Why do US Customs search laptops?
 

As I reported in a recent trip report, I received the "random" (aka I was silly enough to be the first person out of baggage claim and they had nothing better to do) search by Customs at SFO a few days ago.

One officer powered up my laptop, turned it towards himself and proceeded to browse through the directories. I leaned forward so that I could see what he was doing. He said "you could lean back a bit", to which I replied "yes, I could, but I want to see what you're doing to my machine". This was not a well-received response. After some minutes of browsing, he'd finished. He never looked at anything in the Linux partitions, of course. I was wishing I'd made Linux the default boot OS, as I'm sure that would have confused the hell out of him. I really wanted to tell him where to find both the MP3 and the video of American Idiot (yes, they are on my laptop) but decided against it.

Once he was finished, I asked what he was looking for, and he replied there were many possibilities, including "illegal company records, pornography". Now, given the search he was doing, there's no way he'd have known any company records, or even been able to tell if I had any. As for pornography, I wasn't aware of that being illegal in the USA. It seems to be available everywhere, including on public access TV in Seattle and on most computers.

I strongly suspect that those were totally bull.... answers, but I don't know. Two things I am left wondering:

1) Does he have any right to search though my belongings (including searching my laptop) without my being able to see what he's doing? He could have caused serious damage or data loss and I'd rather not allow that. (I was carrying a complete CD-based backup of the whole machine in one of my other bags though.)

2) What are they really looking for? Are they really looking for anything, or just being terrorists? As far as I could tell, he was just browsing at random to try to annoy me and waste my time.

He probably was at least looking for child pornography, of which mere possession is illegal in the U.S. (as well as many, many other places). His ability to find it is another matter, of course! I imagine that people who indulge in child porn protect it reasonably well. They know it's illegal, obviously.

Bruce

The importation of immoral articles is illegal. Where pornography is concerned, this has been defined by the courts as bestiality and child porn. CBP seizes child porn quite frequently, and that is almost certainly what he was looking for. While some are good at hiding it, many don't bother and bring it across on hard drives, CD's, etc.

The "business records" part, however, does not make any sense.

And yes, he had every right to search your stuff without you watching.

Edit: bestiality is in a weird "you can possess it, depending on state law, but importation is still illegal under federal law" category, along with switchblades.

Back in my private sector days, I always carried blank company nondisclosure agreements for proprietary information and was prepared to make any overzealous TSA officer or other government official sign one if I believed they were reading company materials for which they did not have access.

Ha. Speaking for me, I'd tell you to shove your form up your behind. The law allows him to search it and does not require compliance with your corporate policy.

One can certainly imagine a set of circumstances under which a government official came to possess valuable corporate information. For instance, a Customs official searching an investment banker might learn of a merger in the works. Acting on that insider information would already be illegal. Violating a nondisclosure agreement wouldn't add too much to the guy's troubles if he were caught!

I wonder if anything like that has ever happened? The answer is probably yes, but I just never heard of such a case.

Bruce

Very true. There are parts of the Privacy Act and/or Trade Secrets Act which also probably apply.

As an attorney, I have some concerns about TSA searching documents and possibly waiving attorney-client privileged status of the documents. Any thoughts?

FUnny -- That's exactly what I'd expect you to say. I wouldn't expect you to care about company policy, but I would expect you to care -- and demand you comply with -- the law of the land: Intellectual property laws, trade secret laws, insider trading laws just for starters.

Hunh? Not in this country.

Child porn has a special definition. "Pornography," generally, has no legal meaning whatsoever. "Obscenity" can be regulated (but is not illegal, per se).

What is "CBP"? Are you talking about a country other than the U.S.?

There is a federal law that proscribes child pornography. I'm not aware of any federal law that addresses any other category other than "obscenity."

Yup. I have exactly the same concerns. I wouldn't allow it and, if necessary, would go to the mat to prevent it.

CBP is Customs and Border Patrol part of DHS.

If that is true, why is it the case? Someone inept (or malicious) could do massive damage to data without ones knowledge. They could do so even if you were watching, but knowing what needs to be fixed/recovered from backup would reduce the hassle factor enormously.

The thing that struck me as odd about it was that all of the physical searching was done right in front of me, with every opportunity for me to see exactly what was being searched and put everything back in its place afterwards. Maybe they aren't required to do that, but they did it that way. Why then conduct the laptop data search in such a different manner?

I believe the Patriot Act relieves you of having to worry about waiving attorney-client privelege, right? ;)

Anything crossing the border can be inspected. That's it. There is one exception, and that is foreign diplomatic pouches.

All of the laws you cite merely prohibit the use of that information for unauthorized purposes.

Yes in this country. 19 USC 1305 is entitled "Immoral articles; importation prohibited". You might wish to read it. It specifically bans the importation of any "article which is obscene or immoral". This even includes advertisements of foreign lotteries for some reason.

I never said pornography was prohibited. Simply that bestiality and child porn are considered obscene and/or immoral and thus their importation is prohibited under the statute I cited above.

