5 Essential Steps to Protect Your Phone and Your Case After the Ninth Circuit's Border Ruling

Why the Ninth Circuit's Border Ruling Changes the Game for Digital Privacy

In my 25 years as a federal prosecutor, I watched the government treat the border as a constitutional dead zone where the Fourth Amendment barely applied. That changed on August 14, 2024, when the Ninth Circuit issued its en banc decision in United States v. Cano, No. 21-50202, holding that the "border search exception" does not automatically authorize forensic searches of electronic devices without reasonable suspicion. The court drew a critical distinction between a manual inspection of your phone—looking at the screen, swiping through open apps—and a forensic extraction using tools like Cellebrite or GrayKey, which copy the entire device's storage, including deleted files, app caches, and encrypted containers. Under the Cano ruling, the government now needs individualized, articulable reasonable suspicion that your device contains contraband or evidence of a crime before it can conduct a forensic search. But here is the trap: if you do not articulate your objection clearly and consistently, the government will argue you consented, and the entire issue is waived for appeal. I have seen federal prosecutors exploit this waiver argument in dozens of suppression hearings under Federal Rule of Criminal Procedure 12(b)(3)(C). The ruling is a powerful shield, but only if you know how to raise it.

The Cano decision explicitly overruled the government's long-standing reliance on United States v. Ickes (9th Cir. 2005), which had permitted warrantless laptop searches at the border with no suspicion at all. The new standard requires the government to articulate specific facts—not just that you are traveling from a known drug-source country or that you fit a generic profile. For example, if you are a dual citizen with family in both the U.S. and Mexico, that alone is not reasonable suspicion. But if you have a prior conviction for money laundering under 18 U.S.C. § 1956 and you are traveling to a jurisdiction known for shell corporations, that might satisfy the standard. The Ninth Circuit also held that the length of detention for a device search must be limited to what is reasonably necessary to complete the inspection. In Cano, the defendant was held for three hours while agents copied his phone—the court found that excessive without reasonable suspicion. This means every minute you are detained beyond a brief, non-forensic inspection could be a constitutional violation, but you must document the time and sequence of events to preserve that claim.

One of the most overlooked aspects of Cano is its discussion of the "foregone conclusion" doctrine as applied to biometric unlocking. The court noted that if you use Face ID or a fingerprint to lock your phone, the government can physically force your finger or hold your face to the device to unlock it, because the act of unlocking is not testimonial under the Fifth Amendment. However, if you use an alphanumeric passcode, the government cannot compel you to reveal it because that would require you to disclose the contents of your mind—a testimonial act protected by the Fifth Amendment. This distinction is drawn directly from the Supreme Court's reasoning in United States v. Hubbell (2000) and Doe v. United States (1988). In my practice, I advise every client who crosses a border—whether by land, air, or sea—to switch off biometric unlocking and use a 12-character alphanumeric passcode at least 48 hours before travel. This gives you time to ensure all your apps and cloud services are logged out and that the device is in a "locked and encrypted" state that requires the passcode to decrypt the file system.

How to Assert Your Rights at the Border Without Escalating the Situation

The moment a Customs and Border Protection officer asks for your phone, you are in a high-stakes interaction where every word and gesture matters. In my years prosecuting drug trafficking and money laundering cases under 21 U.S.C. § 841 and 18 U.S.C. § 1956, I saw agents use conversational tactics to elicit consent without the traveler ever realizing they had waived their rights. An officer might say, "You don't mind if I take a quick look at your phone, do you?" or "Just hand it over and we'll have you on your way in five minutes." If you hand over the device silently or say "sure," you have given consent under the Fourth Amendment's consent exception, and the Cano ruling will not help you because the search was not a warrantless search—it was a consensual search. To preserve your rights, you must say, clearly and without hostility, "I do not consent to any search of my device." Do not add qualifiers like "I guess" or "if you have to." Say it once, firmly, and then remain silent. You do not need to explain why you are refusing, because any explanation can be used to develop reasonable suspicion.

