Yesterday, the 9th Circuit Court of Appeals handed down an extremely important ruling on electronics searches at border crossings. After years of writing and talking about this issue I'm very excited to finally see a court take a position that is in-line with what I and many others have been advocating that the policy ought to be.

The court ruled that although customs officials can order you to open up your laptop for them so they can poke around in it manually, they cannot perform a full forensic investigation of the drive without some sort of reason to suspect that you might be guilty of a crime.

The idea is that the contents of your luggage are subjected to search at the border and so the contents of your electronics may be subject to a search at a similar level of intrusiveness. This might mean asking you to boot it up, looking around at the files on the hard drive, looking at the browser history. However, when customs agents seize your laptop from you and mail it off to an analysis center where a team of professional forensic analysts go through it with a fine tooth comb, reading all of the contents and looking even at fragments of deleted data, this is a step far beyond what a "routine" search of physical goods at the border consists of. It should require some sort of suspicion on the part of customs agents and should not be done at random.

Finally, a court has understood the issue well enough to see the distinction between a cursory search through a computer system and a forensic investigation of a computer system and has insisted upon reasonable suspicion in the later circumstance. This is extremely close to the balance first proposed by Mark Rasch in a SecurityFocus column in 2008.

This is probably the best result that civil liberties advocates can hope for under our current border search doctrine. I think it puts searches of electronics in line with the overall doctrine as it exists right now. I therefore see it as a major victory for privacy rights. A result that is more protective of civil liberties than this would require more fundamental changes to our ideas about border searches in general, rather than a specific ruling about electronics.

For example, the EFF states: "We wish it was the probable cause standard, but we’ll take the reasonable suspicion standard in lieu of no standard at all..." I don't think this is terribly realistic. As far as I know, no search at the border, no matter how intrusive, currently requires probable cause. One would need to first establish the circumstances under which probable cause would be required for a border search in order to then argue that searches of electronics fit into that circumstance.

Frankly, I'm not totally happy with the standard set by this ruling either. I don't see any reason that customs officials need to look at the files in my hard drive or read my browser history absent some sort of suspicion. However, I don't think we can ask for much more from the court system on this absent legislation. We're lucky to have gotten this much.

In fact, this ruling sets the stage for review by the Supreme Court, and although I really hope the Supreme Court upholds this ruling, there are many who disagree.

The dissents in this case provide examples of the twisted logic and self contradicting ideas of those who support random forensic examination of people's computers. Judge Callahan's dissent tries to have it both ways when it comes to random searches. She states on the one hand:

All the evidence in this case suggests that the government does not have the resources—time, personnel, facilities, or technology—to exhaustively search every (or even a majority) of the electronic devices that cross our borders... That means border agents must prioritize who, what, and how they search. By and large, border agents will conduct forensic electronic searches of people who... the agents reasonably suspect may be trying to carry illegal articles into, or themselves illegally enter, the country.

Then just a few paragraphs later she writes:

It is common knowledge that border agents at security checkpoints conduct more thorough searches not simply of those persons who arouse suspicion but also of a percentage of travelers on a random basis.

In other words, Callahan attempts to simultaneously argue that a requirement for reasonable suspicion is unnecessary because searches will not be performed at random and at the same time unworkable because it will prevent the government from performing random searches. You simply cannot have it both ways!

Judge Smith, also in dissent, goes so far as to compare the intrusiveness of a computer search at the border with the strip search of a prison inmate, writing:

The suspicionless strip search upheld in Florence, which included a close visual inspection of “the buttocks or genital areas,” was unquestionably more intrusive than the so-called “computer strip search” at issue here.

I've read over this several times and I cannot see what the purpose of including this sentence was other than to imply that the millions of Americans who travel outside the United States for business and personal reasons every year should have no greater expectation of privacy than inmates in a federal prison, and that just like prison wardens, customs officials need to be freed of those messy Constitutional concerns so that they can protect the United States without worrying that they've gone too far.

More importantly, both Callahan and Smith refuse to acknowledge the difference between a search of a few documents carried in a brief case and a detailed analysis of massive quantities of information stored on a laptop. They both reach for silly analogies in order to make points that are demonstrably false: that people choose to carry this information with them and that the amount of information that you have with you is some how proportionate to your economic status.

Judge Callahan writes:

There is no reason someone carrying a laptop should receive greater privacy protection than someone who chooses (or can only afford) to convey his or her personal information on paper...

(And in a footnote:) The element of choice is crucial. The fact that border searches occur at fixed times and checkpoints makes them inherently less intrusive; a person “with advance notice of the location of a permanent checkpoint has an opportunity to avoid the search entirely, or at least to prepare for, and limit, the intrusion on her privacy.”

Judge Smith writes:

Mapping our privacy rights by the amount of information we carry with us leads to unreasonable and absurd results. Under the majority’s reasoning, a Mini Cooper filled with documents is entitled to less privacy protection at the border than a stretch Rolls-Royce filled with documents; a pickup truck filled with documents is entitled to less protection than an 18 wheeler filled with documents. It appears that those who cannot afford a 64 gigabyte iPad, or the “average” 400 gigabyte hard drive discussed by the majority, will alone be subject to suspicionless searches. The majority’s reasoning also protects the rich (who can generally afford more sophisticated devices) to a greater extent than the poor (who are presumably less able to afford those more capable devices.)

Travelers are not carrying massive quantities of information with them when they cross borders because they have made a conscious choice that they don't care about the privacy of that information! They have that information with them because that is how the technology works and that is what it does.

These devices are used by people in all socio economic class brackets. In fact, only the rich can afford to choose not to bring information with them when they travel. Only the rich can afford special travel laptops and travel cellphones that protect them from having information exposed to these searches.

Furthermore, the amount of my information that you search is the amount of my privacy that you've violated. If you search more of my information, you violate more of my privacy, and therefore the need that I have for you to establish that there is some sort of reason that you are violating my privacy increases.

That is why it makes sense to map privacy rights to the amount of information we're carrying. The technology has fundamentally altered the social balance struck by the border search doctrine by placing more people at the border more frequently with more information. It is not reasonable for judges to put their fingers in their ears and pretend that these changes have no consequences!

Judge Smith writes: "Under the majority’s reasoning, the mere process of digitalizing our diaries and work documents somehow increases the “sensitive nature” of the data therein, providing travelers with a greater expectation of privacy in a diary that happens to be produced on an iPad rather than a legal pad."

Its time we take a step back from observations like this, and ask ourselves why it makes sense for customs agents to be reading randomly selected people's diaries at all. What purpose does this serve? The fact is that it is astronomically unlikely that customs is going to happen upon a terrorist or a child pornographer through totally random explorations of people's private thoughts and writings. The privacy violation is extreme, the benefit is nonexistent, and the practice needs to come to a stop.

Frankly, this is not how law enforcement is supposed to work in a free society.

Border agents need 'reasonable suspicion' for deep search of electronics