Deciding whether to unlock your device is “a very personal” choice that may depend on what information you’re carrying, said Nate Wessler, the deputy director of the Speech, Privacy and Technology Project at the American Civil Liberties Union. If you’re a doctor whose phone holds private information about patients, for example, or a journalist with confidential sources, you may be less willing to enter your passcode for a CBP officer.

Loading

“People have to weigh the practical implications,” Wessler said. “Would they rather try to protect their privacy but lose use of their phone for potentially weeks or months, or end up giving the password and making it easier for the government to search?”

During a basic search, an officer looks through the device by hand. But in rare cases, agents can perform an advanced, or forensic, search, during which they copy a device’s contents onto a government computer for further analysis. A forensic search may even be able to unearth some files that a device’s owner had deleted, Wessler said.

The passcode calculus is different for foreign tourists and other people without permanent status in the United States, since they have no legal right to enter the country.

“In that case, it’s usually best to just give the information because otherwise they’ll turn you right around,” Azhar said.

The last meaningful updates to rules regarding electronic device searches at the border were made in 2018, during the first Trump administration.

CBP’s authority to search devices applies to travellers both entering and exiting the United States. But an overwhelming majority of searches happen when travellers are arriving in the country, said Jake Laperruque, the deputy director of the Security and Surveillance Project at the Center for Democracy and Technology, a nonprofit that supports digital free expression.

Officers looking through a device will often check for evidence that could point to criminal activity, including images or messages related to narcotics or child pornography, Laperruque said. But they could also find content that raises questions about legal activities, such as attending a political protest, or those that fall in a gray area, such as communicating with doctors who provide services that are banned in certain states.

If you’re travelling domestically in the US, your devices are not subject to the same scrutiny. The Transportation Security Administration cannot examine a device’s digital contents.

Do I have the same rights everywhere?

Not exactly. Federal courts have created a patchwork of rules for forensic device searches. In 18 states, including California, Massachusetts and Virginia, agents need reasonable suspicion to conduct a forensic search, according to the Center for Democracy and Technology.

In 10 states, including Florida and Georgia, agents do not need reasonable suspicion. The remaining states, including New York, New Jersey and Texas, have no clear rule.

The legal landscape at New York City airports is especially complicated because of conflicting federal court decisions. The 2nd US Circuit Court of Appeals is weighing a unified rule.

To simplify enforcement, CBP requires agents everywhere to have reasonable suspicion before conducting a forensic search. But that rule includes an exemption for a “national security concern,” which privacy experts said could be broadly interpreted at agents’ discretion.

So how can I protect my data?

Taking one or more of these steps will help protect your privacy no matter where you pass through an immigration checkpoint.

Loading

Create strong passcodes for your devices using a complex string of numbers, letters and special characters. If you prefer a numerical code, opt for more digits.Update your software. Using the latest operating system will reduce the chances of CBP gaining access to your device if you refuse to unlock it.Buy a second phone and leave your emails, photos and other sensitive information on your devices at home.Turn off your device before going through customs. Powering it down more fully encrypts the data, privacy experts said, and disables facial or fingerprint recognition when the device is first turned on. You can also turn off biometrics in your device’s settings.Keep your device in airplane mode. CBP says it will search only “information that is resident upon the device at the time it is presented for inspection,” and officers may not search information that is solely stored in the cloud.Back up your device to the cloud and erase it before going through customs. You can redownload your data later on.

Keep in mind that if you turn off your device or disconnect it from the internet, you may not have access to digital boarding passes or travel itineraries. Carry hard copies of all documentation you may need to present for inspection.

If an agent takes your device, ask for a receipt. CBP says it provides travellers whose devices are seized with a document detailing who at the agency will be their point of contact and how to reach them.

And once you get your device back, just to be safe, change your passcode.

This article originally appeared in The New York Times