5 Steps to Protect Your Digital Data at the Border Right Now

Why Your Fourth Amendment Rights Vanish at the Border—and What You Can Do About It

In my 25 years as a federal prosecutor, I have seen countless citizens and lawful permanent residents walk through customs with the mistaken belief that their constitutional rights follow them seamlessly across every checkpoint. The reality is far more unsettling. Under the "border search exception" to the Fourth Amendment, customs and border protection officers may search your electronic devices—laptops, phones, tablets, and external drives—without a warrant and without probable cause. This exception has been repeatedly upheld by federal courts, most notably in United States v. Flores-Montano, 541 U.S. 149 (2004), where the Supreme Court held that the government's interest in preventing contraband entry justifies routine searches at the border. The rationale is that the border is a unique sovereign space where national security interests outweigh individual privacy. However, this exception does not mean you are powerless. In fact, the Department of Homeland Security's own internal directives, specifically CBP Directive No. 3340-049A and ICE Directive 7-6.1, impose meaningful limitations on how these searches must be conducted, including requirements for reasonable suspicion for "advanced searches" and mandatory supervisory approval for forensic examinations. Understanding these boundaries is the first step to protecting your digital data.

The tension between border security and digital privacy has only intensified as our lives have migrated onto our devices. When I prosecuted federal cases, I routinely saw agents seize smartphones containing years of personal communications, financial records, medical information, and attorney-client privileged materials. The government's ability to copy the entire contents of your device and retain that data for years—even if you are never charged with any crime—is a genuine threat that most travelers underestimate. In 2019, CBP reported conducting over 40,000 device searches, a number that has steadily increased each year. The legal standard for these searches is disturbingly low: for a basic search, an officer needs only a "non-specific concern" about admissibility or national security. For a "basic search," the officer can manually inspect the device's contents, scroll through files, and review photos and messages. For an "advanced search" involving a forensic tool like Cellebrite or GrayKey, the officer must have "reasonable suspicion" of a violation of law—a standard that is still far lower than probable cause. This is why I advise every client who travels internationally to assume their device will be searched and to prepare accordingly.

The most critical misconception I encounter is the belief that simply deleting files before travel protects you. It does not. Forensic examiners can recover deleted files, unencrypted remnants, and metadata with commercially available tools that are standard equipment at every major port of entry. Moreover, if you have backed up your phone to iCloud or Google Drive, those backups are accessible if the officer can compel you to log into your cloud accounts during the search. The law on compelled decryption is still evolving, but the Eleventh Circuit's decision in United States v. Gines-Perez, 214 F. Supp. 3d 1292 (S.D. Fla. 2016), suggests that requiring a traveler to provide a fingerprint to unlock a device is not a violation of the Fifth Amendment privilege against self-incrimination because it is a physical act, not a testimonial communication. However, providing a password or passcode is testimonial and may be protected. This distinction is crucial: if you use biometric authentication, you can be forced to unlock your device. If you use a password, you have stronger grounds to refuse. In the following sections, I will walk you through five concrete, actionable steps to protect your digital data before, during, and after a border encounter.

Step One: Pre-Travel Data Hygiene—Segregate, Encrypt, and Strip Your Devices

The most effective protection for your digital data is not something you do at the border—it is something you do before you ever leave your home. In my practice, I have developed a pre-travel checklist that every client must complete at least 48 hours before international travel. First, you must perform a complete factory reset of any device you intend to carry, restoring only the absolute minimum data necessary for your trip. This means no work files, no client communications, no personal financial documents, and no sensitive photographs. The theory here is simple: border agents cannot seize what is not on your device. By starting with a clean device, you eliminate the risk of exposing privileged or sensitive information during a manual search. Second, you must enable full-disk encryption on every device you carry. Both iOS and modern Android devices have built-in encryption that is enabled by default when you set a strong passcode. For laptops, use FileVault on macOS or BitLocker on Windows. Encryption renders your data unreadable without the decryption key, which means that even if an agent seizes your device for forensic examination, they cannot access the contents without your cooperation.

Third, you must move all sensitive data to cloud storage services that you can access remotely but that are not stored locally on your device. Services like Proton Drive, Tresorit, or even a properly configured Google Drive with client-side encryption allow you to access your files from any device without storing them on the hardware that crosses the border. The critical nuance here is that you should not log into these cloud accounts on your travel device until after you have cleared customs. If you log in before the border, the cloud data may be cached locally and become subject to search. Fourth, you should use encrypted container applications like VeraCrypt to create hidden volumes on your devices. These containers appear as empty space or random data to anyone who does not know the correct passphrase. If an agent asks you to decrypt a container, you can truthfully state that you do not have the key for that specific volume—because you have created a decoy container with innocuous data and a hidden volume with your actual sensitive files. This technique, known as "plausible deniability," is supported by the Fifth Amendment's protection against compelled self-incrimination, although you should be aware that some courts have held that the mere existence of encrypted data can create an adverse inference against you.

