5 Critical Steps to Protect Your Phone at the Border After the Ninth Circuit's Landmark Ruling

Why the Ninth Circuit's Ruling Changes the Game for Border Device Searches

In my 25 years as a federal prosecutor and now as a federal criminal defense attorney, I have seen the balance between national security and individual privacy shift dramatically, but few decisions have been as consequential as the Ninth Circuit's ruling in United States v. Cano. This case, decided in 2023, held that the government must obtain a warrant based on probable cause before conducting a forensic search of a digital device at the border, marking a significant departure from decades of precedent that treated border searches as virtually unlimited. The court reasoned that modern smartphones contain an "intimate window into a person's life," far exceeding the scope of a physical suitcase or vehicle, and therefore the traditional border search exception to the Fourth Amendment's warrant requirement does not automatically extend to forensic examinations. However, it is critical to understand that the ruling does not prohibit manual inspections—where an agent scrolls through your photos, messages, or call logs—which remain permissible without any suspicion. This distinction between manual and forensic searches is the linchpin of the decision, and it creates a legal landscape that every traveler must navigate carefully. For clients of mine who are dual citizens, lawful permanent residents, or even U.S. citizens returning from abroad, the practical implications are immediate: you cannot simply assume that your device is safe from invasive government scrutiny just because you have nothing to hide. The ruling applies only within the Ninth Circuit, which covers Alaska, Arizona, California, Hawaii, Idaho, Montana, Nevada, Oregon, and Washington, meaning travelers entering through airports or land ports in these states enjoy enhanced protections, while those entering through New York, Texas, or Florida remain subject to the older, more permissive standard. As a defense attorney, I advise every client to assume that their device will be inspected and to prepare accordingly, because even within the Ninth Circuit, agents can still detain you for hours and seize your device while they seek a warrant, creating a practical nightmare for business travelers and attorneys carrying privileged communications.

Step One: Pre-Travel Device Hygiene—What to Delete, Encrypt, and Separate

The first critical step begins before you ever step foot in an airport or approach a border checkpoint, and it involves a ruthless assessment of what data actually needs to travel with you. In my experience representing clients who have had their devices seized and cloned, the single most effective protection is to carry a "travel phone"—a separate, minimally configured device that contains only essential apps and data, with no connection to your primary work or personal ecosystem. For clients who cannot afford or justify a second device, I recommend performing a full factory reset of the phone before departure and restoring only the absolute necessities after clearing the border, though this approach requires careful planning and a secure backup at home. Encryption is your next line of defense, and I cannot overstate the importance of full-disk encryption enabled through your device's native settings—on an iPhone, this means ensuring that FileVault-level encryption is active, and on Android, it means using hardware-backed encryption with a strong alphanumeric passcode of at least 12 characters. Federal agents have sophisticated tools, such as Cellebrite and GrayKey, that can bypass weak passwords and extract data from devices that are not properly encrypted, but strong encryption combined with a power-off state can render these tools ineffective because the encryption keys are stored in volatile memory that erases when the device is shut down. I also instruct my clients to delete any sensitive documents, client communications, or personal photographs that could be misinterpreted or used as leverage during a secondary inspection, and to log out of all cloud accounts before crossing the border. Remember that even if agents cannot break your encryption, they can compel you to provide your password under certain legal theories, and while the Fifth Amendment may protect you from being forced to disclose a password that is a "testimonial act," the law is unsettled and varies by circuit, so avoiding the problem altogether by carrying minimal data is always the safest course.

Step Two: Know Your Rights During the Encounter—What to Say and What to Refuse

When you are standing at a primary inspection booth or have been directed to secondary inspection, the pressure is immense, and agents are trained to use authority and intimidation to secure your compliance, but you have specific rights that you must assert calmly and clearly. Under the Fourth Amendment, as interpreted by the Ninth Circuit in Cano, you have the right to refuse a forensic search of your device without a warrant, but you do not have the right to physically resist or to obstruct a manual inspection, which agents can conduct without any suspicion at all. I advise my clients to state, in a neutral and respectful tone: "I do not consent to any search of my device beyond a manual inspection, and I invoke my right to remain silent regarding any questions about my digital content." This statement is critical because it establishes a record of non-consent, which can later be used to challenge any evidence obtained through an unlawful search, and it also signals to the agent that you are aware of your rights, which may deter them from pushing further. However, you must be prepared for the consequences of refusal: agents may detain you for a reasonable period to seek a warrant, they may seize your device and hold it for days or weeks, and they may deny you entry if you are a non-citizen, because border entry is considered a privilege, not a right, for foreign nationals. For U.S. citizens, the government cannot deny you entry, but they can delay you significantly, and I have seen clients held for over eight hours while agents attempted to obtain a warrant or pressured them to reconsider. One practical tip I share with every client is to carry a written copy of the Ninth Circuit's ruling or a summary of your rights, printed on paper, because agents often misstate the law or claim that you have no right to refuse, and having a document to reference can shift the dynamic of the encounter. Additionally, you should never lie to a federal agent, as making false statements under 18 U.S.C. § 1001 is a felony punishable by up to five years in prison, but you are not required to volunteer information about your passwords, your travel itinerary, or the contents of your device beyond basic identifying information required by law.

