Judge Nina Morrison of the US District Court for the Eastern District of New York (Brooklyn, Queens, Staten Island, and Long Island) has ruled that police, including officers of U.S. Customs and Border Protection (CBP), need a warrant to search your cellphone at JFK International Airport, even when you are entering or leaving the US.

This ruling is certainly a positive development. It’s a break with a line of judicial decisions that have made US borders and international airports a Fourth Amendment-free zone, even for US citizens. It’s likely to influence other judges and other courts, even though — as a ruling from a District Court rather than an appellate court — it doesn’t set a precedent that’s binding even on other judges in the same Federal judicial district.

But there are important issues that weren’t addressed in this case, and important things you need to know to exercise your rights at JFK or other airports — even if judges in future cases in the same or other judicial districts are persuaded by the ruling in this case.

While Mr. Kurbanali Sultanov, a US citizen, was visiting his family in Uzbekistan in early 2022, an “alert” was added to the Department of Homeland Security’s TECS database flagging  him for special treatment whenever he tried to enter or leave the US.

A check for TECS “lookouts”  is one of the components of the algorithmic ruleset used by CBP to determine, from each international airline reservation (PNR), whether or not to give the airline permission to issue a boarding pass to that passenger for that flight and what instructions or messages to send to CBP staff or other Federal agencies as to how to treat that passenger when they arrive at an international airport or US border crossing. TECS alerts can be generated by matches with one or more fields including name, date of birth,  passport number, telephone number, email address, IP address, and/or other identifiers and selectors.

According to information provided in 2019 to companies bidding on a TECS upgrade project, “TECS is a collection of approximately 58 major applications, sub-systems and services with an estimated total of 17.9M Source Lines of Code (SLOC) supporting primary and secondary traveler processing.”

In its ruling in US v. Sultanov,  the court noted that, “A hit or lookout may be entered by another government agency into TECS for a variety of reasons.” The court’s opinion and the rest of the record are, however, strangely silent as to who or what agency set the TECS alert flag for Mr. Sultanov, according to what criteria, or on what (if any) evidentiary basis.

According to the court’s s decision (p. 65),  “The parties agree that the TECS hit to an ISP address associated with Sultanov gave the government reasonable suspicion that his device(s) contained illegal material when he returned to the United States.” That suggests that the court mistakenly assumed that a TECS alert can only be set when the subject of the alert is suspected of a crime.

But that’s not an accurate or appropriate description of how TECS alerts are used.

CBP has claimed the right to search any person or cargo entering or leaving the US as intrusively as it likes, for any purpose, without suspicion or probable cause. In line with that claimed authority, CBP uses TECS alerts to target “persons of interest” for search and/or interrogation without regard for whether they are suspected of a crime, much less whether any such suspicion is “reasonable” or rises to the level of “probable cause”.

CBP has, for example, used TECS alerts to flag people for questioning because it thought they might have evidence of crimes committed by other people, or because the FBI hoped to recruit them to act as informers and spies on their communities back in the USA. Neither of these reasons to want to stop, search, or question someone, or to set a TECS flag to do so, indicates that there is any reason to suspect that person of committing any crime.

In Mr. Sultanov’s case, CBP got away with bootstrapping its basis for suspicion out of thin air. Either CBP itself or some other unspecified agency (or maybe a foreign government) decided it wanted Mr. Sulmanov searched, so it set a TECS lookout flag to have him searched the next time he entered or left the US. And the court accepted the existence of that TECS flag as being, in and of itself, sufficient evidence that there was a “reasonable basis” for the subsequent search.

In other words, CBP’s desire to search Mr. Solmanov, as manifested by the TECS alert, was found to be a reasonable basis to suspect him of some crime. And that was, in turn, found to be sufficient to make the evidence obtained from the forensic search of Mr. Solmanov’s phone admissible in the criminal case against him as the fruit of a search carried out in a “good faith” belief by the CBP agents that it was legally justified.

That finding is wrong, and we hope that it’s challenged in future cases. We’ve never seen any evidence that TECS alerts are limited — even by non-binding CBP policies — to people suspected of crimes. On the contrary, Federal agents are trained to use TECS alerts whenever they want to question or search a person of interest who might be likely to travel internationally, regardless of whether that person is suspected of any crime. IRS agents, for example, are trained to use TECS alerts to collect taxes, even when delinquent taxpayers aren’t under investigation for any crime.

Parsing the 93 pages of legalese in Judge Morrison’s 93-page order (what’s all this about the “major questions doctrine”?), here are some takeaways for travelers from what happened to Mr. Solmanov and how the court let the CBP  off the hook despite finding they the police should have gotten a warrant:

