CTRL - Canadian Tech Rights Lab

Our digital devices, and especially our smartphones, are incredibly intimate. They are a window into our health, finances, politics, religion, sexuality, and personal relationships. They are detailed records of our conversations, calendars, movements, photo albums, medical appointments, late night anxieties, and much more.

Despite the intensely personal nature of the information on our electronic devices, and the essential role they play in our day-to-day lives, the Canada Border Services Agency (CBSA) claims broad authority to search travellers’ electronic devices at the border, often without suspicion.

The last thorough attempt at documenting CBSA policy for electronic device searches was the second edition of the BCCLA’s Electronic Devices Privacy Handbook, published in 2018. A lot has changed since then:

• Our devices play an even more intimate and essential role in all our lives.
• The volume of storage on devices has increased dramatically.
• Court decisions have found that CBSA’s applications of the Customs Act and IRPA to searches of electronic devices are unconstitutional.

To see how the landscape has changed, in 2025 we made an Access to Information request to the CBSA for records relating to its searches and seizures of electronic devices at the Canadian border. We asked about policies and procedures for when and how searches are conducted, tools and technological capabilities used, privacy and oversight, and statistics showing how common these practices are. We also asked about passwords and biometric credentials, and what happens if people refuse to provide them. The full text of the request is at the end of this post.

In March 2026, CBSA responded.

We learned:

• There have been significant changes in how CBSA handles digital devices at the border between 2018 and the present.
• CBSA has taken a more aggressive stance on passwords, claiming that providing access to a device is a requirement of entry to Canada.
• Changes in CBSA policy were driven by courts finding that CBSA’s reliance on Customs Act and IRPA to justify suspicionless searches of devices was a violation of the Charter.
• These decisions resulted in an approximately 50% decrease in the number of digital devices searched by the CBSA on a monthly basis in the provinces where the decisions are binding (Ontario and Alberta).
• Before the court decisions, nearly 75% of device searches conducted by CBSA found nothing in violation of the law. After, the false positive rate dropped to 56%.

We did not learn:

• What indicators CBSA uses to target searches of devices.
• What hardware and software tools CBSA uses to unlock, search, and copy devices.

This information was requested, but was either withheld or redacted by CBSA.

The full response is available for download below, both as an OCRed PDF and the original document as received from CBSA. We will try to provide a more detailed analysis in future posts, including recommendations for travellers looking to protect their privacy. For now, we’ve pulled out a few highlights from the responses. Page references are to the PDF.

Downloads

• PDF, OCRed: 2026-CBSA-Device-Search.pdf
• Original, no OCR: A202539936_2026-03-26_15-31-32.pdf

Note: Adobe Acrobat and Claude Opus 5 were used to OCR the original response and to clean up OCR results. It’s generally pretty accurate, but double-check against the original before relying on OCR text.

Highlights

Definitions and authorities

The documents confirm that CBSA still asserts that electronic devices and the information on them are “goods” under the Customs Act, which states that goods “includes conveyances, animals and any document in any form” (Customs Act, s 2(1)).

The CBSA “Policy on Port of Entry Examination of Travellers’ Digital Devices”, dated July 2024 (“Policy”) (PDF p 90-118) reviews the broad authorities granted by the Customs Act and Immigration and Refugee Protection Act. It walks through CBSA’s interpretation of those powers, excerpting key provisions and offering minimal guidance on interpretation.

CBSA and its enabling legislation distinguish between “search”, “examine”, and “inspect”, to refer to a CBSA officer looking at the contents of an electronic device, and between “detain” and “seize” to refer to CBSA taking custody of an electronic device and its contents, either permanently or temporarily. Different authorities rely on different verbs, and may require different standards.

While this post will reference the terms used by the CBSA, we may default to the colloquial terms. We may use:

• “Search” to mean a CBSA officer looking at the contents of an electronic device.
• “Seize” to mean CBSA not returning a traveller’s electronic device to the traveller.
• “Copy” to mean CBSA making copies of the information on an electronic device.

Selecting travellers to search

CBSA Border Services Officers (“BSOs”) are told to consider “the potential private nature of data stored on digital devices” (Policy, PDF p 101) and should “not [conduct] digital device exams as a matter of course” (Policy, PDF p 92).

