Of laptops and US border searches

Original URL: https://www.theregister.com/2008/03/24/us_border_control_laptop_searches/

Feds seek unfettered access

Posted in Legal, 24th March 2008 09:02 GMT

Recently, I was going through an airport with my shoes, coat, jacket, and belt off as well as with my carry-on bag, briefcase, and laptop all separated for easy inspection. I was heading through security at the Washington D.C., Ronald Reagan National Airport in Arlington, Virginia, or "National" as we locals call it. As I passed through the new magnetometer which gently puffed air all over my body - which to me seems to be a cross between a glaucoma test and Marilyn Monroe in Gentlemen Prefer Blondes - a TSA employee absent-mindedly asked if he could "inspect" my laptop computer. While the inspection was cursory, the situation immediately gave me pause: What was in my laptop anyway?

Similar thoughts must have gone through the head of Michael Timothy Arnold on July 17, 2005. He was having a bad day that was about to get much worse.

Arnold arrived at the International Arrivals Building at Los Angeles International Airport after a 20-hour flight from the Philippines. He might have looked like any other US traveler arriving from Manila after what he said was a three-week vacation visiting friends--tired, haggard, and casual. The Customs and Border Patrol agents were a bit suspicious, because they knew the Philippines is a haven for "sex tourism." They were also suspicious because Arnold could not remember the name of the company where he had once worked as a night auditor and appeared "fidgety." They demanded that Arnold power up his laptop, which the agents then examined for child pornography - which they ultimately found.

The Federal District Court rejected the government's argument that a search of a laptop is no different than rifling through luggage during arrivals inspection, and they suppressed the warrantless and essentially "suspicious-less" laptop search as unreasonable. The case was argued before the federal appellate court in October 2007 and a decision is imminent. The salient question: To what extent may customs, border, immigration, or other government officials search, mirror, copy, or analyze the contents of electronic gadgets with neither probable cause nor a warrant?

At the edge of law

It is clear that people traveling into and out of a country have a lower expectation of privacy at the border. Perhaps more accurately, a governmental search at the border is more likely to be considered "reasonable."

The agents get to do things they can't do if, for example, they simply stop you on the street. They can question you, they can rifle through your unmentionables, and even examine documents you are bringing with you. The agents can even disassemble your gas tank, looking for hidden compartments that you could be using to smuggle things. In the Arnold case, the government argued that its search authority at the border is "plenary" or unrestricted, except that to do an invasive body cavity search, it would have to have some kind of suspicion.

But searches of things? Well, they can do whatever they want it would seem.

The customs agents' job is to protect the nation from "anything harmful," to gather intelligence, prevent terrorism, and to enforce all of the laws, including child pornography and copyright laws. The computer is no different from any other "closed container" that the agent may search. Just as the agent needs no probable cause to search your underwear, they need no probable cause to rummage through your laptop. And besides, they are doing it to protect the country and enforce the laws and prevent terrorist attacks. You don't have any privacy rights at the border anyway, so what's the problem?

Same planet, different worlds

So, for example, is a computer the same as a briefcase or suitcase, under the law? I mean, if you don't want your stuff searched, don't bring it with you. You abandon your "expectation of privacy" at the border, right?

The government's position is as frightening as it is naíve. A computer is not the same thing as a briefcase. Nor, for that matter, is an iPod, a thumb drive, or a cell phone. It is both quantitatively and qualitatively different, and that makes all of the difference in this case. It seems that the government and the lower court are speaking past, and not at, each other. The government says, "We can do anything for any reason," and the court says, "No, you need reasonable suspicion to search a laptop."

Indeed, they are both wrong.

The consequences of the government's argument would be that they could, at the border, seize your daughter's iPod and lock her up if they thought the songs were not licensed. They could copy the entire contents of your computer, read your e-mail, medical records, communications with doctors, lawyers, or priests. They could examine deleted files, create a database of your friends and associates, and provide any or all of this information to the CIA, Interpol, the NSA, the FBI, or for that matter, the Iraqi intelligence services. All without probable cause, suspicion, or warrant, because you had the unmitigated gall to cross the border with your laptop.

Encrypting files on the laptop would be of little utility because, if they win their argument in another border search case in Vermont, they could compel you to provide them with the encryption key. The only thing you could do is not take your laptop or wipe it clean before you come back.

The consequences of the defendant's argument are likewise unappealing. If the government could not search computers at the border (or needed reasonable suspicion, which they don't need to search luggage), there is some merit to the argument that the computer will become the medium of choice for transporting contraband (although it's still easier to simply e-mail it to yourself.)

Luggage or laptop?

