Laptop Privacy at the Border

Brian Doherty | June 25, 2007

The Electronic Frontier Foundation (EFF) files an amicus brief in a case, U.S. v. Arnold (being considered by the 9th Circuit Court of Appeals) of a man caught on child porn charges because of a search of his laptop by customs agents at Los Angeles airport. From the EFF press release:

Over the past several years, U.S. customs agents have been searching and even seizing travelers' laptops when they are entering or leaving the country if the traveler fits a profile, appears to be on a government watch list, or is chosen for a random inspection. The Supreme Court has ruled that customs and border agents may perform "routine" searches at the border without a warrant or even reasonable suspicion, but EFF and ACTE argue that inspections of computers are far more invasive than flipping through a briefcase.

"Our laptop computers contain vast amounts of personal information about our lives. You may do your banking on your computer, for example, or send email to your doctor about health concerns," said EFF Senior Staff Attorney Lee Tien. "Travelers should not be subjected to unconstitutionally invasive searches of their laptops and other electronic devices just because they are crossing the border."

Full EFF amicus brief.

Comments

|6.25.07 @ 6:17PM|#

Password protection, people, password protection!

What stays in Vegas|6.25.07 @ 6:29PM|#

"Our laptops computers contain vast amounts of personal information about our lives."

All fixed.

LarryA|6.25.07 @ 6:41PM|#

Password protection, people, password protection!

Nice in theory.

"What is your password, sir. You aren't going anywhere until I see what's behind it. If you haven't done anything wrong..."

The only valid reason for the airport search is to discover anything dangerous to the plane or other passengers. All else should require a warrant.

|6.25.07 @ 6:44PM|#

Password protection, hell. Encryption, people, encryption.

But really, you have no rights at the border which was made clear to me in the '70s. They can search anything and ANYWHERE, if you get my drift. SCOTUS will side w/ customs on this if it ever gets that far. Bet on it.

|6.25.07 @ 6:47PM|#

I'm sorry, I misread/misinterpreted. On a domestic flight, SCOTUS might, nay should, side with liberty. But I doubt it.

|6.25.07 @ 7:08PM|#

J sub D,

There is no US Customs search when you fly on domestic flights.

LarryA,

These are US Customs searches, not airport security. You have already landed and left the plane when they search you. They can search anything for contraband, which could very easily be on a computer, as it was in this case. They are also searching for legal products that you are not paying duty on. Such as jewelry or anything beyond the $500 or whatever the duty free exemption is.

|6.25.07 @ 7:19PM|#

If you drive across the border, they can take your car apart bolt by bolt at their discretion. I don't think the EFF has much of a leg to stand on here.

|6.25.07 @ 7:25PM|#

So I got I right the first time. Please treat my second post like a campaign promise. It never happened.

|6.25.07 @ 7:29PM|#

What I find interesting is that the issue is so pointless. Assuming you support (as the overwhelming majority of Americans do) the foolish practice of trying to prevent drugs from crossing the border, you can support physical searches as furthering that goal. Even a lot of libertarians are willing to attempt to suppress child-porn -- but searching laptops at the border might be the least effective way of doing that.

Not surprisingly, almost all electronic contraband is transmitted electronically.

Any of you who insists on smuggling data the hard way -- by writing it on a physical medium and hand-carrying it past customs -- should investigate the field of steganography.

|6.25.07 @ 7:37PM|#

Password protection is mostly wishful thinking.

There are electronic utilities that will neatly crack open most computers protected with a password.

So if you want it confidential you need to encrypt it.

ktc2|6.25.07 @ 7:43PM|#

Been wondering how long it will be before you can be locked up until you agree to decrypt (ie give them password/key) your files.

Not much longer I think.

Nathan Bowers|6.25.07 @ 9:13PM|#

If you're worried about being forced to give up your password be sure to use an encryption scheme with plausible deniability: http://en.wikipedia.org/wiki/Deniable_encryption

|6.25.07 @ 10:19PM|#

If you drive across the border, they can take your car apart bolt by bolt at their discretion. I don't think the EFF has much of a leg to stand on here.

crimethink, according to Brian Doherty's post itself, that is not correct.

The Supreme Court has ruled that customs and border agents may perform "routine" searches at the border without a warrant or even reasonable suspicion[.]

The issue is what can be searched without "reasonable suspicion." Apparently, according to the post, they can do "routine" searches which certainly would not include taking your car apart, and should not include searching the electronic content of a laptop which is obviously not hiding drugs or weapons or fruit.

