New information on your iPhone being searched by Customs at the border

Taking an iPhone or iPad when you leave or enter the United States is a complicated issue for attorneys.  You are likely going to want to do work when you are abroad — especially if you are traveling for business, not pleasure — and thus it makes perfect sense to have your iOS device with you.  In fact, it can be a much better option than a computer, which can be more easily attacked by malware in a foreign country.  If you can get access to WiFi and you use VPN software like Cloak, you should be fairly safe.  The problem, however, is that U.S. customs agents as of late have been demanding to search mobile devices upon reentry into the country, and there are some reports that they will sometimes even copy the data from a device.  If you have confidential attorney-client communications or attorney work product, you don’t want a stranger who works as a U.S. customs agent to have unfettered access.

To try to get more concrete information on the current state of affairs, Sen. Ron Wyden, a Democrat from Oregon who has a reputation of being a privacy advocate, recently sent a letter to Acting Commissioner Kevin McAleenan of Customs and Border Protection (CBP) with questions on the current policies.  I encourage you to read the full response as posted by the Washington Post, as well as the article by Brian Fung of the Post, but here are four parts of the response that jumped out a me.

First, CBP does sometimes search electronic devices in the possession of individuals entering the United States, but does so rarely — less than one-hundredth of one percent of travelers.  CBP will inspect devices of both non-citizens and U.S. citizens.

Second, if your device is locked, CBP can ask you to unlock your device so that they can search it.  If you refuse to do so, and if you are a U.S. citizen, CBP will still allow you to enter the country, but you may be delayed (so you may miss your connecting flight) and your device will likely be confiscated.  If you are not a U.S. citizen, failure to unlock your device could be a reason that CBP does not allow you to enter the United States.

Third, CBP takes the position that it has the authority to search anything that is on the device itself.  CBP asserts several justifications for searching devices, and you can probably guess them.  For example, CBP may look for contraband (such as child pornography), or information that could be a threat to national security (such as something related to the proliferation of nuclear weapons).

Fourth, CBP will not ask to access your information on remote servers.  Thus, they should not ask you for your password to Dropbox, Facebook, your law firm, etc.  However, if there is a local copy of any data synced to a remote server — such as local files in the Dropbox app on your iPhone — CBP can look at those documents.

All of this means that if you don’t look too suspicious — which unfortunately might be determined based upon the color of your skin or the clothes that you are wearing — there is a very good chance that a customs agent will not ask to look at your phone at all.  My most recent experience with customs was just a few weeks ago when I was in a car and drove across the border to Canada and then drove back again.  The experience of re-entering the U.S. was incredibly quick and non-intrusive for me, just a few questions.  Then again, I was in a van with my wife and kids coming across the border next to Niagara Falls, so it was fairly obvious that we were just typical American tourists.

But if you are unlucky, customs may well ask you to unlock your iPhone or iPad so that they can search through your files.  You need to decide before your travel whether this risk is enough reason to not take your device in the first place.  The Electronic Frontier Foundation prepared an excellent document on this topic called Digital Privacy at the U.S. Border: Protecting the Data On Your Devices and In the Cloud.  According to the EFF, you can ask the border agent to withdraw the order that you unlock your device on the grounds that the device contains confidential and sensitive attorney-client communications and attorney-work product.  This might work.  But it might not, and in the process you are going to have explain to the agent in great detail what is on the device.

The EFF also cites a 2009 directive stating that border agents must consult with the CBP legal office before searching documents protected by the attorney-client privilege.

I wish I could conclude this post with easy answers, but it appears that there are none at the moment.  I don’t know how you should weigh the usefulness of having your iPhone and iPad with you outside of the country versus the risk that a border agent will try to search the device as you enter the country.  And remember, we are just talking about U.S. border agents right now; you may also find yourself facing an official in another country who demands access to your device and who has no regard for the Rules of Professional Conduct or the Rules of Evidence governing privilege.