CBP updates border search rules for electronic devices

U.S. Customs and Border Protection released Directive 3340-049B, updating how officers can search electronic devices at borders [CBP]. The policy covers smartphones, laptops, and storage devices, and applies at ports of entry and nearby operational areas.

The directive allows searches based on specific intelligence, suspicious behavior, or customs enforcement needs — no warrant or probable cause required. Officers must document each search, including justification and findings. For devices containing sensitive data — such as attorney-client communications, medical records, or journalistic materials — CBP mandates use of a "sensitive but unclassified" handling process to limit unauthorized access.

CBP now explicitly permits the use of external forensic tools to extract data without turning on the device. These tools can clone storage or recover deleted files, but the directive requires that such actions be conducted only by trained personnel and logged in detail.

The update replaces a 2020 version and includes revised training requirements for officers. It also clarifies that travelers cannot be penalized for refusing to provide passwords, though officers may still detain devices for further review.

Critics argue the rules still enable broad surveillance, especially for journalists, activists, and international travelers. The Electronic Frontier Foundation has previously challenged similar practices in court, citing First and Fourth Amendment concerns [CBP].

The directive does not impose limits on data retention periods or require destruction of copied material, leaving oversight largely internal.