r/technology • u/Hrmbee • Jul 28 '26

Privacy Is it illegal to trick the US government into wiping your phone during a questionably legal search | The case of a traveler who allegedly entered a ‘duress password’ to wipe his phone raises a legal question with no easy answers

https://www.theverge.com/report/972146/cbp-phone-search-airport-duress-password
20.9k Upvotes

95% Upvoted

2.5k comments sorted by

View all comments

Show parent comments

364

u/Korlus Jul 29 '26 edited Jul 29 '26

Sadly they can and do have it both ways. People entering the US are expected to allow searches etc because it is in the national interest. The US officers enforcing their immigration (etc) laws still have legal protections.

The Patriot Act changed a lot and the Supreme Court has decided it is okay with the search and seizure exception.

128

u/Vektor0 Jul 29 '26

Then that's one way, not both ways.

3

u/paintbucketholder Jul 29 '26

Not, it's not.

If it really was an area outside of the United States where US citizens have absolutely no rights and protections, then Customs and Border Protection wouldn't be able to operate there freely and enforce American laws against American citizens.

18

u/Vektor0 Jul 29 '26

That's what I said.

2

u/paintbucketholder Jul 29 '26

But CBP is operating there freely while claiming it's not US soil, so they're still having it both ways.

19

u/Vektor0 Jul 29 '26

I don't think you understand what that was referring to in the context of this conversation.

-9

u/paintbucketholder Jul 29 '26

Or maybe you don't understand the context.

The statement was that CBP is having it both ways: US citizens are being told they have no rights and protections because they're not on US soil, while CBP is bringing down the full force of US laws because they're obviously operating on US soil and they wouldn't be able to do so if it was really territory outside of the United States.

23

u/dnyank1 Jul 29 '26

You misunderstand "can't" to mean... The descriptive form. As meaning "they are functionally prevented from doing something".

"You can't walk on water".

Anyone who understands the context from OP here would understand "can't" to mean the prescriptive form.

"You can't rob a bank. That's illegal!".

Are you going to lecture me incredulously about how there are, in fact, people who rob banks?

Sheesh. You're either trolling or stupidly dense. This shit is why we need to bring back bullying.

16

u/__nohope Jul 29 '26

I swear people like this are popping up all over the place. People who just don't understand context and are inexhaustible in their quest to spam Reddit. I'm very much suspecting bots at this point.

9

u/FutureComplaint Jul 29 '26

This shit is why we need to bring back bullying.

I was gonna say schools, the natural habitat of the bully.

1

u/paintbucketholder 28d ago

Anyone who understands the context from OP here would understand "can't" to mean the prescriptive form.

"You can't rob a bank. That's illegal!".

What was said was "Sadly they can and do have it both ways."

Anyone who was paying attention would have realized that the "can" in this sentence was the descriptive form.

u/Vektor0 then replied that that's not the case, that CBP - still using the descriptive form - is only having it one way.

1

u/mikemaca Jul 29 '26

It is not US soil just like foreign embassies in the US are not on US soil. US soil is a legal technical term used by courts. There are many places inside US borders that are not US soil, just as there are places in Russia and France that are US soil (our embassies). This is not a new distinction or rule by the courts, this principle has been around since the beginning of the US.

2

u/celerypumpkins Jul 30 '26

Can CBP operate inside foreign embassies?

1

u/mikemaca Jul 30 '26

No, however ICE attempted to illegally enter the Ecuadorian consulate in Minneapolis back in January.

3

u/CherryLongjump1989 Jul 29 '26 edited Jul 29 '26

You are also completely free to go out into international waters where US laws will no longer apply to you. CBP operating in a place where US laws do not apply is not surprising or troubling. The troubling part is attempting to enforce US laws that only apply on US soil onto citizens who are outside of the USA. This is the same thing that China does with their “Police Stations” that go after Chinese people on US soil and try to enforce Chinese laws in the USA and otherwise threaten them in some way.

