Digital Privacy: Protecting the Data On Your Devices

[Wilhelm]

The U.S. government reported a five-fold increase in the number of electronic media searches at the border in a single year, from 4,764 in 2015 to 23,877 in 2016.1 Every one of those searches was a potential privacy violation. Our lives are minutely documented on the phones and laptops we carry. Our devices carry records of private conversations, family photos, medical documents, banking information, information about what websites we visit, and much more. Moreover, people in many professions, such as lawyers and journalists, have a heightened need to keep their electronic information confidential. How can travelers keep their digital data safe?

The U.S. Constitution generally places strong limits on the government’s ability to pry into this information. At the U.S. border, however, those limits are not as strong, both legally and practically. As a matter of the law, some legal protections are weaker – a fact EFF is working to change. As a matter of practice, border agents may take a broad view of what they are permitted to do. Border agents may attempt to scrutinize the content stored or cached on your phones, laptops, and other portable electronic devices, including electronic communications, social media postings, and ecommerce activity. Moreover, agents may seek to examine your public social media postings by obtaining your social media identifiers or handles. As of this writing, the federal government is considering requiring disclosure from certain foreign visitors of social media login credentials, allowing access to private postings and “friend” lists.

This guide (updating a previous guide from 20112) helps travelers understand their individual risks when crossing the U.S. border, provides an overview of the law around border search, and offers a brief technical overview to securing digital data.

As an initial matter, readers should note that one size does not fit all. We are deeply concerned by invasive and even abusive practices of some border agents, and we are well aware of the serious consequences some travelers may face if they run afoul of a border agent. Many groups, including EFF, are working to establish clear legal protections to help alleviate that fear. In the meantime, however, we know that some travelers will want to take a highly conservative approach, while others will be less concerned. This guide is intended to help you make informed choices according to your situation and risk-tolerance.

Part 1 identifies the risk assessment factors that all travelers should consider (such as immigration status, travel history, and the data stored on the device) and the potential actions that travelers can take to secure their digital privacy at the U.S. border. Those actions include:

Before your trip. Travelers should decide whether they can reduce the amount of digital information that they carry across the border. For example, they may leave certain devices at home, use temporary devices, delete content from their devices, or shift content to the cloud. Travelers should protect the information they do carry over the border. Most importantly, they should use full-disk encryption and backup their data somewhere else. Also, shortly before arriving at the border, travelers should power off their devices, which will resist a variety of high-tech attacks against encryption. Travelers should not rely solely on fingerprint locks, which are less secure than passwords.

At the U.S. border. Agents may ask travelers to unlock their devices, provide their device passwords, or disclose their social media information. This presents a no-win dilemma. If a traveler complies, then the agents can scrutinize and copy their sensitive digital information. If a traveler declines, then the agents can seize their devices, subject the traveler to additional questioning and detention, and otherwise escalate the encounter.


Border agents cannot deny a U.S. citizen admission to the country. However, if a foreign visitor declines, an agent may deny them entry. If a lawful permanent resident declines, agents may raise complicated questions about their continued status as a resident.

Your response to this dilemma may vary according to your risk assessment. However, all travelers should stay calm and respectful, should not lie to border agents or physically obstruct them, and should plan for this dilemma ahead of time. Try to document or politely ask for the names, badge numbers, and agencies of the government officers you interact with.

After your trip. If you feel that U.S. border agents violated your rights by searching or seizing your digital devices or online accounts, please contact EFF at [email protected]. Also, write down everything that happened as soon as possible.

Part 2 provides a primer on the law and policies related to border search of digital devices to help you understand the broader legal context. In particular, we address:

Your rights at the border. Compared to people and police in the interior of the country, border agents have more power and people crossing the border have less privacy. But the border is not a Constitution-free zone. The powers of border agents are tempered by the First Amendment (freedom of speech, association, press, and religion), the Fourth Amendment (freedom from unreasonable searches and seizures), the Fifth Amendment (freedom from compelled self-incrimination), and the Fourteenth Amendment (freedom from discrimination).