If the officer insists on taking the phone anyway, do not physically resist. Physical resistance can lead to charges under 18 U.S.C. § 111 (assaulting a federal officer) or 19 U.S.C. § 1459 (failure to present for inspection), which carry significant prison sentences. Instead, repeat your objection: "I do not consent, but I will not physically interfere with your actions." This statement does two things. First, it preserves your Fourth Amendment claim for a suppression hearing under Federal Rule of Criminal Procedure 41(g). Second, it prevents the government from arguing that you submitted to authority voluntarily, which would constitute implied consent under Schneckloth v. Bustamonte (1973). I have represented clients who mumbled "okay" under their breath while handing over their phone, and the government successfully argued in district court that the client had consented because there was no clear verbal objection. The Ninth Circuit's ruling in Cano does not change this basic principle: the burden is on you to manifest your refusal. Silence is not refusal; it is acquiescence.

Another critical procedural step is to demand a lawyer immediately if the detention extends beyond a brief, non-forensic inspection. Under Miranda v. Arizona (1966), custodial interrogation requires warnings, but border detentions for device searches often fall into a gray area. The Ninth Circuit in Cano held that a three-hour detention for a forensic search was a "seizure" under the Fourth Amendment, but it did not automatically trigger Miranda because the agents were not asking questions about the phone's contents. However, if the agents begin questioning you about your travel, your contacts, or your business, you are in custodial interrogation and you should say: "I am invoking my right to remain silent and my right to an attorney under the Fifth and Sixth Amendments." Do not answer any questions about your phone's passcode, your encryption software, or your messaging apps. The government can use your answers as admissions under Federal Rule of Evidence 801(d)(2)(A). I have seen clients destroy their defense by saying, "I use Signal because I care about privacy," which the government then used to argue consciousness of guilt in a conspiracy case under 18 U.S.C. § 371.

Preparing Your Device Before You Travel: A Technical and Legal Checklist

Preparation is your first line of defense, and it must happen at least 48 hours before you reach a port of entry. The government's forensic tools, such as Cellebrite UFED and GrayKey, can extract data from devices that are powered on and unlocked, but they struggle significantly with devices that are powered off and fully encrypted. The first step is to ensure your device is running the latest operating system with full-disk encryption enabled. On iOS, this is automatic if you have a passcode enabled under iOS Settings > Face ID & Passcode. On Android, you must go to Settings > Security > Encrypt Phone. If your device does not support full-disk encryption, do not bring it across the border. The second step is to disable biometric unlocking entirely. Go into your settings and turn off Face ID, Touch ID, and any iris scanning. Then set a strong alphanumeric passcode that is at least 12 characters long, with a mix of uppercase, lowercase, numbers, and symbols. Do not use a pattern or a simple PIN. The reason is legal, not just technical: under the Fifth Amendment, you cannot be compelled to disclose a passcode, but you can be compelled to provide a fingerprint or face scan under the "foregone conclusion" doctrine. The Ninth Circuit in Cano explicitly acknowledged this distinction, citing United States v. Fricosu (10th Cir. 2016) and In re Application for a Search Warrant (N.D. Ill. 2013).

The third step is to log out of all cloud services and messaging apps. iCloud, Google Drive, Dropbox, WhatsApp, Signal, and Telegram all store metadata and content on remote servers. If your phone is seized and forensically copied, the government can access cached tokens that allow it to download your entire cloud account without a warrant. In United States v. Warshak (6th Cir. 2010), the court held that users have a reasonable expectation of privacy in the content of emails stored on a third-party server, but the government often argues that cached tokens on a seized device constitute consent to access the cloud. To prevent this, go to Settings > Accounts and remove all cloud accounts from the device. Then delete the apps themselves. Do not just sign out—delete the apps, because some apps store authentication tokens in the app's sandbox that can be recovered by forensic tools. I have seen cases where the government used a recovered Signal token to download years of encrypted messages, which were then used as evidence in a wire fraud case under 18 U.S.C. § 1343. The defense's motion to suppress under the Fourth Amendment failed because the token was considered "abandoned property" once the user logged out, but the government argued the user had voluntarily placed the token on the device. This is a losing argument that you can avoid entirely by deleting the apps.

