A case here in Halifax, Nova Scotia has hit the world media in a big way, in no small part because it raises an issue of great concern to anyone who travels internationally, and on which there has been no meaningful legal determination in Canada. The facts as they have been reported are that a Quebec resident named Alain Philippon, returning from a trip to the Dominican Republic, was stopped at the Halifax airport by customs officials for what appears to have been "secondary inspection." This involved a search of material he had with him, including his cell phone. The official who stopped him demanded that he provide the password, but Philippon refused to provide it. He was arrested and charged under s. 153.1(b) of the Customs Act, which provides:
153.1 No person shall, physically or otherwise, do or attempt to do any of the following:
(b) hinder or prevent an officer from doing anything that the officer is authorized to do under this Act.
Mr. Philippon was released on bail and has returned to his home. He has not commented on the case, other than to say he intends to fight the charge. He faces a fine of up to $25,000 and up to one year in jail.
Media interest in this case has been intense, to say the least; I have done at least a dozen interviews about it (including an appearance on CBC's national morning news program, The Current, on March 13). I have turned down a dozen more, including a request to do a Skype interview from a Russian TV network. CBC reporter Jack Julian, who broke the story and did the initial interview with me (followup here) told me that it was the most-read story on the CBC website for several days. A number of people have written to me to give me their views, or to tell me about their own experiences at Customs. This is not, I hasten to add, because everyone is entranced with what a law professor thinks, but because it is something that is of great interest to everyone who a) travels, and b) owns a cell phone, tablet or computer -- which adds up to a lot of people.
The most basic question raised by this case that seems to pull people in is this: do customs officials (in Canada, the Canada Border Services Agency or CBSA) have the power to search your cell phone, tablet or computer at the border? At the moment, that question is settled, though as discussed below I would say "not for long." However, the more pointed question raised here is this: even if CBSA officials have the power to search your device, can they compel you to provide them with the password? This issue is not only intellectually interesting, but so far as I can make out it has not yet been litigated in Canadian law.
First off, CBSA officials do have very broad powers of inspection under the Act -- in particular under ss. 11, 12 and 99. They can (and do) haul you aside, pat you down, and examine anything you have with you. You can be compelled to open or otherwise facilitate inspection of any object, container, receptacle etc. that you have. Notably, they do not require "reasonable and probable grounds to believe" that a crime was committed or that you have evidence, as they would if they wished to obtain a search warrant for your house or your suitcase or your car anywhere outside the border.
Under s. 8 of the Canadian Charter of Rights and Freedoms, the procedural requirements which must be met by the police or other state officials vary, depending on the "reasonable expectation of privacy" you have in the thing or place being searched. It has long been the view of the courts that the reasonable expectation of privacy at the border is very low. Not to say that it is non-existent -- the border is not a Charter-free zone -- but due to the intense public interest in border security, the broad search/inspection powers under the Customs Act have generally been upheld as being consistent with s. 8 of the Charter. As the Ontario Court of Appeal commented in the 2006 case of R v Jones:
No one entering Canada reasonably expects to be left alone by the state … Travellers also reasonably expect that Customs authorities will routinely and randomly search their luggage. Put simply … the principle … that individuals are entitled to be left alone by the state absent cause being shown … does not operate at the border. The opposite is true. The state is expected and required to interfere with the personal autonomy and privacy of person seeking entry to Canada. Persons seeking entry are expected to submit to and co-operate with that state intrusion in exchange for entry into Canada.
Thus, the occasional reported cases where people try to challenge a border search of a phone as a s. 8 violation have not met with much success (e.g. R v Leask, where the court held that a search of the accused's computer was exactly the same as searching anything else he had with him). I have certainly heard of lots of cases where people were told to allow the search of their device or it would simply be whisked away and analyzed.
However, it is highly arguable that we have moved into a time when interpreting a word like "goods" in the Customs Act to include such sophisticated devices as smart phones, tablets and computers is no longer sufficient. Over the course of the last five years the Supreme Court of Canada has held with increasing certainty that the privacy interest resident in these kinds of machinery is different, and more profound, than in normal possessions. Your phone or computer, after all, potentially contains your banking information, your personal photos, your diaries and appointment books, communications of every sort (including confidential and privileged communications)…in short, the kind of information that is at your "biographical core" and which immediately attracts s. 8 protection against unnecessarily over broad searches. Cases such as R v Morelli, R v Cole, R v Vu, R v Spencer and R v Fearon clearly demonstrate the Court's view that due to the amount and nature of the personal data contained in (or accessible by way of) computers of all sorts, a high threshold of privacy must be overcome or at least accommodated by state officials in order for a search to be lawful. The Court has even been developing (in Spencer, in particular) the idea of "informational privacy" as an evolving privacy value that underpins the s. 8 analysis.
