In response to my recent missive (“Beating Customs Agents With Your Laptop”) about the fourth-amendment-free zone overseen by U.S. Customs and Border Protection, Lawrence Friedman at Customs Law sent an email explaining some of what can really happen when you try to apply technogeek law to the real world:
In response to your encryption-deleted key suggestion, you might think in terms of a lost key to a suitcase. If CBP decides they want to search your locked suitcase, they will ask for the key. If you say you lost the key, they will find the nearest pry bar and open it. Same goes for your laptop. The inspector at the border does not necessarily know or care anything about encryption levels. What he or she knows is that he or she has the authority to take it, turn it over to Immigration and Customs Enforcement, and wait to see what they say. You could be without your laptop for a very long time.
If Customs decides it wants to play hardball, the next thing that will happen is that you will get a summons demanding the release of the encryption key. Even if you don’t know it, the key is in your possession or control (since you left it with someone else). That’s good enough. Fail to turn over the key, and you may find yourself in court with a federal judge threatening to toss you in jail until you come up with the key.
To me, that made no sense, so I explained my thinking:
Hypothetically, they wanted to see what was on my laptop, and it contained 160 gigabytes of ciphertext. They saw that. The decryption key is stored inside the country and is not crossing the border, so it’s none of their business under the fourth amendment, and the plaintext doesn’t even exist unless I decrypt the disk, so how can I be legally required to provide it?
I knew he’d eviscerate my argument, but the way he did it was chilling:
Your response, I think, points out the false premise in your thinking. The law is clear that the fourth amendment protects the interests of people, not property. And, it only applies to people inside the US. At the border, the fourth amendment offers you no protection against an unreasonable search and seizure with the limited exception of the most egregiously personal physical searches. The Supreme Court famously said that border searches are almost always reasonable because they are border searches.
Er, yes…I believe that is technically referred to as the “fuck you and your rights” theory of constitutional interpretation.
Actually, as Kip Esquire explained in a comment last year:
The same session of Congress that passed the Bill of Rights (to send to the states for ultimate ratification) had two months earlier passed a plenary customs search statute. Therefore the Fourth Amendment was “obviously” not meant to apply to customs searches — the “legislative intent” is, we are told, unambiguous and not open for debate.
By the way, Lawrence Friedman was a really nice guy to answer my idiot questions, and his blog, Customs Law, is well-written. If you have an urgent desire to keep up with the latest word in enforcement of laws relating to textile imports and preference programs, fumigation of wood packing materials, and denial of special licenses to unlade, it’s the only place to be.
One more thing. In his first message, Friedman also had this advice:
Best thing to do is cooperate with the search, identify any documents that may be privileged or business proprietary, and smile a lot. Whenever possible, leave the laptop at home. You can take some solace in the fact that these searches really are quite rare.
Heck, I’ve never been out of the country. It’s the principle of the thing that pisses me off. I’d like to think that lying back and trying to enjoy it is not the American way.
It isn’t so much lying back and enjoying it as it is using other strategies to avoid the issue. Leave your laptop at home. Use google docs to move your documents, etc. etc. The border is the border and has always had a different set of rules. My problem with the IV at the border types is that they insist on trying to overturn 230 years of law instead of using technology to overcome the issue.
How can you discuss this issue without mentioning Sebastien Boucher?
I didn’t feel like looking into specific cases. The Boucher case in particular is too complicated for me to think about clearly yet, especially with the Fifth Amenement issue. My gut feeling is that the safe combination analogy is correct—if the key is on a USB dongle, they can make him produce it (or search for it) but since it’s in his mind, they can’t make him say it. The argument that he’s already admitted some things about the contents of the encrypted section makes no sense to me. Since nobody but Boucher knows the key, nobody can know what it would mean if he revealed it. But I’ve strayed far from Customs’ authority to search.
By “you” I actually meant “one, especially a lawyer specializing in Customs matters”.
Gosh, if only one of us was some kind of law-talkin’ dude…oh wait, that’s you!
The thing about Boucher’s case is that it turns on the fifth, rather than fourth amendment. This raises different issues. The encryption key is not in the possession of some third party who does not have a self-incrimination problem. Also, it appears that Boucher waived the fifth amendment by answering some potentially incriminating questions. Think of it this way, a bank robber can’t say “I handed the teller the robbery note,” and then clam up for all subsequent questions claiming self-incrimination. It’s too late, he’s incriminated himself and waived that right. This will be an interesting case to watch because the fifth amendment issues have not been nearly as well developed as the fourth amendment issues.