A US senator is sounding the alarm about a US Customs and Border Protection (CBP) policy that allows the agency to download and save data from some searched phones for 15 years, and make the information available to thousands of federal agents.
On Thursday, Senator Ron Wyden (D-Oregon) sent a letter to CBP, urging it to update its data-collection policy "to focus on suspected criminals and security threats, rather than allowing indiscriminate rifling through Americans' private records without suspicion of a crime."
The data collection can occur when CBP goes beyond a basic phone search, which usually involves a border officer examining a phone by hand to view text messages and call logs. The CBP can also conduct an advanced search when agency officials have "reasonable suspicion" that the traveler is violating laws or poses a national security concern. It can then use forensic tools to download data from the phone into a central database.
According to Wyden, CBP told him during a June meeting that it saves data from “less than 10,000” phones per year, which includes archiving text messages, calls logs, contact lists and in some cases, photos and other sensitive data.
“CBP confirmed during this briefing that it stores this deeply personal data taken without a warrant signed by a judge, from Americans phones for 15 years and permits approximately 2,700 DHS personnel to search this data at any time, for any reason,” he says.
In the same briefing, CBP revealed government agents can look through archived phone data without recording the purpose for the search. The data is also saved in a growing government database, but the exact scale of how many Americans have had their data collected is unclear.
“CBP has yet to provide my office with statistics on the total number of Americans whose data has been stored in this database or how frequently the database is searched by government personnel,” Wyden says.
Although the data collection is done for security purposes, Wyden says the CBP is essentially conducting “warrantless border searches” on Americans' personal devices. He also claims travelers are not always informed of their rights before they give up their phones for a search.
He points to CBP “tear sheets," which explain to a traveler their rights when handing over their phone to the agency. However, Wyden says tear sheets are not always provided at the beginning of the search, when travelers can refuse. He also claims they are misleading since they don't mention how CBP can download and save the data from a seized phone for 15 years.
“The tear sheet also states that collection of travelers’ information is ‘mandatory,’ but fails to convey that CBP may not arrest an American or prevent them from entering the country if they refuse to tell CBP their password,” Wyden writes in the letter, which later adds: “Innocent Americans should not be tricked into unlocking their phones and laptops.”
However, the CBP insists it's following applicable laws. "Border searches of electronic devices are part of CBP’s longstanding practice and are essential to enforcing the law at the US border and to protecting border security," the agency told PCMag in a statement. "CBP's broad authority to conduct border searches is well-established, and courts have rejected a categorical exception to the border search doctrine for electronic devices."
A CBP official also told The Washington Post the agency will only save data from a phone in a small fraction of searches and only when “absolutely necessary.”
In the 2022 fiscal year, CBP has conducted searches on over 38,000 devices thus far, according to the agency’s own data. It's unclear how many of those devices had their data saved. In the meantime, Wyden is asking CBP to supply a written letter with steps on how the agency will address the issues "no later than October 31."
Americans can refuse to give up their passcodes to CBP, but agency officials can still detain the device for up to five days, giving them a chance to access it themselves, according to the Electronic Privacy Information Center. Non-US citizens who refuse can also be blocked from entering into the country.