Device and conquer: how the Border Force traps travelling criminals

A person singled out for digital ­device examination by Australian Border Force officers will have been identified before they set foot into the secure Customs area at airports.

An Australian Border Force official searches a mobile phone. Picture: Lyndon Mechielsen

A person singled out for digital ­device examination by Australian Border Force officers will have been identified before they set foot into the secure Customs area at Australia’s international airports.

The searches are not conducted at random, but rather are ­performed on individuals whom the ABF considers a potential risk.

Risks include criminal history (if known), intelligence passed on from other agencies such as the police, and other factors such as unusual patterns of travel.

Examples can include older men making repeat trips to and from countries such as The Philippines, where child sexual abuse is a higher risk, or people buying last-minute tickets from known drug importation hotspots such as some ports of South America.

The ABF uses powers it is granted under three pieces of legislation – the Customs Act 1901, the Migration Act 1958 and the Maritime Powers Act 2013 – to search electronic devices such as phones, laptops, tablets and removable storage drives.

The powers were originally ­designed with baggage searches in mind but most of the searches are conducted under section 186A of the Customs Act, which was passed in 1999 to take digital property into account. This also allows them to copy suspect data.

Those who are required to undergo a digital search will not have any indication they’ve been ­singled out until they reach what the ABF calls the “marshal point ’’ – after they have had their passport scanned and they have collected their baggage.

It is here that all passengers hand over their incoming passenger card to an ABF officer, and are directed either to the exit gates or into lanes to have their baggage examined.

It is at this point they will be asked to hand over all their digital devices to the ABF officer, who will remove them and take them to a secure room where they will be physically plugged in to ABF computers that scan all files, including photos and messages.

The searches take place in an internal room on computers that are isolated and not connected to the ABF’s regular network, in order to protect the chain of custody on any data copied, and to protect the ABF network from any potential malware.

The owner of the devices is not permitted to be present during the searches. The ABF will request the pin codes and passwords to open the devices, but has no power to order people to hand them over.

Those who refuse usually have their devices seized.

The ABF returns almost all devices to their owners within 14 days, but this is done as a matter of policy, not under any specific law requirement. The devices of particularly high-risk individuals such as known child sex offenders are often held for longer while ABF’s digital forensics experts try to gain access to them.

Computers do an automated scan looking for suspect images, trigger words and videos. Anything suspect identified by the computer is then reviewed by ABF officials trained to examine digital evidence. Some of the material seized, particularly relating to child sexual abuse imagery, is so disturbing that the ABF limits its officers’ exposure to it.

If the devices are clean, they are returned to the owner, usually within an hour or so. If images need further examination or explanation, they are copied, and the device’s owner is questioned.

If there is a legitimate explanation, the images are deleted from ABF files and the devices returned to their owner, but if illegal material such as child abuse imagery, terrorism-related material, or evidence of illegal activities such as drug-smuggling, child sexual abuse, identity fraud or other offences is identified, the data is copied and given to police for investigation and prosecution.

Unless they have a warrant, the ABF does not have the power to search for data that has been backed up in the cloud.