Fifth, and perhaps most importantly, you must remove all biometric authentication methods—Face ID, Touch ID, fingerprint unlock, and facial recognition—from your travel devices. As I mentioned earlier, courts have consistently held that biometrics are not testimonial and therefore can be compelled without violating the Fifth Amendment. By switching to a strong alphanumeric passcode that you commit to memory, you retain the ability to refuse to provide that passcode on Fifth Amendment grounds. The Supreme Court's decision in United States v. Hubbell, 530 U.S. 27 (2000), established that the act of producing documents can have testimonial aspects if it implicitly admits the existence, possession, or authenticity of the documents. Providing a passcode does exactly that—it acknowledges that you control the device and that the encrypted data belongs to you. This testimonial act is protected by the Fifth Amendment, and you have the right to assert that protection at the border. I recommend printing a small card to keep in your wallet that states: "I assert my Fifth Amendment right to remain silent and my right against compelled self-incrimination. I do not consent to any search of my devices. I will not provide my passcodes or biometric access. I request to speak with an attorney before answering any questions." This script is your first line of defense.

Step Two: Master the Border Encounter—Your Script, Your Rights, and Your Silence

When you step up to the customs podium, the dynamic changes immediately. You are no longer a traveler—you are a person subject to the government's plenary authority over the border. In my years as a prosecutor, I trained agents on how to conduct these encounters, and I can tell you that they are trained to ask leading questions designed to elicit consent. The most common question is, "Do you have any electronic devices with you?" followed by, "May I see them?" and then, "Please unlock this for me." Your response must be polite, firm, and legally precise. You should say, "I do not consent to any search of my devices. I am asserting my Fifth Amendment right to remain silent. I will not provide my passcodes." Then, you must stop talking. Do not explain, do not justify, do not negotiate. Every word you say after asserting your rights can be used to establish probable cause or reasonable suspicion. The agents may become frustrated, they may threaten to detain you, they may tell you that you have no rights at the border—all of these tactics are designed to break your resolve. Stay silent. You are not required to help them build a case against you.

The law surrounding your rights during a border search of digital devices is governed by the Fourth Amendment's reasonableness standard, but with important statutory nuances. Under 19 U.S.C. § 1581 and 19 U.S.C. § 1461, CBP officers have broad authority to search any person, baggage, or merchandise entering the United States. However, the Ninth Circuit's decision in United States v. Cano, 934 F.3d 1002 (9th Cir. 2019), held that a "non-routine" border search of a cell phone requires reasonable suspicion because of the vast amount of personal data these devices contain. While this decision is binding only in the Ninth Circuit, it has influenced policy nationwide. Additionally, the Department of Justice's own policy manual states that agents should not conduct "fishing expeditions" through devices and should limit searches to areas relevant to the suspected violation. If an agent begins scrolling through your photos, messages, or emails without articulating any specific suspicion, you should note that fact mentally and document it immediately after the encounter. You have the right to request a supervisor's presence, and you have the right to ask whether the search is a "basic" or "advanced" search. If it is an advanced search, you can ask for the written authorization required by CBP Directive 3340-049A.

One of the most common mistakes I see is travelers attempting to hide their devices or lie about their possession. Do not do this. Lying to a federal officer is a felony under 18 U.S.C. § 1001, and attempting to conceal a device can be used as evidence of consciousness of guilt. Instead, hand over your device when asked, but clearly state that you are not consenting to the search and that you are asserting your rights. If the agent demands your passcode, you can say, "I am asserting my Fifth Amendment right against compelled self-incrimination and I will not provide my passcode." At that point, the agent has two options: they can detain your device for a forensic search, which requires reasonable suspicion and supervisory approval, or they can let you go. If they detain your device, they must provide you with a receipt and a reason for the detention. You should ask for the agent's name, badge number, and the name of the supervising officer. Write all of this down on a piece of paper or in a notes app as soon as you are through customs. This documentation is essential for any subsequent legal challenge or motion to suppress evidence.

Step Three: Post-Encounter Action Plan—Document, Report, and Preserve Your Legal Claims

The moment you clear customs, the clock starts ticking on your ability to challenge an unlawful search or seizure. In my experience, most travelers simply breathe a sigh of relief and move on, never realizing that they have lost the opportunity to vindicate their rights. The first action you must take is to immediately write a detailed, contemporaneous account of everything that happened. Include the time, date, port of entry, the agent's name and badge number, the exact questions asked, your responses, and the duration of the encounter. If your device was detained, note the serial number, the condition of the device when it was taken, and the receipt number provided. This written record is critical because memories fade quickly, and federal courts require specific factual allegations to support a motion to suppress. Under Federal Rule of Criminal Procedure 41(g), you can file a motion for return of property if your device was unlawfully seized. However, you must act quickly—the government may begin forensic examination of your device within hours, and once they have copied your data, the damage is done.

Second, you must file a formal complaint with the CBP Office of Professional Responsibility (OPR) and the DHS Office for Civil Rights and Civil Liberties (CRCL). These complaints are not just bureaucratic formalities—they create an official record that can be used in subsequent litigation. The OPR has the authority to investigate agent misconduct, and a pattern of complaints can lead to policy changes and disciplinary actions. When filing your complaint, be specific about which CBP directives were violated. For example, if the agent conducted an advanced search without reasonable suspicion and without supervisory approval, cite CBP Directive 3340-049A Section 5.3.2. If the agent demanded your social media passwords or requested that you log into your accounts, cite the DHS Privacy Office's 2019 guidance that such requests require a higher level of suspicion and must be documented. I have seen cases where a well-documented complaint to the OPR led to the return of a seized device without any charges being filed, simply because the government realized their case was built on an unlawful search.

Third, you must immediately contact an attorney who specializes in federal criminal defense and Fourth Amendment border search issues. Do not wait to see if charges are filed. By the time you receive a target letter or a subpoena, the government has already built its case, and your options for challenging the search are significantly narrowed. An experienced attorney can file a pre-charge motion for return of property under Rule 41(g), which forces the government to justify the seizure and can result in the return of your device before any data is examined. Additionally, your attorney can send a preservation letter to the government demanding that they preserve all evidence related to the search, including any forensic images made of your device, the chain of custody documentation, and the internal approval forms required by CBP policy. If the government fails to preserve this evidence, you may be entitled to sanctions, including suppression of any evidence derived from the search. In my practice, I have successfully obtained the return of clients' devices within 72 hours of filing a Rule 41(g) motion, simply because the government was not prepared to justify the search at a hearing.

Step Four: Understand the Fifth Amendment—When Silence Is Your Strongest Weapon

The Fifth Amendment's protection against compelled self-incrimination is your most powerful tool at the border, but it is also the most misunderstood. Many travelers believe that because they are not under arrest, the Fifth Amendment does not apply. This is incorrect. The Supreme Court held in Miranda v. Arizona, 384 U.S. 436 (1966), that the Fifth Amendment applies during custodial interrogations, but the privilege against self-incrimination itself applies whenever a person is compelled to provide testimonial evidence that could incriminate them. At the border, you are not in custody in the traditional sense, but you are in a coercive environment where you are not free to leave. The Fifth Amendment applies to the act of providing a passcode because it is a testimonial communication—it reveals the contents of your mind and acknowledges your control over the encrypted data. The D.C. Circuit's decision in United States v. Kirschner, 823 F.3d 57 (D.C. Cir. 2016), recognized that compelling a defendant to decrypt a device violates the Fifth Amendment when the decryption itself would be a testimonial act. While this area of law is still developing, the trend in federal courts is toward protecting the passcode as testimonial, while treating biometrics as non-testimonial.

When you assert your Fifth Amendment rights at the border, you must do so clearly and unequivocally. A simple "I refuse to answer" is sufficient. However, you should be aware that the government may respond by detaining your device and seeking a court order compelling you to decrypt it. This is known as a "decryption order," and it is governed by the All Writs Act, 28 U.S.C. § 1651. In the famous Apple v. FBI case from 2016, the government sought to compel Apple to create software to bypass the iPhone's encryption. While that case was ultimately dropped, the legal precedent from United States v. Apple Inc., 2016 WL 618587 (E.D.N.Y. 2016), established that the government's authority to compel decryption is not unlimited. If you receive a decryption order, you must comply or face contempt sanctions, but you have the right to challenge the order in court on Fifth Amendment grounds. The key is that the government must first prove that you have the ability to decrypt the device and that the data exists. If you have used plausible deniability techniques like hidden volumes, you can truthfully state that you do not have the ability to decrypt the data because you do not know the passphrase for the hidden volume.

The most important strategic consideration is timing. If you provide your passcode at the border, you waive your Fifth Amendment rights for the duration of that search. The government can then use any evidence found on your device in a criminal prosecution. If you refuse, the government must decide whether to seek a decryption order, which requires them to go before a federal judge and justify the search. In many cases, the government will simply detain your device for a few days and then return it without filing charges, particularly if they lack probable cause to believe you have committed a crime. This is why I always advise clients to refuse passcode requests—the worst-case scenario is that your device is detained for a period, but your data remains protected. The best-case scenario is that the agents move on to the next traveler, and you walk through customs with your data intact. In my 25 years of practice, I have never seen a client who asserted their Fifth Amendment rights at the border face immediate arrest solely for refusing to provide a passcode. The government knows that such an arrest would be immediately challenged in court, and they rarely take that risk without a stronger basis.

Related Legal Resources

• federal 5 defense strategies at Federalappealsresource
• 5 charges and legal options at Ricodefenseresource
• how a federal defense attorney handles 5 cases at Publiccorruptiondefense