Customs, compelled device unlocking, and PR spin

Stuff reports:

A new law means Customs will no longer be able to demand that people entering the country hand over the passwords to their devices without reasonable cause.

No such power

This is framed as a restriction, but the reality is that Customs never credibly had the legal power to demand people hand over passwords for electronic devices in the first place. They claimed they did under section 151 of the Customs Act which was concerned with physical examination of goods, and makes no mention of electronic devices, security access codes, or passwords. We don't find this interpretation convincing.

Of course Customs didn't let this stop them and asserted the power anyway – at the rate of hundreds of people per year. Sometimes Customs took copies of the data and handed it over to the Police. People who refused had their devices confiscated.

In other words, Customs assigned themselves the power to do this and then punished those those who refused to comply. Isn't this the job of Parliament?

New powers with no credible limit

The new Customs & Excise Bill will, when passed, finally grant Customs the power to demand access to electronic devices. There is a penalty of up to $5000 if access is refused (or cannot be granted by the person because they don't know it – see here for more technical difficulties). This is an entirely new power and we think it is misleading to claim it is a restriction just because they have to claim to have reasonable cause.

It's even more misleading when you realise that this "reasonable cause" provision has:

• No need to say what reasonable cause Customs has or provide any evidence of same
• No oversight or auditing of the use of this power
• No way for someone to appeal the decision of a Customs officer
• No penalties for Customs officers who break the rules

This "new power with restrictions" looks a lot more like just a PR spin version of a "new power".

Is this justified?

These days we store huge amounts of personal information on our phones, laptops, tablets and other devices. This includes business information, personal correspondence, medical information, letters to our MPs, art, photos, very personal photos, and so on. Do we really want to give Customs access to all of that?

You could possibly make an argument that this new power would be justified if it helps catch serious criminals or even wannabe terrorists, but that's not what it's for. It's only for detecting "relevant offending" – unlawful import/export or other offences under the Customs Act.

In other words, we're giving Customs access to our entire digital lives so they can possibly stop someone importing a pirated movie or avoiding paying duty. 

We think that this is disproportionate – the imposition on regular law abiding people far outweighs the minor benefits realisable through the use of the power. As such this part of the Bill can't be justified under the Bill of Rights Act which forbids "unreasonable search and seizure" and it should be dropped from the Bill.