- CBP can search phones and laptops without a warrant and without suspicion. In fiscal year 2025, this applied to 55,318 individuals out of over 419 million processed, which is less than 0.01%. However, the number is rising rapidly.
- Do not delete data once the inspection has started. This could lead to federal charges with a penalty of up to 5 years.
- The consequences of refusing to unlock depend on status. A U.S. citizen will not be denied entry for this reason, although the device may be seized. A foreign national's lack of cooperation may negatively affect their admissibility assessment.
- The search includes data on the device. The directive prohibits intentionally accessing data stored solely remotely, but much cloud data is still stored on the phone.
- Device detention should generally not exceed 5 days, but there is no strict upper limit. Keep the CBP Form 6051D.
This is the second part of the series on border control in the U.S. We describe when CBP can review phones, laptops, and other devices, the difference between basic and advanced searches, what courts say, what the Tunick case teaches, and how to prepare devices before travel. The process of inspection, the rights of citizens, Green Card holders, and tourists, denial of entry, ESTA, and I-94 are discussed in the first part.
This material is informational and does not constitute individual legal advice. Border law changes rapidly, and some constitutional principles differ among federal appellate circuits (as shown in the table below). Individuals with atypical immigration histories, prior detentions, denials of entry, or ongoing cases should consult a lawyer before traveling, not after.
Search of Phones and Laptops
The Fourth Amendment to the U.S. Constitution protects against unreasonable searches. However, there has long been an exception at the border known as the border search exception, established in U.S. Supreme Court jurisprudence: the government has broader powers at the border than within the country because it controls what and who enters the territory.
CBP's policy is currently governed by CBP Directive No. 3340-049B “Border Search of Electronic Devices,” effective January 1, 2026. It replaced directive 3340-049A from January 4, 2018. Many texts on the internet still describe the state prior to 2026.
What is an “electronic device” according to CBP
The directive lists: computers, tablets, disks, tapes, USB drives, SIM cards, GPS navigation devices, drones, infotainment systems in cars, smartwatches, phones and other communication devices, cameras, and music and media players.
Basic Search and Advanced Search: Two Different Worlds
Basic search is any search that is not advanced. The officer manually reviews the content of the device without external equipment and may note what they see if it relates to immigration, customs, or other law enforcement activities. The directive explicitly states that a basic search can be conducted “with or without suspicion”.
Advanced search is a search in which the officer connects equipment, either wired or wirelessly, to copy or analyze the contents of the device. An important nuance: using external equipment solely to make the content viewable (bypassing a password, breaking encryption, translating content, previewing files from the disk without a screen, or charging the device) does not make it an advanced search.
| Basic Search | Advanced Search | |
|---|---|---|
| What it involves | Manual review of content | Connecting equipment to copy or analyze |
| Required suspicion | None | Reasonable suspicion of a violation of law enforced by CBP or national security concern |
| Supervisor approval | Not required | Always, minimum Grade 14 |
| Additional approval | Not applicable | If the basis is solely national security concern, director-level approval is needed before the search |
| Participation in practice (FY2025) | 92% | 8% |
This is internal policy, not your right
The directive states that it imposes requirements “above and beyond prevailing constitutional and legal requirements”. In section 8.1, it adds that it is an internal statement of CBP policy and “does not create or confer any rights, privileges, or benefits on any person or party”.
The requirement of reasonable suspicion for advanced searches is thus a commitment of CBP to itself, not a right that a traveler can invoke at the inspection station.
How Often Does This Really Happen
In fiscal year 2025, out of over 419 million travelers processed at border crossings, CBP searched electronic devices of 55,318 individuals. The agency summarizes this as “approximately 0.47% of secondary inspections and less than 0.01% of all arriving international travelers”. Of these searches, 50,922, or 92%, were basic searches. Thus, searching a device is not a standard element of secondary inspections.
However, the trend is clearly increasing:
| Fiscal Year | Number of Device Searches |
|---|---|
| 2018 | 33,296 |
| 2019 | 40,913 |
| 2020 | 32,038 |
| 2021 | 37,450 |
| 2022 | 45,499 |
| 2023 | 41,567 |
| 2024 | 46,362 |
| 2025 | 55,318 |
| 2026 (three quarters, up to June 30) | 52,081 |
After three quarters of 2026, the number of searches exceeded the total for the entire year of 2024. The number of advanced searches is also increasing: in the third quarter of 2026, there were 1,688, compared to 1,008 in the same quarter of 2024. Data for the fourth quarter of 2026 has not yet been published by CBP.
