New Zealand defends its border device search policy (Q&A)

What’s the cost of data privacy at the border? In New Zealand, it could be $5,000, if you resist an immigration official’s demand that you hand over your phone, tablet, or laptop before entering the country.

The Customs and Excise Act of 2018, which went into effect on October 1, establishes clear guidelines on how the country can enforce its device search policies at border crossings, including airports.

Customs agents who have a “reasonable suspicion” that a traveler has engaged in criminal activity such as child exploitation or drug trafficking can demand that travelers unlock their devices with a typed password or passcode, fingerprint, or facial recognition.

READ MORE ON TRAVEL AND SECURITY

How to protect your data when traveling internationally
Your next flight itinerary could be easily hacked
How to securely send your personal information
How to protect yourself when using airplane Wi-Fi

Upon a preliminary, “cursory” exam of a device, New Zealand’s immigration officials are required to ensure that the device is in airplane mode and is not connected to Wi-Fi, and they are limited to look at data stored on the device. Whether the stored data officials inspect during these preliminary exams includes emails, messaging history, or even app activity logs is unclear.

The new fine for refusing to comply with these preliminary device search requests is actually part of New Zealand’s efforts to clarify what rights travelers have—and don’t have—when entering the country, argues Terry Brown, a representative of New Zealand Customs Service.

“Under our previous legislation, we still had power to retain and search electronic devices,” Brown says. “What the old act didn’t do was make some explicit provisions for electronic devices, and so [as] part of the enhancement of the Customs and Excise Act 2018, we sought to clarify the existing powers and sanctions that we had. This is one of those.”

New Zealand is hardly the first country to retain the right to search travelers’ devices at border crossings. How to respect travelers’ privacy rights during device searches has become a more visible issue in the past few years, however, as immigration agencies in the United States and other countries have pushed for more aggressive searches at their ports of entry. And New Zealand, known for its sweeping vistas, plentiful sheep, and other-worldly film sites, is one of the first countries attempting to clarify the consequences travelers might face for refusing to comply with search demands.

The country, Brown says, historically has searched few travelers’ devices at the border. Of the 17 million people who passed through New Zealand Customs in 2017, fewer than 0.2 percent had their luggage searched, and 0.5 percent of those were subject to a device search.

In total, only 537 devices were searched in 2017. Brown says he doesn’t expect that number to increase under the new law. What follows is an edited transcript of our conversation.

Q: What spurred the policy change for New Zealand?

We’ve got new legislation, which has been five years in gestation. Obviously, there’s been quite a lot of interest in our treatment of electronic devices. Throughout the process, we engaged very closely with the Office of the Privacy Commissioner to balance the right of people to be free from unreasonable search and seizure with the government’s border protection objectives.

For a New Zealand customs agent, what constitutes a “reasonable suspicion” that might result in a device search?

We brought in a two-tiered threshold that’s the cornerstone for our policy process, going forward. The first threshold is a preliminary search, and that’s where an officer must have reasonable cause to suspect that a person in possession of a device is involved in relevant criminal offending. That criminal offending can cover a raft of things, including child exploitation images, drug offending, terrorist activity. Those are the main three clear ones.

The next-tier level is the highest threshold. We must have reasonable cause to believe that an actual device contains relevant evidential material. [Editors’ note: Brown did not specify what a next-tier device inspection entails.]

We conducted only 537 preliminary searches last year. And, of course, an individual may carry multiple devices, so that doesn’t necessarily translate to 537 passengers. That gives you an idea for scope and scale of this: It is not done very often. But in terms of your question, we actually conduct screening of passengers in many incidences prior to them leaving or disembarking from the port, before their arrival in New Zealand, and so we have data and technology to identify high-risk travelers, in that respect.

We can consider a whole raft of things, such as a person’s travel history, body language, and general demeanor. There may be other factors at play that take into account the veracity of the person’s travel or on-file information—responses to questions we’ve asked about their previous travel, for example. And there may be other indicators within the traveler’s baggage that give rise to that reasonable cause to suspect.

How does New Zealand define “reasonable cause to believe”?

The officer really, really believes that the electronic device contains evidence. This belief may be based on previous intelligence, holdings, or other information that has come into our possession.

Walk me through how a device search is administered.

