiciously, responsibly, and consistent with the public trust."
The new guidance provides that the search should be limited to the information that is "on" the device. To aid in restricting the search to information that is only on the device, the agent is directed to shut off its connectivity to networks, e.g. by the agent placing the device in airplane mode or requiring its owner to do so. Agents are also directed to "take care" that they "do not take actions that would make any changes to the contents of the device." The Directive goes on to describe basic searches where an agent, essentially, just looks at the information contained on the device and an advanced search that, by the Directive and the policy and procedures it establishes, calls for "reasonable suspicion" in which case the agent may use external equipment to review, copy and/or analyze its contents. Moreover, while the directive states that the owner of the device should be able to be present when the search is conducted, it clarifies that this does not require that the owner actually be able to observe the search when doing so could give away, essentially, investigatory techniques.
Notably, for business travelers, the directive provides:
Officers encountering business or commercial information in electronic devices shall treat such information as business confidential information and shall protect that information from unauthorized disclosure. Depending on the nature of the information presented, the Trade Secrets Act, the Privacy Act, and other laws, as well as CBP policies, may govern or restrict the handling of the information. Any questions regarding the handling of business or commercial information may be directed to the CBP Associate/ Assistant Chief Counsel office [sic] or the CBP Privacy Officer, as appropriate.
Enhanced protections also apply to Attorney-Client Privileged and/or Attorney Work Product privileged documents.
Should a device owner/custodian refuse to decrypt/unlock the device, CBP Agents have authority to seize the device and use other technical means to access the device. This authority also includes the right to seize the device and seek a court order. Further, upon "probable cause" the directive provides that the device and information on such devices may be seized. Finally, the directive provides that there is no private right of action created by the issuance of the Directive itself—meaning you cannot sue CBP solely for their violating their own directive.
What then does this mean? For all of the reasons that you should be thoughtful about bringing materials and information into foreign countries, you should likewise be thoughtful about the information that you pack in your devices and choose to take across the United States' border. Thus, for instance, carrying business sensitive information that is, perhaps, governed by a confidentiality agreement, should be reconsidered. Likewise, candid photos of you on the beach in Cannes while you "go native" may be worth some thought.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