The total for the quarters of 2025 in the CBP table is 55,424, while in the text it is 55,318 (data may be adjusted). We provide the number from the text.
Cloud Data: What CBP Can See and What It Cannot
The search includes only information located on the device: “only the information that is resident upon the device and accessible through the device's operating system or through other software, tools, or applications”. Furthermore: “Officers may not intentionally use the device to access information that is solely stored remotely”.
To ensure this, the directive requires cutting off connectivity. The officer may either ask the traveler to disable connections (airplane mode and turning off Bluetooth and Wi-Fi) or do it themselves when justified by national security, law enforcement, officer safety, or other operational reasons. One of these two paths must be followed. A separate provision concerns passwords: “Passcodes or other means of access may not be utilized to access information that is only stored remotely”.
Where the Trap Lies
The rule “only data on the device” sounds like strong protection, but in practice means less than it seems. A large portion of “cloud” data is simultaneously on the phone: downloaded messages, synchronized emails, locally saved photos, application cache, messaging history. If you want to limit exposure, check before traveling what your apps are storing locally.
Password, PIN, and Fingerprint
According to CBP, travelers are “obligated to present their electronic devices and the information resident on the device in a condition that allows for the examination of the device and its contents”. If the device cannot be inspected due to a password or encryption, “that device may be subject to exclusion, detention, or other appropriate action or disposition”.
Note what CBP does not say. It does not claim that refusing to provide a password is a crime, nor does it threaten arrest. The listed consequences pertain to the device, not the person. Additionally, there is time: the traveler “may face longer processing times”. The consequences of refusal depend on status:
- U.S. Citizen has the right to enter their own country: “If a traveler being admitted as a U.S. citizen does not present their device in a condition that allows for examination, the U.S. citizen traveler will not be denied entry into the United States based on CBP's inability to complete an inspection of their device”. CBP adds that the device may still be seized. Thus, a citizen risks losing their phone but not entry.
- Foreign National (tourist on ESTA or with a visa): “CBP may consider the foreign national's noncompliance and the inability to inspect the device when making admissibility decisions and may take appropriate law enforcement actions. However, CBP's ability to inspect an electronic device alone does not determine admissibility”. Lack of cooperation may be taken into account in the admissibility assessment, although the inability to inspect the device does not determine it.
- Green Card Holder has a stronger position than a tourist but weaker than a citizen. Details, including the 180-day absence threshold, are described in the first part.
There is also a provision favorable to the traveler: passwords provided to the officer are recorded only temporarily, they may not be entered into CBP systems, and after the search is completed, they must be “deleted or destroyed”.
The Fifth Amendment: Why There Is No Simple Answer
A separate question is whether the government can legally compel a specific individual to disclose a remembered password. This is a Fifth Amendment issue and protection against self-incrimination.
Courts have held that the Fifth Amendment protects against being compelled to disclose the contents of one's own mind. Thus, providing a password or PIN from memory is considered testimonial. A fingerprint or facial scan is a physical characteristic, treated similarly to taking fingerprints or handwriting samples, and is usually not covered by this privilege.
The New Jersey Supreme Court stated: “if an individual is compelled to disclose the contents of his own mind, such disclosure implicates the Fifth Amendment privilege”. However, the same court ordered a suspect to provide passwords, citing the foregone conclusion doctrine: if the government already knows of the existence and possession of the items, compelled production does not “testify” anything new. State courts debate whether to measure this doctrine against the password itself or against the contents of the device.
The U.S. Supreme Court has not resolved this issue. In May 2021, it declined to hear the case from New Jersey. Therefore, there is no simple rule of “you must always provide a password” or “you never have to.” It is only certain that refusal does not mean CBP will return the device and end the inspection.
One Practical Difference
Since passwords from memory and biometrics are legally treated differently, before the border, you can disable fingerprint and facial unlocking and leave only the password. This is not a guarantee and does not exempt you from the obligation to present the device for inspection, but it is a legal decision made before travel, not an action during the inspection.