CBSA relies on a series of indicators to select which travellers are subjected to searches of electronic devices. The list of indicators is entirely redacted (For example, likely redactions in Policy, PDF p 103-4). In the past, CBSA has stated that indicators included men travelling alone and travellers from high-risk countries.

Searches should only be conducted when there is “a clear link to administering or enforcing CBSA program legislation that governs the cross-border movement of people and goods”. Searches cannot be conducted “with the sole or primary purpose of looking for evidence of a criminal offence” (Policy, PDF p 103).

Passwords and credentials

Demanding passwords

CBSA takes the position that “travellers have the legal obligation under the Customs Act to provide the means to access their goods, including digital devices” (Policy, PDF p 116). Providing a password to an electronic device can be a condition of entry into Canada (Policy, PDF p 107):

Where a password is required to gain access to a digital device, Officers should explain to a traveller that a password must be supplied in order for the traveller’s obligations on entry to Canada under the Customs Act, the IRPA or other CBSA program legislation to be fulfilled.

For devices secured by biometrics, CBSA advises that BSOs should obtain the password rather than allowing access by biometrics (Policy, PDF p 108):

While a device may primarily be protected by a biometrics-enabled method, the device can often also be accessed through a password. Where possible, Officers should seek to gain access to devices using this latter type of security method.

When a traveller provides their password, BSOs must write the password on a piece of paper apart from their notes. If there is no evidence found, the paper with the password is given to the traveller, and the traveller is told to change their password immediately. If there is evidence found, the password is recorded in the BSO’s notes (Policy, PDF p 108).

Other means of accessing devices

CBSA has Digital Forensic Units who can provide assistance unlocking devices or conducting searches. A notetaking guide states (PDF p 131):

There are heightened sensitivities around the use of facilitative technology. It is important that the CBSA is transparent about the use of this technology and accounts for any support given to aid in the examination of digital devices.

Despite this commitment to transparency, the specific technologies used by CBSA are not detailed in the ATIP documents and may have been redacted or withheld.

During an examination of a digital device by a BSO at a port of entry, “assistance to gain access to the device shall not be obtained from any source outside the CBSA” (Policy, PDF p 116).

Network access

Before searching a device, BSOs must disable network connectivity to that device to prevent remote wiping of the device (PDF p 120) and to ensure the BSO does not obtain anything from the internet that was not already on the device (PDF p 130).

The Policy notes that “Airplane Mode” may not disable all connectivity, and requires disabling wifi and any tethering. The ATIP response included several pages on how to enable Airplane Mode on iOS and Android devices (PDF p 120-129).

Travellers can provide directions to disable network access, but are not allowed to do it themselves (Policy, PDF p 109).

Cloud content

One major development in CBSA policy is a coherent approach to handling cloud-based content. The states that CBSA “must only access data that is stored on a traveller’s digital device and must not access any data stored remotely” (emphasis in original) (Policy, PDF p 109). Disabling network access ensures that a search does not access cloud data (PDF p 130).

This policy was in place at least as early as November 2019 (PDF p 1).

Search standards

Pre-approval by supervisors (R v Canfield)

In the June 2021 version of the Policy, the CBSA introduced a significant new requirement: any examination of digital devices by BSOs must be pre-approved by a supervisor (PDF p 70).

This Policy change follows Operational Bulletin OBO-2021-037, issued on June 8, 2021 (OBO-2021-037, PDF p 144). In addition to requiring a new training for BSOs prior to conducting examinations of digital devices, it states (emphasis in original):

It is now mandatory for BSOs to receive Superintendent/Chief approval prior to conducting a digital device examination (this approval can be obtained either in person or over the phone). BSOs must be able to provide rationale to Superintendents/Chiefs as to why they will be conducting a digital device examination. For example, what indicators are present and what contravention those indicators are pointing towards. This applies to all examinations of digital devices accompanying a traveller (i.e. those performed either under the Customs Act or the Immigration and Refugee Protection Act).

