The Border Exemption: Your Phone Can Be Searched Without a Warrant

For me, it isn't the lack of warrant (I am a UK Citizen but I expect we have similar problems here), it is the lack of transparency and accountability.

If was arrested on suspicion of something, I can get legal assistance and I can know what I am suspected of and why before any of my property (or in this case, potentially very private and sensitive information) could be taken. If the arrest is manifestly wrongful or not based on any evidence, then I expect it would be easy enough to resist investigation.

On the other hand, having someone at the border who can justify an arbitrary search on the basis that "they might suspect of something", without having to clearly justify that basis and that if they then take property (or information), potentially copy it completely opaquely and then have zero accountability if that is misused is extremely frustrating but I guess you need to lobby your lawmakers to make the system fairer and to ensure legal protections of privileged information is completely upheld - period.

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

It's self explanatory.

IANAL. This is my understanding.

For US citizens entering the US: If you're concerned about protecting your data from this threat, you should use GrapheneOS (or less good would be a latest iPhone in lockdown mode and BFU) and not talk to the police. The 5th amendment does not seem to have an exception at the border, so you can't legally be compelled to hand over your password by border agents (there's not strong case law here). They can lie, they can detain you, search you, they can seize your stuff. You shouldn't be the one arguing with them, you should be silent (besides identification) and ask for an attorney (you don't have a right to an attorney at a routine search). As a US citizen, you can refuse and still enter.

GrapheneOS has demonstrated to be robust against physical access even in AFU [1]. It's still a good idea to shut down / restart because BFU is much more secure. To maintain convenience while avoiding reliance on the rate limiting of the secure element, you can use a long random passphrase as your primary unlock (you enter it every time the device is in BFU) and a fingerprint with a second factor pin as the secondary unlock.

Even if you factory reset your phone and backed up data (to an E2EE cloud provider, over Tor and memorized the credentials), you should still not disclose your password because it could allow evidence to be planted or your device to be compromised. Nothing you say to the border agents can help you in court, it can only be used against you. […]

I don't like this. I think about a year ago when there was a big push for chat control in the EU, almost like an instinct, I started working on ways to be more soverign with my data.

I'm just a regular guy who really has nothing to hide, but that doesn't mean I need to be complacent with just allowing a future I don't like be propped up in front of my eyes.

What I've come to realize is there is really no safer place for your data and communications than just your own home. At the very least, I would like a judge to review the evidence of my alledged wrong doing before the government can raid my castle and get what they need.

Why do I, as a regular citizen feel the need to invoke and create my own protections on personal data and communications?

There's something deep inside me that feels the need to be prepared for this odd future where the government feels they have the right to access everything. It's deeply troubling on many fronts.

”[the CBP agent] said if I didn’t give them my phone, my interrogation was going to take much longer and they could retain my phone indefinitely”

I would take a punt at filing a complaint about that. Threatening someone with selective enforcement must fall short of professional standards at CBP, as stated on their .gov page:

https://www.cbp.gov/sites/default/files/2024-09/exhibit_08_-...

Legally, would my data be safer if I shipped an encrypted phone/hard-drive/laptop through USPS? Does that have more/fewer legal protections than being on my person when you cross the border? Is there a distinction between USPS and UPS?

Obviously a real practical bummer, just wondering if there is an obvious escape hatch for the professional ne'er do well who would easily circumvent the intent.

> “In [Fiscal Year] 2025, out of the over 419 million travelers CBP processed at ports of entry, CBP only searched the electronic devices of 55,318 international travelers,” the agency wrote, or 0.0013%.

And...

> In Fiscal Year 2020, CBP processed more than 238 million travelers at U.S. ports of entry. During that same period of time, CBP conducted 32,038 border searches of electronic devices, representing less than .014 percent of arriving international travelers.[1]

In other words, now it's as likely[0] to get your phone searched as in 2020. It's interesting how the media shapes people's perspective, isn't it?

[0]: 0.001% less likely, so just marginal error.

[1]: https://www.cbp.gov/newsroom/stats/cbp-enforcement-statistic... not sure it reports 2020's data here though.

Too bad phones aren't easy to do a full back up of, wipe, then restore after you are past the border agents. Or can keep all user data on a microSD card that you remove and secure before the search.

You know, I've been looking for an excuse to play with an Ubuntu phone. Maybe I can justify buying one purely for travel so that nothing terribly interesting is on there.

Granted, even if they seized my phone now I don't think they'd find much terribly interesting stuff on there outside of a concern at how many lolcow "Documentaries" I watch.