The fourth step is to power off your device completely before you approach the border checkpoint. A powered-off device with full-disk encryption is virtually impenetrable to forensic tools without the passcode. If the device is powered on, the encryption keys are stored in volatile memory, and a "cold boot attack" or a "JTAG extraction" can potentially recover them. By powering off, you force the government to either compel you to enter the passcode (which you cannot be forced to do under the Fifth Amendment) or obtain a warrant based on reasonable suspicion under Cano. If you are crossing by car, power off the device at least 15 minutes before you reach the primary inspection booth. If you are flying, power off during the final descent and keep it off until you are through customs. Do not turn it on in the customs hall, because the government can use surveillance cameras to observe you entering the passcode. In United States v. Payton (D. Ariz. 2020), the government used a hidden camera to record a traveler entering his PIN, and the court denied suppression because the traveler had no reasonable expectation of privacy in a public customs hall. Power off, and keep it off.

What to Do If Your Device Is Already Seized: Building the Record for Suppression

If you are reading this after your device has already been seized, you must act immediately to preserve your legal remedies. The first thing to do is write down everything you remember about the encounter, in as much detail as possible, and send it to your attorney. Federal Rule of Criminal Procedure 41(g) allows you to move for the return of property, but you must show that the seizure was illegal and that you are lawfully entitled to possession. The Cano ruling gives you a powerful argument: if the government conducted a forensic search without reasonable suspicion, the seizure itself was unlawful, and any evidence derived from it must be suppressed under the exclusionary rule. However, you need a detailed timeline to make that argument. Write down the exact time you arrived at the checkpoint, the time the officer asked for your device, the time you handed it over (or did not), the time you were detained, and the time you were released. Note the officer's name and badge number if possible. Note whether you were asked to unlock the device, whether you did so voluntarily, and whether you stated your objection. This record is critical because the government will argue that the search was brief and non-forensic, and your detailed timeline can rebut that.

The second thing to do is to immediately file a motion to suppress under the Fourth Amendment, citing United States v. Cano and the new reasonable-suspicion standard. Your motion should argue that the government lacked individualized, articulable suspicion to conduct a forensic search, and that the length of detention exceeded what was reasonably necessary for a manual inspection. You should also argue that any evidence obtained from the device is "fruit of the poisonous tree" under Wong Sun v. United States (1963). If the government claims it had reasonable suspicion, you are entitled to an evidentiary hearing under Franks v. Delaware (1978) to challenge the veracity of the agent's statements. In my experience, agents often rely on boilerplate language about "high-risk travel patterns" or "indicators of smuggling" that do not meet the individualized suspicion standard articulated in Cano. Your attorney should demand that the government produce the agent's training materials and any internal CBP directives regarding digital device searches. The Ninth Circuit in Cano specifically criticized the government's reliance on "generalized profiles" and "routine border inspections," so you have strong precedent to challenge those claims.

The third thing to do is to assert your Fifth Amendment right against compelled self-incrimination if the government attempts to compel you to provide your passcode. If you are served with a grand jury subpoena or a court order directing you to unlock the device, your attorney should file a motion to quash under Federal Rule of Criminal Procedure 17(c), arguing that the act of entering the passcode is testimonial and that the government cannot demonstrate the "foregone conclusion" exception applies. The government must show that it already knows the passcode exists, that you know it, and that the device contains specific evidence—not just that the device might contain evidence. This is a high bar, and the Ninth Circuit's Cano decision reinforces that the government cannot use the border as a shortcut around the warrant requirement. I have successfully argued in multiple cases that the government's request for a passcode is a "fishing expedition" that violates the Fifth Amendment, and I have seen judges grant motions to quash when the government could not articulate specific evidence it expected to find. Remember, the burden is on the government to prove the foregone conclusion, not on you to prove your innocence.