The editorial argues that a device holding years of email, location history, medical records, and private communications cannot be legally equivalent to a duffel bag. Extending the century-old border search exception to forensic phone extractions collapses a meaningful distinction between physical luggage and the digital record of a person's entire life.
By submitting the Law & Crime piece under a headline emphasizing 'without a warrant or reasonable suspicion,' the submitter frames the ruling as an alarming erosion of Fourth Amendment protections. The 118-point score signals that the HN audience shares the framing that suspicionless forensic device searches are qualitatively different from traditional luggage inspection.
The editorial highlights that the Second Circuit now diverges from the Fourth and Ninth Circuits (which require reasonable suspicion) with the Eleventh Circuit in the middle. This kind of unresolved constitutional split over a rapidly scaling government practice is exactly the pattern that forces the Supreme Court to take up the question.
The piece emphasizes that CBP already runs ~47,000 device searches per year, up roughly 5x in a decade, and that 'advanced' searches feed Cellebrite/GrayKey extractions into a 15-year retention archive. The ruling matters less as an abstract doctrine and more because it legally blesses an industrial-scale forensic pipeline that already exists.
The article's framing ('the government was entitled') reports that the Second Circuit found the border search exception squarely applicable, treating the case as a direct application of long-standing doctrine rather than a novel expansion. Under this reading, phones at the border fall within the same warrantless-inspection authority courts have upheld for other property crossing the border.
On September 18, the Second Circuit Court of Appeals ruled that US Customs and Border Protection agents can conduct forensic searches of travelers' electronic devices — phones, laptops, tablets — without a warrant, without probable cause, and without even reasonable suspicion. The case, decided in the government's favor, extends the century-old "border search exception" to the Fourth Amendment to cover the full contents of modern computing devices.
The border search exception has always allowed customs officers to inspect luggage without a warrant. The novel question was whether a phone containing years of email, location history, medical records, source code, and private communications should be treated like a suitcase. The Second Circuit said yes. A device that holds more information than most Americans generated in their entire lives a generation ago is now, legally, indistinguishable from a duffel bag.
This puts the Second Circuit — covering New York, Connecticut, and Vermont, which includes JFK, Newark-adjacent travel patterns, and the Canadian land border — in direct conflict with the Fourth and Ninth Circuits, which have required at least reasonable suspicion for forensic device searches. The Eleventh Circuit sits somewhere in the middle. That's a three-way split, and it's the exact kind of unresolved constitutional question the Supreme Court eventually takes up.
The practical reality is that CBP already conducts these searches at scale. The agency's own numbers show roughly 47,000 device searches in FY2024, up from about 8,500 a decade earlier. Most travelers never hear about it because most searches are "basic" — an officer scrolling through your photos and messages. The ones covered by this ruling are the "advanced" searches: plugging the device into forensic extraction tools like Cellebrite or GrayKey, which pull deleted messages, location history, and app data into a searchable archive that CBP retains for 15 years.
For a working developer, the meaningful shift isn't legal — it's operational. Your laptop crossing a US border is now, by default, treated as an unattended device in a hostile environment. That framing is not paranoid. It's the standard threat model any security team would apply to a machine left overnight in a hotel room in a country you don't trust. The Second Circuit just clarified that the United States, at its own ports of entry, qualifies.
The developer-specific problems compound quickly. If you have production SSH keys on your laptop, a CBP forensic image now contains them. If your password manager is unlocked when the device is seized, everything is exposed. If you have client source code under NDA, an agent with no articulable reason can copy the entire repository and retain it for 15 years. There is no meaningful data-minimization principle in this regime; the doctrine assumes the government's interest at the border is total.
Some commentators on the HN thread pointed out — correctly — that this is not new law so much as new clarity. CBP has been doing this. What changed is that a federal appellate court just eliminated the last shreds of legal ambiguity for travelers in the Second Circuit. The circuit split guarantees the Supreme Court will eventually take a case; it does not guarantee they will side with travelers. The current court has been comfortable extending administrative-state exceptions, and the border is administratively convenient.
There is a real legal counterargument worth naming. The government's position is that borders have always been the state's strongest sovereign moment — the place where the Fourth Amendment's normal presumptions relax because the alternative is unenforceable customs and immigration law. That framing is coherent in 1789. It is harder to defend when "contraband" now includes what's in your Signal history.
If you or your team crosses US borders with work devices, this ruling is a forcing function to formalize a border protocol. The good news is that most of the mitigations are boring and well-understood:
Travel with a clean device. A separate laptop, freshly imaged, with only the apps and data you need for the trip. This is what security-conscious enterprises have done for China and Russia travel for a decade. Add the US to the list — at least for entries through the Second Circuit — and the operational cost is a spare ThinkPad and an afternoon of setup.
Sign out of everything before you land. Not "close the tab" — actually sign out and clear session tokens. A device seized while you're logged into GitHub, AWS, Slack, and your password manager is a very different disclosure than one that only contains encrypted-at-rest data. Full-disk encryption plus a powered-off device plus signed-out sessions is the minimum viable posture; anything less and you're relying on the officer not to look.
Rotate credentials on return. If your device left your sight — even briefly, even for a "basic" search — treat it as compromised. Rotate SSH keys, revoke OAuth tokens, and re-enroll MFA. This is unglamorous, takes about two hours, and is now table stakes for engineers who travel internationally.
Push your employer to have a written policy. Most companies don't. The absence of policy means every individual engineer improvises under stress at a border, which is exactly when people make bad decisions like unlocking a device to "cooperate." A one-page policy that says "do not unlock, do not consent, contact legal, we will replace the device" removes the individual burden and gives officers a clear signal that the device is a corporate asset.
The circuit split makes Supreme Court review a matter of when, not if — likely within the next two or three terms. In the meantime, expect CBP to lean into the new authority in the Second Circuit specifically, because that's where the law is now most permissive. If you're a security engineer, this is a good week to dust off the corporate travel policy. If you're an individual developer with any sensitive data on your personal machine, this is a good week to accept that "the border" and "your threat model" are now the same conversation.
This happened to me last month in Halifax Canada, I wanted to board a transfer flight to Amsterdam, going through Boston. I was stopped as I had salts with me from a buddhist relic I couldn't exactly identify. The machine said it contained a primary explosive (silver azide). I was ordered to gi
The best time to delete all social media accounts and never post anything online with your name attached ever again was 10 years ago. The second best time is right now. This stuff can and will be used against you out of context 10, 20, 30 years into the future.
Customs has always been able to search everything without a warrant or suspicion when crossing the border. I guess this is saying that they can search the digital contents of physical devices/media as well?
The problem with these laws isn't that they can search you at the border. It's that they can search you within 100 miles of the border (https://en.wikipedia.org/wiki/Border_search_exception). The total number of people who live within that zone is 213 Million people, or
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
It is insane to me that judges consistently rule that the constitution doesn't apply because there's a "border" within 100 miles.The 4th Amendment says, exactly: The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and