- Don't refuse to give them access to the phone unless you are prepared to be turned away, and/or have the phone confiscated for a period of time (easily up to five days or more). Yes, they can demand your password
- Don't keep anything on the phone you don't want them to see. Your cloud storage is supposedly safe from prying eyes. I'd be dubious about the reality of this, mind you.
- If you'd rather not let them get into your phone (you didn't follow advice #2) I hope you aren't dumb enough to have relied on biometrics to lock your phone, especially facial recognition.
Customs agents have broad power: Immigration lawyer Henry Chang notes that one of his own colleagues once complained about a search, fearing a breach of attorney-client privilege: "The officer said, 'I don't care,"' Chang said. He said border guards can easily refuse someone entry: "There's ways they can mess with you," he said. "They can just declare you an immigration risk... detain you, turn you away until you co-operate... That's enough to scare people into co-operating."
The new directive: On Jan. 4, U.S. Customs and Border Protection issued a new directive titled, "Border Search of Electronic Devices." It actually set new limits on agents, establishing criteria for when they can conduct extensive searches -- like downloading documents stored in the cloud, or uploading files into a storage drive for analysis.
Your passcode: Agents can demand a passcode to open your phone without probable cause, Nielsen confirmed during the hearing.
The cloud: There, there are new limits. Agents can't just start downloading old files from the cloud: "They can search the data that is apparent on the phone," Nielsen said. "They can't use the phone to access anything that might be stored remotely."
Airplane mode: Officers are supposed to ask travellers to shut off their signal. That's to ensure remote files don't get downloaded accidentally. If warranted by security concerns, the Jan. 4 directive says officers can themselves perform the task of shutting off connectivity.
Advanced search: An officer may judge it necessary for national security purposes, such as cases where the traveller is on a watch list, to connect a phone to a hard drive, to copy its contents for analysis. The directive says this requires the approval of a certain rank of supervisor.
Detention: If they can't access a device, officers can detain it for a multi-day period. Detentions beyond five days must be approved by management. To detain a device, officers must fill out a form.
Sensitive info: Lawyers can claim attorney-client privilege, citing which specific files are sensitive, and the officer must consult with customs legal counsel and the U.S. attorney's office to determine which files should be isolated from the regular search. Medical records, proprietary business information, and journalists' notes must be handled in accordance with U.S. law, like privacy and trade-secrets legislation.
Accountability: Travellers can be present during a search, though they can't ask to see the screen. Travellers must be notified of the purpose for a search. There are national-security exceptions on those rights. But travellers must be given information on where they can complain. Searches must be documented, with statistics kept and regularly published. Regular audits must keep track of whether agents are following rules.
Destruction of records: Any copies of information held by U.S. customs must be destroyed, and any electronic device returned -- unless there's a security threat and probable cause for an exception.
So what to do: Chang offers three pieces of advice -- before crossing the border, delete private material or transfer it to the cloud; at the border, turn on airplane mode yourself; and, finally, be prepared, unless you have some really compelling privacy reason, to just turn over your phone.