Federal Appellate Court Approves ‘Pretext’ Border Search

For almost nine years, Chinese national and U.S. resident Haitao Xiang had been employed by the Monsanto company in St. Louis, Missouri, as a research application engineer specializing in hyperspectral imaging technology. As with most jobs of this type, Xiang had signed a non-disclosure and confidentiality agreement with his employer, agreeing not to take and/or use any of Monsanto’s trade secrets. When Monsanto became suspicious about Xiang’s Google searches and the fact that he had sent some packets of information to a Monsanto competitor in China, they confronted him. Ultimately, Xiang quit his job and was returning to China through Chicago.

His now-former employer, concerned that Xiang had taken trade secrets, coordinated with U.S. customs officials who put Xiang on a “Record Lookout,” triggering an intensive border search when he sought to leave the country pursuant to CPB policy. When Xiang sought to leave O’Hare, the CPB officials seized his cell phone, laptop computer, SD card and a SIM card while Xiang boarded his flight and left. CPB shipped the seized electronic materials to St. Louis, where they could be examined both by law enforcement officials and Monsanto officials there. Ultimately, Xiang was charged with (and provisionally pleaded guilty to) a violation of the federal criminal trade secret law—the Economic Espionage Act.

On May 5, 2023, the United States Court of Appeals for the Eighth Circuit ruled that the border patrol officials were within their authority—under the so-called “border search” doctrine—to seize Xiang’s computers and devices and to ship them off for later imaging and detailed inspection.

Border Searches

Anyone who has traveled internationally is familiar with the concept of a border search. Whether you are departing or arriving, if you are traveling internationally, the government has the right to inspect you, your carry-on bags and your checked baggage as part of its power to enforce customs and immigration laws. They can look for illicit plants, drugs, child pornography or anything that is illegal to import or export. They can also enforce the laws on the importation or export of monetary instruments, cash, etc. You know, a border search.

Increasingly, however, CPB and other government agencies have been attempting to use the border search authority not simply to enforce export/import laws but to gather evidence in a wide variety of other criminal cases simply because of the relaxed rules of search and seizure at the border.

In Riley versus California, the Supreme Court invalidated a general search of a suspect’s cell phone as a “search incident to a lawful arrest,” finding that a search of a cell phone—with the massive amount of data (including personal data) which might be contained on it—was fundamentally different than a search of a briefcase, a backpack or jeans pocket and that the police needed a warrant to search the contents of a cell phone incident to an arrest. CPB adopted a border search protocol that allowed it to conduct a cursory review of electronic devices at the border and, “in instances in which there is reasonable suspicion of activity in violation of the laws enforced or administered by CBP, or in which there is a national security concern, and with supervisory approval at the Grade 14 level or higher (or a manager with comparable responsibilities), a [Border Patrol] Officer may perform an advanced search of an electronic device.” The difference between an ordinary and advanced search for electronic devices is similar to the difference between an agent asking you to open your luggage for inspection and them conducting a full cavity search for electronic devices. With an advanced search, the border agents can have the entirety of the contents of your devices forensically imaged and shipped for later analysis, inspection, review and—critically—dissemination to other agencies. That’s the kind of search CPB conducted here based on “national security” concerns.

The Purpose of the Search

In theory, the reason there is a “border search” doctrine is to protect the border. In fact, the CPB policy expressly states that the search can only be conducted when there is a reasonable suspicion of a violation, not of all laws or any law, but of the laws enforced by CPB (or a national security concern.) In fact, other courts like the Ninth U.S. Circuit Court and the Fourth Circuit Court have held that the purpose of border searches (and the reason they are reasonable) is to enforce import/export laws and not for “general law enforcement purposes.” However, in the case of Mr. Xiang, the Eighth Circuit joined the Second Circuit in finding that the border agents can use their border search authority to search for and seize evidence of any criminal violation.

Why This Matters

The Eighth Circuit Court found the search to be reasonable even though it was “extended” and intrusive under the border search doctrine. Under its doctrine, as long as any CPB official has any reason to believe that there is a violation of any law, they may conduct an invasive search and imaging of the device, and there is no restriction on the sharing of the results of that search.

