CBP Now Has a Massive Searchable Database for Devices Seized at the Border

Every year, U.S. Customs and Border Protection (CBP) agents seize tens of thousands of cell phones, laptops, and other devices from travelers at or near the country’s borders, often without charging them with a specific crime. Those seizures give the agency access to massive amounts of highly personal information—data that CBP will now upload to a searchable, agency-wide surveillance database and maintain for up to 75 years, according to a privacy assessment recently published by the agency.

CBP has been collecting this kind of data for a long time, but the process has been decentralized, creating a natural limit on who could access the information and how easily they could do it. The new system, developed by PenLink, a Nebraska-based surveillance and analytics company, will change that. It will create “a risk that irrelevant information extracted from devices will now be accessible to a larger number of (US Border Patrol) agents with no nexus to that particular case,” according to CBP’s privacy assessment.

The agency says it has mitigated that risk by restricting access to the system to trained forensic analysts and limiting what data it deems relevant enough to be copied off a device and uploaded. “Searches (of electronic devices) have resulted in evidence helpful in combating terrorist activity, child pornography, drug smuggling, human smuggling, bulk cash smuggling, human trafficking, export control violations, intellectual property rights violations and visa fraud,” an CBP spokesman wrote in an email to Motherboard. “CBP has established strict guidelines to ensure that these searches are exercised judiciously, responsibly and consistent with the public trust.”

Privacy advocates say the scope of data CBP considers relevant remains unnecessarily large, pointing out that CBP has a history of overstepping its constitutional powers when it comes to travelers’ data.

In 2018, the ACLU and Electronic Frontier Foundation sued the agency to stop its agents from seizing devices, without a warrant, from people who were not under any suspicion of having committed a crime. A federal judge ruled that agents must now demonstrate “reasonable suspicion” of a crime—the lowest burden of proof under the law—before copying data off a device. CBP has appealed the ruling and the case remains ongoing.

“This (PenLink) technology and this system really supercharges the privacy invasion that’s happening at the border right now,” Nate Wessler, one of the ACLU attorneys arguing the case, told Motherboard. One of the main goals of the suit, he said, is to ensure CBP can’t establish this kind of centralized surveillance system, filled with private data the agency can repurpose years or decades down the road in unrelated matters.

When they do, there is virtually no limit to what they can seize, including GPS history, text messages, emails, social media posts, photos, videos, and financial accounts and transaction records, according to the privacy impact assessment, which was published July 30.

If the device’s owner is detained, arrested, or removed from the country, CBP stores that data for 75 years. If they are not, the data is stored for 20 years.

Initially, CBP will only roll out the centralized PenLink system in select locations, but it plans to take the system agency-wide in the months to come.