Border Device Search: Authority, Thresholds, and Limits

Authority

United States Customs and Border Protection Directive 3340-049B is effective internal agency policy governing inbound and outbound electronic-device searches at the physical border, its functional equivalent, and the extended border, consistent with law and agency policy.

The accepted record identifies the directive as agency policy. It is not presented here as a statute, a court holding, or a universal constitutional rule. Its stated geographic scope covers the physical border, the functional equivalent of the border, and the extended border, and it applies to inbound and outbound electronic-device searches within the directive's terms.

That classification matters because different sources answer different questions. The directive states how the agency categorizes and conducts searches under its policy. The circuit records below distinguish an opinion's description of agency policies from judicial statements about search thresholds. Neither source type should be collapsed into a single nationwide rule broader than its own scope.

This page is a reference to the accepted records, not legal advice. It does not predict what will happen in a particular encounter, decide whether a search is lawful on facts outside the records, or extend a policy statement to another agency or jurisdiction.

For the wider set of travel research pages, see Travel and Mobility.

Basic versus advanced searches

The directive defines a basic search as reviewing or analyzing information on the device and an advanced search as connecting equipment to copy or analyze device contents, but equipment used merely to make contents available for inspection does not constitute an advanced search.

Under the accepted directive record, a basic search may occur with or without suspicion. The accepted threshold record says an advanced search requires reasonable suspicion of a violation of law administered or enforced by United States Customs and Border Protection, or a national-security concern, and requires supervisory approval.

The categories are policy terms with stated qualifications. Basic should not be silently replaced by routine, and advanced should not be treated as a synonym for every use of connected equipment. The directive says external equipment used merely to make device contents available for inspection—including to bypass a password or overcome encryption—does not constitute an advanced search.

The threshold statement is also bounded. It reports the directive's internal policy for these categories; it does not decide every constitutional question, summarize every circuit record, or establish a rule for another authority. The next section therefore keeps the accepted circuit records separate rather than treating the directive as the final word nationwide.

• Basic search: review or analysis of information on the device under the directive's definition.
• Advanced search: connection of wired or wireless equipment to copy or analyze device contents; equipment used merely to make contents available for inspection, including to bypass a password or overcome encryption, does not constitute an advanced search.
• Basic-search threshold in the accepted directive record: with or without suspicion.
• Advanced-search threshold in the accepted directive record: reasonable suspicion of a covered-law violation or a national-security concern, plus supervisory approval.

Circuit positions

The accepted First, Fourth, Ninth, and Eleventh Circuit records do not state one uniform threshold for electronic-device searches at the border, so each record must be read at its documented scope.

The accepted First Circuit opinion describes the policies under challenge as allowing basic electronic-device searches without reasonable suspicion and advanced searches only with reasonable suspicion. The accepted Fourth Circuit record says a forensic border search of a phone is nonroutine and permissible only with individualized suspicion.

The accepted Ninth Circuit record says manual cell-phone searches may occur without reasonable suspicion and forensic cell-phone searches require reasonable suspicion. The accepted Eleventh Circuit record says no suspicion is necessary to search electronic devices at the border.

These are separate circuit records, not ingredients for an averaged rule. The First Circuit entry remains the opinion's description of the policies; the other entries remain the judicial statements in their accepted records. The terms basic, advanced, manual, forensic, nonroutine, reasonable suspicion, and individualized suspicion stay attached to the record that uses them.

The page also does not decide how a court would classify a different technique or factual setting. It reports each accepted record at its documented scope and leaves legal application to qualified counsel and current authority.

• First Circuit opinion: describes the policies as allowing basic searches without reasonable suspicion and advanced searches only with reasonable suspicion.
• Fourth Circuit record: a forensic phone search is nonroutine and permissible only with individualized suspicion.
• Ninth Circuit record: manual phone searches may occur without reasonable suspicion; forensic phone searches require reasonable suspicion.
• Eleventh Circuit record: no suspicion is necessary to search electronic devices at the border.

Published search counts

The accepted evidence packet supplies no publishable United States Customs and Border Protection device-search count, count population, or count period, so this page prints no number or trend.

This is a typed evidence gap, not a zero. The question remains on the page because published search volume is relevant to understanding the subject, but the accepted packet does not support a value that can be printed with its population and period.

No estimate, approximation, historical number, or directional claim fills the gap. A number without a defined population and period could describe a different measure, and a trend requires comparable observations rather than an unsupported inference. The page therefore preserves the missing field visibly.

A later source can answer the question only if it supplies the count, what was counted, and the period covered through an accepted record. Until then, the evidence-bound answer is that this packet does not establish a publishable count.

Passcodes and access requests

The directive permits United States Customs and Border Protection to request a traveler's assistance, passcode, or other access means and to maintain that access means for the duration of the search when needed for examination.

