US border device search figures and the unlock decision before travel

On 4 November, the Freedom of the Press Foundation (FPF), a US press freedom organisation, cited data obtained by Canada's CBC News in its digital security newsletter: in the first three quarters of fiscal year 2026, US Customs and Border Protection (CBP) searched 32% more travellers' electronic devices than in the same period a year earlier. The US federal fiscal year begins in October of the previous calendar year, so those three quarters run from October 2025 to June 2026. Both US citizens and foreign visitors entering or leaving the US can be searched, but the consequences of refusing to unlock a device differ. In FPF's words, border searches "affect a very small percentage of international travelers, but they are disproportionately travelers who are not U.S. citizens."

As relayed by FPF, the CBC report counts 47,517 basic searches in those three quarters and another 4,564 advanced searches. The report also notes that CBP will not reveal how many of the searches took place at the northern border with Canada or the southern border with Mexico, and FPF, citing it, writes that the agency "is reportedly on track for a record-setting year for device searches." Adding up the quarterly table on CBP's website, we count 52,081 searches in the first three quarters, already more than 90% of the 55,318 for the whole of fiscal year 2025. CBP's page notes that the statistics may change when finalised, and as of 8 November the table had no figure for the fourth quarter.

The difference between the two kinds of search is set out in CBP Directive 3340-049B, an internal directive that took effect on 1 January and replaced the earlier 049A. It defines an advanced search as "any search in which an officer connects equipment, wired or wireless, to copy and/or analyze the contents of an electronic device," allowed only with reasonable suspicion that the traveller has broken a law CBP enforces, or a national security concern, and with supervisory approval. Connecting equipment merely to bypass a password, overcome encryption or translate content does not count as an advanced search. Every other search is a basic search, which an officer may conduct "with or without suspicion," and which the journalist checklist written by FPF with EFF (the Electronic Frontier Foundation) describes as manually looking through information on a device.

The same directive obliges travellers to present devices "in a condition that allows inspection of the device and its contents." If a device is protected by a passcode or encryption, officers may ask for the traveller's assistance or for the passcode, and a recorded passcode is not to be uploaded into CBP systems. A device that cannot be inspected may be detained, ordinarily for no more than five days, with longer detention needing higher-level approval. Copies of a device's contents are kept for at most 21 days after the search ends, except in cases such as probable cause to suspect a violation.

Under the directive, officers may not intentionally use a device to reach information stored only in the cloud, so during a search they ask the traveller to turn on airplane mode and turn off Bluetooth and Wi-Fi, or cut the connection themselves. For material covered by attorney-client privilege, the directive sets out a procedure of contacting the legal office and forming a separate filter team. Work-related information carried by journalists is grouped with medical records as other possibly sensitive information, which "shall be handled in accordance with any applicable federal law and CBP policy."

The body of the directive does not distinguish between US citizens and foreign travellers in what follows a refusal to provide a passcode. According to CBP's explanatory page, whether a device can be inspected does not by itself decide admission, and a US citizen will not be refused entry on that ground alone. The same page says a citizen's device may still be detained and clearance may take longer, while for foreign travellers the matter can be weighed in the admission decision. FPF's article puts the possible detention at days or weeks and the checklist at days to months, and the checklist warns that refusing may bring scrutiny of a green card holder's permanent resident status, and that foreign nationals arriving on a visa or under the visa waiver programme may be denied entry.

Perspective

The US Supreme Court has not yet ruled on border searches of phones, and the federal courts of appeals differ depending on how the search is done. EFF's July article reports that the Fourth Circuit held manual searches to be routine, needing neither a warrant nor individualised suspicion. On 18 September the legal blog Volokh Conspiracy summarised a Second Circuit ruling from the day before, which likewise held that a manual search of a phone needs no warrant and no suspicion at all; the traveller in that case was a lawful permanent resident of the US. We have not read either ruling in full.

