Dr. Andreas Gal is the former CTO of the Mozilla Foundation, and the founder of a software company that was acquired by Apple Computer last year. He’s a naturalized US citizen and a frequent international business traveler.

Here’s part of Dr. Gal’s account  (in another part of which he links to some of our previous reporting on related issues) of what happened when he arrived at San Francisco International Airport after a trip to Europe last November:

I quickly found myself surrounded by three armed agents wearing bullet proof vests. They started to question me aggressively regarding my trip, my current employment, and my past work for Mozilla, a non-profit organization dedicated to open technology and online privacy.

The agents proceeded to search my belongings and demanded that I unlock my smartphone and laptop. This was rather concerning for me. My phone and laptop are property of my employer and contain unreleased software and proprietary information. I’ve signed a non-disclosure agreement promising not to give anyone access.

Because I was uncertain about my legal responsibilities to my employer, I asked the agents if I could speak to my employer or an attorney before unlocking my devices. This request seemed to aggravate the customs officers. They informed me that I had no right to speak to an attorney at the border despite being a U.S. citizen, and threatened me that failure to immediately comply with their demand is a violation of federal criminal code 18 USC 111.

I declined to answer any further questions, and continued to ask to speak to an attorney instead. The interrogation and threats continued for some time, which I endured silently. Despite initial threats that they would keep my devices if I didn’t unlock them, I was eventually permitted to leave the customs area with my devices.

The ACLU of Northern California has complained to the Department of Homeland Security and its Customs and Border Protection component about the detention, search, and interrogation of Dr. Gal and the baseless threats of criminal prosecution made by CBP.

We share the concerns raised by the ACLU in their complaint on behalf of Dr. Gal.

But there are some additional aspects of this case worth noting:

1. The CBP agents were lying and making threats which they did not follow through on. When Dr. Gal persisted in not merely asserting but exercising his rights, the CBP agents allowed him to leave without being charged with any crime.  The takeaway is that law enforcement officers can and will  lie, that their goal is always to get you to “consent” to whatever they want to do or want you to do, and that you will never find out the actual limits of their legal authority unless you say no to any requests for consent.  In this case, Dr. Gal was allowed to leave with his electronic devices. His devices might have been kept longer by CBP, but if they had been, Dr. Dal would only have been able to contest their continued detention or any demand for him to unlock them or provide the passwords if he withheld his consent. If police ask you, “May I…?”, that means they know they need your permission. Just say, “No”.
2. There’s an additional law which Dr. Gal could have invoked, but of which he was probably unaware: the Privacy Protection Act,  Title 42 US Code, Section 2000aa. As a blogger and Twitterer, Dr. Gal is almost certainly protected by the Privacy Protection Act — as is anyone who posts publicly to social media. The Privacy Protection Act provides an important potential means of redress for searches and seizures of documents or electronic data at airports — but only if you know your rights and assert them when government agents threaten to violate them.
3. Dr. Gal’s account of what happened to him at SFO and the ACLU complaint letter address the likely basis for his detention and interrogation (as inferred from the questions he was asked about activities protected by the First Amendment). But they don’t address either the means by which he was targeted, or who was responsible. Given that Dr. Gal was surrounded by a special squad of armed goons before anyone had asked him any questions, he could only been targeted based on the data about him held by CBP, including records of his past and most recent travels (including mirror copies of airline reservations) and any TECS alerts set by law enforcement agencies. Records released by CBP in response to Privacy Act and FOIA requests by other travelers have shown how TECS alerts are used to target journalists and activists and trigger messages (based on ingestion of airline reservations) so that a “welcoming party” such as Dr. Gal can be waiting for them to search and question them and, in some cases, seize and image their electronic devices. We’ve assisted other travelers who have been able to use Privacy Act and FOIA requests for records of their travel to identify or get clues about when a TECS alert was set for them as a “person of interest”, by whom or by what agency, why, and with what handling instructions. Much information is always withheld, but clues sometimes get through.