This case law has established new procedural requirements in the settings of obtaining search warrants, search and seizure, obtaining data from third parties and search incident to arrest -- making the border setting the "next frontier" (if you will pardon the awful pun). Accordingly, it seems logical that a s. 8 challenge to a customs border search made against the backdrop of these authorities might very well produce a result consistent with them: that despite the overall lower expectation of privacy at the border, computers are not analogous to suitcases, handbags or purses and need to be treated with greater attention to the privacy interest attached to them.
This is made all the more complex, of course, by what is sometimes called the "portal argument." A phone or tablet, in particular, is not just a static device with data on it, but an electronic portal to all kinds of information that is stored elsewhere on the internet, or "in the cloud." The privacy interest, therefore, is magnified even further. Even if the CBSA officials have the right to search your phone, can they access your banking information? Your web-based email? And consider this -- depending on the app, the data that is accessible via the phone could very well be resident in another country. Do CBSA officials, in Canada, have the jurisdiction to access and even download data that is stored somewhere else? There is a great deal of authority that would say no, and some that suggests it would violate international law.
It is entirely possible that all of these arguments could be made in the Philippon case, which is one thing that makes it an interesting one to watch.
The other interesting aspect is the demand for the password. Again, the Customs Act contains obligations for people appearing at the border to allow inspection of their belongings and to actively facilitate the searches by opening (or "causing to be opened") any luggage or containers they have with them. This, too, hasn't been terribly controversial in the past, but the privacy interest in computers and the like is inevitably going to complicate this issue. Is requiring you to "open" your phone by providing CBSA officials with your password truly analogous to being made to open a suitcase? It is one thing for them to take the phone or computer away to have it forensically analyzed, but entirely another to compel you to facilitate them in finding evidence. It is more comparable, I think, to the normal search and seizure setting, where police cannot compel you to unlock the door of your house when they arrive with a search warrant; most people do, because the police can simply force the door if they don't, but they cannot compel you to participate. Similarly, with investigative detention, the police are empowered to ask questions but the individual is not required to answer them.
There is US case law on this issue, but it has not been resolved to any degree of certainty. As I recall the majority of the cases, the courts often find that to demand the password offends the principle against self-incrimination, which is embodied in the Fifth Amendment to the US Constitution. Despite some research and some consultation of knowledgable colleagues, I cannot find any case in Canada which has considered this issue.
So this, then, is another fascinating aspect of the Philippon case: he only interfered with or hindered the CBSA officials in their duties if they were lawfully entitled to demand his password and he was lawfully obliged to provide it. Therefore, his ultimate guilt or innocence could rest on this extremely novel issue, which must necessarily be informed by the SCC's recent case law on informational privacy.
As I said above, this is one to watch. One can only hope that Mr. Philippon will retain counsel and follow through on his plan to contest the charge, if for no other reason than that it might help to develop some very unsettled law.
UPDATE (18 March 2015): at the urging of my friend and former student, Allan Richarz, I looked again at the BC Provincial Court decision, R v Buss. I did not read the case carefully enough the first time I looked at it, as it does touch on this issue. In Buss the accused willingly gave up the password to his computer at customs but later argued that the results of the search should be excluded. The court dealt with the issue of compelling the password briefly:
I do not find that, in this context, the requirement to provide a password offends the right to be free from self-incrimination. To hold otherwise would have the result of an enhanced right against self-incrimination at the border. As R. v. Jones points out at para. 40:
The mere fact that a person has attracted the suspicion of a Customs official, thereby causing that official to ask routine questions and conduct a routine search, does not give that individual any enhanced constitutional protection against self-incrimination.
Again, in light of the recent Supreme Court of Canada case law, this approach (with respect) seems insufficient. Even in the context of search incident to arrest, where the overall expectation of privacy is quite low, the Court in Fearon required that searches of cell phones be carried out with a minimum of intrusion and carefully-documented. To be clear, that is in circumstances where police have grounds to arrest the person—surely a less invasive standard should be set for a situation where a person has, for some reason, “attracted the suspicion of a Customs official.”
*Many thanks to David Fraser, Steve Coughlan and Allan Richarz for insight and assistance.