Having for years enforced a constitutionally offensive border search regime at physical borders and U.S. international airports, Customs and Border Protection (CBP) recently proposed to expand its violations in troubling new ways by prompting travelers from countries on the State Department’s Visa Waiver Program list to provide their “social media identifier.” Mounting criticism recently prompted the agency to commit to some useful limits, but the proposal remains flawed.

Recently joining the ranks of diverse critics is the U.N. Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, who wrote to the U.S. Ambassador at the end of September.

Many social media users share sensitive information online intended for friends and family that they would not share with their (or a foreign) government.

EFF submitted several sets of comments expressing our concerns with the proposal, beginning during the initial comment period. After CBP extended the original comment period until the end of September, the agency received comments from thousands of users opposing its ill-considered and counter-productive policy. It issued a preliminary response to those initial comments, to which we replied in a follow up analysis noting the proposal's continuing defects. We also joined coalition comments compiled by the Center for Democracy & Technology, as well as a second set of coalition comments organized by the Brennan Center for Justice in response to a DHS notice required by the Privacy Act.

Violating international law

The international community has also grown outspoken. An important new voice joined the debate at the end of September, when David Kaye, the U.N. Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, wrote to remind our government that international law protects everyone’s “right to maintain an opinion without interference and to seek, receive and impart information and ideas of all kinds, regardless of frontiers,” in addition to “the right of individuals to be protected…against arbitrary…interference with their privacy and correspondence.”

Mr. Kaye’s letter also reiterates the necessary and proportionate principles developed in 2013 by a global coalition of civil society, privacy, and technology experts (including EFF) and endorsed by over 600 organizations and a quarter million individuals around the world. It goes on to challenge CBP’s proposal for half a dozen reasons, including the vagueness that has concerned EFF. In particular, Mr. Kaye notes that:

It is unstated whether (and under what circumstances) officers may request additional information or access to private accounts. It is also unclear whether officers can request or persuade travelers who have left the data field blank to provide information, or whether they would be questioned about why they left the field blank.

Of course, social media profiles can reveal an immense amount of personal details about an individual. Many social media users share sensitive information online intended for friends and family that they would not share with their (or a foreign) government.

Chilling speech and expression

Our allies at ACCESS NOW have noted that “A person’s online identifiers are gateways into an enormous amount of their online expression and associations, which can reflect highly sensitive information about that person’s opinions, beliefs, identity, and community.” As my colleague Sophia Cope wrote in August:

[S]ocial media handles...can easily lead the government to information about [a traveler's] political leanings, religious affiliations, reading habits, purchase histories, dating preferences, and sexual orientations, among other things. Moreover, given the highly networked nature of social media, the government would also learn such personal details about travelers’ family members, friends, professional colleagues, and other innocent associates, many of whom may be U.S. citizens and/or residents with constitutional and statutory rights.

Travelers accustomed to political repression in their own countries may, as the U.N. special rapporteur noted, inhibit their own expression to avoid scrutiny during anticipated future travel. So, too, will Americans: knowing that an international friend's decision to answer CBP’s proposed question could compromise our own opportunity for anonymous speech, as well as associations, many Americans—especially those familiar with our country’s history of suppressing dissent—may rationally decide to limit their online speech to avoid controversial topics that might invite scrutiny.

Such constitutionally offensive chilling effects are established and predictable in the face of documented surveillance and even more likely given the troubling history of U.S. federal authorities excluding visitors for ideological reasons. CBP's proposal to ask visitors to disclose their social media handles undermines the Obama administration’s written commitment to reverse this policy in order to allow Americans to hear diverse views.

Undermining the privacy of Americans

CBP and DHS formulated the proposed policy in the face of longstanding criticism for their domestic programs monitoring social media activity, to which executive officials have recently re-committed their agencies. Our comments joining the Brennan Center, in particular, highlight how CBP's current proposal would further impact the rights of Americans since the proposal would enable CBP to map relationships between visitors and their U.S. contacts and then share information gleaned from the social media profiles of those U.S. residents with other agencies potentially poised to monitor them.

