Customs able to demand unlock/passwords at the border

The Government's new Customs and Excise Bill gives Customs the ability to demand people unlock electronic devices and reveal decryption keys at the border. The relevant section is 207 – Data in electronic devices that are subject to control of Customs.

Customs will be able to make a "full search" of an electronic device if they have reasonable cause to suspect that "a person in possession of the device has been, is, or is about to be involved in the commission of relevant offending", or if they believe that the device might have information about relevant offending. There is no obligation on Customs to reveal any details about the reasons they have, nor any way to challenge them. We note that this is less than what Customs asked for – they wanted to be able to search any device without cause (see page 134 in the original discussion paper).

Customs can only examine the information on the device, they can't then use the device to access data held in other locations, i.e. they can't log in to Facebook and examine your private messages.

Futhermore, "relevant offending" is limited to the import/export of prohibited goods, an offence under the Customs Act, or unlawful importation or exportation of goods. However, with the history of Customs cooperating overly much with the Police (as admitted in the Switched-On Gardener case), the high level of access Customs give Police to their systems (as detailed in the MoU between Customs and Police), and the new information sharing provisions in this Bill, we are sceptical as to whether this will be honoured.

Refusing to unlock the device or give up the password will be an offence with a fine of up to $5000, and possible loss of the device.

An article at Tech Liberty points out some of the obvious practical issues with this proposed power (written before the bill was introduced). In particular:

• Will the person even have the password, particularly on devices that can be shared by multiple users such as laptops?
• If there really is highly incriminating material on a laptop, it'll be better to pay the $5k fine.

Comment

This is another case where the government is claiming special powers at the border that could not be justified anywhere else. People can store amazing amounts of personal data about themselves on laptops – medical records, diaries, love letters, personal photography. Phones store information about where we've been, who we've talked to, and what we've said. We shouldn't be lightly making this available for Customs officers to paw through.

The arguments Customs makes for getting this power in their original discussion paper are rather weak. Just what sort of information do they expect to find that justifies this power? Anyone engaged in serious smuggling would surely be smart enough to leave their documents in the cloud and access them over the internet once they arrive.

We note that if there was real suspicion of serious criminal wrongdoing that the Police could obtain a search warrant under the Search & Surveillance Act once the person has entered the country.

We oppose this provision in the law as an unnecessary overreach that will have serious practical problems in enforcement.