Government policies and practices at the border. For many years, the federal government has asserted broad powers at the border to search and seize travelers’ digital information. These intrusions are growing in frequency and intensity.

Finally, Part 3 is a primer on the technology of privacy protection. To secure our digital lives, we often must rely on (and understand) encryption, passwords, effective deletion, and cloud storage. In Part 1, we highlight some of the ways you can use these tools and services to protect your privacy. Part 3 offers a deeper dive.

Want to learn more about surveillance self-defense? Since you are reading this guide, you may be interested in digital security in general, and not just while you are crossing international borders. If so, check out EFF’s Surveillance Self-Defense guide.3

Want to help EFF protect everyone’s digital privacy at the border? Contact your U.S. senators and representatives, and ask them to support legislation requiring government officials to get a warrant from a judge based on probable cause of criminal activity before searching digital devices at the border. Also, please join EFF!

What is the Border?
According to the U.S. government, “the border” includes the land borders with Canada and Mexico, airports for international flights, and seaports for international cruises.4 Travelers crossing the border will be inspected by U.S. Customs & Border Protection (CBP) officials, which may include an interview and examination of personal belongings. At 15 airports and one seaport (in Canada, the Caribbean, Ireland, and the United Arab Emirates), travelers will be inspected by CBP prior to departing the foreign country, rather than upon arrival in the United States.5

Risk Assessment Factors
A variety of factors can influence the precautions that travelers take at the U.S. border to protect their privacy. Here are a few things to consider.

Factors about You
Citizenship, Residence, and Immigration Status
If you are a foreign visitor, you may be more easily denied entry into the country. If you are a lawful permanent resident, entry raises complicated questions about the government’s ability to challenge your continued status as a resident. Thus, if you are not a U.S. citizen, refusing to comply with a border agent’s demand that you unlock your device, provide your device password, or disclose your social media information may raise special concerns. That, in turn, may call for protective measures, or consultation with a lawyer, before you begin your trip.

Travel History
If you have traveled to certain countries, such as those regarded by the U.S. government as connected to terrorism, drug trafficking, or sex tourism, it may draw additional scrutiny from border agents. Your frequency of international travel and the length of your trips may also inspire additional screening.

Law Enforcement History
If you are subject to an ongoing or past investigation, have a prior conviction, or otherwise are under suspicion for any reason, you may be screened or questioned more intensively.

Tolerance for Hassle From Border Agents
How willing are you to risk a potential confrontation with border agents or delays in your travel plans? Your answer may affect your decision on whether to comply with an agent’s demand that you unlock your device, provide your device password, or disclose your social media information.

Interest in Advocating for Your Privacy
If you are philosophically opposed to intrusive border searches, you may feel that the importance of asserting your rights may outweigh the risk of having your devices seized, being extensively questioned, missing a flight, or otherwise being detained. If so, you should still educate yourself so you can be an effective advocate.

Factors About Your Data and Devices
Sensitivity of the Data
All people need to consider the risk that the government may access their sensitive information. If you are a journalist, attorney, doctor, or other professional, you may have a special responsibility to safeguard your data.

Seizure of the Device
Refusing to grant access to your phone may result in the government choosing to seize it. Can you tolerate the financial costs and inconvenience of losing a device to the government for an indefinite period of time?

Lost Access to Information on the Device
Have you made a backup of the data on the device? If not and it is seized, you will not have access to that information for the duration of the seizure.

Importance of Access to Data While Traveling
Do you need all your personal data while traveling? If not, consider leaving your device—or certain devices at home. Alternatively, consider removing data from your device, or storing it in the cloud so you can access it once you reach your destination. If you do need data on your device while traveling, take precautions to protect your data.

Quality of Internet Access During Trip
Will you have access to fast and reliable Internet access while traveling? If so, you may be able to limit the amount of data you carry over the border by using a cloud service provider.

Who Owns Your Device
Do you own your device? If not, consult with the person who does (such as your employer).