In the preliminary search, we’re asking people to provide their password or access code for the device. It’s simply a requirement for the individual to provide us that access to quite a cursory manual examination of the phone. We keep it in offline mode, so we’re not accessing the cloud; we’re not downloading any new material. Generally, we do this in the presence of the passenger, and it’s really just a quick assessment as to whether or not the phone contains any evidence or incriminating material. If we then want to move that forward into the more forensic approach, then we need to obviously have that requisite cause to believe.

Candidly, if someone didn’t disclose the password, that might be a trigger for that ‘reasonable cause to believe’ threshold, and we might subject that device to a more detailed examination. There’s a risk that the device will, in fact, be forfeited and seized.

The interest, I guess, has been around a failure or refusal of a person to provide that access password. With that, there’s a provision for a $5,000 penalty on conviction for an offense and failing the requirement to disclose the password. The reality, of course, is that when you’re dealing with individuals at the border, we expect them to voluntarily comply with that requirement, or potentially face a prosecution or conviction.

Does the policy apply to all travelers, or are New Zealand citizens exempt?

It applies to all travelers.

How many of the searched devices in 2017 belonged to New Zealand citizens?

I don’t have that information, Seth. But New Zealand acclaims itself as a great tourism destination. We’re not in the practice of applying this power liberally, without the controls that certainly the office of our Privacy Commissioner has validated as being effective, and striking the right balance.

What happens to a traveler who is willing to pay the fine but doesn’t want to reveal her password or use a biometric log-in?

It’s likely that the device would be detained and subjected to forensic examination. We have a host of scanning equipment that is a less intrusive means for the threshold of reasonable cause to believe, and that would give us an indication, for example, if there were any child exploitation images on the device.

Candidly, if someone didn’t disclose the password, that might be a trigger for that “reasonable cause to believe” threshold, and we might subject that device to a more detailed examination. There’s a risk that the device will, in fact, be forfeited and seized.

We ensure that before a manual search, which is generally done in the presence of the owner, various functions are switched off to prevent any adverse access to material not stored on the actual device. Then we perform a file-by-file cursory examination, and as I indicated, these preliminary searches generally take a matter of minutes.

Can you describe the level of interaction that customs agents are permitted to have with a device they’re searching?

No files are copied. The password isn’t recorded. In fact, we’re quite happy for the traveler to enter the password himself, and then hand the phone over to the officer.

The first stage is that we need to have a suspicion about the individual who is in possession of a device. The individual is the focus. If during a preliminary exam, the person voluntarily complies with a password request, and the device doesn’t seem to have any evidence of illegal behavior, then we’ll generally be satisfied at that point—unless there is another trigger, or information comes to our attention that elevates our suspicion to a “reasonable cause to believe” threshold.

What happens if, say, the customs officer accidentally accesses something on the phone that they are not supposed to access, and they see something indicative of criminal behavior in New Zealand that may not be criminal behavior in the person’s home jurisdiction? What’s the protocol then?

Officers are empowered to examine all moveable personal effects, so travelers must present themselves and their belongings to officers of customs. It’s the same as crossing any jurisdictional border. The powers at the border are generally quite stringent. And it’s no different in New Zealand.

If officers see things that are personal in nature and aren’t a criminal offense, obviously, they’re not going to retain the files, they’re not going to copy documents. And in the context of the preliminary search, they’ll do it in the presence of the passenger.

Has your office received any complaints about the change in policy?

No. Because the new legislation has been in gestation for about five years, it’s been subject to very rigorous debate in select committees. The Privacy Commissioner, as I’ve indicated, has been closely scrutinized for the electronic-devices question. There was a provision for the public and lobby groups to participate in most discussions though the progression of the bill stage.

Any concerns have been subject to debate, but ultimately, it’s been passed. Now we need to apply the law fairly but vigorously. And we need to report to parliament on the occasions that we do perform device searches. So I’m sure we’ll be under some close scrutiny to ensure that we are applying it fairly and appropriately.

It sounds like you’re expecting a fairly minimal impact on tourism.

Absolutely. You know the figures that I’ve spoken to you—we’re actually anticipating, if anything, those figures may drop simply because there is that higher testing threshold. Previously, there were no thresholds, and there was no encumbrance on us to examine devices.