That statement reports the accepted policy record's request and retention language. It does not become a constitutional holding, a technical decryption claim, or a conclusion about the legal consequences of a particular response. The page offers no instruction on whether or how a person should comply.

The accepted packet does not establish a rule for compelled biometric unlocking. A passcode or other requested access means cannot be used to infer a fingerprint, face, or other biometric rule. The gap remains explicit rather than being filled from an adjacent authentication concept.

Authentication architecture and factor location belong to Passkeys and Second-Factor Location. Storage-encryption boundaries belong to Full-Disk and Container Encryption. Linking those owner pages keeps technical mechanics separate from what the directive says officials may request during a search.

• Established by the accepted policy record: officials may request assistance, a passcode, or another access means.
• Established by the accepted policy record: the access means may be maintained for the duration of the search when needed for examination.
• Not established by this packet: a compelled-biometric-unlocking rule.
• Not supplied here: legal advice, a constitutional holding, or a technical claim that access will succeed.

European entry contexts

The accepted packet does not establish a European Union-wide border-entry device-search authority, threshold, passcode rule, or biometric rule; its accepted records instead cover a narrower criminal-investigation context and two distinct German provisions.

The accepted European Union framework record concerns police access during a criminal investigation to personal data stored on a mobile telephone. It is not a European Union-wide border-entry rule, and this page does not recast it as one.

The accepted German customs record says baggage, conveyances, and cargo may be inspected to determine compliance with customs rules. The accepted German criminal-procedure record separately says, in accordance with paragraphs 1 and 2 of section 110 of the German Code of Criminal Procedure, electronic storage media found on a searched person may be reviewed. Customs inspection and criminal-procedure review are different scopes.

The three records do not combine into a general European border-device rule. The criminal-investigation record stays tied to that setting. The customs record stays tied to the listed objects and customs compliance. The electronic-storage-media record stays tied to a search under its criminal-procedure provision.

No threshold, passcode rule, biometric rule, or entry-wide authority is inferred where the accepted packet does not supply one. The resulting limitation is deliberate: a narrow, citable fact is more useful than a broad rule assembled from unlike contexts.

• European Union framework record: police access during a criminal investigation to personal data stored on a mobile telephone.
• German customs record: inspection of baggage, conveyances, and cargo to determine customs-rule compliance.
• German criminal-procedure record: in accordance with paragraphs 1 and 2 of section 110, electronic storage media found on a searched person may be reviewed.
• Gap preserved: no accepted European Union-wide border-entry device-search authority, threshold, passcode rule, or biometric rule.

What officials can reach and how redress is described

The directive permits requests for assistance or an access means to examine a device and information on it that is accessible through software applications, and it describes a pre-search notice about reporting concerns and seeking agency redress.

The accepted access record concerns assistance, a passcode, or another access means and permits maintaining that access means for the duration of the search when needed for examination. The request extends to examination of the device or information on it, including information accessible through software applications present on the device.

The accepted remedy record states a notice step before a border-device search: the individual will be told how to obtain information on reporting concerns and seeking agency redress if aggrieved. This page reports that notice language without promising a remedy, outcome, deadline, or entitlement the record does not state.

Technical questions remain on their owner pages. Full-Disk and Container Encryption covers storage-encryption boundaries. Passkeys and Second-Factor Location covers authentication and factor location. 3-2-1 Backups and Border Crossings covers backup-copy exposure and cloud-copy limits.

Keeping those mechanics separate prevents a policy request from becoming a claim about device architecture, cloud reach, backup availability, detention, or factor behavior. The accepted packet also supplies no biometric-unlocking rule, so the page makes none.

Puerto Rico-mainland transit

The accepted records place Puerto Rico within the customs territory of the United States and subject covered movement from Puerto Rico to another United States destination to agricultural inspection, but they establish no general electronic-device-search authority for that transit.

The customs-territory record says the customs territory of the United States includes only the states, the District of Columbia, and Puerto Rico. That definition is limited to the jurisdictional scope of the cited customs rule.

The agricultural-inspection record says persons, conveyances, baggage, cargo, and other articles moving from Puerto Rico to another United States destination are subject to agricultural inspection. The listed inspection scope is not rewritten as a device-search rule.

Together, the records establish customs-territory status and a covered agricultural-inspection requirement. They do not establish a general electronic-device-search authority, passcode rule, biometric rule, or search threshold for Puerto Rico-mainland transit. Those questions remain unanswered by this accepted packet.

This distinction avoids importing the federal-border device policy into a different record merely because both concern movement and inspection. The page reports each authority at the scope its source supports and makes no claim about a particular encounter.

For the Puerto Rico case, see Puerto Rico Jurisdiction Reference: Records and Exposure.