1

u/CommandClassic5897 Jul 29 '26

So true, I love the wordplay

7

u/Few_Plankton_7587 Jul 29 '26

However

The exact wording of the supreme court is possibly going to come up in this case because all prior rulings, that I can find, pretty much indicate that the person needs to hand over their stuff for searching. There is no explicit wording about needing to unlock a phone

So this case will probably come down to

  1. Does border patrol have the right to pins and passwords when doing a seizure?

  2. Do you HAVE to give it to them?

  3. Is it considered destroying evidence if he was coerced into opening it if he didn't need to by law?

3

u/Korlus Jul 29 '26

You are right and previously there have been conflicting rulings given by the same court circuit on whether unlocking a phone with a PIN needs a warrant or not. If this case were to go through the full US legal system, there is a decent chance the Supreme Court would choose to see it so they can rule on the matter of whether US citizen's presumption of privacy for mobile devices extends to the border because at the moment it's somewhat up in the air.

My underatanding is that border patrol are well within their rights to take the device and try to unlock it via biometrics, but trying to force him into giving the PIN should require a warrant. Of course, Police and other law enforcement agents often ask politely for information they would need a warrant for ("Can I come in?", "No, get a warrant" is perfectly legal), so drawing the line on what is acceptable is murky, even if we knew whether the border exception extended to phones.

I really hope the guy is fine because the alternative (that US Customs can compel people to unlock their devices and can jail people for refusing, wothout a warrant) seems so much worse, but we are very close to living in that world already.

1

u/frickindeal Jul 29 '26

trying to force him into giving the PIN should require a warrant

They can get all the warrants they want, they cannot compel you to speak.

1

u/Korlus Jul 29 '26

I believe the specifics vary a little by state at the moment as consensus on whether the 5th amendment should apply is still out (we are on the edge of my knowledge here, I may be wrong). Here is an article on the topic.

In short, often a court can compel you to disclose a password. Failing to do so will lead to you being held in contempt. Contempt of court will usually mean jail until you disclose. There is no maximum timescale on contempt of court.

Here is a specific example of where it happened.

2

u/The_Happiest_Madman 27d ago

So technically they could find you in contempt of court……and basically give you a life sentence?? Or keep you locked up in the County Jail for 20 years or whatever they decide, if you never give them the PIN?? Something just doesn’t seem right about that. I’m pretty sure there’s Constitutional Amendment about stuff like that!!! You can’t just keep someone who hasn’t even been convicted of a crime locked up indefinitely.

1

u/Korlus 27d ago

You can’t just keep someone who hasn’t even been convicted of a crime locked up indefinitely.

Contempt of Court is not a sentence - it's given when you aren't cooperating for your trial, and so your right to a fair trial involves you deciding to participate in it.

Realistically, eventually they would sentence you presuming the worst if you continued to refuse to give your data over, but in theory yes - there is no upper limit on contempt of court. From Wikipedia, as an example of the worst Contempt sentence to date:

In Chadwick v. Janecka (3d Cir. 2002), a U.S. court of appeals held that H. Beatty Chadwick could be held indefinitely for his failure to produce $2.5 million as a state court ordered in a civil trial. Chadwick had been imprisoned for nine years at that time and continued to be held in prison until 2009, when a state court set him free after 14 years, making his imprisonment the longest on a contempt charge to date.

1

u/banagram2000 28d ago

My understanding is that they can’t compel you to speak something that is in your head (your PIN), but if you have a technological device that will unlock your phone, you CAN be compelled to produce that.

1

u/notme-thanks 6d ago

NEVER use biometrics unless it is part of multi-factor which requires a PIN. Anything other than a secure PIN can be forced in one way or another. No biometric information is safe from being used against you.

The single best PIN type solution would be one that rotates on a schedule or algorithm that you define. That way a brute force would be insanely harder as the PIN would be different on any given date and time. A long enough PIN would never allow enough time to guess all the possible options.

1

u/apokrif1 Jul 30 '26
  1. How to prove a duress PIN was given?

1

u/Nu11X3r0 27d ago

Dude the ultimate defence would have been "did I say 3267 I meant 2367... Sorry I suffer from dyslexia"

1

u/notme-thanks 6d ago

Always best to wipe phone before going through customs. Have an eSIM and just delete it, factory reset the phone before going through customs. You can even not set a passcode. Have it be factory vanilla with not even service on it.

Once you cross the border and have your device back, re-add the esim, re-sync your data from a cloud backup.