This Operational Bulletin and change to policy was presumably made in response to R v Canfield, 2020 ABCA 383, in which the Alberta Court of Appeal held that suspicionless searches of electronic devices under the Customs Act were a violation of the Charter:

[111]      We are satisfied that s 99(1)(a) of the Customs Act violates s 8 of the Charter to the extent that it authorizes unlimited searches of the contents of personal electronic devices (such as cell phones or lap top computers). The provision is not saved by s 1 as a reasonable and demonstrably justified limit. Accordingly, we declare that the definition of “goods” in s 2 of Customs Act is of no force or effect insofar as the definition includes the contents of personal electronic devices for the purposes of s 99(1)(a).

It is not explicitly stated in the Policy or the Operational Bulletin, but it is reasonable to assume that the detailed note-taking requirements and approval by a supervisor are intended to demonstrate and document a reasonable grounds to suspect before a search.

The notetaking requirements are further detailed by a guide titled “Digital Device Examinations - Notetaking Requirement: Rationale” (PDF p 130). This guide

Alberta: Reasonable suspicion under IRPA (R v Al Askari)

Later in 2021, a second Alberta case (R v Al Askari, 2021 ABCA 20) led to Operational Bulletin OBO-2021-041, which put similar limits on examinations of electronic devices conducted in Alberta under IRPA. It states (OBO-2021-041, PDF p 146) (emphasis in original):

As a result of the recent Alberta Court of Appeal ruling in R v. Al Askari 2021 ABCA 204, prior to relying on section 16 of the Immigration and Refugee Protection Act (IRPA) to initiate an examination of a digital device at a port of entry, border services officers (BSOs) must have a reasonable suspicion relating to specified regulatory purposes under s.16(3) of IRPA.

Specified IRPA 16{3) Regulatory Purposes:

In order to justify a digital device examination unders.16(3) of IRPA for regulatory purposes, a BSO must have reasonable suspicion with respect to a foreign national’s or permanent resident’s 1) identity, 2) admissibility, and/or 3) other articulable regulatory non-compliance under IRPA.

The Operational Bulletin goes on to explain how BSOs can write their notes to demonstrate compliance (OBO-2021-041, PDF p 147):

When articulating the regulatory purpose for the examination, vague device examination purpose rationales such as “IRPA non-compliance” are too broad to fulfil the requirement to indicate the specific regulatory purpose of a digital device examination. More targeted IRPA regulatory purpose rationales Ii nked to “identity concerns” or “inadmissibility concerns” are more defensible. These rationales must link directly to the “totality of border processing circumstances” (e.g. BSO roles and responsibilities under IRPA at the port of entry, progression of port of entry processing of the traveller, and the indicators the BSO is relying on to justify initiation and progression of their digital device examination).

Reasonable Suspicion:

A BSO’s reasonable suspicion under IRPA can develop progressively during port of entry processing of a foreign national or permanent resident but must be articulable prior to initiating a digital device examination under 16(3). The reasonableness of a BSO’s prior suspicion under IRPA will be assessed by courts against the “totality of border processing circumstances” which includes all indicators. A BSO’s reasonable suspicion with respect to identity, admissibility and/or other articulable regulatory non-compliance under s.16(3) of IRPA must be tied to indicators that are fact-based, and grounded in common sense and practical, everyday experience.

The totality of the objective facts or circumstances must be articulated in a BSO’s notebook and able to withstand independent scrutiny. Mere hunches and intuition are insufficient to meet the requirement of reasonable suspicion.

Ontario and Alberta: no searches under s 99(1)(a) of Customs Act (R v Pike)

In R v Pike, 2022 ONSC 2297 , the Ontario Superior Court of Justice joined the Alberta Court of Appeal in finding fault in CBSA’s suspicionless searches under the Customs Act. In explaining the finding, Justice Harris wrote:

[75]           Possession of a digital device is not truly a matter of free choice nor is carrying it over the border. It is difficult for many of us to conduct our work or home lives without computers and cell phones. They have become a necessary appendage—for better of for worse—and have fully ingratiated themselves into our lives. We cannot live without them. In light of their importance, in my view Canadians would never countenance deeply private information resident on digital devices being vulnerable to random, standardless, wholesale investigation by the state.

