Preparing a phone before a border crossing

This page does not advise refusing a lawful demand at a border. At a UK port or airport, wilfully failing to comply with a Schedule 7 duty — which includes providing access to an electronic device — is a criminal offence. At a US border, Customs and Border Protection’s own directive allows an officer to detain a device it cannot inspect because of a passcode or encryption. In Australia, there is no legal compulsion to provide a password, but Border Force can seize the device instead. Three different legal positions, three different consequences — what follows states each of them, and only then turns to device-side steps that do not involve refusing anything.

A person questioned under Schedule 7 of the Terrorism Act 2000 “must—give the examining officer any information in his possession which the officer requests.” The Schedule 7 Code of Practice states that this duty to provide access to a device “includes where access to a device requires the person to unlock a device through application of their thumb or finger, or any other form of access control.” Wilfully failing to comply with a duty imposed under Schedule 7 is a criminal offence. See Extraction after seizure for what happens to a device once it has been examined.

The ABF has told a Senate Estimates committee: “There is no legal compulsion for a traveller to provide a password/passcode or provide assistance to an electronic device at the border.” It also told the same committee what follows a refusal: “If an individual refuses to comply with a request or provide a password for an examination of their electronic device, and an ABF officer considers there to be a risk to the border, the ABF officer is authorised to seize that device for further examination prior to being returned.” See Border: ABF for the rest of that policy, including retention timeframes.

CBP’s own directive states: “Travelers are obligated to present electronic devices and the information contained therein in a condition that allows inspection of the device and its contents.” It also states what happens if that is not possible: “If an officer is unable to complete an inspection of an electronic device because it is protected by a passcode or encryption, the officer may…detain the device pending a determination as to its admissibility, exclusion, or other disposition.” See Passcode vs biometrics for the rest of that directive.

None of the following is advice to refuse a lawful demand. Each is a state a device can be put into before travelling, described in the vendor’s own words:

• Turning off biometric unlock leaves the passcode as the way in. Apple’s own documentation lists entering the passcode, or unlocking with Optic ID, Face ID or Touch ID, as the alternatives once its most-protected data class has locked — so with biometric unlock switched off, the passcode is the one that remains.
• Powering a device off returns app data to a locked state. Android’s file-based encryption documentation states that Credential Encrypted storage, the default location for app data, is only available after the device has been unlocked — which a power cycle undoes.
• Advanced Data Protection changes what Apple itself can access in the account. Apple states it does not hold the encryption keys for Advanced Data Protection categories and cannot help recover that data if the account holder loses access — the same limit described on Cloud and carrier.

See the border-prep tool and the rights card for a step-by-step version of the legal position stated above.