The U.S. Customs and Border Protection agency (CBP) has authority to search electronic devices without warrant or probable cause. Civil liberties groups are challenging this power in court, but journalists should be aware that current practice risks exposing contacts, sourcing, and reporting material contained on laptops, phones, and other devices.
It is not possible to give uniform advice on digital security for those crossing the U.S. border because each individual has different security needs and risks. All journalists however, should complete a thorough risk assessment before traveling, taking into consideration immigration status, travel history, reason for visiting the U.S., and the data stored on their devices.
Journalists, including citizens and non-citizens, should be aware of their rights and know what to expect if they are stopped. The Electronic Frontier Foundation has general information on how to prepare and what to expect when traveling through airports and other ports of entry into the U.S., which can be found here. We encourage journalists planning travel to the U.S. to review it.
Journalists asked to hand over or unlock digital devices that contain confidential material should inform the officials that the media have an ethical obligation to protect sources and unpublished material. CPJ is aware of some cases where journalists avoided electronic device searches by asking border agents to call their media organization’s legal counsel or by stating that the device is company property. Journalists should be aware however, that refusal to cooperate with CBP requests may result in continued questioning, travel delays, confiscation of equipment or, in some cases, denial of entry into the U.S. for noncitizens.
CBP’s updated policies on electronic device searches state that agents are not allowed to intentionally access data that is exclusively stored remotely (for instance in the cloud), and should ensure wireless connectivity is disabled before a search. The policies state that agents must have reasonable suspicion and supervisory review for most “advanced searches,” in which agents connect a device to external equipment of the purpose of copying information or recovering encrypted or deleted files.
Journalists are advised to travel with devices that hold minimal personal and work information. If possible, purchase electronic equipment, such as phones and laptops, that are used only for travel purposes. You should only store information and contact details that are necessary for your trip on those devices, and the information should not put you or your sources at risk.
Journalists should be aware that devices with little personal data or that have recently been wiped may be flagged as suspicious. Journalists will need to assess the risks before traveling and make decisions based on their risk profile.
Before traveling
- Think about how you will react if you are stopped by a border guard. This should form part of your risk assessment and may also be discussed with your employer and/or lawyer beforehand.
- Review what information is stored on your devices and take steps to remove data that could put you or your sources at risk. Review pictures, videos, and documents as well as information in messaging apps.
- Back up information to an external hard drive or move information to a cloud service.
- Log out of and uninstall any apps that may provide a border guard with information that you are not comfortable sharing. For example, social media apps that include conversations. Back up the content of messaging apps where possible to avoid losing any information when you reinstall the app.
- Turn on full disk encryption for your devices. Create a long password or passphrase.
- You may want to travel without knowledge of your passwords. If you create a passphrase for you encrypted device that you have not learned, you can store that passphrase with a trusted contact until after you have crossed the border. Be aware that border guards may become suspicious if you are unable to unlock your devices. CBP policy states that it may detain a device if an agent is unable to complete an inspection because of a passcode.
- A PIN lock on your phone instead of fingerprint or face recognition is more secure.
- Clear your browsing history on all search engines.
- Speak with a trusted contact and inform them of your travel itinerary, including route, carrier details, vehicle details, and time of arrival.
- Power off devices before crossing the border to protect your equipment from attacks.
At the border
- Keep your devices within your line of sight whenever possible.
- If you are stopped at the border and your devices are inspected, stay calm and be respectful. Do not lie to border guards or try to prevent them from accessing devices.
- Get clarification from border guards about whether they are asking you to do something or if it is an order. If it is a request, then you might politely decline. However, be aware that not complying with a request may have consequences.
- If needed, document information on the guards who stopped or detained you, including their names, numbers, and departments. Note whether your devices were taken out of sight. If CBP retains your devices, you have the right to ask for a property receipt.
After the border
Journalists concerned about the treatment received when stopped can do the following:
- If you are worried that your device has been tampered with, contact the tech department at your media outlet to ask them to review the device.
- If you handed log in details to a border guard, change your passwords and credentials.
- Keep a record of what happened, including a description of any witnesses. This information may be needed if you decide to later mount a legal challenge.
CPJ continues to document cases of actual or attempted search or seizure of journalistic materials. Journalists can email details of their experiences at border stops to [email protected].