CBSA responded to these decisions by creating a dual policy, allowing travellers entering Canada in Alberta or Ontario more rights than those entering in other provinces (PDF p 151):

Under Operational Bulletin OBO-2022-027, the CBSA instructed BSOs at ports in Ontario and Alberta that they could not rely on section 99(1)(a) of the Customs Act to conduct searches of electronic devices, and instead must rely on section 99(1)(e), which requires a higher standard of “suspects on reasonable grounds” (PDF p 150) (emphasis in original):

Section 99(1)(e) authorizes officers to examine goods (including conveyances) where the officer suspects on reasonable grounds that the Customs Act or any Act of Parliament administered or enforced by the officer have been or might be contravened in respect of the goods. A threshold of reasonable grounds to suspect is based on the totality of the circumstances, and requires more than a “mere suspicion”. Instead, it must be based on objectively discernible facts that establish a reasonable possibility (but not probability) of a contravention in respect of the goods.

Under s.99(1)(e), a personal digital device examination must only be initiated if there are reasonable grounds to suspect that specific CBSA program legislation has been or might be contravened in respect to digital goods (contents) on the device itself (e.g., videos or images of suspected child pornography, hate propaganda etc.). Section 99(1)(e) does not, for example, authorize officers to look for evidence that other accompanying physical goods have been imported in contravention of CBSA program legislation (e.g., a receipt proving undervaluation or indicating undeclared goods).

The Operational Bulletin advised BSOs that this higher standard would likely mean the traveller would be considered “detained”, triggering their rights under section 10 of the Charter:

Arrest or detention

10  Everyone has the right on arrest or detention

(a) to be informed promptly of the reasons therefor;

(b) to retain and instruct counsel without delay and to be informed of that right; and

(c) to have the validity of the detention determined by way of habeas corpus and to be released if the detention is not lawful.

The Operational Bulletin states that BSOs must grant travellers their Charter rights before requesting the password for an electronic device by informing them of the reason for their detention and their right to counsel:

The facts on which an officer will be relying to conclude that they have authority to examine personal digital devices under 99{1)(e) likely mean that the traveller would be considered detained under the charter [sic]. Officers in Alberta and Ontario relying on 99(1)(e) to conduct personal digital device exams should afford section 10 Charter rights prior to asking for access to the device (eg. access codes) and initiating the exam.

When conducting a Charter detention of the traveller, please adjust the Customs Act contravention detention statement from the Officer Reference Booklet as follows: “I am detaining you on suspicion that your goods fail to comply with Customs Tariff item 9899 and that you are attempting to import prohibited goods into Canada.” When detaining a traveller officers must also read the traveller their rights and caution as set out in the Officer Reference Booklet.

Operational Bulletin OBO-2022-027 was meant to be a stopgap measure until new legislation went into effect setting a new standard for searches of electronic devices. This was expected to happen when Bill S-7 became law (PDF p 150):

Officers conducting personal digital device examinations in Alberta and Ontario must now rely on the authorities under s.99(1)(e) of the Customs Act. Section 99(1)(e) must be used in the interim until legislative amendments are finalized.

However, the expected legislation did not become law, so to the best of our knowledge the Operational Bulletin is still in effect, and ports in Alberta and Ontario still have higher standards for searches of electronic devices than the rest of the country.

Search procedure

Procedure flowchart

The ATIP documents include a flowchart setting out the process for “Conducting a digital device examination” (PDF p 119). The flowchart begins with a BSO interviewing the traveller and goes through to potentially examining the device, detaining or seizing the device, or returning the device to the traveller.

Specific files or applications

When BSOs determine a preliminary search is necessary, they should limit the scope by asking to see the “areas” of the device they believe are relevant to the indicators or concerns that gave rise to the search (Policy, PDF p 110).

Software tools

We know that prior to 2018, CBSA used third party software such as ICWhatUC and Field Search to search travellers’ electronic devices. This policy was changed sometime prior to February 2021, when CBSA issued an Operational Bulletin reminding that these software packages were no longer allowed to be used at ports of entry, and all copies of the software should be destroyed or delivered to the Digital Forensics Investigator (OBO-2021-007, PDF p 140).

Copying information

CBSA policy states that officers should not copy anything from travellers’ devices unless authorized by “CBSA program legislation”, including the Customs Act or IRPA (Policy, PDF p 111).

During an initial search by a BSO, “copying” is done with a CBSA-issued camera, and officers are instructed not to record “contacts, phone numbers, names, dates of birth or other information” from digital devices into their own notebooks without a specific need under CBSA program legislation (Policy, PDF p 111).

