Your Data Is Still Not Your Own at the Border: The Second Circuit’s Alisigwe Ruling and CBP’s 2026 Device Search Directive

On September 17, 2026, the U.S. Court of Appeals for the Second Circuit held in United States v. Alisigwe that the government needs neither a warrant nor any level of suspicion to manually search a traveler’s cellphone at the border, and it rejected four district court decisions within the circuit that had required a warrant. The ruling follows CBP’s replacement of its 2018 electronic device search policy with Directive 3340-049B, effective January 1, 2026. Business travelers, in-house counsel, and companies whose employees carry client, pricing, or technical data through ports of entry in New York, Connecticut, and Vermont should revisit their travel practices now.

Key Takeaways

The Second Circuit held that a manual search of a cellphone at the border is a routine search that requires no warrant and no suspicion, and that the First Amendment imposes no separate warrant requirement.
The court expressly left open whether a forensic search, such as an off-site extraction of a phone’s data, requires reasonable suspicion.
CBP Directive 3340-049B permits basic searches with or without suspicion and limits advanced (equipment-assisted) searches to cases involving reasonable suspicion or a national security concern, with supervisory approval.
Under the directive, officers may not intentionally use a device to access information stored solely in the cloud, and a device that cannot be inspected due to a passcode or encryption may be detained.
Our 2017 article on this topic predates two policy revisions and this ruling. This article replaces it.

Border Device Searches After Alisigwe

What happened at JFK

According to the opinion, Chinwendu Alisigwe, a lawful permanent resident, was stopped at John F. Kennedy International Airport in 2019 by Homeland Security Investigations (HSI) and CBP officers. An officer instructed him to unlock his phone, scrolled through his photo gallery, and photographed images of other people’s names, birthdates, and Social Security numbers. Two years later, officers stopped him again at JFK, manually reviewed his phone, and photographed a WhatsApp message. The court noted that no extraction of the phone’s data was performed. Alisigwe was convicted of conspiracy to commit bank fraud, bank fraud, and conspiracy to commit money laundering, and was sentenced to five years of imprisonment.

The district court had ruled that cellphone searches at the border require reasonable suspicion and found that suspicion present. The Second Circuit affirmed the conviction but rejected that reasoning.

What the court held

No suspicion required for a manual search. The court applied its precedent that searches of a traveler’s property at the border are routine, treated a cellphone as property, and concluded that a manual search of a phone is a routine search the government may conduct without suspicion.
Riley does not apply at the border. The court held that Riley v. California (2014), which requires a warrant to search a phone incident to arrest, rests on a different exception and does not alter the border-search rules.
Not limited to contraband or border crimes. The court held that the border-search exception is not limited to searching for contraband or evidence of border offenses, and that the validity of a border search does not depend on whether a criminal investigative motive prompted it.
No First Amendment warrant requirement. The court rejected the argument, raised by amici the Knight First Amendment Institute and the Reporters Committee for Freedom of the Press, that the First Amendment independently requires a warrant to search a phone at the border.
District court decisions rejected. The court identified United States v. Smith (S.D.N.Y. 2023), United States v. Sultanov (E.D.N.Y. 2024), United States v. Fox (E.D.N.Y. 2024), and United States v. Djibo (E.D.N.Y. 2015), each of which had required a warrant, and stated that those decisions are wrong.

Judge Eunice Lee concurred only in the judgment. She agreed that neither a warrant nor probable cause is required, but disagreed that phone searches are routine searches requiring no suspicion at all, writing that a cellphone “is not a suitcase.”

What the court did not decide

In a footnote, the majority stated that because the case involved only manual review, it did not need to decide whether sophisticated forensic methods, such as off-site forensic analysis of a phone’s data, might qualify as a nonroutine search requiring reasonable suspicion. The court added that the question may often lack practical significance because a suspicionless manual search might establish reasonable suspicion for a forensic one.

The Second Circuit is the federal appellate court for New York, Connecticut, and Vermont (28 U.S.C. § 41). The opinion surveyed other circuits, summarized below.
Source: United States v. Alisigwe, No. 24-960 (2d Cir. Sept. 17, 2026), slip op. notes 8 and 9.

What CBP’s 2026 Directive Requires of Officers

The court sets the constitutional floor. CBP’s internal policy sets the procedures its officers follow. CBP Directive 3340-049B, Border Search of Electronic Devices, took effect January 1, 2026, and supersedes Directive 3340-049A (January 4, 2018). CBP summarizes its device search authority on its Border Search of Electronic Devices page.

Basic and advanced searches

Basic search. An officer may conduct a basic search, meaning a review of information residing on the device, with or without suspicion (Section 5.1.3).
Advanced search. An advanced search is one in which an officer connects equipment, wired or wireless, to copy or analyze a device’s contents. An officer may perform one only where there is reasonable suspicion of activity in violation of laws CBP enforces or administers, or, absent reasonable suspicion, where there is a national security concern. Advanced searches require supervisory approval at Grade 14 or higher, and a national-security-only search requires approval from the Director, Field Operations or an equivalent official (Sections 3.4 and 5.1.4).
Equipment used only to gain access. Using external equipment merely to make contents available for inspection, for example to bypass a password, overcome encryption, translate content, or charge a device, does not make a search an advanced search (Section 3.4).

