Border agents can’t lawfully search data stored in the cloud

Storing dating in the cloud isn’t always the safest means of locking it down, but avoiding local storage could benefit anyone concerned for their privacy while crossing U.S. borders.

In a letter addressed to Oregon Senator Ron Wyden and reported by NBC, the U.S. Customs and Border Protection agency (CBP) clarified that its policy allowing warrantless border searches is apparently restricted to locally stored data only. The letter from CBP is a response to questions submitted by Wyden and other lawmakers on February 20, 2017 requesting specifics on the border device-search policies.

“CBP’s authority to conduct border searches extends to all merchandise entering or departing the United States, including information that is physically resident on an electronic device transported by an international traveler,” acting CBP Commissioner Kevin McAleenan wrote. “Therefore, border searches conducted by CBP do not extend to information that is located solely on remote servers. I appreciate the opportunity to offer that clarification.”

According to the letter, that distinction applies whether “those servers are located abroad or domestically.” While the distinction might not seem like much, it’s a juicy bit of detail for privacy advocates and a notable revelation from an agency that often appears more keen to stonewall its critics than to clarify its policies and practices.