Preparing a phone before a border crossing

This page does not advise refusing a lawful demand at a border. Under Schedule 7 of the Terrorism Act 2000, a person commits an offence if he wilfully fails to comply with a duty imposed under or by virtue of the Schedule, wilfully contravenes a prohibition imposed under or by virtue of the Schedule, or wilfully obstructs, or seeks to frustrate, a search or examination under or by virtue of the Schedule, and the Code of Practice says the person must provide access to any electronic device to allow for a search to be undertaken. Customs and Border Protection’s directive says that if an officer is unable to complete an inspection of an electronic device because it is protected by a passcode or encryption, the officer may detain the device pending a determination as to its admissibility, exclusion, or other disposition. The Australian Border Force told a Senate committee that there is no legal compulsion for a traveller to provide a password/passcode or provide assistance to an electronic device at the border, and also that if an individual refuses to comply with a request or provide a password for an examination of their electronic device, and an ABF officer considers there to be a risk to the border, the ABF officer is authorised to seize that device for further examination prior to being returned. What follows gives the words of each, and then turns to device behaviour that the vendors document, none of which involves refusing anything.

Schedule 7 of the Terrorism Act 2000 says a person who is questioned under paragraph 2 or 3 “must—give the examining officer any information in his possession which the officer requests.” The Schedule 7 Code of Practice says information requested under paragraph 5(a) “may include passwords to electronic devices.” The same paragraph says an examining officer may not, however, compel a person to disclose or confirm the identity of a source of journalistic information or disclose information subject to legal privilege. That is a rule for the examining officer. As quoted, it does not give the person a right to refuse any Schedule 7 duty. The Code also says “The person must provide access to any electronic device to allow for a search to be undertaken, including where access to a device requires the person to unlock a device through application of their thumb or finger, or any other form of access control.” Under paragraph 18, a person commits an offence if he wilfully fails to comply with a duty imposed under or by virtue of the Schedule, wilfully contravenes a prohibition imposed under or by virtue of the Schedule, or wilfully obstructs, or seeks to frustrate, a search or examination under or by virtue of the Schedule. See Extraction after seizure for what happens to a device once it has been examined.

In answer AE22-050 to the Senate Legal and Constitutional Affairs Legislation Committee’s Additional Estimates, the ABF said: “There is no legal compulsion for a traveller to provide a password/passcode or provide assistance to an electronic device at the border.” In the same answer it said: “If an individual refuses to comply with a request or provide a password for an examination of their electronic device, and an ABF officer considers there to be a risk to the border, the ABF officer is authorised to seize that device for further examination prior to being returned.” See Border: ABF for the rest of that policy, including retention timeframes.

CBP’s directive states: “Travelers are obligated to present electronic devices and the information contained therein in a condition that allows inspection of the device and its contents.” It also states: “If an officer is unable to complete an inspection of an electronic device because it is protected by a passcode or encryption, the officer may…detain the device pending a determination as to its admissibility, exclusion, or other disposition.” See CBP and your phone at the U.S. border for the rest of that directive. Statutes and prosecution guidance on destroying, concealing or obstructing, and a United States indictment, are set out in Duress wipes, auto-reboot and the law.

None of the following is advice to refuse a lawful demand. Each item below is what a vendor’s documentation says:

• Apple’s description of the Complete Protection class. Apple’s Platform Security Guide says that for the Complete Protection class, shortly after the user locks a device the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID, Face ID, or Touch ID.
• Android’s description of CE storage before first unlock. Android’s file-based encryption documentation says testers can verify that CE storage is locked before the device has been unlocked for the first time since boot.
• Apple on Advanced Data Protection. Apple says you can choose to enable Advanced Data Protection to protect the vast majority of your iCloud data, and states: “If you enable Advanced Data Protection and then lose access to your account, Apple will not have the encryption keys to help you recover it” — see Cloud and carrier for the rest of what Apple says on this.

See the border-prep tool for what the law and the agencies’ own documents say at a border, and what the sources say happens to a device afterward, and the rights card for the position in your jurisdiction, each line with its quoted source.