Device Detention: Timelines No One Knows
CBP can detain a device and continue the search after you leave the airport. This requires supervisor approval, and the directive provides timelines:
- detention should generally not exceed 5 calendar days, unless special circumstances arise,
- extensions beyond 5 days require approval from the Port Director, Patrol Agent in Charge, or an equivalent-level manager,
- extensions beyond 15 days are approved and reapproved in segments of a maximum of 7 days by the Director, Field Operations or equivalent,
- there is no strict upper limit, extensions can be renewed.
Upon detention, the officer must issue a completed CBP Form 6051D, which serves as a receipt, also noting the transfer of the device. Collect it and keep it. According to the CBP tear sheet, you will receive written acknowledgment indicating the detained equipment, contact person, and contact method.
The “7 days to destroy copies” rule no longer applies
The 2018 directive required the destruction of data copies within 7 days of determining there was no basis for retaining them. Directive 049B removed this rule. A uniform window applies: CBP does not retain copies “beyond twenty-one (21) calendar days following the conclusion of the border search”, unless one of the retention bases applies. Guides repeating “7 days” describe an outdated state.
Bases for longer retention of copies primarily include probable cause, and even without it, information related to immigration, customs, and other enforcement matters, if permitted by the applicable system of records notice. Information entering the ATS system may be retained for up to 15 years.
Attorney-Client Privilege, Journalists, and Medical Data
For materials covered by attorney-client privilege, the directive provides a separate procedure. You must invoke it yourself before the officer begins reviewing the data.
- You report that the material is privileged
The officer must ask for clarification, preferably in writing, regarding which files, types of files, folders, names of attorneys or clients, email addresses, or phone numbers this pertains to.
- CBP contacts its own legal counsel
Before searching such materials, the officer must contact the CBP Associate/Assistant Chief Counsel's office.
- Material is sorted by the Filter Team
A team composed of legal and operational representatives separates privileged material from the rest or applies another measure, with the written consent of the Chief Counsel.
- Copies are deleted
After the review is completed, copies deemed privileged must be “sanitized”, unless a direct threat to life or national security has been identified.
Journalists and medical data do not have such a procedure. The directive merely states that sensitive information, such as medical documentation and journalists' working materials, is treated according to federal law and CBP policy, and questions are directed to CBP legal counsel. There is no Filter Team or right to block the review. The claim that “journalists are protected like attorney-client correspondence” is false.
Where Courts Disagree
It is important to separate CBP policy from the minimum requirements of the Constitution. They are not the same, and federal courts do not speak with one voice.
The starting point is the ruling Riley v. California, 573 U.S. 373 (2014): The U.S. Supreme Court unanimously ruled that police generally cannot search the digital contents of a phone seized during an arrest without a warrant. The concluding statement of the justification was: “get a warrant”.
However, Riley does not apply at the border. The case concerned the “search incident to arrest” exception, and the court noted that other exceptions may still justify a warrantless search. The First Circuit summarized it in one sentence: “Riley did not purport to extend this rule to the border search context”. The reasoning “police need a warrant, so does CBP” is flawed.
Here is how it looks in various appellate circuits:
| District | Manual Search | Advanced Search | What Can Be Searched |
|---|---|---|---|
| 11. Florida, Georgia, Alabama | without suspicion | without any suspicion | without limitations |
| 1. Massachusetts, Maine, New Hampshire, Rhode Island, Puerto Rico | without suspicion | reasonable suspicion, without a warrant and without probable cause | without limitation to contraband (the court rejected this) |
| 4. Maryland, Virginia, Carolinas, West Virginia | without suspicion | requires “some measure of individualized suspicion”; the court deliberately did not decide whether reasonable suspicion is sufficient or if a warrant is needed | required connection to border control objectives |
| 9. California, Arizona, Washington, Oregon, etc. | without suspicion | reasonable suspicion, that the device contains digital contraband | only digital contraband |
| 2. New York, Connecticut, Vermont | No appellate ruling. Two district court rulings from 2024 required a warrant, but they do not bind anyone outside those cases | ||
| U.S. Supreme Court | Has never ruled on this issue. In June 2021, it declined to hear the case Merchant v. Mayorkas, arising from the First Circuit's ruling |
The crux of the dispute in specific cases:
- United States v. Kolsuz (Fourth Circuit, 2018) found a forensic examination of a phone to be a non-routine search requiring “some measure of individualized suspicion”, and deliberately did not determine what standard this should be.
- United States v. Touset (Eleventh Circuit, 2018) went the opposite way: “no suspicion is necessary to search electronic devices at the border”, explicitly noting the divergence from the Fourth and Ninth Circuits.
- United States v. Cano (Ninth Circuit, 2019) introduced a subject limitation: searches of phones at the border, both manual and forensic, “must be limited in scope to a search for digital contraband”.
- United States v. Aigbekaen (Fourth Circuit, 2019) added a requirement for a connection to border control objectives. Suspicion regarding solely a domestic crime, without a cross-border element, is insufficient.
- Alasaad v. Mayorkas (First Circuit, 2021), one of these civil cases, filed against the policy itself. The court found no violation of the Fourth or First Amendment and rejected the limitation to contraband.
In April 2025, the Eleventh Circuit applied the Touset precedent in United States v. Grimes, stating that the Fourth Amendment does not require reasonable suspicion for forensic searches of devices at the border. However, this opinion is marked “DO NOT PUBLISH,” so it does not create binding precedent and has only persuasive authority.
The takeaway for Polish readers: real constitutional guarantees depend on which airport you land at. Miami and Atlanta are in the Eleventh Circuit, where forensic searches of phones do not require any suspicion. Los Angeles and Seattle are in the Ninth Circuit, where suspicion is required and must be limited to searching for contraband. Boston is in the First Circuit. New York has no appellate ruling.
The Tunick Case: Why You Should Not Delete Data
A story circulates online about a man who provided a code to delete data from his phone during a border inspection. It is based on a real criminal proceeding, but popular accounts mix the indictment with press reports.
What the Court Records Show
The case is United States v. Tunick, case number 1:25-cr-00499-ELR-CCB, federal court for the Northern District of Georgia in Atlanta.
The indictment alleges that Samuel Tunick violated 18 U.S.C. § 2232(a): around January 24, 2025, the defendant, before and during the search and seizure of property by a CBP officer, “did knowingly destroy, damage, waste, dispose of, and otherwise take any action to delete the digital contents of a Google Pixel cellular phone, for the purpose of preventing and impairing the Government's lawful authority to take said property into its custody and control”.
Section § 2232(a) penalizes the intentional destruction, damage, disposal of property, or other actions taken to prevent or hinder the government from taking possession of it. The penalty: a fine or up to 5 years in prison, or both.
Status of the Case Today
Tunick has not been convicted. The course of the case according to court records:
| Date | Event |
|---|---|
| January 24, 2025 | Incident at Atlanta airport, returning from the Dominican Republic |
| November 13, 2025 | Indictment, filed under seal |
| December 3, 2025 | Unsealing; defendant pleads not guilty, released on $10,000 bond |
| March 17, 2026 | Defense motion to exclude evidence and explanations |
| July 20, 2026 | Hearing on the motion; conditions of release modified |
| September 18, 2026 | Court postpones schedule for post-hearing briefs |
| October 19, 2026 | Defense submits post-hearing brief; government response due by November 9, defense reply by November 23, 2026 |
A ruling on the motion to exclude evidence will be made no earlier than November 23, 2026. Until then, there will be no substantive ruling. The charge is not a conviction.
What Is Not in the Indictment
Press reports link the case to the GrapheneOS system and the duress password feature, which is a special password that deletes data when entered. However, the indictment does not mention the words “GrapheneOS” or “duress.” The indictment only refers to the deletion of digital content from a Google Pixel phone. These terms are also absent from the defense motion, which describes full disk encryption and deletion of encryption keys. The claim that this is “the first such case in the U.S.” is a journalistic assessment, not a court finding.
What This Means Practically
The Border You Must Not Cross
Traveling with a phone containing little data is entirely different from deleting data during an inspection. There is no obligation to carry your entire digital archive across the border, and limiting the contents of your device before departure is a legal decision.