According to a 13 October overview by the law firm Holland & Knight, the circuits are further apart on forensic searches, with the Fourth and Ninth Circuits requiring reasonable suspicion. The Eleventh Circuit holds that none is needed, and the remaining circuits have either left the question open or not yet faced it. The overview's authors expect the Supreme Court to take up the issue before long. CBP's directive also provides that where binding circuit precedent imposes different requirements, the place where the search begins determines which rules apply.

CBP's directive presents border searches as part of carrying out its customs, immigration, law enforcement and homeland security responsibilities, used among other things to detect terrorism, smuggling and child sexual abuse material. It states that "courts have rejected a categorical exception to the border search doctrine for electronic devices" (the doctrine under which border searches generally need no warrant), and that some of its own requirements are imposed "as a policy matter," "above and beyond prevailing constitutional and legal requirements." On its border searches page, EFF argues that "a warrant based on probable cause, issued by a judge, is required for border device searches." In the Second Circuit case, one judge wrote a concurrence (agreeing with the outcome while giving separate reasons) arguing for at least some suspicion, and the author of the Volokh Conspiracy post argues that a warrant should be required.

FPF's article notes that makers of forensic tools rely on exploit research that can take months, "so simply keeping your device up to date will make it significantly harder for someone to make a forensic copy of your device." It also recommends a long, unique passcode and powering the device down before going through border security, which returns it to its encrypted state and significantly reduces what forensic tools can extract. Modern phones encrypt the disk by default, while computer users should check that FileVault on a Mac or BitLocker on Windows is turned on. The directive treats connecting equipment to bypass a passcode as a basic search, needing neither reasonable suspicion nor supervisory approval, and FPF's article does not discuss whether updates and powering down still help in that situation.

The checklist advises deciding before the trip whether to unlock a device or give the passcode if asked. It puts the chance of being selected for a device search at less than 0.01% of international travellers, but adds that depending on what information you carry, "the impact of a search may be quite high." For those who plan to unlock, it suggests moving files, chat histories and contacts they do not want seen off the device beforehand, emptying the trash, and temporarily leaving groups on messaging apps such as Signal. It also suggests logging out, on the day of travel, of accounts that border officials should not be able to access.

People who will carry source material into or out of the US can read the checklist before they leave, and FPF and EFF each host a copy in English. The checklist also recommends noting down a lawyer familiar with border cases and telling family or friends when you expect to clear the border. EFF's Surveillance Self-Defense site has a page of border advice as well, last reviewed in October 2018, which warns that some of its recommendations may be out of date. The checklist was published in June 2025, before the new directive took effect in January, but its descriptions of basic and advanced searches match the new directive's definitions.

We, a community based in Taiwan, also looked at device inspection at borders in parts of Asia. In mainland China, the Ministry of State Security issued two sets of procedural rules for state security organs, one for administrative enforcement and one for criminal cases, which took effect on 1 July 2024; we did not obtain their text, only the account state security officers gave China News Service, a state news agency, on 11 June 2024. According to that report, officers may inspect electronic devices only while carrying out counter-espionage work and only those of individuals and organisations connected with it, which the officers said rules out ordinary inbound travellers. Each inspection needs approval from the head of a state security organ at the level of a city divided into districts or above, even in an emergency, and the officer must show enforcement credentials with the person inspected or a witness present.

For Taiwan, Hong Kong and Japan, as of 8 November we found no published rule or official guidance on customs examining the contents of travellers' phones or other devices. Article 105 of Japan's Customs Act lets customs officers question people and inspect goods and the related books and documents, including electromagnetic records, but we found no provision in the Act that expressly covers devices carried by travellers and did not determine whether Article 105 extends to them.

When comparing practices across places, on privacy one can ask whether a search needs suspicion or a warrant, how long copies of device contents are kept, and whether journalists' material has its own handling procedure. On effectiveness, one can ask whether raising the threshold for searches would affect CBP's work on smuggling and national security cases. Since CBP does not disclose how searches are spread across its borders, one can also ask whether outsiders can judge from the published figures whether searches are being used for the purposes the directive lists.