The United States Customs and Border Protection (CBP) cannot legally demand access to any user data that is stored “exclusively” in the cloud, according to a letter from Customs and Border Protection addressed to Senator Ron Wyden which leaked online earlier this week. However, any data stored on a device is within the agency’s purview, even if it is encrypted. U.S. Customs agents can demand a user’s passwords to get past login screens, get into password-protected archive files, and can even request access to user profiles for various websites, including social media. Should a user deny the agent their password, they can expect their device to remain at the Customs office on lockdown until they allow a search. Non-citizens trying to enter the country can be denied entry for refusing to allow a search of their devices, but this is a discretionary rule and does not necessarily mean that refusing a search is guaranteed to send you back the way you came.
The use of the word “exclusively” technically means that data from websites and cloud services cached on a device at the time of the search is legal for agents to demand access to. Therefore, setting Google Drive to allow offline access to some files, having Google Play Music cache your music for smoother playing, and having encrypted conversations from services like Facebook Messenger hanging around on the device are all examples of situations where a Customs agent could legally demand access to a file or piece of user data that would otherwise be considered to be “exclusively” stored off-device in the cloud, and would thus normally fall outside of their purview.
When the CBP’s agents search a device, they’re doing so in order to look for any illegal content that may be difficult or dangerous to transmit over the Internet, or anything that could present a risk to national security. This can be anything that’s unlawful, no matter how minor or severe, and depending on what’s found, could result in various legal consequences, or a denial of entry into the United States. Any kind of confidential government information you don’t have clearance for, video evidence of a crime you’ve committed, or potentially even a few illegally downloaded songs or apps could technically land you in trouble with the CBP.