DHS on border laptop searches: we can't tell you why this is legal, and we won't limit searches to reasonable suspicion

The DHS has responded to a Freedom of Information Act request filed by the ACLU asking when and how it decides whose laptop to search at the border. It explained its legal rationale for conducting these searches with a blank page:

On Page 18 of the 52-page document under the section entitled “First Amendment,” several paragraphs are completely blacked out. They simply end with the sentence: “The laptop border searches in the [Immigration and Customs Enforcement] and [Customs and Border Protection] do not violate travelers’ First Amendment rights as defined by the courts."

More excellence from "the most transparent administration in American history." Also, the DHS rejected claims that it should limit searches to situations where it had reasonable grounds for suspicion, because then they would have to explain their suspicion:

First, commonplace decisions to search electronic devices might be opened to litigation challenging the reasons for the search. In addition to interfering with a carefully constructed border security system, the litigation could directly undermine national security by requiring the government to produce sensitive investigative and national security information to justify some of the most critical searches. Even a policy change entirely unenforceable by courts might be problematic; we have been presented with some noteworthy CBP and ICE success stories based on hard-to-articulate intuitions or hunches based on officer experience and judgment. Under a reasonable suspicion requirement, officers might hesitate to search an individual's device without the presence of articulable factors capable of being formally defended, despite having an intuition or hunch based on experience that justified a search.

Feds say they can search your laptop at the border but won’t say why [Cyrus Farivar/Ars Technica]


  1. Would it not be the Fourth Amendment that is violated by unwarranted search and seizure? Why is the First Amendment mentioned? Is there some laptop-based religion that I don’t know about? oh, wait… Macbooks. It makes sense now.

    1. laptop-based religion that I don’t know about? oh, wait… Macbooks. It makes sense now

      Jeez, how did you manage to make this about people who prefer a different computer than you?

      Quit obsessing about them, come out of the closet and buy a Mac already.

  2. I can’t remember my password. It’s the stress of the suspicious grounds of your request.  I need a little time…and a lawyer…to help me remember.

    1. No problem, we’ll just put you in this solitary Relaxation Chamber until you can recall.  Meanwhile –  Do you recall if you enabled full-disk encryption?   Your memory might save the American taxpayers a few KWH of processor time.   You don’t want to waste precious tax dollars,  do you?

      1. Hmmm, not sure.  Again, I’m positive my lawyer knows.  Let’s give him a call. He knows lots of stuff. Stuff about laws, lawsuits, really cool stuff.

        1. Sorry, as this is an international border, you have no right to a lawyer. And since we’re part of the federal government, we get to decide whether or not you can sue us. Let’s take a walk down this long flight of stairs, I hope you don’t trip and fall down them three or four times. If you manage to survive the stairs, maybe you’ll need to go to our detainment area. It’s similar to Gitmo, but in another place. Or would you rather remember your password?

  3. Ah, those wonderful intuitions and hunches. Trump the Bill of Rights every time, don`t they? Thats why the Founding Fathers made special provisions for them and all. I understand that they have been specially effective in New York, what with the obviously color and income blind stop-and-frisk program.

    Where can I get my degree in Intuitionology and Hunchamatics Theory?

    1. well it was demolished, and then imported piece by piece to america to be reconstructed.

  4. Ah, yes.  Trusting the hunches of people who are trained and encouraged to be bullying and paranoid (although many of them already were that way before they got the job – it’s why they signed up).

    I’m curious about those “….noteworthy CBP and ICE success stories based on hard-to-articulate intuitions or hunches….”  Whats’ the ratio of successful hunches to stupid shit that the agents should be sued for?  Pretty low, I’d wager.

  5. Is there a good source of best practices for protecting your laptop/data/privacy/self if you have an upcoming border crossing?

    1.  Yeah I wonder if you could just pop out the battery or HD (should the laptop have such a function) or will they just then confiscate it? I would bet that if they are this shitty they will gladly take any non-responsive laptops indefinitely.

    2. Take the data you need, encrypt it with Truecrypt, then put that file somewhere you’ll be able to retrieve over the internet later. Dropbox or Google Drive or get a cheap VPS (Virtual Private Server). Hopefully what you need isn’t huge.