Presumably CBSA Digital Forensics Officers have more sophisticated tools than a CBSA-issued camera to record information from travellers’ devices, but that information was withheld from the ATIP response.

Intimate images

CBSA acknowledges that travellers’ devices often contain sensitive information, including “intimate images” of the traveller or others. If a traveller raises a concern about intimate images on their digital device, the BSO should “ask the traveller if there is a way to reasonably circumvent the viewing of those images” (Policy, PDF p 112).

Further details on handling intimate images appear to be redacted.

Solicitor-client privilege or judicial information

If a traveller flags information on an electronic device as being subject to solicitor-client privilege or containing judicial information, officers are instructed to bring the circumstances to their supervisor for further instructions. If the device cannot be released, officers must “seal the device in a package marked with the assumption they are privileged, and set the device aside for review by a court or analogous independent review body for confirmation of privilege” (Policy, PDF p 113-4).

Evidence of a crime

A section detailing what to do if the officer encounters evidence of a crime is entirely redacted except to note that the examination may alter digital evidence (Policy, p 114-5).

Reporting searches

CBSA now records the number of searches of digital devices, listing date, number of examinations, and the port of entry (Policy, PDF p 112). Full details of the search must be recorded in officers’ notebooks.

Information sharing

CBSA policy on when and how information collected from travellers’ electronic devices may be shared with other agencies was not provided in detail. However, the documents reference two other policies: Policy on the Disclosure of Customs Information: Section 107 of the Customs Act and Policy on the Disclosure of Personal Information: Section 8 of the Privacv Act (Policy, PDF p 117-8)

Search statistics

CBSA provided statistics on the number of searches both before and after implementing OBO-2022-027 in April 2022 (PDF pp 157 and 161). They included what they call a “resultant search rate”, or “an examination where a customs- or immigration- related contravention or offence has been uncovered” under the Customs Act or IRPA (PDF p 161).

Using these statistics, we calculated the non-resultant search rate — the percentage of people subjected to a search by CBSA that did not find a violation of law. Before the more rigorous standards were adopted in 2022, CBSA at ports in Alberta had a non-resultant search rate of 76.9% and Ontario 78.1%, meaning that for over 3/4 of the travellers whose electronic devices were searched, CBSA did not find violations of the Customs Act or IRPA:

February 1, 2020-April 28, 2022

After the new standards came into effect, the resultant search rate was still under 50%, but was improved, suggesting that CBSA took greater care in targeting travellers for searches because of the increased standards.

April 29, 2022-April 30, 2024

National totals

Original Request

The original ATIP request was for:

All records from 2020 to the present relating to the search or seizure of electronic devices, including but not limited to smartphones, computers, tablets, and storage media. This includes, without limitation:

Policies and Procedures

• Policies, procedures, guidelines, and criteria governing the targeting, authorization, or conduct of searches or seizures of electronic devices.
• Policies and procedures regarding requests for passwords, passphrases, biometrics, or other access credentials from device owners or users, including procedures for addressing refusals.
• Policies governing the retention, return, or disposal of seized electronic devices.
• Policies governing the retention, use, deletion, or sharing—with other agencies or governments—of data copied or extracted from electronic devices.
• Policies and procedures relating to access to data stored on cloud services through applications or logged-in accounts on electronic devices during or after a search or seizure.

Tools and Technical Capabilities

• Records describing or relating to software or hardware tools used to conduct searches or seizures of electronic devices, including tools used to bypass encryption, biometrics, passwords, passphrases, or other security measures.
• For each such tool, any manuals, technical documentation, training materials, promotional materials, contracts, purchase orders, or other records.

Privacy and Oversight

• Privacy Impact Assessments or similar assessments, reviews, or reports relating to:

  • The search or seizure of electronic devices.
  • Requests for passwords, passphrases, biometrics, or other access credentials.
  • Access to cloud data through electronic devices.
  • The retention, use, or sharing of device data.

Statistics

• Statistical records, reports, or summaries showing:

  • The number of times access credentials, including passwords, passphrases, or biometrics, were requested from device owners or users.
  • The number of times such requests were refused.
  • The number of times hardware or software tools were used to facilitate searches or seizures of electronic devices or the data stored on them.