4

My question pertains to the somewhat recent emergence/increase of technological searches present at US borders. The premise I am operating under is that, a), while there are limits to this, border agents can demand passwords to phones, laptops or similar devices, and b), you face annoying to potentially serious consequences (being detained, not allowed to enter the US, and/or having your device confiscated for a period of time or indefinitely). I don't have what I would consider sufficient sources for this information (i.e. for documenting what is actually legal*, certainly there are many sources documenting that such events have occurred).

*I am aware that the law in this case may change or become more clearly defined, as matters seem to have a degree of fuzziness now.

All of that out of the way, consider somebody (a US citizen) crossing the US border who, knowing they might be stopped and asked for their password by border agents, set an unusually long password. Specifically, one occupying several letter-sized pages. When asked for their password, they provide a pre-printed copy of this password (the rationale is that typing such a password would likely take many attempts and be highly irritating, since you cannot see mistakes on most computer login screens - the individual perhaps intends this to be a protest). What, if any, legal consequences could result from doing this? I am aware that there are significant risks of practical consequences resulting from this, such as being detained regardless of law, however, I am interested in the legal aspect.

In a different scenario, someone (again a US citizen) chooses to instead infect their computer with malware which is programmed to spread to any connected devices (say, if border agents connect USB devices with forensic tools to collect data). Perhaps this person too thinks of this as a protest. What are the potential legal consequences of doing this?

I should specify that while I am somewhat flexible with my language by saying "potential" consequences, an answer merely stating the relevant computer misuse laws for the latter, or failure-to-comply laws for the former isn't exactly what I am looking for - I am interested in an analysis that specifically accounts for the context of these border searches.

I have no intention of doing any of these things, nor would I endorse them being done.

Improve this question
5
  • What's the status of the person? US citizen? Resident? Tourist?
    – D M
    Jan 31, 2018 at 6:24
  • 6
    Setting a long password, and attempting to infect another computer with malware are two very different things; the difference is not slight.
    – Brandin
    Jan 31, 2018 at 7:50
  • Related: law.stackexchange.com/q/24293/271
    – cHao
    Jan 31, 2018 at 18:39
  • @brandin I understand the point and have edited my question accordingly. The reason I think these are related is that they are the two most obvious ways that occurred to me one could cause border agents problems with such a search.
    – Davis
    Jan 31, 2018 at 20:09
  • @DM US Citizen is what I intended, and I edited this into the body of the question. It might be interesting to know what the differences are for other statuses, though.
    – Davis
    Jan 31, 2018 at 20:10

1 Answer 1

Reset to default
1

As a citizen, you cannot be denied entry into the US, so you can simply refuse to comply with a demand to unlock your phone, or give them the password. They may (temporarily, some number of weeks) confiscate the device until it is determined to not be a problem (whatever the security issue is). They cannot compel you to unlock it or reveal the password, though a court order could have that result. The consequences of having a 400 character long password are probably similar to the consequences of a refusal, save for the court order part: you can be delayed, and it will cost you something (shipping) to get your device back. This ACLU article spells out the difference between what you'd hope for and what is.

CBP has a leaflet explaining that you may be searched, some of what their statutory authority is (8 USC 1357, 19 USC 1499,1581,1582). As they say, "failure to provide information to assist CBP or ICE in the copying of information from the electronic device may result in its detention and/or seizure". A more detailed document is here: is it almost 10 years old, so things may have changed. However it indicates that seized devices should normally be returned within 30 days; they should be conducted with the knowledge or presence of the traveler; consent is not necessary. See p. 8 for a bit of discussion of the possibility that it may be impossible or imprudent to get a password from a traveler – they can just copy the storage device.

As for leaving a computational booby trap is concerned, that presumes more technical knowledge about how CBP works and what such a trap would be like than I have. Infecting another computer is a crime.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .