Border Patrol Says It's Barred From Searching Cloud Data On Phones (nbcnews.com)

According to a letter obtained by NBC News, U.S. border officers aren't allowed to look at any data stored only in the "cloud" -- including social media data -- when they search U.S. travelers' phones. "The letter (PDF), sent in response to inquiries by Sen. Ron Wyden, (D-Ore.), and verified by Wyden's office, not only states that CBP doesn't search data stored only with remote cloud services, but also -- apparently for the first time -- declares that it doesn't have that authority in the first place." From the report: In April, Wyden and Sen. Rand Paul, R-Ky., introduced legislation to make it illegal for border officers to search or seize cellphones without probable cause. Privacy advocates and former Homeland Security lawyers have said they are alarmed by how many phones are being searched. The CBP letter, which is attributed to Kevin McAleenan, the agency's acting commissioner, is dated June 20, four months after Wyden asked the Department of Homeland Security (PDF), CBP's parent agency, to clarify what he called the "deeply troubling" practice of border agents' pressuring Americans into providing passwords and access to their social media accounts. McAleenan's letter says officers can search a phone without consent and, except in very limited cases, without a warrant or even suspicion -- but only for content that is saved directly to the device, like call histories, text messages, contacts, photos and videos.

Comments

Well obviously

[cfalcon]

Obviously if your data is in the cloud, the government already has access to it if it needs. This just looks like a territorial dispute between different parts of the government...

Misdirection

[martok]

CBP: "That's right folks. Store your data in the cloud because that is where it is most secure." Well played but no thanks.

Re:Misdirection

[slick7]

What happens on a bright sunny day when the clouds disappear?

Re:Misdirection

[Kjella]

CBP: "That's right folks. Store your data in the cloud because that is where it is most secure." Well played but no thanks.

What would you rather want, a ruling that they can? Also, remember that "the cloud" is not a legal term - if they can legally access your Dropbox/Facebook account, they can also access your personal Linux server you saved the ssh password for. Besides this fully makes legal sense, border control has the right to search the data you are trying to bring into the country. Data on a remote server you may potentially never access from or bring to the US should obviously not be part of the border search. I know many people here don't like concept of an electronic search at the border at all, but if you want that limited to a physical search for contraband the law needs to change. Until then use one of the many obvious ways to not have your private data accessible at the border.

Re:Misdirection

[TheGratefulNet]

so many things, I would have done; but clouds got in my way...

Re:Misdirection

[Anonymous Coward]

"The cloud" doesn't have to mean "someone else's server". It can simply mean "a server that I run from my basement" in this case, since that's also not on the device itself.

Thanks to Trump, that has changed.

[Anonymous Coward]

Now they can reject asylum seekers without even bothering to process them.

Soon they'll be free to deport anybody that simply isn't a loyal enough American, eh, Comrade?

And the border wall will be transparent as well as solar powered.

Somebody please tell me that he's sundowning.

IBM & Amazon paid their bribes

[rsilvergun]

Facebook didn't.

"without consent"

[UdoKeir]

But if they say you can't leave for 4 hours unless you show them your Facebook, and you yield. That's giving them permission to search your Facebook. So the "cloud" distinction mentioned doesn't apply.

Re: "without consent"

[oobayly]

At what point would that become coercion?

Re: "without consent"

[sjames]

Based on recent court rulings, I'd guess somewhere around the third tooth they drill out without anesthetic.

Re: "without consent"

[geekmux]

At what point would that become coercion?

Doesn't fucking matter. The average citizen does not have the financial means to defend even a single unconstitutional action against them. The Legal Industrial Complex is second only to the Medical Industrial Complex in terms of committing financial ass-rape against consumers. And those committing illegal actions against citizens know this.

Your only real chance is to arm yourself with enough legal knowledge to damn near pass a Bar Exam in hopes of diffusing a situation without being forced to defend yourself in a courtroom. Otherwise, you're likely going to be financially fucked. Is pissing away a chunk of your net worth or going into considerable debt really worth not giving up a social media password? Sorry kids, Daddy can't afford to help you with college. Refused to comply with an illegal search a few years ago. Kind of ate up the college fund.

The only Right we have left is the Right to ignorantly assume we can still afford any other Right history has bestowed upon us.

Look At The Other Hand

[rtb61]

Ohh, it's a look at the other hand story, a magic trick. Folks they are not searching you phones for data, they grab it search your identity and then decide whether or not they install software onto your phone. They do not want to search your phone once, they want to search it for as long as it lasts. If it was about searching your phone, they would do it too your face, to watch reaction as they searched each directory. Nope, they hide the search from you, don't let you see it because they are not taking off but adding on and they most definitely do not want you to see that.

You can store a lot on phones nowadays and creating a copy via a USB (searching is not copying everything for ever) and getting a 100mb off a phone takes quite some time, queues at airports would be many kilometres long and really they only take enough time to add software rather than copy data.

I think people are starting to realise and hence are becoming far more cautious and are not travelling through US espionage customs with zero digital devices. Cheaper to buy a burner phone at the new location than attempt to clean a spy ridden one. When travelling overseas leave your personal phone at home and buy a new one when you get there. When you want to bring your digital data back from over seas, encrypt it and send it back to your localised ISP storage or on a device you had hooked up to your home network. When they ask, do you have anything to declare, answer in a proud voice, I like me privacy and I have nothing for you to search or add spyware to.

Re:Look At The Other Hand

[AHuxley]

Re "Cheaper to buy a burner phone at the new location than attempt to clean a spy ridden one."
The detection rate would be even more easy then.
Normal people have a smart phone with history. Normal people show what is on their phone and the details go back years in an average and normal way.
A person with no phone in 2017 is interesting.
A wealthy person with a new phone with no contacts or history?
What happened to their old phone? Lost? Stolen? Why not recover all data back into the replacement? Or add some of the data?

East Germany tried to place its young graduates into West Germany. So they would advance up in the West German gov/mil/private sector and would spy over decades.
To do so they would have to interact with some local government in West Germany.
Average West Germans made some counter culture comments https://en.wikipedia.org/wiki/.... Clothing, hair styles was often very different to past German generations. Some loud and direct political comments to the government while getting their papers worked on was expected.
Then along comes a nice person with a good hair cut, nice clothing and very correct and different attitude. They stood out in a large group as East Germany never fully understood West German culture at that time. Their "spy" looked like special forces with a distinctive hair cut, they had all their papers ready and a good attitude when talking. Guess who was pulled out of the line for further questions every time?

Its the same with digital devices in 2017. Having nothing or a new empty smart phone stands out in a world of normal people with years of digital history per device.

Re:Look At The Other Hand

[Miamicanes]

Bonus points if you intentionally craft the phone/laptop's browser history with embedded Javascript to pwn the agent's own computer when s/he goes to view it using some badly-written viewer that naively renders it straight into an IE window. And plenty of JPEG cat images crafted to exploit buffer overflow vulnerabilities.

Or, if you just want a free ticket to Defcon next year as a speaker, make an image backup of your hard drive & any embedded firmware onto immutable media (like BD-R) prior to passing through customs, let CBP have fun installing malware on it, then diff your homemade honeypot against that backup when you get home and reverse-engineer any changes they made.

Re:Look At The Other Hand

[blindseer]

I believe your argument works against you. The people in your example stuck out because they were strangers in a strange land, not just because they had a nice haircut and a sunny demeanor. Certainly their appearance and demeanor added to the "oddness" effect but I have my doubts that was the only reason they were given scrutiny.

A person that knows the local customs, because they are locals, would not trigger the "oddness" detector like a person that did not know those customs. People even in 2017 don't always have a smart phone. People have them lost, stolen, or broken all the time. There's still plenty of "counter culture" types that choose to do without the latest gadget.

A wealthy person with a new phone with no contacts or history?

Showing up at a border while wearing a $5000 suit does not automatically mean you have to have the latest and greatest iPhone in your pocket, or that you know how to add all your contacts and apps from your old one if you do have a new phone. As you say, there are a lot of odd people in the world.

Besides, what are they going to do about it? If you don't have a phone to search then they can't search your phone. Holding up someone at the border just because they dress nice but don't have a phone does sound like an odd way to do things. If you tell border patrol you left your phone at home because you didn't want to risk them taking it from you then they'll likely just roll their eyes ("Oh, it's one of THOSE again") and wave you through.

There still is a counter culture, and some of them don't carry cell phones.

Re:Look At The Other Hand

[AHuxley]

Re Besides, what are they going to do about it?
The really good news now is that a lot of shared mil/gov/police and private sector databases exist. All kinds of nations and some unexpected nations support the USA in finding criminals and interesting people.
So many images are captured around the world by all kinds of groups and given back to US law enforcement.

Social media is packed with interesting people supporting banned groups trying to enter or exit the USA.
The more a "normal" person tires to hide by not having any smart phone on them at the time, the more interesting they are.
Their social media use is gov/mil searchable but they lie and claim to have not much tech, don't use much tech, ever?
Investigations started long before a person arrives. In the past it was what people tried to sneak in terms of drug or images.
So a lot of freedom was given to search everything and ask questions.
Now people want to fund, join and be seen with banned groups and their leadership. Hoping to hide the travel destination and images online far away from any direct search.
The replacement smart phone just for entering the USA can be very telling as a device. How it was paid for, any use, what account was set up, the number used, any calls, what brand? Any serial or other numbers that would show some group has been handing out safe phones/accounts as cover for return to the USA?
Interesting people are often not that smart and have a larger social media history or get given hardware by others who think they know what is been looked for.
Mistakes are made, people get sloppy just once or reuse details that are already on file. GPS or just testing the camera in some unexpected nation is a classic error. Have to know how the new phone works to show its really been used.
The first and only image packed with metadata was deleted but was it really? That first network connection was in what nation?

Re:Look At The Other Hand

[Lumpy]

"Normal people have a smart phone with history. Normal people show what is on their phone and the details go back years in an average and normal way."

no they don't. Most people do not transfer absolutely everything to their phone every time. Even Photos and videos do not auto transfer and all the apps only a handful you tell to do a "cloud sync" will transfer any data.

Also most people use their phone replacement as an opportunity to clean house.

If you think there is years of data on there then you have zero clue as to how the majority of smartphone users deal with getting new phones. NONE of them do a full backup and then a full restore on the new one. That is far to difficult for the masses.

Re:Look At The Other Hand

[houghi]

I have several phones lying around at home. I assume most people will hold on to their old phones or at least one of them.

If I ever get to travel to the US, I would be doing so as a tourist. I would just us an old phone and put on just the things I really need, like travel.
Also no password protection (when I go over the border) and a fake email address.

This is more than what I had to do when I traveled through east Germany.

OTOH, let's not go to the USofA. It is a silly place.

Re:Look At The Other Hand

[desdinova 216]

so, maybe a year or two of data then?

Well yeah

[Dunbal]

That's the NSA's job. No need to duplicate the effort...

Re: Only apps can app apps!

[Dunbal]

Why don't you tell us how you really feel?

Re:Searching tablets too or just phones?

[AHuxley]

AC every bag, device and its storage has been open to search.
People have returned to the USA with material that results in further investigation on their camera SD cards or on the past film.
Digital devices can now hold many images or video files.
Now that same interesting data is been uploaded to cloud services.
Metadata could show gps locations in nations of interest to the USA not covered by any visa or digital passport entry/exit records.
Thats why images and modern files with metadata are of so much interest. They show faces, gps location, dates and names of banned groups.
Just a "holiday" is often a meeting with banned groups. Using the cloud to hide such meetings from detection is not good for investigators.

Re:Funding and support

[Kjella]

Can't tell if serious or just an elaborate troll... but in other words, privacy is fine until you want to enter a country. Then you should have to provide all information about everywhere you've been, everyone you've communicated with and the contents of that communication, every group or organization you're ever been a member of, every photo you've ever taken, basically every scrap of information about your life from birth to present day? Sounds like a fascist country I wouldn't want to visit. Sounds more like a fascist country you should escape from and never return.

Follow the data

[Anonymous Coward]

Loyal to America? No.
Trump does "loyal to Trump" not "loyal to America". Foreign spies are fine, dictators flagged as enemies of the US are fine... as long as they help *Trump*.

1) It should be clear from the emails that Trump knew about his Russian help.
2) If you look at the data Russia hacked, it was ELECTORAL ROLLS mostly.
3) This is the same data that Trump is trying to get now as his role of Whitehouse squatter.
4) So if you follow the data that will have gone to someone to help Trump 'win' an election.
5) And the new data, being obtained on demand from Trump, will be cloned and make its way to the same group for the next election.
6) The group in 5. won't be the usual lot, like Mercer.

Re: Only apps can app apps!

[Dunbal]

I'm an atheist, but not gay. So you can suck your own dick. I agree with the rest of your sentiments though, in principle. I wouldn't say I actually hate Christians - I just avoid them. I've learned not to waste my time :)

Re:Funding and support

[AHuxley]

Re "Can't tell if serious "
Great.
Mistakes and poor grammar protect against been considered as having any social influence.
A level of good grammar, an expensive education, good spelling, project names are often topics for later human review.
People working for the police and security service also look for interesting people who can influence a lot of people on social media with one comment thats well written, articulate and could show some public relations effort. The sort of education they had.
Does/did that person work for the mil/police/gov and why are they online? The first hint of a whistleblower? A book or book chapter could be next.
In many nations its much safer to have some doubt over occupation, education, use of grammar, skills when commenting on line.
People trying to discover a person who has social influence will then LOL and quickly move onto other comments that are too perfect or that have an insider quality.

Re: Only apps can app apps!

[Anonymous Coward]

"I'm a fucking proud atheist .... I just wish all of them would burn in hell for all eternity"

So funny. Even in denial, he believes.

Re: Only apps can app apps!

[mrclisdue]

Thank you for your reply.

Good night and God bless.

Re: Only apps can app apps!

[Rujiel]

Does the border patrol now pay for nonsense bulk trolling like other agencies do? It's seeming that way

Re:Funding and support

[AHuxley]

Re 'Ever notice how rarely trolls put effort into any of the qualities you named, while their end goal is to influence people like puppets?"
GCHQ has tools to manipulate online information, leaked documents show (15 July 2014)
https://www.theguardian.com/uk...
The term automated would cover that effort.

Good.

[Lumpy]

Those assholes should not be able to search phones in general.

Hoping that even more is taken from them to restore our rights once more.

Re:border crossing

[presidenteloco]

-Place phone in plastic bag.
-Duct-tape phone to $400 drone.
-Place drone near border crossing maybe a few miles away.
-Cross border.
-Drive a few miles.
-Fly drone with phone across border.
-Proceed on merry way.

Re:What do they mean by "US travellers"?

[ahodgson]

Anything within 100 miles of the border is a Constitution-free zone, don't you know. So I assume they mean everyone. But especially anyone who looks like they might be from the Middle East.