Waiting to pass through customs is a tedious but unavoidable part of international travel. But US Customs and Border Protection (CBP) policies also introduce complex ethical headaches for lawyers crossing the US border.
The outside counsel for a multinational company that is the defendant in a lawsuit is traveling to a country outside the United States. The company’s general counsel asks the outside counsel, “What will you do if a US customs agent asks to see your email? There are lawyer-client communications in there."
CBP Guidelines for Searches
CBP has the authority to search electronic devices—without a warrant—at ports of entry, such as international airports, road and rail crossings at the border, and within 100 miles of the border. While these searches are rare, CBP can review content saved on devices, but cannot search cloud data.
Earlier this year, CBP issued a directive, CBP Directive No. 3340-049A, January 4, 2018 ("CBP Directive"), to provide guidance on how CBP intends to use its power to conduct searches of electronic devices. The CBP Directive:
- Provides that devices may be “presented” or "detained" for inspection. "Presentment" means a response to a Customs agent's demand to inspect an electronic device.
- Permits searches of both inbound and outbound travelers.
- States that a search “include[s] an examination of only the information that is resident upon the device.” This is an important restriction on the scope of a search by CBP.
- Describes both "basic" searches, which examine the device and its contents, and "advanced" searches, which may involve forensic equipment and copying.
- Provides that device searches will usually occur in the device owner's presence.
The Duty of Confidentiality
For many travelers, the requests above raise no ethical issues. But lawyers' computers and phones often contain lawyer-client communications and clients’ confidential information. And state bar ethical rules impose a duty not to disclose privileged and client-confidential information. Statutes and regulations may also require lawyers to protect a client’s personal data. There is no customs-search exception to this duty.
In general, lawyers should make sure that any customs search does not violate these obligations. The NY City Bar Association's Formal Legal Opinion 2017-510 suggests how to balance these obligations with CBP regulations.
The opinion states that:
- A lawyer has a duty to take reasonable steps to protect client confidences;
- A lawyer may comply with a demand by a border officer with lawful authority;
- But a lawyer should make reasonable efforts to dissuade the border officer from reviewing a client’s confidential information or to limit the extent of that review.
Reasonable Efforts to Keep Client Information Confidential
"Reasonable efforts" in this context might include:
- Putting devices in airplane mode before approaching a border area. The CBP Directive clarifies that only information resident on the device may be searched. Airplane mode cuts off network connections, which cuts off access to remote information.
- Remaining polite, professional and truthful.
- Being aware that a Customs agent may physically search a device. For example, an agent may search for contraband in the battery compartment.
- Being prepared for the agent to ask for passwords or access to the device.
- If an agent asks for a password:
- Confirming the authority of the border officer and the purpose of the search; and
- Confirming that the agent is requesting voluntary consent to search the device.
As discussed above, a lawyer's duty of confidentiality may require that the lawyer refuse. In most cases, the lawyer must take reasonable steps to protect a client's confidential information, taking into account the sensitivity of the information on the device and other relevant considerations.
If the client-confidentiality interest is strong and the agent persists, the lawyer should inform the agent of the lawyer’s profession and that the device contains confidential information covered by lawyer-client privilege. For the former purpose, the lawyer should carry some form of professional identification, such as a business card or a bar membership card. Some suggested language to inform the agent of the latter:
I am a lawyer and this device contains information that is confidential and privileged. I am not permitted to show that information to anyone else, including you. I therefore cannot provide you with the [device/passwords] you are requesting. Under s.5.2 of CBP Directive 3340-049A, I request that you contact [your/CBP] counsel before proceeding.
If the agent insists on searching the device even after being informed of the lawyer’s profession and duty to protect lawyer-client privileged information, what the agent can do depends on the lawyer’s citizenship:
- A US citizen cannot be prevented from entering the United States, even if they don't provide a password. However, not providing a password may result in delay and detention of the device.
- A Non-US citizens may be detained or denied entry, and the agent may detain the device.
At this point, the border officer may escalate the matter to CBP legal counsel.
If CBP detains the device, the lawyer will receive a custody receipt. Devices are generally returned within five days.