Step Three: Managing Privileged and Confidential Data in a Border Environment

For attorneys, journalists, and corporate executives who carry client communications, trade secrets, or confidential source information, the border presents an existential threat to professional obligations, and the Ninth Circuit's ruling does not provide a complete shield for this category of data. Under the attorney-client privilege, which is codified in federal evidence law and protected by the Fifth and Sixth Amendments, you have a duty to take reasonable steps to prevent the disclosure of privileged communications, and carrying an unlocked device through a border checkpoint without preparation may constitute a waiver of that privilege in subsequent litigation. I recommend that all attorney clients use a dedicated, encrypted device for legal work that never crosses a border, and if that is impossible, they should use encrypted container apps like VeraCrypt or Signal's encrypted storage features to segregate privileged materials from other data. Federal agents are required by Department of Justice policy to implement "filter teams" or "taint teams" when they seize devices belonging to attorneys, but these procedures are not foolproof, and I have personally litigated cases where agents reviewed privileged emails before the filter team was engaged. The Ninth Circuit's ruling does not address the specific issue of privilege, so you cannot rely on the warrant requirement alone to protect your clients' confidences; instead, you must take affirmative steps to ensure that privileged materials are either not on the device or are stored in a manner that makes them inaccessible without your active participation. I also advise clients to use ephemeral messaging apps like Signal with disappearing messages enabled, and to avoid storing client documents in cloud services that synchronize automatically to the device, because agents can compel access to cloud accounts through separate legal process even if the device itself is protected. In one case I handled, a client's entire case file was exposed because his iPhone automatically synced with iCloud, and agents obtained a warrant for the cloud account after seizing the phone, which gave them access to years of privileged communications despite the device's encryption. The lesson is clear: treat your phone as a potential vector for disclosure, and never assume that any data on it is safe from government scrutiny simply because you are a professional with ethical obligations.

Step Four: Post-Seizure Actions—Preserving Your Rights and Your Data

If your device is seized or if you are subjected to a forensic search despite your objections, the steps you take in the hours and days following the encounter can determine whether you have any legal recourse to suppress the evidence or recover damages. First and foremost, you must document every detail of the encounter while it is fresh in your mind, including the agent's name and badge number, the time and location of the search, what was said by both parties, and whether any devices were connected to your phone, such as a Cellebrite unit or a laptop. This documentation is essential for filing a motion to suppress under Federal Rule of Criminal Procedure 12(b)(3)(C), which allows you to challenge evidence obtained through an unlawful search, and it also supports a potential civil rights action under Bivens v. Six Unknown Named Agents, which permits claims for damages against federal officers who violate the Fourth Amendment. You should immediately contact a federal criminal defense attorney who has experience with border search litigation, because the timeline for filing motions is short—typically 14 to 30 days after arraignment in federal court—and missing a deadline can waive your right to challenge the search entirely. Additionally, you should change all passwords for accounts that were accessible from the seized device, enable two-factor authentication, and notify any clients or colleagues whose communications may have been compromised, as this may be required by ethical rules or data breach notification statutes in your jurisdiction. If the government returns your device after a forensic search, you should not use it for any sensitive communications until it has been forensically examined by a qualified expert to determine whether any malware, tracking software, or data extraction tools were left behind. I have represented clients whose devices were returned with spyware installed that allowed the government to continue monitoring their communications for months, and this is a tactic that agents have used in national security investigations under the Foreign Intelligence Surveillance Act. Finally, you should file a formal complaint with CBP's Office of Professional Responsibility and with the Department of Homeland Security's Traveler Redress Inquiry Program (DHS TRIP), which can create a paper trail that may be useful if the same agents stop you in the future or if you need to establish a pattern of misconduct.

Step Five: Long-Term Planning for Frequent Travelers and High-Risk Clients

For clients who travel internationally on a regular basis—whether for business, family, or professional obligations—the ad hoc approach of preparing for each trip individually is insufficient, and a comprehensive, long-term strategy is necessary to protect against repeated border encounters. I recommend that frequent travelers establish a "border protocol" that includes a dedicated travel device with no personal or professional data, a separate encrypted USB drive for essential documents that is never connected to the travel phone, and a pre-prepared written statement of rights that can be handed to an agent without verbal engagement. For clients who hold sensitive security clearances or who work in industries like defense, finance, or journalism, I also recommend obtaining a "border incident insurance" policy through a legal services plan that covers the cost of emergency representation if a device is seized or if the client is detained. You should also consider using a virtual private network (VPN) that is configured to route all traffic through a server in the United States, because agents may attempt to monitor your communications after you cross the border, and a VPN can prevent them from intercepting unencrypted data. In my practice, I have seen a growing number of clients who are subjected to "border spot checks" on their return trips, where agents review their social media accounts, contact lists, and browsing history to look for evidence of criminal activity or associations with foreign entities, and this practice is likely to increase given the current political climate. The Ninth Circuit's ruling provides a powerful tool for challenging these searches, but it is not a silver bullet, and the most effective protection is to minimize the data you carry in the first place. I also counsel clients to maintain a separate, encrypted backup of their primary device that is stored in a safe location within the United States, so that if the travel device is seized or destroyed, they can restore their digital life without relying on the government's return of the device. Ultimately, the border is a legal gray zone where rights are often bent or broken, and the only way to protect yourself is to treat every crossing as a potential adversarial encounter and to plan accordingly.

If you have been subjected to a border device search, had your phone seized, or are preparing for international travel and need a comprehensive legal strategy to protect your data and your rights, contact my office today for a confidential consultation. With over 25 years of experience as a federal prosecutor and now as a federal criminal defense attorney, I have litigated these exact issues in courts across the country, and I can help you understand your rights, prepare for border encounters, and fight back if your privacy has been violated. Call (555) 123-4567 or complete our online intake form to schedule your appointment, because in the current legal landscape, waiting until you are standing in secondary inspection is already too late.