Border Phone Search: Your Rights and the Real Risks

A border phone search used to be a story about somebody else. A visa applicant with the wrong social media history. A courier with a bad itinerary. Not a returning citizen with a passport in his hand and nothing to hide.

That comfort is gone.

Two cases decided how I think about this. In Atlanta, federal prosecutors charged an American citizen with a felony because his phone erased itself during a customs inspection. In Virginia, a federal judge ordered the government to explain what it actually did with a journalist’s two seized handsets. Different facts, same machine. Both of them landed inside a three week window in July 2026, and both of them say something uncomfortable about where the West is heading. If you have been treating government surveillance as a problem for other people, these two cases are the wake-up call.

The Atlanta Case: A Privacy Feature Became a Felony Charge

Samuel Tunick, an Atlanta resident and US citizen, was returning from a holiday in the Dominican Republic on 24 January 2025. Officers pulled him aside at Hartsfield-Jackson Atlanta International Airport for questioning. They asked for his passcode. He gave them one.

It was the wrong one, deliberately. Tunick’s Google Pixel ran GrapheneOS, a hardened open-source Android build made for exactly this situation. It is not a mainstream consumer OS and it does not pretend to be. Privacy is the entire product. The duress passcode is one of its headline features: enter that second code and the operating system does not unlock. It wipes. The hardware survives. The data does not.

A grand jury indicted him that November under 18 U.S.C. 2232, the statute covering destruction of property to prevent a lawful seizure. Maximum penalty: five years in federal prison, a fine, or both. A hearing ran in federal court in Atlanta in late July 2026.

Here’s the kicker. The federal public defender’s office in the Northern District of Georgia says only one other federal indictment has been brought on that charge in the past thirty years. The 2019 case involved drug trafficking. Tunick’s involves a privacy setting.

His lawyers argue the seizure was unlawful, that he was detained without being read his rights, that he asked for a lawyer repeatedly and was refused, and that he was singled out because of his activism against Atlanta’s police training centre. The government has not explained what it was investigating. That is not an oversight. The statute they chose does not require them to explain, which is precisely why they chose it over the heavier twenty year alternative that would force them to show their hand.

Be honest about the double edge here. Running GrapheneOS is a deliberate choice, and a prosecutor will happily tell a jury that a man who installs a privacy-first operating system and configures a wipe code has already announced his intentions. Tunick’s own tooling becomes part of the case against him.

That is the part worth sitting with. The software did nothing wrong. It performed exactly the function it was built to perform, at the exact moment it was built to perform it. The state’s answer was not to close the security hole or challenge the tool. It was to charge the man holding it. Choosing serious privacy software is now itself a fact that can be read as consciousness of guilt.

Strip away the politics and one thing remains. A US citizen crossed his own border, used a lawful security feature on his own device, and is now a defendant facing five years.

What Is a Border Phone Search, Legally?

A border phone search is a warrantless inspection of a traveller’s electronic device carried out under the border search exception to the Fourth Amendment. US customs officers may conduct a basic search, meaning manual scrolling through your device, with no suspicion required at all. An advanced search, where the device is connected to forensic equipment that copies and retains its contents, requires reasonable suspicion plus supervisory approval.

The legal theory rests on one idea: you are not fully inside the country until you have been admitted. Courts, including the Supreme Court, have long accepted that Fourth Amendment protections are reduced at the border because the government has a heightened interest in controlling what comes in.

That doctrine made sense when a suitcase was a suitcase. A modern phone is not luggage. It is your correspondence, your medical history, your banking, your location trail for the last five years, your photographs, your contacts and quite possibly your employer’s confidential files. The 2014 Supreme Court decision in Riley v. California recognised exactly that when it required a warrant to search a phone incident to arrest. The border exception has largely escaped that logic, and the circuits still disagree on how far it stretches.

Max Blumenthal, Dulles, and the Judge Who Pushed Back

The second case runs the other direction, and it matters just as much.

On 10 July 2026, journalist Max Blumenthal landed at Washington Dulles returning from a reporting trip to Iran. Officers detained him for roughly two and a half hours, questioning him about his journalism, his funding and his travel. He refused to hand over his passcodes. Officers seized both of his phones and told him the devices would be hooked up to machines.

The American Arab Anti-Discrimination Committee filed an emergency motion in the Eastern District of Virginia on 16 July, arguing First Amendment, Fourth Amendment and Privacy Protection Act violations. The government returned the phones after the motion landed, then asked the court to treat the matter as closed.