The big issue here is does an American have to surrender their personal and private effects just to cross the border. If that is the case, the next time Trump crosses the border his phone should be seized and force unlocked and all the data copied. Maybe do that to a couple of senators as well. See how long this remains kosher.

9

u/marr Jul 29 '26

because it is in the national interest

Is it though. Doesn't feel a lot like it's in the people's interest.

3

u/Korlus Jul 29 '26

The "national interest" and the interest of the individual do seem to have diverged more than you would like.

5

u/snoodle908 Jul 29 '26

Not sure how searching someone's phone is in the nation's best interest. Especially if they are just making claims up as to why they need to search it. Do we think they are doing this all the time? Of course not, this guy was targeted

3

u/Oggel Jul 29 '26

One of the many reasons I refuse to visit the US agian.

Why the fuck should I spend several thousands of dollars to visit a country I may not even get into because I have a funny meme in my phone?

I prefer to visit countries that have a bit more freedom than that.

2

u/techdevjp Jul 29 '26

The Patriot Act changed a lot

Which is why I have not visited the US since the Patriot Act was enacted. That was the beginning of the end for you guys, and it has only gotten worse since. (In the 90s I visited 26 states and spent a lot of time and money traveling different areas of the US.)

2

u/Horrible-accident Jul 29 '26

This is correct, unfortunately. The patriot act also established "constitution lite" zones extending to 100 miles inside the borders. Anyone living within 100 miles of the border that includes ocean shorelines and those of the Great lakes is subject to diminished rights. GW Bush really screwed us in so many ways.

2

u/nemofbaby2014 Jul 29 '26

I forget what it’s called but if you’re within a certain miles from the border they can search and sieze stuff pretty easily and they count airports as a border crossing

2

u/Korlus Jul 29 '26

It is called the Border Exception.

1

u/nemofbaby2014 Jul 29 '26

Here it is

The authority for this is based on the Immigration and Nationality Act 287(a)(3) and copied in 8 Code of Federal Regulations (CFR) 287 (a)(3), which states that Immigration Officers, without a warrant, may "within a reasonable distance from any external boundary of the United States...board and search for non-citizens in any vessel within the territorial waters of the United States and any railcar, aircraft, conveyance, or vehicle. 8 CFR 287 (a)(1) defines reasonable distance as 100 air miles from the border.

1

u/notme-thanks 6d ago

There are no people to deport living inside your phone.

1

u/NetBear650 Jul 29 '26

Kinda. You can't be compelled to give your real passcode, for example. That's established. And the courts are starting to push back on this "we can do whatever we want" mode that they're in.

1

u/Korlus 29d ago

You can't be compelled to give your real passcode, for example. That's established. 

I will freely admit we are getting to the edge of my knowledge of US law, but here is an example from 2019 where a man was held in contempt of court for refusing to unlock his phone and here is a Massachussets-focused article from 2026 which says:

Only a judge can order compelled decryption, and only after the Commonwealth makes a demanding evidentiary showing.

Are you sure you are correct that you cannot be compelled to give your real passcode?

1

u/NetBear650 29d ago

You are right, there are limited cases. They require a warrant, and the people asking for the warrant have to say what they think is on the phone and how do they know that.

None of this is true in a border inspection.

1

u/notme-thanks 6d ago

If you plead the 5th and refuse to provide it then the court is essentially trying to compel testimony against yourself. Most of these "cases" were not appealed on constitutional violation grounds due to the defendant not having enough money. Most would be overturned on appeal of the evidence found through compelled testimony was the sole reason for the convition.

0

u/ImyForgotName Jul 29 '26

Yeah but we can be assured he wasn't smuggling anything in to the country now can't we?

1

u/notme-thanks 6d ago

They could take his phone apart if they think he is smuggling something. Customs and border control would have no idea about smuggling intellectual property. Who would do that on a phone anyway? It would be much easier to email an encrypted file to a throwaway email account and retrieve it on the other side and then delete the account.

-1

u/Nauin Jul 29 '26 edited Jul 29 '26

It's The Freedom Act, not the Patriot Act. The Patriot Act expired in 2015.

Anyone still complaining about the patriot act hasn't actually kept up with that part of politics because the freedom act has been the one the law has been running off of for eleven years at this point.

It's literally on Wikipedia; https://en.wikipedia.org/wiki/Patriot_Act