Procedures for lawful access to digital data at the border

(a) Standard Subject to subsection (b), a Governmental entity may not— (1) access the digital contents of any electronic equipment belonging to or in the possession of a United States person at the border without a valid warrant supported by probable cause issued using the procedures described in the Federal Rules of Criminal Procedure by a court of competent jurisdiction; (2) deny entry into or exit from the United States by a United States person based on a refusal by the United States person to— (A) disclose an access credential that would enable access to the digital contents of electronic equipment or the digital contents of an online account; (B) provide access to the digital contents of electronic equipment or the digital contents of an online account; or (C) provide online account information; or (3) delay entry into or exit from the United States by a United States person for longer than the period of time, which may not exceed 4 hours, necessary to determine whether the United States person will, in a manner in accordance with subsection (c), consensually provide an access credential, access, or online account information, as described in subparagraphs (A), (B), and (C) of paragraph (2). (b) Emergency exceptions (1) Emergency situations generally (A) In general An investigative or law enforcement officer of a Governmental entity who is designated by the Secretary of Homeland Security for purposes of this paragraph may access the digital contents of electronic equipment belonging to or in possession of a United States person at the border without a warrant described in subsection (a)(1) if the investigative or law enforcement officer— (i) reasonably determines that— (I) an emergency situation exists that involves— (aa) immediate danger of death or serious physical injury to any person; (bb) conspiratorial activities threatening the national security interest of the United States; or (cc) conspiratorial activities characteristic of organized crime; (II) the emergency situation described in subclause (I) requires access to the digital contents of the electronic equipment before a warrant described in subsection (a)(1) authorizing such access can, with due diligence, be obtained; and (III) there are grounds upon which a warrant described in subsection (a)(1) could be issued authorizing such access; and (ii) makes an application in accordance with this section for a warrant described in subsection (a)(1) as soon as practicable, but not later than 7 days after the investigative or law enforcement officer accesses the digital contents under the authority under this subparagraph. (B) Warrant not obtained If an application for a warrant described in subparagraph (A)(ii) is denied, or in any other case in which an investigative or law enforcement officer accesses the digital contents of electronic equipment belonging to or in possession of a United States person at the border without a warrant under the emergency authority under subparagraph (A) and a warrant authorizing the access is not obtained— (i) any copy of the digital contents in the custody or control of a Governmental entity shall immediately be destroyed; (ii) the digital contents, and any information derived from the digital contents, may not be disclosed to any Governmental entity or a State or local government; and (iii) the Governmental entity employing the investigative or law enforcement officer that accessed the digital contents shall notify the United States person that any copy of the digital contents has been destroyed. (2) Protection of public safety and health A Governmental entity may access the digital contents of electronic equipment belonging to or in possession of a United States person at the border without a warrant described in subsection (a)(1) if the access is— (A) necessary for the provision of fire, medical, public safety, or other emergency services; and (B) unrelated to the investigation of a possible crime or other violation of the law. (c) Informed consent in writing (1) Notice (A) In general A Governmental entity shall provide the notice described in subparagraph (B) before requesting that a United States person at the border— (i) provide consent to access the digital contents of any electronic equipment belonging to or in the possession of or the digital contents of an online account of the United States person; (ii) disclose an access credential that would enable access to the digital contents of electronic equipment or the digital contents of an online account of the United States person; (iii) provide access to the digital contents of electronic equipment or the digital contents of an online account of the United States person; or (iv) provide online account information of the United States person. (B) Contents The notice described in this subparagraph is written notice in a language understood by the United States person that the Governmental entity— (i) may not— (I) compel access to the digital contents of electronic equipment belonging to or in the possession of, the digital contents of an online account of, or the online account information of a United States person without a valid warrant; (II) deny entry into or exit from the United States by the United States person based on a refusal by the United States person to— (aa) disclose an access credential that would enable access to the digital contents of electronic equipment or the digital contents of an online account; (bb) provide access to the digital contents of electronic equipment or the digital contents of an online account; or (cc) provide online account information; or (III) delay entry into or exit from the United States by the United States person for longer than the period of time, which may not exceed 4 hours, necessary to determine whether the United States person will consensually provide an access credential, access, or online account information, as described in items (aa), (bb), and (cc) of subclause (II); and (ii) if the Governmental entity has probable cause that the electronic equipment contains information that is relevant to an allegation that the United States person has committed a felony, may seize electronic equipment belonging to or in the possession of the United States person for a period of time if the United States person refuses to consensually provide access to the digital contents of the electronic equipment. (2) Consent (A) In general A Governmental entity shall obtain written consent described in subparagraph (B) before— (i) accessing, pursuant to the consent of a United States person at the border the digital contents of electronic equipment belonging to or in the possession of or the digital contents of an online account of the United States person; (ii) obtaining, pursuant to the consent of a United States person at the border, an access credential of the United States person that would enable access to the digital contents of electronic equipment or the digital contents of an online account; or (iii) obtaining, pursuant to the consent of a United States person at the border, online account information for an online account of the United States person. (B) Contents of written consent Written consent described in this subparagraph is written consent that— (i) indicates the United States person understands the protections and limitations described in paragraph (1)(B); (ii) states the United States person is— (I) providing consent to the Governmental entity to access certain digital contents or consensually disclosing an access credential; or (II) consensually providing online account information; and (iii) specifies the digital contents, access credential, or online account information with respect to which the United States person is providing consent. (d) Retention of digital contents (1) Lawful access A Governmental entity that obtains access to the digital contents of electronic equipment, the digital contents of an online account, or online account information in accordance with this section may not make or retain a copy of the digital contents or online account information, or any information directly or indirectly derived from the digital contents or online account information, unless there is probable cause to believe the digital contents or online account information contains evidence of, or constitutes the fruits of, a crime. (2) Unlawful access If a Governmental entity obtains access to the digital contents of electronic equipment, digital contents of an online account, or online account information in a manner that is not in accordance with this section, the Governmental entity— (A) shall immediately destroy any copy of the digital contents or online account information, and any information directly or indirectly derived from the digital contents or online account information, in the custody or control of the Governmental entity; (B) may not disclose the digital contents or online account information, or any information directly or indirectly derived from the digital contents or online account information, to any other Governmental entity or a State or local government; and (C) shall notify the United States person that any copy of the digital contents or online account information, and any information directly or indirectly derived from the digital contents or online account information, has been destroyed. (e) Recordkeeping A Governmental entity shall keep a record of each instance in which the Governmental entity obtains access to the digital contents of electronic equipment belonging to or in the possession of an individual at the border, the digital contents of an online account of an individual who is at the border, or online account information of an individual who is at the border, which shall include— (1) the reason for the access; (2) the nationality, immigration status, and admission category of the individual; (3) the nature and extent of the access; (4) if the access was consensual, how and to what the individual consented, and what the individual provided by consent; (5) whether electronic equipment of the individual was seized; (6) whether the Governmental entity made a copy of all or a portion of the digital contents or online account information, or any information directly or indirectly derived from the digital contents or online account information; and (7) whether the digital contents or online account information, or any information directly or indirectly derived from the digital contents or online account information, was shared with another Governmental entity or a State or local government.