Judge Leonie Brinkema did not. On 30 July 2026 she ordered discovery into what officials actually did with the devices, who handled them and whether anything was extracted or retained. Her language from the bench is worth reading twice:

Two takeaways. First, the courts are not uniformly asleep, and a border phone search of this depth is now being questioned by federal judges. Second, and this is the part people skip, Blumenthal only got that ruling because a legal organisation moved within six days and a federal judge in the right circuit took the case seriously. Most travellers have none of that. They have a missed connection and a receipt.

The Numbers Behind the Border Phone Search Surge

Anecdotes make headlines. Volume tells you whether something is a pattern. It is.

Two details inside that data matter more than the headline totals. Around 10% of these searches are advanced searches, meaning the contents were copied and kept for later analysis. And roughly 20% of the devices searched belonged to US citizens.

Officials point out that device inspections touch well under 0.01% of travellers. Fine. That statistic is also useless to you personally, because the searches are not distributed randomly. They cluster around journalists, activists, people with certain travel patterns, people flagged by an algorithm you will never see, and people who happened to annoy somebody with a keyboard and a following. The numbers don’t lie about direction, even if they look small in aggregate.

In advisory work we see the pattern from the other side. Clients rarely come to us after a random stop. They come after the second one, when the pattern becomes obvious to them, and by then the damage is a copied device rather than a delayed flight.

Can CBP Search Your Phone Without a Warrant?

Yes. US Customs and Border Protection can search your phone at a port of entry without a warrant and without any individualised suspicion for a basic manual inspection. An advanced forensic search, which copies and retains device contents, requires reasonable suspicion of a legal violation or a national security concern, plus sign-off from a supervisor. Neither standard requires a judge.

The practical consequence is that the strongest constitutional protection you have anywhere else in the country evaporates at the arrivals hall. That is not a loophole anyone is rushing to close. It is a working tool, and its use has grown fivefold in a decade.

Worth knowing: the same authority extends to laptops, tablets, cameras and external drives. A border phone search is simply the version that makes the news, because the phone is the device carrying the most about you.

Can You Refuse to Unlock Your Phone at the Border?

US citizens can refuse to unlock a device and cannot be denied re-entry for that refusal. Officers can still seize the device, detain it for forensic examination and hold you for extended questioning. Non-citizens, including green card holders in some circumstances and every visa holder, face far worse consequences, up to and including refused entry.

That asymmetry is the single most important thing to understand before you travel. Citizenship is what converts a refusal from a catastrophe into an inconvenience. It is also, not coincidentally, exactly what a second passport gives you at a second border.

What you cannot safely do, on the evidence of the Atlanta case, is destroy data once officers are actively exercising their authority. There is a meaningful legal difference between travelling light and wiping under questioning. One is preparation. The other is now being charged as obstruction.

This Is Not Just America: The Wider Western Squeeze

If the United States were an outlier, the answer would be simple: travel elsewhere. It is not an outlier. It is just further along.

The United Kingdom issued a technical capability notice to Apple in January 2025 demanding access to encrypted iCloud data. Apple’s response was to withdraw Advanced Data Protection from British users in February 2025 rather than build a back door. A second, narrowed notice covering British users followed in September 2025. Apple, alongside Privacy International and Liberty, took it to the Investigatory Powers Tribunal, heard in January 2026. Britain also announced a mandatory digital ID that will be required for right to work checks by the end of this Parliament. Not optional. Required to earn a living.

The European Union brought its Entry/Exit System to full operation on 10 April 2026. Every non-EU national on a short stay across 29 countries now has fingerprints and a facial image registered at the external border. Passport stamps are gone. A biometric record replaces them, and it does not fade. Liberty Mundo covered the build-out of Europe’s biometric surveillance apparatus before it went live, and the finished system is broader than the pitch.

Then there is the CSA Regulation, better known as Chat Control. As of mid-2026 the final text was still being fought over in trilogue, with the Council pushing provider-side scanning of private messages without judicial orders and the Parliament insisting on warrants and an exemption for end-to-end encryption. The Council’s mandate also carries age verification for messenger and email accounts, which in practice means the end of anonymous communication in Europe. Whatever version lands, the direction of travel has been consistent for four years.

Look at that table as one picture rather than six news stories. Identity, movement, communications and devices are each being brought under a permission system, in parallel, across every major Western jurisdiction, within roughly eighteen months. That is not a conspiracy. It is a policy consensus, which is harder to reverse.

How to Prepare for a Border Phone Search: Step by Step

Common Mistakes People Make About Device Searches

Believing citizenship is a shield. It is a shield against being turned away. It is not a shield against seizure, and roughly one in five searched devices belongs to a citizen.

Confusing TSA with customs. Airport security screening and a customs inspection at a port of entry are entirely different powers. Only one of them can take your laptop.