So, if the state of Ohio suspects you are shortchanging their taxing authority, but they don’t have enough information to get a warrant, they can wait until you travel from Toledo to Windsor and alert CPB—who can then seize your computer without a warrant. Moreover, the border search exception applies not only to searches conducted at the actual border but also to those conducted within a “functional equivalent” of the border, such as international airports, as well as within a “reasonable distance” from the border, defined by federal regulations as 100 air miles. This means that cities like Cleveland, Akron and even Columbus are considered to be on the “border,” and that CPB can demand people in those cities pony up their laptops and cell phones upon suspicion of any crime—whether they are traveling internationally or not. It also means that CPB can use the “border search” doctrine as a pretext to conduct a search when any other agency wants to peek into your computer. No warrant. No court order. Just a seizure at the “border.” In other cases, federal courts have rejected arguments that the government must show some suspicion that the electronic device contains actual contraband (something that is illegal to transport, like digital child porn) as distinguished from containing evidence of some crime.

This opens the door for a host of pretext border searches—as far as 100 miles from the border—of anyone’s electronic devices without a warrant, so long as there is some suspicion that the device contains evidence related to the commission of some crime. The results of that search may be shared with other agencies, intelligence agencies or foreign agencies.

Conclusion

Under the rationale of this case, the government could use the fact that someone is traveling across a border (entering or leaving the U.S.) as a pretext to conduct an invasive search of the contents of their electronic devices under circumstances where there is no warrant or probable cause to conduct the search. Using the relaxed rules applicable at the border (one might say, ‘where there are no rules’) the contents of the phone, iPad or laptop can be shipped off to a remote site, imaged and analyzed and shared with any government agency—regardless of whether this has anything at all to do with protecting the borders.

For travelers, this means that the contents of their electronic devices are not secure. A good approach is to have every electronic device encrypted with both biometric and password-based encryption or, better yet, have a password that is held by some third party. An alternative is to have a “throwaway” computer—like a Chromebook—that contains no data whatsoever. Just assume that if you travel, your devices do too. And all of you are subject to search.

Image Source: privacy us-border–bobby-hidy–cc-by-nd

Avatar photo

Mark Rasch

Mark Rasch is a lawyer and computer security and privacy expert in Bethesda, Maryland. where he helps develop strategy and messaging for the Information Security team. Rasch’s career spans more than 35 years of corporate and government cybersecurity, computer privacy, regulatory compliance, computer forensics and incident response. He is trained as a lawyer and was the Chief Security Evangelist for Verizon Enterprise Solutions (VES). He is recognized author of numerous security- and privacy-related articles. Prior to joining Verizon, he taught courses in cybersecurity, law, policy and technology at various colleges and Universities including the University of Maryland, George Mason University, Georgetown University, and the American University School of law and was active with the American Bar Association’s Privacy and Cybersecurity Committees and the Computers, Freedom and Privacy Conference. Rasch had worked as cyberlaw editor for SecurityCurrent.com, as Chief Privacy Officer for SAIC, and as Director or Managing Director at various information security consulting companies, including CSC, FTI Consulting, Solutionary, Predictive Systems, and Global Integrity Corp. Earlier in his career, Rasch was with the U.S. Department of Justice where he led the department’s efforts to investigate and prosecute cyber and high-technology crime, starting the computer crime unit within the Criminal Division’s Fraud Section, efforts which eventually led to the creation of the Computer Crime and Intellectual Property Section of the Criminal Division. He was responsible for various high-profile computer crime prosecutions, including Kevin Mitnick, Kevin Poulsen and Robert Tappan Morris. Prior to joining Verizon, Mark was a frequent commentator in the media on issues related to information security, appearing on BBC, CBC, Fox News, CNN, NBC News, ABC News, the New York Times, the Wall Street Journal and many other outlets.

mark has 203 posts and counting.See all posts by mark