The government's argument is predicated on the assumption that a laptop is no different from any other container. Yet, that assumption is simply is not true.

Computers contain vast quantities of confidential and private information, communications, and relationships, for which most people would agree should be maintained with a reasonable expectation of privacy, even when they cross the border. While all of this information is entitled to legal protection against unreasonable (e.g. warrantless) searches by the government inside the country, some of it is entitled to even greater protection. Stored electronic communications, privileged materials, trade secrets, financial records, and other information are particularly protected against government intrusion.

While most people do not travel internationally with a copy of every chat they have ever had, or every Facebook friend's picture in their Samsonite, or every picture they have of their boyfriends or girlfriends, they have exactly this information on their laptops. They have their checkbook information, passwords, financial records, medical records, correspondence, records of books purchased, Web sites reviewed, and more. In short, communicative and expressive materials.

In 1958, the State of Alabama required the NAACP to provide it with the names and addresses of all of its members, a requirement that the Supreme Court held violated the expressive and due process rights of the organization. Yet, according to the current government's argument, if this information was contained somewhere on a laptop computer traveling across national borders, the information could be accessed, copied, and entered into a central depository, even absent of any evidence of criminal activity.

Indeed, if we accept the government's argument, there is no reason to restrict this doctrine to border searches. A search at the border is permissible because it is "reasonable." It is "reasonable" because the government has a good reason to do it -- to protect the borders. But, just try flying domestically without being patted down and having your luggage examined. Certainly such a "search" on a domestic flight is "reasonable." Oh, and on a train or bus as well. Try entering any federal property, such as a federal office building, military facility, or courthouse. You and your belongings are subject to search, but does this give carte blanche for examining, copying, or analyzing the contents of electronic devices at any of these places? I think not.

A compromise

I'm all for catching child predators and terrorists, as I think the vast majority of us are. If we keep the warrantless and suspicion-less searches limited, then these types of searches might be "reasonable." Even without suspicion, it is reasonable at an international border (or even at the airport) to ask someone to boot up their computer to make sure it is really a computer, and is not being used to transport illegal bombs or drugs. That's what should be considered "reasonable."

If there is some suspicion (and perhaps what Arnold was doing was suspicious enough, perhaps not), the border agents can make a cursory inspection for a specific list of prohibited contraband (for example, child pornogrpahy), just as they could rifle through files in a briefcase to look for kiddie porn in a magazine. Anything more intrusive should require either greater suspicion or probable cause and a warrant. Sure it would be nice to be able to mirror the hard drives of suspected terrorists or their families, friends, or associates and create a super database of associates and communications (similar to what is done with computers seized on the battlefield in Iraq or Afghanistan). It would be nice to do that without a warrant, even if they didn't cross the border. But how do we know they are suspected terrorists? Shouldn't a "reasonable" search at the border require some level of suspicion?

What is needed is some limit on governmental search and seizure powers for electronic information, even at the border. Overall, to pass constitutional muster, the search must be reasonable, but more leeway could be granted to the Customs and Border Protection Service because of their mission, which is essentially to prevent contraband from entering the country. Once you expand that mission to gathering information about any violation of law (tax laws, copyright law, SEC reporting laws, or sodomy laws, to name a few) and to "gathering intelligence" about potential crimes (for example, terrorist patterns), the scope of the permissible search becomes, as in the government's argument, "plenary".

That's where reasonableness ends. To give border agents unfettered authority to search the full contents of anyone's computer, for any reason, defies common sense and constitutionality. To allow the "seized" data to be carted off to a massive and unrestricted law enforcement and intelligence database is likewise unreasonable. As James Madison stated in 1788 (anonymously, by the way) in Federalist 51:

If men were angels, no government would be necessary. If angels were to govern men, neither external nor internal controls on government would be necessary. In framing a government which is to be administered by men over men, the great difficulty lies in this: you must first enable the government to control the governed; and in the next place oblige it to control itself.

Some border searches of laptops are reasonable, even without suspicion. Some are reasonable with only "specific and articulable facts" to lead one to believe that there is evidence of specific wrongdoing on the computer. And some searches, seizures, and copying of computers are just flat out unreasonable. For example, reading attorney-client or priest-penitent privileged and personal files. It isn't all or nothing, despite the government's arguments to the contrary.

Now, can I get my laptop back?

SecurityFocus columnist Mark D. Rasch, J.D., is a former head of the Justice Department's computer crime unit, and specializes in computer crime, computer security, incident response, forensics and privacy matters as Managing Director of Technology for FTI Consulting, Inc.

This article originally appeared in Security Focus.