Nope. Talking about the US. CBP is Customs and Border Protection. It was formed about two years ago by a merger of the Customs, Immigration, and Agriculture inspection functions, along with the Border Patrol.

There are several reasons why people are not always allowed to witness the search of their bags, vehicles, etc. during a CBP inspection. The first is that often they get in the way. Another is for officer safety, especially if the travelers outnumber the officers involved. A third is that there are some inspection methods and technology that are simply not for public knowledge. Finally, it is sometimes just an established policy after something happens.

Now, I can't see how any of those apply to this laptop search. My guess is the guy was either just copping an attitude, or he thought he was a computer genius and didn't want to give away his super-top-secret computer search techniques. :rolleyes:

Primarily to see if you visit this kind of website

How subversive! Good way to become one of the 80,000-plus names on the terrorist watch list. :D

Any correlation between post counts and getting blacklisted by los federales? Or is it an inverse relationship? :D

Interesting. Without researching it to see if it's ever been tested, I'd say it is unconstitutional on its face, or at least unconstitutional as-applied if it is extended to anything other than obscenity.

Wow. I can't keep up with all the changes that have been made in the name of homeland security. Thanks for the correct info.

Yes, I can see why he might not want to reveal his super-top-secret computer search techniques. Well, technique, since it appeared to be singular and appeared to entail: Click on "my computer", change the view from large icons to list, click on drive letters, click on various directories until bored.

It's all mind-bogglingly lame. The Linux partitions are not visible to Windows, so much of the drive wasn't even searchable by his super-top-secret computer search technique.

It has certainly been used many times as a basis for seizure and civil forfeiture. You should read the law...there's a whole lot of items which are specifically prohibited from importation. And that's just one statute. People don't realize just how complicated import laws can be -- after all, they have an entire title (19) of the US Code.

Statute is at http://caselaw.lp.findlaw.com/script...le=19&sec=1305

A quick search turned up two Supreme Court cases, both finding §1305 to be Constitutional. See US v 12-200 ft. Reels of Film (413 U.S. 123) from 1973 and US v Thirty-seven Photographs (402 U.S. 363) from 1971. These were both obscenity cases. I didn't turn up challenges to the other provisions in my cursory search.

SCOTUS case web links for the lazy: http://caselaw.lp.findlaw.com/script...s/413/123.html and http://caselaw.lp.findlaw.com/script...s/402/363.html

My pleasure. Customs, Immigration, and Agriculture merged into two agencies: CBP and ICE. Simple, eh? :D

The sad part is that the technique described above still manages to find child porn. Who said criminals were smart?

Agreed. I consider myself to be a rather computer-savvy person, but without either my tools or the owner's cooperation, I wouldn't have a chance of finding well-hidden files.

So does your computer require a password for access to Windows? And if so, I presume you were asked for it and gave it to him?

One thing that nobody has mentioned is the International Traffic in Arms (ITAR) regulations. If you are a government contractor, or you work in the science or engineering fields, or you have advanced cryptographic software on your machine, or even if you aren't or don't, you might have information that is outlawed for export on your machine -- look up the ITAR regulations -- and you could be in deep water if such information is discovered.

It doesn't require one. I treat Windows as inherently insecure and consider password protection of it pointless (against any intruder with any real knowledge). I assume that I would have had to provide any password if asked, just as I had to unlock my checked bag to let them search that.

The funny thing is that I had been considering just the night before whether to disable the Windows boot altogether and make it boot straight into Linux. I so wish I'd done that, because I've have loved to have seen what he'd have done with a Linux command line.

I'm only questioning a seizure based on an expressive work being, "immoral." If I want to bring in a non-obscene (by the Miller standard) pamphlet advocating, for example, premarital sex, it would be a First Amendment violation to preclude it.

As I said, obscenity-based seizures are not constitutionally problematic. I have a problem with the "immorality" provision. At best, it's impermissibly vague and, at worst, a substantive infringement of 1st, 4th and 5th Amendment rights.

Ah my friend. Windows can be made to be VERY secure. I'd like to avoid a religious debate on which OS is better, but since I detest the idea of some overweight (you didn't mention he was skinny, so I'm assuming he's average) and overzealous CBP inspector exercising a powertrip by fat fingering your machine, here you go:

Choose a password greater than 14 characters
Run Syskey in mode 2 for added protection -- essentially a double password, and choose one hard to remember. Do this and CBP will have an awfully hard (practically impossible) time getting into your machine unless you tell them your password.
The just to tick them off and wast their time, encrypt a bunch of random files with EFS -- they'll need your password to decrypt these, but they won't get your password unless you tell them...

See http://www.microsoft.com/resources/d...d_sec_xsst.asp for how to enable syskey.

Now technical issues aside, let's look at the legal aspects here:
What if he declined to tell his password? Could Customs detain him? What if his machine required smart card or token based logon -- and he didn't have the token?

Can Customs "dump" somebody's phone (i.e. look at all the dialed/received calls on it)?

Well, I've only ever seen the statute used for obscenity and foreign lottery materials (which are specifically precluded). Otherwise, I would tend to agree. Morality is different for different people and communities. Federal law must be clear and consistant.