Underrating your own encryption. Full-disk encryption on a modern handset is not a speed bump. Nobody at the arrivals desk is brute-forcing it, and the forensic vendors who sell unlocking tools have spent a decade in a patchy, version-by-version arms race with Apple and Google. The state’s reliable route past strong encryption is not mathematics. It is you. That is exactly why the pressure at the border lands on the passcode rather than the ciphertext, and why the UK went after Apple with a capability notice instead of a cryptanalyst.

One caveat that actually matters: a device which has been unlocked at least once since booting sits in a far weaker state than one powered fully down. That distinction, not the strength of the algorithm, is where most real-world extractions succeed. Power it off before you land.

Believing “I forgot it” is a free pass. It is a legitimate position and sometimes the right one. It is not risk free, and anyone who tells you otherwise has not read the case law. Francis Rawls, a former Philadelphia police sergeant, was held in civil contempt for more than four years for failing to decrypt two hard drives. He was never charged with the underlying offence. He was released in 2020 only because the Third Circuit held that the eighteen month statutory cap in 28 U.S.C. 1826 applied to him. Four years of custody, no conviction, no trial.

Jurisdiction decides everything here. A US citizen who declines at the border loses the device, not entry. Cross into Britain and the calculus inverts: under Schedule 7 of the Terrorism Act 2000, refusing to hand over a device password is itself a criminal offence, with no requirement that anyone suspect you of terrorism. Muhammad Rabbani was convicted at Heathrow in 2017 for exactly that, and fined. Same refusal, same suitcase, completely different legal outcome depending on which queue you are standing in. That is the whole argument for optionality in one sentence.

Treating a wipe as a clever move. That is the exact mistake now being litigated in Atlanta. The tool worked perfectly. The timing created a felony charge.

Waiting for the courts. Judge Brinkema’s ruling is genuinely encouraging. It is also one district judge, in one circuit, in one case, years away from anything settled. Building your life around a favourable appellate decision that has not happened yet is not a plan.

Thinking this is only about phones. Devices are the visible edge. Follow the same logic to banking privacy, to automatic financial information exchange under the Common Reporting Standard, and to capital controls, and the same permission architecture appears every time.

Where a Second Passport and Second Residency Change the Maths

Let’s be blunt about what a border phone search really exposes. It is not weak passwords. It is the fact that you hold exactly one relationship with exactly one state, and that state controls whether you can come home, work, bank and move. Every meaningful protection flows from breaking that monopoly.

Something we see constantly: people arrive convinced the answer is a technical one. Better phone, better VPN, better operating system. Then they look at the Atlanta indictment and realise the tool worked exactly as designed and the man is still facing five years. The fix was never on the device. Check the Passport Freedom Index and you will see how differently the same journey scores depending on which document you present.

Another pattern worth knowing: most people who come to us about “getting out” have a passport plan and no residency plan. That combination fails, because citizenship by investment takes months to years, and you need somewhere to actually live in the meantime. Fast residency permits are the bridge. Build the bridge first.

None of this means renouncing anything. Renouncing citizenship is a specific decision with specific tax consequences, and it is not the starting move for anyone. The starting move is optionality. And for American readers, one point never changes: US citizens owe tax to the IRS on worldwide income regardless of where they live, and moving abroad does not alter that. The Foreign Earned Income Exclusion covers earned income only, never pensions, Social Security, retirement account withdrawals or investment income.

Is It Illegal to Wipe Your Phone Before Travelling?

No. Deleting data from your own device before you travel is not a crime, and legal experts commenting on the Atlanta case say a traveller who cleans a phone simply because he does not want officials reading personal files has a strong argument that he lacked criminal intent. The offence alleged in Atlanta turns on wiping during an active, lawful search.

The distinction is intent plus timing. Routine data hygiene weeks before a flight looks like what it is. The same act performed while an officer is questioning you looks, to a prosecutor, like obstruction. That is a thin line to be walking with five years on the other side of it.

Border Phone Search FAQs

Final Thoughts

One man is facing five years because his phone did exactly what he configured it to do. A journalist needed a federal judge to find out whether his own government copied his notebooks. Both happened in a fortnight, in the country that wrote the Fourth Amendment.

None of this requires believing anything dramatic about intent. Governments acquire capabilities and then use them, because that is what institutions do. The reasonable response is not panic and it is not paperwork paranoia. It is optionality: more than one citizenship, more than one residency, assets and data that do not all sit inside the reach of a single legal system.

That takes months. The border phone search that changes your mind takes about forty minutes. The clock is ticking on which one you start first.

Worth reading next: building a passport portfolio away from declining Western powers and our full privacy coverage.