The Register's guide to protecting your data when visiting the US
Summary: You're (mostly) screwed without preparation
Getting into America can be tricky at the moment if you have the wrong skin color or the wrong surname.
Even though President Donald Trump's crackdown on refugees and Muslim immigrants has been put on hold by the courts, US border officials have got the message: now's the time to make life difficult for some people entering the country.
Just last week, American-born NASA scientist Sidd Bikkannavar said he was stopped by border agents when he returned from racing solar-powered cars in Patagonia, South America. The G-men insisted to their fellow citizen he hand over his JPL-issued government phone and PIN so it could be inspected and its contents copied.
"On my way home to the US last weekend, I was detained by Homeland Security and held with others who were stranded under the Muslim ban," Bikkannavar wrote on Facebook. "Officers seized my phone and wouldn’t release me until I gave my access PIN for them to copy the data."
You don't have to be a refugee nor from one of the seven Muslim-majority countries on Trump's badly worded executive order on immigration to feel the heat from customs and borders staff. Green card and visa holders, even Canadians, have been stopped.
If you're traveling into the Land of the Free, what are your rights? What about the data on your devices? The Register has been talking to experts on the matter and the results aren't looking great.
Good cop, bad cop
Like a police officer, a US Customs and Border Patrol (CBP) official must have a reasonable suspicion that a crime or immigration violation is being committed, before seizing and searching devices and possessions. Unfortunately, CBP staff aren't always adequately trained, and there isn't much oversight, so this requirement of probable cause can be pushed to its very limit by some agents.
Border officials don't just have authority over you at your point of entry – CBP can take action within 100 miles of any US border, which covers roughly two thirds of the country's population. While CBP has more powers at borders, within that 100-mile zone the agency is perfectly within its rights to set up immigration checkpoints, and to conduct searches if officers feel they have a reasonable suspicion about someone.
In practice, tourists have been stopped in national parks and asked to show their visitation paperwork, or stopped when driving down the road. While some of these cases were slapped down in court as unfair searches, it took time and money to do so. Always make sure you have identification with you at all times and keep it safe.
When it comes to safeguarding your personal data on devices, CBP has considerable leeway in what it can demand and copy – basically everything is up for grabs. The CBP told The Register it reserves the right to check "computers, disks, drives, tapes, mobile phones and other communication devices, cameras, music and other media players, and any other electronic or digital devices."
"All persons, baggage, and merchandise arriving in or departing from the United States are subject to inspection, search and detention," a spokesperson said.
"This is because CBP officers must determine the identity and citizenship of all persons seeking entry into the United States, determine the admissibility of foreign nationals, and deter the entry of possible terrorists, terrorist weapons, controlled substances, and a wide variety of other prohibited and restricted items."
While this is applicable to all, it's important to note that when entering the US you have a particular set of rights depending on whether you are a citizen, a legal permanent resident, arriving on a visa, or visiting under a visa waiver program.
I'm a Yankee Doodle Dandy, you're not
First off, if you're a US citizen, the CBP doesn't have the right to block you entering the homeland. However, if there's an outstanding warrant out on you, expect to be collared as soon as you set foot on American soil.
When it comes to data security, American citizens also have additional rights, although there are some important caveats.
"US citizens can't be compelled to turn over passwords," Nathan Wessler, staff attorney at the ACLU, told The Reg. "But border agents may make your life much more difficult. It does have the right to seize electronic devices and send them off to a forensics lab for tests that could take weeks or months."
Such laboratories are typically not in the airport building, and devices that are taken could be sent anywhere in the US. You can get them back – if you're willing to pay for delivery charges; There's no time limit on Uncle Sam holding them; and you're dependent on an overworked techie getting around to checking them out.
If you are coming in on a green card, visa or a visa-waiver, you technically don't have to give up passwords or encryption keys. However, the CBP doesn't have to let you into the country if you refuse – it's up to the discretion of the CBP officer at the time.
If you are refused entry, you'll be put in a holding cell and sent home. If you're lucky, the airline will let you change your return ticket – if not you'll have to pay for another one. Being ejected will show up as a big red flag next time you try to enter the US.
Sponsored: Becoming a Pragmatic Security Leader