President Trump’s Executive Order expanding the pre-existing and ongoing #MuslimBan from foreign airports to US points of entry, by forbidding entry to the US by citizens of specified blacklisted countries, doesn’t say anything explicit about searches or interrogation of people entering or leaving the US.
But this Executive Order seems to have been interpreted by US Customs and Border Protection officers at US borders and international airports and at “preclearance” sites abroad as giving them a green light for intensified questioning and searches (“extreme vetting”) of travelers including searches and demands for passwords to laptops, cellphones, and other digital devices.
In response to this wave of digital harassment and snooping at airports and borders, several news outlets, civil liberties organizations, and free press and journalists’ rights organizations have posted technical and legal advisories about how journalists and ordinary travelers can protect their data when they travel.
We welcome this attention to airport and border search law, and these efforts to educate travelers.
We want to add one potentially significant law that few travelers (or CBP officers or TSA checkpoint staff) are aware of, and that isn’t mentioned in any of the advice to travelers about airport and border searches that we’ve seen recently: The Privacy Protection Act of 1980.
We’ve written about the Privacy Protection Act several times before, especially in the context of border searches of activists and journalists. But the protection offered by this law isn’t limited to journalists. Here’s an unfortunately necessarily refresher on what this law means and what you can do to take advantage of it:
What is the Privacy Protection Act? The Privacy Protection Act of 1980 is codified at Title 42 US Code, Section 2000aa, and has been implemented by Department of Justice regulations at 28 CFR § 50.10 and provisions of the US Attorneys’ Manual (which have the force of regulations) at § 9-13.400.
What does this law say? The law, regulations, and instructions to Federal officers prohibit certain searches and seizures by Federal state, or local law enforcement officers of documents, data, and the premises where these documents or data are, or are expected to be, found. They impose both substantive and procedural restrictions, including requirements for advance approval by high-level Department of Justice officials, on permissible searches and seizures.
How is this law enforced? The Privacy Protection Act creates a private right of action to sue Federal, state, or local government agencies and agents in Federal court for money damages (and attorneys’ fees) if they violate these rules. Few lawsuits have been brought under this law, probably because almost nobody knows about it. But the right to recover damages is real. Our parent organization, the First Amendment Project, has represented an independent photojournalist in successful litigation for damages under this law.
The Privacy Protection Act isn’t just for “journalists”. The law protects “work product materials” or other “documentary materials” that are “possessed by a person reasonably believed to have a purpose to disseminate to the public a newspaper, book, broadcast, or other similar form of public communication.” If you intend to post some of your photos or descriptions of events on social media, your documents and digital materials are covered.
The Privacy Protection Act protects digital data as well as papers. “‘Documentary materials’, as used in this chapter, means materials upon which information is recorded, and includes, but is not limited to, written or printed materials, photographs, motion picture films, negatives, video tapes, audio tapes, and other mechanically, magnetically or electronically recorded cards, tapes, or discs.”
The Privacy Protection Act protects you even at airports and international borders. There is a limited exception to the Privacy Protection Act for border and customs searches, but only for searches and seizures for a limited purpose: “in order to enforce the customs laws of the United States.” Searches and seizures at borders and international airports for any other purpose — such as to enforce immigration laws or investigate terrorist threats — are subject to the restrictions and limitations of the Privacy Protection Act. There is no exception to the Privacy Protection Act law for any other administrative searches, such as those at TSA checkpoints for domestic flights.
There are many exceptions, and exceptions to the exceptions. Read the law, the implementing regulations, and the relevant sections of the US Attorneys’ Manual. If you aren’t sure about what the law means, or what your rights are, get legal advice. (Realize that most lawyers are unaware of, and unfamiliar with, this law, but also that this blog is not legal advice.)
Giving government agents a copy of the law and telling them that you intend to distribute materials to the public might not stop a search, but might delay it or prompt officials to reconsider, consult their superiors, and/or give you a chance to consult your attorney. Or they might give up rather than bother to go through a tedious process of getting the necessary high-level approval.
Ignorance of the law is a defense. The Privacy Protection Act only applies if the government agents searching or seizing your documents “reasonably believe” that you intend to disseminate information to the public. And, “It shall be a complete defense to a civil action … that the officer or employee had a reasonable good faith belief in the lawfulness of his conduct.”
Most law enforcement officers and other government agents have never heard of this law, and won’t know about it unless you tell them. And unless you tell them, they won’t know that you intend to post photos or descriptions of events on social media.
To protect your rights, be proactive. Don’t give government agents a chance to later plead ignorance of the law or of your status. Tell any US government agents who threaten or attempt to search or seize your papers, digital devices, or storage media that they contain work product and other documentary materials, and that you intend to disseminate some of them to the public. Refer them specifically to the Privacy Protection Act, 42 USC § 2000aa.
Consider carrying a copy of this law in your wallet and/or with your laptop, phone, and/or other devices. (You can fit this version on both sides of a single letter-sized sheet of paper.) And put a copy of this “readme” file in the root and user directories of each device. That way anyone searching any of your devices ought to be warned about the law, even if the search is conducted secretly and not in your presence.