Doc|6.26.07 @ 7:32AM|#

No doubt the laptops are taken to the TSA's new Orwellian-named 'Freedom' Center

http://www.tsa.gov/press/speeches/freedom_dedication.shtm

|6.26.07 @ 7:47AM|#

Brian Courts,
I believe the "They can take your car apart bolt by bolt, and if they don't find anything, they give you back the pile of bolts and wish you a nice day" story.

I use to cross the US/CA border fairly regular, every car was stopped and "routinely" searched. This always included being questioned (Citizenship? Where are you going? How long were you in Canada? Are you attempting to smuggle drugs or other contraband into the United States? e.g.) and sometimes included a look in the trunk. However, the customs agent could deem you to be suspicious (for just about any reason), and single you out for a more intense search.

I've known people who were told "pull over there" and had their luggage opened and spread out while being grilled for a couple of hours.

cls|6.26.07 @ 8:15AM|#

What is done with the lap tops is more than a search for contraband. They often confiscate the computer and either keep it for weeks or copy the entire hard drive to go through it. Now compare that to what they do with a car? They may search a car thoroughly and bring out sniffer dogs and such. But they don't keep the car for weeks.

And the essence of a computer is information so when they copy a hard drive they have all your passwords, bank account details, etc. I believe the courts have previously ruled that constitutional rights regarding searches do not apply at border control because to apply you have to be officially within the country and you aren't in the country until the search is over.

|6.26.07 @ 8:38AM|#

PAPERS!! Get used to the searches. In this country you have been having the right to be stop and searched for crossing the street rememeber. we gave up those rights and now we dare question the invasion of a laptops privacy lol. PAPERS!!!

|6.26.07 @ 8:45AM|#

They often confiscate the computer and either keep it for weeks or copy the entire hard drive to go through it.

As long as they are just copying it, who cares? I thought you didn't have any property rights in information anyway.

|6.26.07 @ 8:47AM|#

If they took my company laptop with a mind to rummage through it, I'd accuse them of trying to steal corporate information. They a free to verify that the laptop is one given to me by my company, but they would not be free to browse through it and i'd sit there in customs until they got the point. Granted, some border guards are just as hard headed and rock stupid and some LEO's, but I'd protect my company from prying eyes of idiots.

db|6.26.07 @ 9:18AM|#

For a previous employer I was doing some work in Canada. I shipped-ahead a box containing some scientific instruments and an obsolete laptop used for datalogging to myself via UPS.

When I arrived at the job site, my box had not arrived yet. A couple of days later we found that the box was held up in Canadian Customs. A week and a half later my box showed up, with the two $5,000-apiece instruments, but no laptop. No explanation was ever received for the missing laptop, however, UPS replaced it based on the insurance we had bought on the package. Luckily there was no company confidential information on the laptop.

|6.26.07 @ 10:29AM|#

Brian Courts,

Leaving aside the question of what exactly "routine" will mean in practice, I'm pretty sure BP agents can take your car apart if they suspect you have some sort of hidden compartment in the car, where you could be hiding contraband, explosives, illegal aliens, etc.

And while a laptop obviously doesn't contain fruit or drugs, it may contain child pornography or illegally copied copyrighted material, both of which you are NOT allowed to import, so Customs agents are allowed to inspect them at entry into the US.

Jozef|6.26.07 @ 10:34AM|#

Passwords and encryption are nice, and I'm using both, but I still prefer keeping all my data on a server, off my travel laptop. My travel laptop is nice and clean, with only the basic software installed, and an empty Documents folder. The only personal information anybody would be able to find (without running some heavy-duty hard drive recovery tools) are severely time-limited cookies.

cls|6.26.07 @ 10:53AM|#

The remark: "As long as they are just copying it, who cares? I thought you didn't have any property rights in information anyway" is rather absurd.

This individual seems to be saying you have no right to keep the pin number to your bank accounts secret. They are confiscating information that can be used to rob people blind or can be used for identity theft. There is all sorts of information that people have property rights in. Patients, copyrights are two examples.

|6.26.07 @ 11:04AM|#

I'm curious what the libertarian justification for punishing possession of child porn is. I understand that it's intended to remove the profit motive for the producers of such material, but we don't apply that reasoning to other products.

For instance, I'm sure I have some stuff that was made with Chinese slave labor. Why is it not OK to punish me, so as to discourage the rights-violating use of slave labor, but it is OK to punish the possessor of foreign-made child pornography?

|6.26.07 @ 11:08AM|#

As long as they are just copying it, who cares? I thought you didn't have any property rights in information anyway

You're comparing apples and oranges. In this case, the person is being forced to disclose information that they wish to keep secret. That's totally different from trying to keep someone else from disseminating information you've already disclosed.

|6.26.07 @ 12:33PM|#

Why is it not OK to punish me, so as to discourage the rights-violating use of slave labor, but it is OK to punish the possessor of foreign-made child pornography?


