Amid the recent news of a U.S. citizen being asked to turn over his phone to authorities at a border crossing, Sophia Cope of the Electronic Frontier Foundation has tips on digital civil liberties.
Related, “Attorney representing a student protester detained by federal immigration agents”
When a man in Michigan was heading home on Sunday from a family vacation in the Caribbean, he was stopped in the Detroit Airport. Federal officers, border agents, detained him, interrogated him and pressured him to hand over his cellphone. The man is a U.S. citizen. He’s a civil rights and criminal defense attorney, and among his clients is an activist who has been charged in connection to a pro-Palestinian protest at the University of Michigan.
Archived at https://web.archive.org/web/20250410185452/https://www.npr.org/transcripts/nx-s1-5357455
Use a pass code. Do not use fingerprint or face ID unlock.
The current law is that you can be compelled to unlock your phone with your face or finger. (Probably should require a search warrant).
You cannot be compelled to say what a pass code or password is. You have the right to remain silent.
This all assumes you’re a US citizen. While technically it applies to all people, the current administration has had no blowback for consistently ignoring these laws for non-citizens.
Best thing you can do if you absolutely need to take your phone across the border (eg, you need your MFA) is to remove any biometrics, change the password, turn the phone off, and if ordered to enter the password, honestly say that you changed it just before traveling and have now forgotten it.
Personally, I find it easier not to travel to/through the US than to buy a burner or wipe/restore my device (I’m not going to stick my data on cloud backup).
Correct. US citizens have an absolute right to enter the country. So if they want to detain for more than several hours, they have to come up with criminal charges.
Permanent residents theoretically enjoy some constitutional rights at the border, but you all have seen what the current situation is
Non-citizen non-LPRs can simply be refused admission and summarily deported on much flimsier grounds than any of this stuff we’re talking about.
Turn off phone before crossing, safest, easiest most resistant
If you don’t want to disable biometric auth, familiarize yourself with your phone and see if it has lockdown mode. Apple phones and most modern Android phones support it, using it will require your password / pin for unlocks. Put it into lockdown mode for the flight.
Yes, this is good, however lockdown mode does NOT protect you against forensic extraction of your data, for example from the Cellebrite tool. Your phone has two states, BFU and AFU (before/after first unlock). To maximize your protection against your data being extracted, your phone needs to have not had its first unlock after being powered up. Lockdown mode does nothing here.
So, use lockdown in general if you like, however, when going through customs or in a place where your phone may be confiscated, power it down fully. Don’t unlock it if you power it up, and don’t use biometric fingerprint or face unlock so you’re not forced to unlock it.