New DHS laptop search policy: crap sandwich, fancier bread

The DHS has issued formal rules to govern how Immigration and Customs authorities handle the seizure of electronic devices and records. The upshot is that agents can still keep your hardware for at least five days before anyone has to decide whether it's reasonable to continue.

By John Timmer |

Although the US has extensive legal protections for personal property and information, these only apply once you're actually inside the country. As part of its role in protecting the nation's borders, the US government has extensive leeway to search personal possessions with little in the way of what might be considered just cause. As personal possessions have gone digital, the Department of Homeland Security has targeted the devices and their data, and courts have ruled that agents have the right to seize laptops and examine the data on them.

The ability to arbitrarily seize personal electronic devices, from laptops to iPods, has concerned everyone from the Electronic Frontier Foundation to a business travelers trade group, and prompted the introduction of a bill in Congress that would call on the DHS to clarify its rules. On Thursday, the DHS did precisely that, providing a set of standards for the handling of personal electronics and data. The new rules are unlikely to end the controversy, however, as they continue to leave major decisions up to the discretion of DHS employees.

The primary document starts out by recognizing that although Customs and Immigration authorities have had the ability to hold personal property for years, the public is justified in thinking that seizures of electronics are a distinct issue. "Where someone may not feel that the inspection of a briefcase would raise significant privacy concerns because the volume of information to be searched is not great," the report notes, "that same person may feel that a search of their laptop increases the possibility of privacy risks due to the vast amount of information potentially available on electronic devices."

So, DHS gets it: our laptops allow us to carry our lives around with us, and losing them is not only a tremendous inconvenience, but raises legitimate fears of exposing irrelevant personal information.

Just because they get it, however, doesn't mean that they're going to act upon that knowledge in any significant manner. The new policy statement sets a few standards and limits for what they do with hardware and data, but doesn't really change the dynamics of the seizures.

So, for example, the document states that the owner of a device should be present when its contents are examined, but carves out so many vague exceptions—"unless there are national security, law enforcement, or other operational considerations that make it inappropriate to permit the individual to remain present"—that it's not clear that the principle would have any practical impact. In the same manner, it lays out the principle that the hardware should be returned to its owner as soon as possible, but only "when appropriate, given the facts and circumstances of the matter." And that's after the agent has been given the opportunity to copy all of the device's data.

Different authorities under the DHS umbrella also get different standards to adhere to. So, for example, Customs and Border Protection (CBP) agents are supposed to get approval from a supervisor to keep a device for more than five days, and from a director-level authority to keep it past 15. In contrast, Immigrations and Customs Enforcement (ICE) officers don't have to do anything for up to 30 days. Data obtained by CBP officers can only be sent to other government agencies for decryption or translation, while ICE gets to use third-party contractors. So, what happens to your hardware and data depends entirely on who seizes it.

And the standards for seizure remain very low. Anyone on a terrorist watch list is fair game, for example.

It's not all bad news. The document points to existing policies which cover especially sensitive data related to business, legal actions, medical records, and the source materials of journalists, and says that the seizures must comply with these.

But, in general, the policy simply codifies some aspects of the program while leaving immense discretionary power in the hands of DHS agents. Although it's nice to know precisely what guidelines these agents are expected to operate within, it will be small comfort for anyone who returns home only to have their laptop seized indefinitely.

Source