      Wipe the drive and do a fresh install of your OS and the programs you actually need. I’d wait to install Truecrypt until the search is done. If they search the computer and ask why there’s nothing on it, give a reasonable explanation like “It was running like crap so I had to start over. It’s going to take me forever to get it back to how I like it.”
      Once you’re over the border, install Truecrypt, retrieve the encrypted file, decrypt the file and you have your stuff. When you’re heading back over the border again, wipe and reinstall again.

      This method does depend on having decent internet access wherever you’re headed.

    3. Is there a good source of best practices for protecting your laptop/data/privacy/self if you have an upcoming border crossing?

      Take out your hard drive, encrypt it and hide it elsewhere within your automobile (be creative).

      Give them your laptop with a dummy hard drive that has a basic install of the OS and an easy-to-remember account password.

      Give the gestapo assholes the password and “allow” them to clone it, etc. 

      Put real hard drive back in later when you’re back in a “free area” of a “free” country down the road.

      In case you forget to do this procedure always keep sensitive business files or whatever in a separate, encrypted area of your computer that has an encrypted backup drive kept elsewhere.

      Be sure and use an app that enables plausible deniability (in a secure manner) where you can have them enter in a fake password and it only opens part of it that you can populate with dummy data (and even wipe the rest without their knowledge).

       Bonus: Have some files within the bogus hard drive to not arouse suspicion.  Whatever you do, don’t have a file that contains the Fourth Amendment to the United States Constitution.

      Why taunt them with radical documents like that?

    4. Step 1) Whole disk encrytpion. (This is if you truly care if the see what is on your drive)
      Step 2) Change your boot loader to point to a non-existent disk.  When the DHS agent, who is surely tech savy :-/ boots your laptop and asks “What does no OS present mean?” start shouting “Dude, what did you do to my laptop?!?  You broke my laptop!!”

  6. This is so willfully stupid that only the willfully stupid will be accidentally caught by the DHS dragnet.  Data, by way of example, has no borders, or rather, it can easily transgress those borders with little friction.  So what’s to prevent someone from establishing the secure equivalent of a Dropbox folder on one side of the border, wiping all connection to it from their laptop before they cross the border, and then reestablishing the account (and data)  as soon as they cross?  Hmm…Nothing.  

    1. If you do that, then you should have dummy Dropbox accounts propagated with dummy data.

      What’s to stop them from observing that Dropbox has been installed on your computer and demanding the password?

      1. You missed my point.  If you don’t have Dropbox installed, they’re probably not going to know that you have a Dropbox (or Dropbox-like account).  That’s what I meant by ‘wiping all connection’ including the application itself.  All you have to do is memorize the password.  Going to such extreme lengths as using multiple ‘dummy Dropbox accounts propagated with dummy data’ is unnecessary if you took the approach I suggested.  I’m also not suggesting that you necessarily use Dropbox (the feds can get access to their encryption keys), but there are secure alternatives syncing mechanisms for would-be ‘terrorists’.  

        1. You missed my point.  If you don’t have Dropbox installed, they’re probably not going to know that you have a Dropbox (or Dropbox-like account).

          I’ll bet you I can tell if Dropbox was installed on your computer even after you uninstall it (and they can too).

          I’ve performed computer forensics for business and government and I can assure you there’s traces of apps left in caches, etc., etc. on all platforms all over the place.

          In Windows, a lot of leftover components and registry entries are often left behind and it’s basically the same with Mac as well.

          Granted, there’s apps you can run that can record everything that’s installed and erase them, along with other apps, terminal commands, etc. you can use to clear caches, etc., etc. – but you didn’t mention those procedures.

          The best thing you could do with your method is clone your computer before installing DropBox and then re-implementing the clone afterwards.  That’s quite a hassle when you can just implement plausible deniability instead.

          There’s all kinds of hidden places that software leaves its mark.  All over the place in Windows and Mac as well.  Don’t forget 3rd party apps that are running.

          Think maybe you’re safer on your Mac?

          Do you use Default Folder on Mac?  There’ll probably be traces of Dropbox usage within its plist.  Busted.

          I’m keeping in mind your intentions are good here, but at the same time your advice could get a dissident jailed or even killed.

