DHS Asserting Unconstitutional Authority to Search Travelers’ Phones and Laptops
eff.org
eff.org
What the EFF's motion for summary judgment actually does is ask the court to extend Riley. There, the Supreme Court held that a search of electronic data on a phone was a fourth amendment violation, even where a search was otherwise permissible without a warrant because it was a search incident to arrest. The idea was that an electronic search did not serve the purposes of a search incident to arrest, which focuses more on ensuring officer safety. A more honest reporting of the article therefore would be "EFF asks court to extend the reasoning of the Supreme Court's recent decision in Riley to hold that the Fourth Amendment protects travelers from searches of electronic data on phones and laptops when such searches are not reasonably related to the purposes of finding contraband and dutiable goods." But that wouldn't bring in all the donor dollars!
I think the EFF actually has a good argument. Possibly the correct argument, at least taking Riley as a given. But man do I hate the press release. (Of course, the EFF's legal filing omits the crap.)
The EFF is arguing that US law enforcement agencies are using warrantless search at the border as a loop hole to circumvent the need to get a warrant in cases that have nothing to do with "contraband or dutiable goods" or any other border security need.
The press release says: > The evidence includes ICE and CBP policies and practices that authorize border officers to conduct warrantless and suspicionless device searches for purposes beyond the enforcement of immigration and customs laws.
These "non border security" searches are clearly unconstitutional, I don't frankly see how that can be contested. These searches are not about the "right of a soveign to police its borders" but about the policing of the interior through bypassing constitutional protection with border searches. My guess is the the actually contested part of this is if there are ANY warrantless searches of electronic devices for the purposes of border security that are constitutionally authorized.
edit: differentiated quoted sources
The same idea applies here: the scope of the search at the border does not include data on electronic devices, as the government does not have an interest that we need to weigh against the person's liberties. It exceeds the "reasonable" part of the fourth amendment. (The memo filed by the EFF includes this reasoning.)
I don't see this as a "debatable" thing. The constitution is clear on the need for a warrant, and while border crossing is one of those exceptions to the 4th allowing searches despite not having suspicion, the exception doesn't apply to search anything and everything, including data.
(Also, in one of these incidents, the electronics were seized and held for months. While I think this is unconstitutional — clone the drive and call it day.)
Conversely, data could be attorney client privileged, HIPPA protected, or classified. Many situations would require a traveler not disclose their encryption password.
The government is free to examine these devices, have fingers pressed to keypads, but IMHO they are not free to compel disclosure of the password.
And there might be violations of the CAN-SPAM act, so we’ll be indexing your mail.
I was told to hand over the passwords for my laptop and phone, lest they seize them "until they can be opened" (see: forever). This was a mind-bending experience for me and I was further interrogated since apparently I must have "something to hide" if I don't want to hand over passwords to my devices to just any person who works in an airport. They even started asking me things like "What are you doing in Australia?", "Who are you visiting?", "Where are you going?" (I am a citizen, it's absolutely no business of "Border Force" who I visit or where I go) and when I was abrasive about those questions they even asked "Have you been in trouble with the law in Australia?"
At the end I did ask what the reason was for them searching me, their answer was simply that they don't need to have suspicion of anything specific.
This doesn't mean I agree with how things are. It's clearly a blatant violation of basic rights, but you can't fight it at the border when you're being searched. Raising awareness and making it a political issue is the only way it can change.
Of course, it would all lead to memorable international travel experiences!
Sure, if you owe duty on three weeks of dirty clothes?
My solution was to stop carrying these devices when I travel. I ship them ahead to my destination through a parcel service, and carry a burner phone (for emergencies) during my actual trip.
"For purposes of ensuring compliance with the Customs laws of the United States and other laws enforced by the Customs Service, including the provisions of law described in paragraph (2), a Customs officer may, subject to the provisions of this section, stop and search at the border, without a search warrant, mail of domestic origin transmitted for export by the United States Postal Service and foreign mail transiting the United States that is being imported or exported by the United States Postal Service."
And I think most other countries have similar rules.
And depending on what kind of parcel service you use, you'd not even have protections against warrant-less searches in US domestic context. I'm not remembering the details, but IIRC only First-Class type mail / parcels are protected. Most packages aren't.
Second, should my devices get damaged then the parcel carrier is on the hook to make me good.
We’re not the only ones who know about Thunderstrike.
Us individual techies always look for ways we can, as people, dodge these intrusions of the system into our lives.
Unfortunately for us individual techies, the real power is in political organizing and shifting the law and culture around such intrusions. We shouldn't need to be inconvenienced like this.
Similar plans wrt if I ever go to something like blackhat or defcon.
A lot of countries don't allow used electronics to be imported, which is more than you think.
Not to mention the duty you have to pay for the countries that do.
I do very little international travel, though, so I may have just been lucky. Most of my travel is domestic, and none of those issues apply when you aren't leaving the country.
What does that even mean?
You don't use the internet?
Surely you have an internet connection, and you could make your device accessible through the internet somehow for accessing your data. It doesn't require "the cloud" in the sense that you keep your data resident in "the cloud" on third-party servers...
Punch a hole in your home internet firewall, or terminate a reverse ssh tunnel on some super cheap VPS provider to access your data from home.
I certainly run fileservers of my own that I can access through the internet, but that's not what people mean by "the cloud", and very probably isn't what the comment I was replying to was talking about, as he specifically mentioned syncing the data to the device.
But I may have misunderstood.
Nonetheless, I don't do that anyway because I don't take a device that can make use of that data. I only take a very basic feature phone.
This doesn't require a cloud service.
Why? What is your threat model?
All phones have software that can be hacked, not just smartphones. But Apple and Google have vast teams aimed at protecting this code... random Chinese OEMs probably don't.
And once you are in country, a smartphone can use Signal (over a foreign SIM or wifi) to have encrypted comms, while all your texts and calls will be intercepted in the clear.
The idea of handing my phone to an agent of the government without physical compulsion is abhorrent to me, and is something I hope to never engage in. For this reason, mobile boarding passes are a non-starter. (see also: wireless keyboards)