A Border Officer Asks to See Your Phone. What Now?

Hidlet is an iPhone app

Point your iPhone camera at the code to install. No account needed.

or text me the link

You have landed after a long flight, you are tired, and the officer at the desk says, “I need to see your phone.” Most travellers are never asked. If it does happen, it helps to have thought about it at home, not at the counter.

This is general information, not legal advice. Rules differ by country, and often by whether you are a citizen, a resident or a visitor. Here is what the official pages say, what you can set up on your iPhone, and what a vault does and doesn’t change.

What the border agencies say

Border agencies describe their own search powers, and EFF’s guide explains that in the US “routine” border searches don’t need a warrant or individualized suspicion, which is different from police inside the country. Two examples, both from the agencies themselves:

• United States. US Customs and Border Protection says all travellers are subject to inspection and that device searches are rare, under 0.01 percent of arriving international travellers in its figures. It says travellers must present devices in a condition that allows examination. A device that can’t be inspected may be detained, and for foreign nationals refusing can count in admissibility decisions. It says U.S. citizens won’t be denied entry for that reason alone. It also says searches are limited to data stored on the device, and that officers either ask you to turn on airplane mode (or switch off Wi-Fi and Bluetooth) or do it themselves.
• Canada. The Canada Border Services Agency says its officers can examine digital devices, and that “you are obligated to provide your password when asked.” Refusing can lead to the device being detained or seized.

Other countries differ again. Search for the border or customs agency of the country you are entering, and read its page for travellers.

The Electronic Frontier Foundation (EFF), a rights group, publishes a longer guide for US travellers. Its 2017 guide says the law is evolving and creates uncertainty for travellers. It is old, so check for newer rules before you travel. If you have a specific worry, such as your immigration status or your job, a lawyer who knows the country is the right person to ask.

The catch

A passcode, a vault or a locked app can stop other people. It can’t change what a border agency is allowed to ask of you. In the examples above, the agencies describe consequences for travellers who don’t give access, and those consequences differ by who you are. The EFF guide also warns that lying to an officer can be a serious crime, and that tools that make data look absent can look like deception. So this article doesn’t suggest hiding things from officers or giving false answers. EFF’s guide advises staying calm and respectful.

What to do before you travel

1. Read the rules for your destination. Start with the border agency’s own page.
2. Update iOS and back up. In Settings, tap your name, then iCloud, then iCloud Backup, and tap Back Up Now. Stay on Wi-Fi until it ends. If a device is held, you still have your data.
3. Carry less. EFF’s guide suggests carrying less data, or a temporary device. Ask what you actually need on the phone for the trip.
4. Know how your lock behaves. Apple says the iPhone asks for the passcode, not Face ID, right after it is restarted, and when you hold the side button and a volume button for 2 seconds (the screen that offers power off and Emergency SOS). EFF’s 2017 guide recommends a memorised, strong password over biometrics. Apple also lists five unsuccessful Face ID matches as a time the passcode is required. Choose a passcode you will remember when you are tired.
5. Lockdown Mode, only if it fits you. Apple says Lockdown Mode is for the few people who may be personally targeted, and that most people never are. It limits features such as message attachments and some websites, and the iPhone must be unlocked to connect to accessories or computers. Apple doesn’t present it as protection against a border search, so we don’t either.

Where a vault fits

A vault is a way to keep private photos out of your photo library and behind a key that isn’t your passcode. That is useful when you hand your phone to a friend, a child, or a stranger who asks to look at a picture. It is not a way to hide things from an officer.

Hidlet is an encrypted vault app, available on the App Store. You draw a pattern, and the pattern is the key to one vault. The pattern isn’t stored, and the app doesn’t show a list of vaults. Leaving the app locks it at once.

What it can’t change. If an officer asks you to open an app, you are in the same position as with your phone: our reading is that the rules of that country apply, not the app’s design. Hidlet has an optional duress vault (a Pro feature) that deletes other vaults from the phone when its pattern is drawn. We wouldn’t use it at a border. That is our reasoning, not a legal statement: deleting data when asked to give access could look like destroying it, and the rules differ everywhere.

What it can do. If you back up a vault to your own iCloud, the encrypted copy lives there, and you can restore it on a new iPhone with your pattern, as long as iCloud Keychain is on, or with your recovery phrase if it isn’t. For what the agencies above say about cloud data, read their pages yourself, because the rules differ.