0

Lets say you just traveled outside your home country (USA). You keep your data on a secure USB (FIPS 140-2 level 3) that will self destruct after (x) number of failed attempts. The data you keep on your drive is very important (Company Secrets, Passwords, Unrecoverable encryption keys, etc.. Very valuable data). When entering the country again the CBP agent flags you for an additional inspection. Upon inspection, they discover your super secure USB with a keypad that peeks his interest. They decide they want to inspect what is on the drive. When asked to unlock the drive you refuse but divulge that very important business data is on the drive.

..At this point they claim you might be a "terrorist" in order to have reasonable suspicion. The CBP agent confiscates the USB in order to do a "forensic examination". During this examination someone handling the drive attempts to unlock the drive too many times and destroys the data.

CBP DIRECTIVE NO. 3340-049,

5.4.1.5 Safeauarding Data During Storage and Transmission. CBP will appropriately safeguard information retained, copied, or seized under this Directive and during transmission to another federal agency. Appropriate safeguards include keeping materials in locked cabinets or rooms, documenting and tracking copies to ensure appropriate disposition, and other safeguards during transmission such as password protection or physical protections. Any suspected loss or compromise of information that contains personal data retained, copied, or seized under this Directive must be immediately reported to the Port Director, Patrol Agent in Charge or equivalent level manager and the CBP Office of Internal Affairs

The data on the drive causes your company to go belly up due to the lose of this drive. This costs you personally millions of dollars and potentially billions worth of investor money.

  • Is the government liable for data destroyed during a forensic examination?
  • What agency would be liable?
  • Are there limits to the amount you can sue the federal government?
Improve this question

2 Answers 2

Reset to default
2

It's well known that the US federal government generally has immunity from liability, unless you can possibly prove negligence on the part of an employee. See Sovereign immunity in the United States - Wikipedia.

You would sue the agency who employs the technician who tried to guess the login and hope to prove that the employee knew that his actions could cause the data loss. And in that lawsuit, you will allege that the loss of the data caused your company to fail and you are suing for compensation in the amount of your losses.

You will have to prove that the data was business critical in order to make your case, but without (a copy of) the data to prove that it was indeed critical to your business, where is your case? And one part of the government's defense will be that if that data was so valuable, why didn't you have a backup?

How much can you sue for? Any amount. But don't count your chickens before they hatch.

Improve this answer
2
  • Couldn't the lawsuit be dismissed on the basis that the damage is due to the OP's failure to disclose the password to the drive? Assuming of course that it is decided that forcing the OP to provide the password isn't against the 5th Ammendment (law.stackexchange.com/questions/1523/…)
    – SJuan76
    Oct 17, 2018 at 8:03
  • Could be; and that the person knew the drive would erase the only copy of the data.
    – BlueDogRanch
    Oct 17, 2018 at 20:47
0

Given the obvious risks of taking the sole copy of such valuable data on a portable device (what if the carrier is mugged, or has a pocket picked, or falls into water, etc?) this might be deemed so foolish that a reasonable person would not have so acted, which might reduce or eliminate damages.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .