How Do Border Searches Affect Electronic Privacy?

TL;DR

International travelers may face forensic searches of electronic devices at U.S. airports under the border-search exception, with federal circuits divided over whether reasonable suspicion is required. Companies should establish policies for cross-border devices, proprietary data, passwords, and employee responses because authorities may seize devices, hold them for up to five days, detain travelers, or deny entry.

Transcript

Um, I know we have a lot to get through. When we were, um, getting ready for this presentation, my head was already exploding, so I want yours to do the same. Um, I'm going to introduce our two really fantastic panelists. Um, to my far, far right is Rick Aldrich. He's a professor. He has 20 years spent in at the Air Force JAG, specializing in cyber... Read More

Key Insights

• The border-search exception applies at international airports when a traveler arrives on an international flight, permitting searches that would ordinarily raise Fourth Amendment concerns. The central unresolved issue is whether a forensic examination of an electronic device requires reasonable suspicion.
• Federal circuits are divided over forensic device searches at the border. The Fourth and Ninth Circuits require reasonable suspicion, while the Eleventh Circuit concluded in Touseh that the standard did not apply because searching a computer was not personally invasive like a strip or body-cavity search.
• Reasonable suspicion in Touseh rested partly on micropayments reported by Xoom, suspected child pornography identified through a Yahoo account, and notifications to NCMEC and the Department of Homeland Security. Authorities then identified the traveler and prepared for his arrival in Atlanta.
• Older evidence may remain relevant in suspected child pornography cases because courts have accepted law-enforcement experience suggesting that collectors tend not to delete such material. The lower court therefore found reasonable suspicion even though the triggering micropayments had occurred one and a half years earlier.
• Compelled disclosure of a passphrase may create a Fifth Amendment self-incrimination issue. Although the 2018 border inspection manual said authorities could require travelers to provide encryption passphrases, the presentation noted that several courts rejected compelled decryption keys in other police cases.
• Fingerprint unlocking generally receives less constitutional protection because courts have held that people lack an expectation of privacy in their fingerprints. A different Fifth Amendment question may arise if authorities specifically demand the finger that unlocks a phone, because the selection communicates knowledge.
• Facial identification may allow authorities to unlock a device because people generally lack an expectation of privacy in the appearance of their faces in public. The presentation noted limited case law and described phone features that can restore a passphrase or PIN requirement.
• Corporate cross-border technology policies are essential because authorities may seize devices, retain them for up to five days, and potentially access proprietary data. Employers should decide what employees carry, whether they surrender passphrases, and how they respond to detention or denied entry.

Questions & Answers

Q: When can border authorities search electronic devices?

The border-search exception applies when a traveler arrives at an international airport on an international flight. Under the Eleventh Circuit’s approach described in United States v. Touseh, authorities may conduct a forensic device search without reasonable suspicion if the search is not personally invasive. The Fourth and Ninth Circuits take a different position and require reasonable suspicion for forensic searches.

Q: Why did authorities search Touseh’s devices?

Xoom noticed small micropayments sent to countries described as known for the sex trade. Because such payments could indicate unlawful activity, Xoom alerted Yahoo, whose review of the associated account identified material believed to be child pornography. Reports reached NCMEC and the Department of Homeland Security, and authorities located Touseh through his passport before his arrival at Atlanta’s airport.

Q: Was the forensic airport search in Touseh lawful?

The lower court treated reasonable suspicion as necessary and concluded that the government had it. On appeal, the Eleventh Circuit held that reasonable suspicion was not required for this border search because examining the computer was not personally invasive. The ruling created a conflict with the Fourth and Ninth Circuits, which require reasonable suspicion for forensic electronic-device searches at the border.

Q: Can old evidence establish reasonable suspicion?

Old information may still support reasonable suspicion in the context described by the presentation. The micropayments connected to Touseh had occurred one and a half years before the airport search, which might be stale in many cases. However, courts have relied on law-enforcement experience that people who collect child pornography tend not to delete it, making older evidence potentially relevant.

Q: Can border officers require a phone passphrase?

The 2018 border inspection manual discussed in the presentation stated that border authorities could force travelers to provide an encryption passphrase. However, the specific border issue had not been resolved in court as presented. Several courts addressing other police demands for decryption keys had refused them because compelled disclosure could raise a Fifth Amendment self-incrimination issue.

Q: Can authorities force fingerprint phone unlocking?

Courts have generally found no expectation of privacy in fingerprints, so requiring a person to place fingers on a reader may receive less constitutional protection than compelling a passphrase. The analysis could change if officers demand the specific finger that unlocks the device, because identifying that finger may communicate knowledge. Trying every finger may avoid that particular Fifth Amendment concern.

Q: Can facial recognition be used to unlock a phone?

The presentation indicated that there was not much case law on facial identification, but most jurisdictions appeared likely to find no privacy expectation in a face visible in public. Under that reasoning, a phone might unlock when its owner looks toward it. Some major phone makers provide methods that return the device to passphrase or PIN-only unlocking.

Q: What should corporate cross-border device policies cover?

A corporate policy should address whether employees carry company devices and proprietary information across borders, how they respond if a device is searched or seized, and whether they surrender passphrases. Authorities may retain a device for up to five days, while refusing cooperation may result in detention or denied entry. Employers should make these decisions before employees travel.

Summary & Key Takeaways

• United States v. Touseh concerned an airport forensic search following reports of micropayments to countries associated with the sex trade and suspected child pornography in a Yahoo account. Evidence discovered on the traveler’s devices supported a warrant to search his home, producing additional evidence that contributed to his conviction and appeal.

• The appeal examined whether searching electronic devices without a warrant at Atlanta’s international airport violated the Fourth Amendment. Courts disagree about forensic border searches. The Fourth and Ninth Circuits require reasonable suspicion, while the Eleventh Circuit held that the standard did not apply when a device search was not personally invasive.

• Password, fingerprint, and facial unlocking methods raise different constitutional questions. Courts have treated compelled disclosure of decryption keys as a possible Fifth Amendment problem, while fingerprints and publicly visible faces generally receive less privacy protection. Companies should anticipate these unresolved distinctions when setting rules for employees who cross international borders with devices.