          1. Yes, it is safer, for a few reasons:  
            1)  This isn’t a manual for terrorists or dissidents.  Careful research would give you all the information you need to know, if you’re in that line of work.  I proposed a hypothetical to undermine the belief that somehow they’ll be able to catch ‘bad’ people or get actionable intelligence by searching through electronic devices, when really, they’re dependent on the clumsiness of the device holder as well as the usual randomness that comes from a border guard accidentally stumbling across something significant.  Anyone stupid enough to take my advice, is, well, just stupid, because they’re risking their life on a hypothetical that may not be applicable to their situation.  
            2)  I’m familiar with the underpinnings of my Mac, and I have multiple tools at my disposal, if necessary, to clean out various traces of files, including plists, caches, hidden, temp, and log files, if I wanted to go to that extreme.  Yes, I suppose you could find some trace of the files you’re looking for if I didn’t do a careful job of tidying up behind me, but still, all you have to do is survive a cursory search at the border, not undergo the equivalent of a digital strip search.  There are admittedly better ways of moving data that doesn’t involve Dropbox or similar, including memorizing the essential information you need to know before crossing the border, foregoing any attempts to smuggle the data altogether.  
            3)  You’re attributing a level of competence to the government that isn’t matched by their output, but is reflective of your own paranoia and belief that your expertise at finding something can be easily transmitted to border guards, who are not exactly set up to do these kind of searches in the first place, even with on-the-ground technicians able to assist them.  Big Gov is not that smart, and the evidence of this is plain to see, since plenty of larger contraband items (drugs, weapons, cash, people) manage to make their way across the border with considerable ease.  Again, they’re almost completely dependent on people’s willingness to volunteer that information, and you if you don’t tell, it’s really, really hard for them to know.  

          2. This isn’t a manual for terrorists or dissidents

            You keep casually interchanging the two. Not sure why or what you’re trying to insinuate, but I wish you’d knock it off.

            Anyone stupid enough to take my advice, is, well, just stupid


            All you have to do is survive a cursory search at the border, not undergo the equivalent of a digital strip search

            Untrue, please read my next response below.

            You’re attributing a level of competence to the government that isn’t matched by their output, but is reflective of your own paranoia and belief that your expertise at finding something can be easily transmitted to border guards

            You should probably educate yourself more on this matter. You’re not just dealing with “border guards” here. Once again, I should also remind you I’ve worked for business and government with IT security. It’s not paranoia, it’s facts (as you’ll see below):


            FTA: (Emphasis mine)

            ” … CBP tells its agents that “with or without individualized suspicion,” they can inspect electronic devices and data encountered at the border. The agency can keep your computer or copies of your data for a “brief, reasonable” amount of time to be searched on- or off-site. Ordinarily, this isn’t more than five days. CBP recognizes that agents might run across privileged or sensitive information stored on devices, but does not clearly explain the procedures for handling it. When CBP agents experience technical difficulties or encounter information that is encrypted or written in a foreign language, they may send the device or a copy of the data to other government agencies that might be able to help access the information. Border agents don’t need any suspicion of wrongdoing to seek this assistance, and it’s unclear whether the cooperating agencies can keep copies of the data they receive indefinitely. … ”

            There are admittedly better ways of moving data that doesn’t involve Dropbox or similar, including memorizing the essential information you need to know before crossing the border

            Memorizing isn’t going to be practical in most cases.

            foregoing any attempts to smuggle the data altogether.

            Smuggle data? Really? As a private citizen you likely have private information in your wallet. Do you consider it “smuggling data” when you travel with your wallet? What about sensitive business plans? If you travel with those, are you “smuggling” your plans?

            Being a dissident (whistleblower, activist, etc.) is overwhelmingly an honorable, often patriotic, thankless and selfless service to humankind. Please quit treating it like it’s something “dirty”.

          3. You’re making quite an ass of yourself, with all that mooing you’ve been making. Given that you have a cow’s hind quarters as your avatar, I’m not at all surprised. You can still turn it around, literally, and step out of the cow pies that you’ve been dropping all around you. It’s just not a good look for you.
            I’m not sure what your beef is, but I’m going to take the bull by the horns, and suggest that you’re butthurt because I didn’t acknowledge your totally obvious technical superiority, which you’ve mooed at me, twice, or your implication that I’m somehow stupid, also mooed twice. I’m a cow whisper, I understand how bovines communicate, so I got the moo on the first go around, and despite giving you hay to fill your hungry belly, I guess deep down, that wasn’t good enough for you, and you decided to charge me. Or maybe you got stung by a bee, which is why you’re so dang riled up and bucking like a young calf. Simmer down, Bessie. Easy, now, girl. Boy. Gender neutral it.
            Anyway, it’s been an udder delight talking to you but I’ve milked this discussion for all it’s worth. I’ll keep on my side of the fence, you keep on yours, right where you belong. (The grass is greener over there, anyway. Swear.)

