arbitrary electronic search & seizure + us border = ok

I ima­gine its not much of a sur­prise given the cur­rent envir­on­ment in the states (as well as, to some extent, sim­ilar past rul­ings in the US). Wired reports arbit­rary searches of elec­tron­ics are OK:

Fed­eral agents at the bor­der do not need any reason to search through trav­el­ers’ laptops, cell phones or digital cam­eras for evid­ence of crimes, a fed­eral appeals court ruled Monday, extend­ing the government’s power to look through belong­ings like suit­cases at the bor­der to electronics.

Need­less to say, con­sid­er­a­tion should be given to tak­ing some steps to pro­tect con­fid­en­tial or sens­it­ive records that you would not want to be seized. And no, I don’t mean nudie pic­tures or the like, but things such as con­fid­en­tial inform­a­tion of your busi­ness, or that of third parties who have entrus­ted you with con­fid­en­tial inform­a­tion, or per­sonal inform­a­tion. That being said, Wired also made this observation:

The 9^th’s rul­ing did not, how­ever, cla­rify whether a trav­eler has to help the gov­ern­ment search his com­puter, by provid­ing the login inform­a­tion, or what would hap­pen when the gov­ern­ment decided to search a laptop with encryp­ted data on the drive. The defend­ant in the case can appeal the decision to the U.S. Supreme Court, but the Court is unlikely to take up an issue that two sep­ar­ate appeals courts have agreed upon.

Altern­at­ively, bet­ter to leave all sens­it­ive data at the office and, if required, con­nect through a VPN, retrieve, then erase before crossing.

Well, at least we can thank our stars that the rul­ing doesn’t apply to “highly intrus­ive searches of the per­son”. Yet.

Update: The EFF has pub­lished an art­icle on pos­sible ways to min­im­ize the risk of laptop searches. They point out that encryp­tion might not be all that handy:

If, how­ever, you don’t respond to CBP’s demands, the agency does have the author­ity to search, detain, and even pro­hibit you from enter­ing the county. CBP has more author­ity to turn non-citizens away than it does to exclude U.S. per­sons from enter­ing the coun­try, but we don’t know how the agents are allowed to use this author­ity to execute searches or get access to pass­word pro­tec­ted inform­a­tion. CBP also has the author­ity to seize your prop­erty at the bor­der. Agents can­not seize any­thing they like (for example, your wed­ding ring), but we do not know what stand­ards agents are told to fol­low to determ­ine whether they can and should take your laptop but let you by.

Elab­or­at­ing on my sug­ges­ted approach, they point out the following:

Another option is to bring a clean laptop and get the inform­a­tion you need over the inter­net once you arrive at your des­tin­a­tion, send your work product back, and then delete the data before return­ing to the United States. His­tor­ic­ally, the For­eign Intel­li­gence Sur­veil­lance Act (FISA) gen­er­ally pro­hib­ited war­rant­less inter­cep­tion of this inform­a­tion exchange. How­ever, the Pro­tect Amer­ica Act amended FISA so that sur­veil­lance of people reas­on­ably believed to be loc­ated out­side the United States no longer requires a war­rant. Your email or tel­net ses­sion can now be inter­cep­ted without a war­rant. If all you are con­cerned about is keep­ing bor­der agents from rum­ma­ging through your reveal­ing vaca­tion pho­tos, you may not care. If you are deal­ing with trade secrets or con­fid­en­tial cli­ent data, an encryp­ted VPN is a bet­ter solution.

Any­way, worth a read if you do cross the bor­der with sens­it­ive information.

Another update: More advice from Bruce Schneier on how to deal with cus­toms (both in the US and else­where) and also safe­guard sens­it­ive inform­a­tion. I par­tic­u­larly like this sug­ges­tion (which he offers after also sug­gest­ing the VPN approach that I men­tioned above) though it does require a little white lie:

If you can’t [use a clean laptop and down­load via secure VPN], con­sider put­ting your sens­it­ive data on a USB drive or even a cam­era memory card: even 16GB cards are reas­on­ably priced these days. Encrypt it, of course, because it’s easy to lose some­thing that small. Slip it in your pocket, and it’s likely to remain unnoticed even if the cus­toms agent pokes through your laptop. If someone does dis­cover it, you can try say­ing: “I don’t know what’s on there. My boss told me to give it to the head of the New York office.” If you’ve chosen a strong encryp­tion pass­word, you won’t care if he con­fis­cates it.

Fur­ther update: US cus­toms, pre­sum­ably emboldened by the court’s decision, have pub­lished their offi­cial policy (PDF) describ­ing arbit­rary search. The good news is that the reac­tion, at least in some corners, is some­what less than favour­able. From a recent art­icle in the Wash­ing­ton Post:

“The policies … are truly alarm­ing,” said Sen. Rus­sell Fein­gold (D-Wis.), who is prob­ing the government’s bor­der search prac­tices. He said he intends to intro­duce legis­la­tion soon that would require reas­on­able sus­pi­cion for bor­der searches, as well as pro­hibit pro­fil­ing on race, reli­gion or national origin.

There’s also some descrip­tion of what the good folks at Cus­toms would do, includ­ing treat­ment of priv­ileged mater­i­als, etc. If you fre­quently travel to the US with sens­it­ive busi­ness mater­i­als, you would do well to review the policy. I may post a sum­mary at some point…

Also, another less than enthu­si­astic op-ed piece in USA Today.

related:

1. arbit­rary elec­tronic search & seizure + cana­dian bor­der = ok
2. the gizmodo/jason chen/search war­rant débâcle
3. draft elec­tronic doc­u­ment reg­u­la­tions for fin­an­cial insti­tu­tions published
4. elec­tronic doc­u­ment reg­u­la­tions for fin­an­cial insti­tu­tions finalized
5. Of Search Engines and Com­pet­i­tion (Part II)