I'll take a stab at answering your question: Because there is no obvious way to tell whether the goods were, in fact, made with Chinese slave labor. However, in the case of child pornography, it is quite obvious that a crime was committed. The pictures are the evidence. Concerning the so-called slave labor goods, it is not readily apparent that a crime was committed in the course of their manufacturing.

Also you should consider the fact that "slave labor" is a pretty generic term. It would require a clear definition as to what hypothetical offenses are being committed against the workers.

For further example, if you had a cat and someone gave you pictures that they took of themselves abusing your cat, wouldn't you want that person punished for torturing/abusing your cat, even if the cat appears to be physically ok? I would think so. In regards to child pornography -- and I will add that I am not a computer forensics expert -- I imagine that it is not easy -- or perhaps not even possible -- to tell where the images originated from, so logically the possessor of said images should have some share of the blame for them.

I don't think the "slave labor goods" analogy holds up well. I'm not an economist so I can't say why exactly, but I think varied standards of living would be one reason why. If a country's economy is shite through and through, sometimes a sweat shop is the only place to earn a living.

|6.26.07 @ 1:52PM|#

However, in the case of child pornography, it is quite obvious that a crime was committed.

That's debatable. First off, in some cases you can't be sure that the "performers" are actually children; and even if you could, you can't be sure that production was made in a jurisdiction where the age of consent is higher than their ages.

I guess the heart of my question is, why do we assume that the China-made cup holder in my car was made without violating anyone's rights until proven otherwise, but we assume that any pornography with young-looking performers did violate their rights until proven otherwise (which is why professional porn studios have to keep evidence of the age of their performers).

|6.26.07 @ 2:23PM|#

crimethink,

I think we are using different definitions of the term "child pornography". You seem to be using the strict legal sense of the term, taking it to mean any pornography with "young-looking" performers under the age of 18 in the US (or whatever imposed teen age that any given country decides upon). I am not talking about teenagers. I am talking about people who are clearly not adults in any way, shape, or form. And most countries do consider that a violation of a minor's rights, so that is why we probably assume that someone's rights were violated until proven otherwise.

|6.26.07 @ 7:38PM|#

I'm pretty sure BP agents can take your car apart if they suspect you have some sort of hidden compartment in the car, where you could be hiding contraband, explosives, illegal aliens, etc.

Presumably they have "reasonable suspicion" as you have stated it, yes.

[The laptop] may contain child pornography or illegally copied copyrighted material, both of which you are NOT allowed to import, so Customs agents are allowed to inspect them at entry into the US.

No, you are again missing the "reasonable suspicion" part. The fact that you could be doing something illegal is not sufficient to meet the standard so there is a case here. If you are merely saying that in practice they may decide it is reasonable, then fine, that might well be true (apparently it is true) - but that is precisely why we have the court case. To simply state that they can search because there just might be illegal items somewhere clearly is wrong according to the current legal standard as stated by the Supreme Court.

Same thing for Warren's comment above - yes if they have a reasonable suspicion they can take your car apart I'm sure. This is not about that, this is about a random person with no reason to suspect he has child porn or anything else on him being asked to allow a search through his computer. I don't get why that distinction seems so hard for anyone to address.

As the stated Supreme Court standard now stands, there is a limit on what border agents can search without suspicion. If that turns out to be ignored in practice then we end up with court cases like this where the court can address what a "routine search" includes. Simply arguing that there could be something illegal does not even attempt to address the standard. You have to make an argument for why a laptop's contents should be considered "routine" in terms of searching.

Robert|6.26.07 @ 8:21PM|#

But why should possession of evidence of a crime itself be criminal? For instance, the cat example.

|6.26.07 @ 10:17PM|#

Get a mac, turn on FileVault on your login. Log off before getting on the plane, or power off (that's what I do). Create a dummy login with nothing interesting in it. Use it every now and then so it has some docs lying around. Log in to the dummy login to show the BP agents your stuff.

Can anyone here name the two constitutional rights that Bush has not sought to undermine? The protection against unreasonable searches definitely has been shredded already, folks.

Amir|6.27.07 @ 5:43AM|#

Password protection won't work. They will force you to provide it and, if you refuse, it will be interpreted as 'guilt' and you won't be allowed to proceed.

Ideally, you should just hide your private data and let them see the stuff you don't mind them seeing. i.e. you need plausible deniability.

For this reason, I recommend http://www.truecrypt.org/