However, from the moment the inspection begins (the officer requests the device or intends to legally take it), intentional deletion, remote wiping, resetting, or activating a deletion mechanism may create a risk of criminal liability. The Tunick case shows that federal prosecutors are willing to apply criminal statutes here. If the situation begins to take on a criminal nature, it is wiser to ask for a lawyer than to try to technically outsmart the inspection.
How to Prepare Devices Before Travel
All the following steps should be taken before the inspection begins. The goal is to protect privacy, not to hide evidence.
- Make a full backup
Detention of a device for five days or longer should not mean loss of data. A backup is also proof of what was on the device.
- Limit data stored locally
Check what apps are saving in the phone's memory. Archived photos and documents from years ago do not need to travel with you.
- Consider a separate travel device
Especially if you are carrying sensitive business data or client information.
- Disable fingerprint and facial unlocking
Leave only the password. Legally, these are two different situations, as mentioned above.
- Log out of accounts you do not need while traveling
The rule “only data on the device” works in your favor only when the data is indeed exclusively remote.
- Secure materials covered by professional secrecy
If you are carrying correspondence with an attorney or client documents, be prepared to specify them (files, folders, names, addresses) and report this before the review begins.
- Do not plan deletion mechanisms as a reaction to inspection
This is the only item on this list that can turn an unpleasant inspection into a criminal proceeding.
- Record the IMEI and serial numbers
These will be useful if the device is detained and you need to recover it remotely.
After Inspection: Tear Sheet, Device Return, and Complaints
The CBP directive requires the officer to inform you before searching the device of its purpose and basis, as well as how to file objections and seek claims. This is done via a tear sheet.
If your device is detained, CBP must contact you after the examination is completed so you can retrieve it where it was detained. If that is not feasible, they may arrange for its return. If the device is seized, rather than detained, you will receive a notice and instructions on how to contest the seizure before the local CBP Fines, Penalties, and Forfeitures office.
General complaint pathways and access to your own records (DHS TRIP, CBP INFO Center, complaint to DHS Office for Civil Rights and Civil Liberties, FOIA request) are described in the first part of the series.
Myths Best Left at Home
“At the border, I have no rights”
False. Government powers are broader there, but constitutional, statutory, and procedural limitations exist, and a U.S. citizen cannot be denied entry to their own country.
“CBP always needs a warrant to look at my phone”
False. CBP policy allows for basic searches without a warrant and without suspicion, and most appellate circuits accept this. The ruling in Riley v. California concerned searches during an arrest, not at the border.
“If I don’t provide my password, they must return my phone”
False. CBP provides for the detention of a device that cannot be inspected, usually for up to five days, but with the possibility of extensions without a strict upper limit.
“CBP will access my entire cloud through my phone”
Also false. The directive prohibits intentionally accessing data stored solely remotely and requires cutting off connectivity. However, much “cloud” data is still stored on the phone.
“I’ll set a code that wipes my phone if someone asks me to unlock it”
This is the most risky advice on the entire list. In the case of United States v. Tunick, federal prosecutors charged such action under a statute punishable by up to 5 years. The case has not resulted in a conviction, but simply being involved in it is severe.
Frequently Asked Questions
Can I refuse to provide my phone password?
You can, but the consequences depend on your status. A U.S. citizen will not be denied entry for this reason, although the device may be detained. A foreign national risks that lack of cooperation will be considered in the admissibility assessment. Whether the government can legally compel someone to disclose a password has never been resolved by the U.S. Supreme Court.
They detained my laptop. When will I get it back?
Detention should generally not exceed 5 calendar days, but the directive provides for extensions (beyond 15 days in segments of a maximum of 7 days), with no upper limit. Keep Form 6051D; it is your only document in this matter.
Does phone searching at the border happen often?
Rarely. In fiscal year 2025, CBP searched devices of 55,318 individuals out of over 419 million processed, which is less than 0.01%. However, the number is rising: after three quarters of 2026, it exceeded the total for the entire year of 2024.
Sources
Status as of October 23, 2026. This material is informational and does not constitute legal advice. CBP policy, immigration regulations, fees, and rulings change, and the case United States v. Tunick is ongoing. Before traveling, check the current status at the source, and for individual matters, seek the assistance of an immigration lawyer.
Comments (0)
No comments yet. Be the first!