This court ruling is a victory for those who think that there are constitutional limits on border searches of laptops. It speaks to the concept that they can boot up a laptop at the border and dig around in it but if they keep it for a long time and do a more in depth forensic analysis they need some basis for suspicion:

Given the passage of time between the January and February searches and the fact that the February search was not conduct(ed) at the border, or its functional equivalent, the court concludes that the February search should be analyzed under the extended border search doctrine and must be justified by reasonable suspicion.

This is a good result. I agree. The question is exactly where do you draw the line between what falls in the border search doctrine and what falls into the extended border search doctrine, but the fact that a line exists is an important point to make.

The government also argues that because Officer Edwards properly seized the laptop, and because the laptop remained in law enforcement custody, she was entitled to conduct a more thorough search at a later time. However, the cases on which the government relies for this argument address the right to conduct a more thorough search of a container as a search incident to a valid arrest, another recognized exception to the warrant requirement... Hanson was not arrested on January 27, 2009, and for that reason the court finds the government's reliance on the "search incident to a valid arrest" line of cases to be inapposite. Accordingly, because the court concludes that June search required a warrant, and because it is undisputed that the search was conducted without a warrant, Hanson's motion is GRANTED IN PART on this basis.

This result is more surprising. I like it, but it seems a little vague. At what point do we cease to be operating under the "extended border search" doctrine and enter the "warrant required" arena?

This could happen if there is some sort chain of evidence problem that makes it impossible for the agents to be reasonably certain that no change had occurred to the object since it crossed the border, but I doubt this occurred in this case.

Another possibility is that reasonable suspicion expires at some point. You've seized the laptop, you performed a more in depth search, you didn't find anything. You're done. You have no further evidence of wrong doing and no further reason to be suspicious, so you've got to give the computer back.

So, its not just the search that would require a warrant but the continued seizure of the device as well - you've got to be able to justify why you are still holding on to it. The question is why did they wait so long to perform the more in depth search, and what sort of timeframes are reasonable? Certainly, six months seems too long. If they are going to perform a more indepth analysis they should be required to do it rapidly - keeping someone's laptop for six months is nearly equivalent to destroying it.

Judge limits DHS laptop border searches | Politics and Law - CNET News