President Trump’s nominee to be Commissioner of U.S. Customs and Border Protection (CBP), Kevin McAleenan, revealed during his confirmation process how the agency implements its new policy not to access cloud content during border searches of digital devices.
In response to written questions for the record submitted by Sen. Ron Wyden (D-OR) and other members of the Senate Finance Committee, McAleenan explained that in accordance with CBP’s new policy to access only information that is “physically resident” on a device, border agents must “ensure that network connectivity is disabled to limit access to remote systems” (page 92).
While McAleenan did not provide details, disabling network connectivity can mean a few things, such as putting a phone or other device into “airplane mode,” or individually toggling off cellular data and Wi-Fi. It could also mean making sure a laptop is not connected to an Ethernet cable, or bringing a device into a SCIF-type room that blocks electromagnetic signals.
This newly disclosed fact—that border agents must disable Internet connectivity before searching a digital device—provides a more complete picture of CBP’s new no-cloud-access policy.
The public first heard of this new policy when McAleenan submitted answers to a separate set of written questions from Sen. Wyden in June 2017. In that document, McAleenan stated that CBP “issued a nationwide muster in April 2017 reminding its officers” that they may only access data “physically resident” on a device. As we explained, CBP’s 2009 policy—the operative policy on border searches of digital devices—does not prohibit border agents from searching travelers’ cloud content. Rather, that policy broadly authorizes agents to search “information encountered at the border,” which apparently would include cloud data accessed via a digital device at the border. Thus the April 2017 muster is a new policy that for the first time bars cloud searches. We welcome the muster.
Because CBP did not make the muster itself public, we submitted a Freedom of Information Act (FOIA) request seeking the document. After filing our Alasaad v. Duke lawsuit challenging border device searches, we received a heavily redacted muster. We then filed an administrative appeal, and in response CBP released the one-page muster with significantly fewer redactions, as well as a two-page accompanying memo with some redactions.
The redacted muster states:
- To avoid retrieving or accessing information stored remotely and not otherwise present on the device, where available, steps such as [REDACTED] must be taken prior to search.
- Prior to conducting the search of an electronic device, an officer will [REDACTED].
Apparently, these muster redactions refer to what McAleenan has since said publicly: that border agents must disable Internet connectivity before searching a digital device.
Additionally, in his most recent responses (page 89), McAleenan stated that CBP’s no-cloud-access policy goes “above and beyond [that which is] constitutionally required.” We couldn’t disagree more. While we believe that warrantless and suspicionless searches of digital data on a device violate the Fourth Amendment, warrantless and suspicionless searches of cloud data are even more intrusive. The Supreme Court in Riley v. California (2014) agreed, stating, “Such a search would be like finding a key in a suspect’s pocket and arguing that it allowed law enforcement to unlock and search a house.”
We urge travelers to report to us (borders@eff.org) when they believe that CBP agents searched their cloud data by failing to put a device in airplane mode or otherwise ensure that the device did not have Internet access. We also urge travelers to submit a FOIA/Privacy Act request to CBP to learn additional details about what border agents might have done with their devices.
Sen. Wyden called on McAleenan to make the entire muster public (page 92). We echo that call. Americans and other travelers have a right to know exactly how the federal government intends to protect this critical aspect of our digital privacy.