1. Film and record CBP agents and police. If you can’t record video and audio on your smartphone without having it unlocked, consider bringing a separate “dumb” device without any personal data stored on it that you use to record interactions with police.
2. Stay in a public place with as many witnesses as possible unless they tell you that you are required to go somewhere. The more witnesses, the better for you if CBP or other cops try to lie about what happened, and the better the chances that someone else might have a recording even if you don’t or even if yours is deleted. If you go into a back room with the police, and they lie about what happens, it will be your word against theirs. If police ask you, “Would you please step this way?”, say, “No thank you. I don’t want to go with you.”  If they insist, say, “I don’t want to go with you. Am I being detained?” If they say you aren’t being detained, remain silent, and stay where you are or go on your way. If they say you are being detained and are required to go someplace with them, say, “I’m not going to resist, but I don’t want to go with you. I’m going with you only because you told me I am being detained. I want to leave as soon as possible. Tell me as soon as I’m free to go.” If they tell you you are required to go somewhere with them, a court is more likely to find that what they did required a warrant, or at least Miranda warnings, or that prolonging your detention was illegal.
3. Don’t consent to any search of your person, possessions, or data. Say out loud, in the presence of witnesses if possible, “I don’t consent to any search.” CBP agents or other police might search you and your devices anyway. But if you don’t consent, you might get the results of the search suppressed, or even recover damages under the Privacy Protection Act. If they say, “We’re going to search it anyway”, tell them “I don’t consent to this search.” If they ask you to sign a consent-to-search form or a waiver of your Miranda rights, write “REFUSED” across it.
4. If they want to search your phone, electronic devices, or data, assert your rights under the Privacy Protection Act. Say, “These devices contain material I am preparing for public distribution, and protected by the Privacy Protection Act.” You don’t have to be a professional journalist. The Privacy Protection Act protects you if, for example, you intend to post some of the photos on your phone on social media. Consider carrying a copy of the Privacy Protection Act, on paper (so you can show it without unlocking your phone) and/or as a “readme” file in the root and data directories of your phone and any devices. There’s  a limited exception to the Privacy Protection Act for some searches at international borders, but only for searches carried out “in order to enforce the customs laws of the United States.” Even at airports and borders, searches for any other purpose, for general law enforcement purposes, or for no specified purpose are covered by the Privacy Protection Act.
5. Back up your phone before any international flight or border crossing, so you don’t lose any critical data if it’s seized. If you have sensitive data on your phone, use strong encryption. Consider deleting sensitive data from your phone before crossing borders or flying internationally, and restoring it afterward.
6. Lock your phone or shut it completely off before approaching checkpoints or borders. Some courts have distinguished between the level of suspicion needed to justify a “manual” search of an unlocked phone (low or none) and a higher level of suspicion needed to justify a “forensic” search that takes longer and requires more tools than just the agent’s finger on the touchscreen while you are detained for a “brief” few minutes or few hours. Internal procedures typically require CBP agents or other police to keep written records if they keep custody of phones or devices or use forensic tools to unlock them. Those records make it harder for them to change their story or make up pretexts after the fact for the search and seizure.
7. Don’t give CBP agents or other police the password(s) to your cellphone or other electronic devices or accounts.  They might seize your devices and use forensic password-cracking tools to get your data anyway. But if you give them your password, even under duress, police will lie and say that you did so voluntarily, and you may find it difficult to establish that you didn’t consent, to get evidence suppressed, or to collect damages.
8. Ask at every step if you are free to leave. If they say you are free to leave, leave immediately. If you are arriving in the US, leave the airport as soon as you can. If you are departing, go on to your gate and board your flight as soon as you can (or give up on flying that day and leave the airport, if you don’t want to run the risk that they will get a  warrant in time to come back and grab you at the gate or off the plane). If you don’t ask if you are free to leave, or you don’t leave as soon as you can, they will claim that the entire encounter was “consensual”.
9. Don’t hand over your phone or other electronic devices or property without a demand. If they say, “May I have your phone?”, say “No, thank you”. If they say, “I need your phone”, ask “Is that a request or a demand?” If they insist on taking it, say, “Am I required to give you my phone?” or “Are you seizing my phone?” If they demand that you hand it over, say, “I am not resisting your seizure of this item, but I want it back as soon as possible.” (Mr. Sulmanov, unfortunately, failed to object to the seizure of his phone, only to the subsequent search of its contents. See note 11, p. 60, of the court order.)
10. If they try to hold your phone hostage to keep you from leaving, call their bluff. Say, “If I am free to leave now, I want to leave now. Give me back my phone, or give me  a written receipt for it, now.” We know, and they know, that you don’t want to leave without your phone. But if they really want to hold onto your phone long enough for a forensic search, they are going to do it and get all the data on your phone — whether or not you wait around for the search. Asking to leave, even without your phone, forces them to document the nonconsensual seizure of your phone, which might make a difference later if you end up in court. And it might force them to make a decision as to whether they have a legal basis to seize your phone before they have time to try to get a warrant.
11. If they take your phone or other belongings, demand a receipt. Curiously, CBP regulations require them to give you a receipt if they seize your property pursuant to a warrant,  but not if they seize it without a warrant. In practice, though, they will probably give you a receipt even for a warrantless seizure. And if they won’t give you your phone back or give you a receipt for it, they will have a hard time arguing to a judge that you were “free to leave” without your phone or a receipt, and thus that they didn’t need to read you your Miranda rights.
12. Ask the basis for any search, seizure, or questioning. Ask, “What’s the basis for this search?”, “What’s the basis for that question?”, or “Am I required to answer that question as a condition of entering or leaving the USA?” Because CBP agents think — incorrectly, as the decision in US v. Sultanov shows — that at an international airport or border crossing they can search and seize whatever they like, for any or no reason,  there’s good chance that if you ask, they will say, “We don’t need any  basis”, or “We are searching for whatever we might find”. Those statements could undermine their later attempts to make up after-the-fact pretexts for their actions, or even leave them personally liable for damages under the Privacy Protection Act if they admit that their search isn’t limited to customs enforcement purposes.

It’s tempting to “cooperate” with border guards or police, to avoid provoking them into treating you even worse than they otherwise would.  But being polite and not resisting doesn’t have to mean giving away your rights.