A new report by the Department of Homeland Security’s internal watchdog has concluded that the agency does not always adequately delete data seized as part of a border search of electronic devices, among other concerns.

According to a new 24-page document released Tuesday by DHS’ Office of Inspector General, investigators found that some USB sticks, containing data copied from electronic devices searched at the border, “had not been deleted after the searches were completed.”

Investigators checked an unspecified number of drives across five ports of entry around the country.

“Based on our physical inspection, as well as the lack of a written policy, it appears [Customs and Border Protection’s Office of Field Operations] has not universally implemented the requirement to delete copied information, increasing the risk of unauthorized disclosure of travelers’ data should thumb drives be lost or stolen,” the OIG wrote.

Border searches of such devices have been on the rise since 2016, with no discernible explanation as to why.

According to CBP’s own figures sent to Ars in March 2017, the agency searched nearly 24,000 devices during fiscal year 2016, up from nearly 5,000 a year earlier. 2017 has seen an even larger increase—hitting more than 29,000 “inbound travelers.” However, the agency maintains that such inspections are exceedingly rare.

Federal authorities do not need a warrant to examine a phone or a computer seized at the border. They rely on what’s known as the “border doctrine“—the legal idea that warrants are not required to conduct a search at the border. This legal theory has been generally recognized by courts, even in recent years.

In its response to the OIG, CBP’s Office of Field Operations wrote that it is “developing a process…to ensure documentation of actions are input properly, to include supervisory review.”

The Office estimated that this would be completed by the end of June 2019.

https://arstechnica.com/?p=1427505