Collecting data on the social media profiles of international travelers could also exacerbate longstanding domestic concerns in other ways.

Only two years ago, the Supreme Court held in Riley v. California that cell phones are not subject to search incident to arrest absent a judicial warrant. In other words, even when an arrest is justified by probable cause that a person has committed a criminal offense, police must receive permission from a neutral arbiter, supported by a separate showing of probable cause, before searching the arrestee’s cell phone.

Yet at the border, DHS already violates the spirit of Riley in ways that this proposal could intensify. First, CBP has long claimed the power to search any electronic device crossing a U.S. border—including those belonging to U.S. citizens—for any reason at all, even without the individual suspicion long required to pat down a suspect within the U.S. or the the judicial warrant required by Riley.

Government lawyers who argued Riley conceded that the power to seize a phone from someone arrested within the U.S. did not justify accessing data—like social media profiles—stored in the cloud (e.g., by tapping on the Facebook app). If, however, CBP collects social media information at U.S. borders from WVP travelers (and through them, their U.S. contacts) it could enable the government to do what in Riley it conceded it could not: access data about Americans stored in the cloud without first gaining a judicial warrant.

Put another way, learning the social media accounts of travelers would expand the government's reach beyond data already gathered from devices and could allow agencies to circumvent legal limits that protect the privacy of Americans within the U.S.

Limits acknowledging some concerns

Our original comments expressed concern that CBP proposed to characterize as optional a question posed in an inherently coercive setting and invite travelers to reveal private and sensitive information by posing that question in a vague way.

Fortunately, CBP issued a statement repudiating a previous draft of its form on which its proposed question appeared as compulsory. The agency said it will make clear that “Providing this information will be voluntary. If an applicant chooses to not fill out or answer questions regarding social media, the ESTA application and I-94W can still be submitted.”

Its most recent statement also commits that "CBP will not violate any social media privacy settings in processing ESTA applications." This pledge is especially important given the agency's established practice of arbitrarily seizing devices at borders and airports, with which the government could conceivably not only access the known social media profiles of travelers but even potentially commandeer them.

On the one hand, we are proud of having helped compel CBP to accept reasonable limits.

Continuing constitutional defects

On the other hand, CBP's proposal remains flawed and continues to suffer from constitutional defects.

Sophisticated travelers may recognize that “information associated with your online presence” such as a “social media identifier” could be limited to a handle or pseudonym used to identify oneself on a particular social network. Some, however, may go further and provide multiple identifiers, or possibly even their passwords, enabling the government to potentially access private content. CBP should clarify how it will treat information provided by travelers and establish strict parameters to prevent misuse.

Morever, CBP admits that it will share data collected through its new question with other agencies "that have a need to know the information to carry out their national security, law enforcement, immigration, or other homeland security functions." This fails to address the concerns that we and others—including the U.N. Special Rapporteur—have raised about the proposal's chilling effects on expression.

Not only will travelers potentially silence themselves in their home countries to avoid prompting scrutiny when traveling to the U.S., but CBP's proposal may lead Americans to seek fewer international relationships with contacts through whom our own information could be exposed. It could also lead other countries to reciprocally demand personally identifying information from Americans seeking to enter their countries, driving a race to the bottom.

Perhaps most dangerously, the proposal omits any indication of how social media profiles will be evaluated or the process through which a traveler could be identified as a security risk. These standards must be articulated in advance to limit individual discretion and prevent ideological profiling of the sort that has long limited the rights of Americans to hear unpopular views.

Even after CBP recently articulated its limits, the proposal remains flawed. It undermines international law, individual rights, the rights of Americans both to hold and to hear unpopular views, and the Obama administration’s foreign policy to promote freedom of expression.

Having filed our comments alongside thousands of other critics, we hope that concerns from both Americans and the international community will spur the administration to reject CBP’s speech-suppressing proposal. Concerned readers can amplify our concerns by prompting their congressional representatives—especially those on the Senate and House Homeland Security committees—to write their own letters seeking answers from DHS and CBP.