Can CBP Install Spyware on Your Phone at the Border? What Airline Passengers Need to Know

By Charles A. Whittier, Esq.

Whittier Law Group – International Law & Civil Rights Counsel

Introduction

International travelers returning to the United States often face scrutiny from U.S. Customs and Border Protection (CBP), particularly when carrying smartphones or other digital devices. These travelers (often U.S. citizens) are often surprised when their cell phone or other device is actually seized by CBP for further review (See our previous blawg on device seizures at the U.S. border).

But can CBP agents secretly install spyware or surveillance software on your phone before returning it to you? The short answer: It’s possible but largely unlawful — and in doing so the CBP would be raising serious constitutional concerns, especially for U.S. citizens.

CBP’s Expansive Authority at the Border

Under the “border search exception” to the Fourth Amendment, CBP agents can search and inspect electronic devices at the border — including at airports — without a warrant, probable cause, or even reasonable suspicion. This power applies to all individuals, regardless of citizenship status.

In 2018, CBP clarified its procedures under Directive 3340-049A, which distinguishes between:

Basic searches (manual review of data stored locally on the device), and
Advanced searches (use of external equipment to review, copy, or analyze content, including deleted or encrypted files).

CBP can temporarily confiscate and detain devices for offsite forensic analysis and may retain copies of data that it deems relevant to law enforcement investigations.

Can CBP Install Spyware or Tracking Tools?

While CBP does have tools that allow forensic access to data — such as Cellebrite or GrayKey — there is no publicly disclosed legal authority granting CBP permission to install persistent spyware or surveillance software onto a phone and then return it to the owner.

Doing so without the traveler’s consent or a judicial warrant could violate several constitutional rights, including:

The Fourth Amendment, which protects against unreasonable searches and seizures.
The First Amendment, if the surveillance targets protected expression or association.
Due Process rights, particularly if individuals are not notified or given an opportunity to challenge the intrusion.

For U.S. citizens, these constitutional protections are stronger, even at the border. Courts have generally required a higher level of suspicion — such as reasonable suspicion or probable cause — before allowing forensic searches of their devices. Installing spyware that continues to operate after the device is returned would likely be seen as an ongoing surveillance measure, far beyond the scope of a border search.

Legal Recourse and Remedies

If a traveler suspects that their phone was tampered with or infected with monitoring software by CBP, they may:

Request a forensic examination of the device by a digital privacy consultant or forensic analyst.
File a FOIA request to learn what data CBP may have accessed or retained.
File a civil lawsuit under the Fourth Amendment or the Federal Tort Claims Act (FTCA).
Contact civil liberties organizations such as the ACLU or Electronic Frontier Foundation (EFF) for guidance or litigation support.

In some cases, especially involving journalists or attorneys, courts have shown greater concern about CBP’s overreach and have limited the scope of electronic searches.

Best Practices for International Travelers

To protect your privacy when traveling internationally:

Use a clean device or temporary (‘burner”) phone with minimal stored data.
Back up data to the cloud and erase sensitive materials before reentry.
Encrypt your phone and use a strong alphanumeric passcode.
Turn off the device or use airplane mode when crossing the border.
Consult an attorney immediately if CBP detains your phone for any period.
If your phone/devices are confiscated, once returned to you assume they contain spyware, replace the device, and change passwords and SIM card; and in the case of a cell phone get a new phone number.

Conclusion

While CBP has broad authority to inspect digital devices at the border, the covert installation of spyware or persistent monitoring tools likely exceeds their legal authority, especially when targeting U.S. citizens. Any such practice would be constitutionally questionable and open to legal challenge.

If you or someone you know believes their phone has been compromised during a border search, consult with experienced legal counsel immediately. At Whittier Law Group, we help travelers, professionals, and business owners protect their digital rights and challenge unlawful searches in federal court.

Contact Us:
Whittier Law Group
Website: https://whittierlaw.international/
Email: info@whittierlaw.international
Phone: (917) 699-9197