Cloud data, passcodes, and detention

Remote data. A border search covers only information resident on the device. Officers may not intentionally use the device to access information stored solely remotely, and will either ask the traveler to disable network connectivity (airplane mode, Bluetooth, and Wi-Fi) or disable it themselves (Section 5.1.2).
Passcodes. The directive states that travelers are obligated to present devices in a condition that allows inspection. Officers may request passcodes. If an officer cannot complete an inspection due to a passcode or encryption, the officer may detain the device (Sections 5.3.1 and 5.3.3). Passcodes are to be recorded only in a temporary format, not uploaded into CBP systems, and deleted when no longer needed (Section 5.3.2).
Detention. Detention after the traveler leaves the port requires supervisory approval and ordinarily should not exceed five calendar days absent extenuating circumstances. Extensions beyond five days require Port Director-level approval, and extensions beyond 15 days are approved in increments of no more than seven days. The officer must issue a Form 6051D custody receipt (Section 5.4.1).
Retention. CBP may retain copies of information where there is probable cause to believe it contains digital contraband or evidence of a violation of law CBP enforces. Without probable cause, CBP may retain only information relating to immigration, customs, and other enforcement matters, consistent with the applicable system of records notice. Otherwise, CBP will retain no copies beyond 21 calendar days after the search concludes (Section 5.6).

Privileged and business information

Attorney-client privilege and work product. When an officer encounters material identified or asserted as privileged, the officer seeks clarification (in writing if practicable) as to specific files, folders, attorney or client names, and similar particulars, and contacts the CBP Associate/Assistant Chief Counsel office before searching it. Privileged material is segregated through a Filter Team or another measure approved by counsel, and copies determined to be privileged are sanitized at the end of the review unless an imminent threat to life or homeland security is identified (Section 5.2.1).
Business confidential information. Officers encountering business or commercial information are to treat it as business confidential and protect it from unauthorized disclosure. The Trade Secrets Act, the Privacy Act, and other laws may govern its handling (Section 5.2.3).

What changed from the 2018 directive?

Comparison of Directive 3340-049A (2018) and Directive 3340-049B (2026):

Preparing People, Devices, and Data Before International Travel

DTL’s read: For travelers entering through New York, Connecticut, or Vermont, Alisigwe changes what a court in those states will suppress more than it changes CBP’s procedures at the inspection booth. CBP policy already permitted basic searches with or without suspicion before the ruling. The practical risk for companies is unchanged and significant: anything resident on a device can be reviewed, and a device that cannot be inspected immediately can be held for later inspection.

In our experience, the companies that handle border device searches well treat them as a compliance issue, not a travel inconvenience. We recommend the following:

Carry only what the trip requires. Consider travel-only devices for employees who handle client files, pricing, technical data, or export-controlled information. The directive lists export-controlled information and theft of proprietary information among the matters border searches can reveal (Section 1.2).
Know what is on the device. DTL’s read: the remote-data limit protects only information that is not resident on the device. Email, messages, and files that have synced or downloaded to a phone are on the phone.
Prepare privilege assertions in advance. Attorneys, in-house counsel, and executives carrying privileged communications should be ready to identify specific files, folders, and attorney or client names, which is the information Section 5.2.1.1 says officers will request.
Flag business confidential information. Be prepared to identify commercial information as business confidential and to ask that it be handled under Section 5.2.3.
Decide the passcode question before you travel. Under the directive, a device that cannot be inspected may be detained. Discuss with counsel how your travelers should respond, and whether a short trip justifies carrying a device you cannot afford to lose for five days or more.
Update company travel policies. Address device selection, data minimization, privilege handling, and an escalation contact for employees referred to secondary inspection.

If CBP Searches or Detains Your Device

Under Section 5.1.7, the traveler is to be notified of the purpose and authority for the search and how to seek redress, unless notification is withheld with supervisor approval. Ask for that information.
If the device is detained, obtain the Form 6051D custody receipt, record officer names and the port, and track the detention against the five-day and 15-day approval thresholds in Section 5.4.1.1.
If privileged material is on the device, assert the privilege at the time of the search and identify it as specifically as possible.
Repeated referrals to secondary inspection or a Trusted Traveler revocation can follow a border encounter. Diaz Trade Law has assisted individuals with Global Entry revocation appeals and traveler redress inquiries.

Updating our 2017 guidance

Our December 2017 article, Your Data is NOT Your Own at the Border, was written under CBP’s 2009 directive. Several points have changed:

How Diaz Trade Law Can Help

Diaz Trade Law advises companies and individuals on CBP inspections, secondary examinations, device detentions, seizures, Global Entry revocations, and traveler redress, and helps companies build travel and data-handling policies for employees who cross the border with sensitive information. Related resources: Customs Wants to Know What’s in Your Laptop; Secondary Examinations When Traveling Internationally; CBP Seizures, Fines, Penalties and Forfeitures.

Your Data Is Still Not Your Own at the Border: The Second Circuit’s Alisigwe Ruling and CBP’s 2026 Device Search Directive