Most folks reading this forum probably don't need to worry. Prior to the liberalization of crypto export rules, it was quite easy to have "controlled" software, for instance the domestic strength version of IE or PGP. But since about 2000 or so (can't remember for sure) all "commercially available" software has been legal for import/export to the US regardless of crypto strength.
It is still possible to have software or hardware designs on a laptop that are ITAR controlled, but if you're working on ITAR controlled non-commercially available products you should know it. Then what you do is get what's called a Carnet from Dept of Commerce, to allow export of this controlled material. Its a real pain to have to deal with the paperwork for this, or anything else to do with ITAR. I carried a Carnet for my notebook PC for a number of years, and can't ever remember encountering a Customs agent who seemed to know or care what it was for.
I'm not sure if other countries have changed their laws, for a number of years it was illegal to import too-strong crypto INTO France, for instance. But again, as long as you're a normal user of commercial products these days you should be OK.
It only took 10-15 years of the Internet being widely used for software downloads before the US Govt realized that prohibiting export of crypto software wasn't working, not to mention being of VERY dubious legality re: the first amendment. For example, the first edition of Bruce Schneir's canonical reference "Applied Cryptography" could be exported and sold worldwide, despite including all kinds of interesting crypto source code, but the CD containing the EXACT SAME CODE as in the book could only be included in US copies.
In many ways, ITAR as it was applied to computer software makes other US Customs/TSA policies look like the height of rationality.

Bob

PS: Sorry for the rant, but I had to work my thru this bureaucratic stupidity for way too long

Agreed. I'm all for upholding and enforcing rational laws rationaly. But would a Customs Inspector conducting an time-wasting, quota-filling investigation by simply fat fingering around Windows Explorer even know he was looking at blueprints for the new whiz-bang F999999 Super Turbo Charged hydroponic[sic ;)] Jet Engine versus the design for a windmill?

I'd love to try and explain the difference to one of these guys between "encoded" and "encrypted"...

You always need to remember, you have little to no rights going through customs. For me, I always declare what I have/buy. No longer do I buy any *legal* dvds outside of the US and bring them in. I watch them at the hotels and trash them.

As for the first question, not really. The laptop could be detained and sent to a forensic lab, but only with reasonable suspicion that there was contraband inside. That would be hard to have unless it was part of an ongoing investigation or other items were found in the luggage, for example.

And I'm not going to comment on the second question. It's not fully settled yet either way.

Wow. You seem to have a pretty low opinion of Customs Inspectors. I can assure you, however, that there are no quotas involved.

Actually not, just take this with a grain of salt for dramatic effect in an anonymous internet board ;) (and please please don't add my name to "the list" :D).

Seriously though, I do have problems with agents (most of my experience is with TSA) that decide to screen my laptop with the explosive wipe simply because the line is moving slow (i.e. nobody in line but me, so they have the time to do the explosive screening). Sounds to me like the inspection in this case happened simply because the CBP guy was bored and the OP was first through the line. I think THAT sucks.

If they asked first before operating my machine I would have less of a problem. When they open the lid it automatically powers on from hibernate mode, then when they shut it again it sometimes gets hosed. They could simply ask before trying to operate my machine that costs more than they make in a month (I have an expensive laptop...)

So am I reading you right -- absent any other "probably cause" type evidence, these situations result in a power struggle between the citizen and the MAN but absent the citizen relenquishing the password, ultimately walks WITH their property in the end?

Added-- I actually appreciate the work Customs and other LE folks do when they act with respect and restraint and not on powertrips. Now if only they'd be a bit more polite with the "turn ya cell phone off" directed at other passengers (mine is off..),

Oh, it's too late. I didn't put you on the no-fly...I did one better: mandatory body cavity searches. :p

Fair enough request. Personally, I would ask you if there's anything flaky about your laptop before turning it on.

I don't know if I'd say that categorically, but probably. Note that I said reasonable suspicion, which is a lower burden to meet than probable cause. I would think a criminal record for child porn would probably give reasonable suspicion, for example.

I'll take that as a compliment and thank you. As for the attitude and power trip thing...all I can say is...you've been around plenty of travelers, right? And you've seen the pushy attitudes they can often have? Imagine putting up with that 8 hours a day every day! But I agree. Like any other job, you'll find your share of disgruntled employees who enjoy making life miserable for others.

Mental note -- lots of chilli before returning to the US next time!
My mistake; I used those terms interchangable; Im no lawyer...
Would convicted felons even be allowed in to most other countries? I thought most countries blocked this.

But absent any real suspicion (as named above) I dont think that failure to reveal ones password should be construed as hiding something -- in some cases, it could be construed as the citizen simply being a PITA or acting on principle. I'm curious if there have been any test cases on this.

That is one way to ensure you get released by CBP as quickly as possible!

Depends on what the convictions were. But very likely not. I was more referring to returning US citizens.

I agree with your opinion. And I'm not aware of any test cases, but usually anything imaginable has happened at some point.

We only have "no rights" when we agree to give them up.