          4. Hay! I’m the one who gets to use all the cow puns!! You’re an excellent writer, for a suspicious, possible terrorist anyway.

  7. Customs has never needed “reasonable suspicion” to search your belongings and other articles you wish to bring in to the country.  There’s more than 200 years of case law supporting this and the diminution of your 4th amendment rights at the border is also well-established.

    Those hunches etc are good enough for most purposes *at* the border.

    Customs officers don’t want to waste their time and resources any more than you want your wasted.

    This is not to say they don’t do some of this out of spite or stupidity but the pay off is so low it tends to be self-limiting in the long run as resources are finite and someone who consistently requests major resources with no “wins” will eventually find him or herself at a one man posting along the AlCan highway.

    I’ve spent enough time with my head buried in someone else’s hard drive to know they rarely grab stuff at the border or elsewhere for the fun of it, aty least at the levels I worked (I can’t speak for the high profile political shenanagins that seem to be occurring and which were some of the reasons I retired.)

    All that being said, I too want to see more real transparency in this stuff.  Especially as regards the contents of your hard drive/flash card etc.  That’s getting to close to “though police” tactics and I do not like it at all.

    1.  What about searches when leaving the country? What about border checkpoints 100 miles away from the border where no one was crossing any border?

    2. That’s exactly why this document was requested. They wanted to know what legal rights they had for this practice. 200 years of case history means nothing if its illegal.

      1.  200 years of case history means that court after court has found it *is* legal by and large.  All the way up to the Supremes.  The right of a sovereign power to protect its borders is older than the Republic and the right to search without probable cause, any or all things crossing that border is pretty much unlimited.  That includes *leaving* the country too, we just don’t do that a whole lot compared to much of the world as there are not many restrictions on what we can leave the country with, especially compared to many other places.  (Lots of countries prohibit their citizens (or visitors) leaving with more than trivial amounts of the local currency for example).  Australia used to have ridiculously sharp limits on how much money its citizens could take with them on foreign holiday and the Soviet Empire forbad *any* amount of rubles from leaving or entering the country.

        Not saying they are 100% right..some of this is abuse pure and simple, just saying it is going to be very hard to get any legal traction on the issue in general.

        I used to do this stuff for a living and what is going on these days is one of many reasons I no longer do it.

        The 100 miles from the border thing usually falls under two areas;  Functional Equivalent of the Border.  That is, if you fly from Frankfurt to Kansas City, Kansas City is the effective U.S. border even though it is more than five hundred miles from any physical border.

        The other part is that, even if you clear Customs, there are circumstances in which you can still be stopped and examined even hundreds of miles from the border.  Generally, it requires good reason and you have to be under continuous observation the entire time or in a situation where you did not or could not stop for proper entry.  Stuff traveling under bond is usually subject to Customs inspection at any time, anywhere.

        (There’s a third type involving where the nearest Customs facility is in regard to border crossings but that’s more rare and usually involves really remote places.)

    3. The legal issue is not as simple as you suggest. There are contexts in which a standard of suspicion must be met even when conducting a border search (United States Vs. Montoya De Hernandez).  Whether an inspection of the contents of a computer is one of those contexts has not been fully reviewed. In 2013, the Ninth Circuit held that seizure and forensic analysis of these hard drives requires reasonable suspicion. (United States Vs. Cotterman). 

      Its worth adding that the resources available to customs officials are only finite because of the current state of this technology. Few people had portable laptop computers 20 years ago. 20 years from now, who knows how expensive searching and duplication will be? If our policy its that its ok for customs to seize and duplicate every laptop that comes in, and our argument is that this is OK because its too expensive to do that, technological change may undermine that argument eventually, and then where will we be? 

  8. “Because if we did things based on what works, we wouldn’t be able to justify our massive budget.”

  9. Add needed file to dropbox or setup remote control/file transfer on your current computer, leave at home.

    Drive through boarders and purchase cheap laptop to use. If money is tight, factory restore laptop before returning to home.

  10. If you give politicians a tool, they will use it immediately and it is only a matter of time until they use it horribly.

    It is completely irrelevant that they promised “transparency” or mouthed sweet-sounding phrases to draw in the rubes. 

    The only way to stop it is to take away the tool.  There is no, repeat no, “good candidate” who won’t use every nasty thing he’s allowed to have.

Comments are closed.