What must a lawyer do to protect client confidences when crossing the U.S. border with a laptop or phone?

Plain-English summary

The opinion analyzes a lawyer's ethical duties at three points around a U.S. border crossing when an electronic device (phone, laptop, hard drive, USB drive) holds confidential client information and a Customs and Border Protection agent, claiming lawful authority, demands access. The committee grounds the analysis in Rule 1.6 (confidentiality), including Rule 1.6(c)'s requirement to make reasonable efforts to prevent unauthorized access, and in the Rule 1.1 duty of competence.

Before crossing, Rules 1.1 and 1.6(c) require reasonable measures to avoid disclosure. The opinion stresses that "reasonableness" is fact-dependent and does not impose a fixed list of mandatory safeguards; Comment [16] to Rule 1.6 supplies factors (sensitivity of the information, likelihood of disclosure, cost and difficulty of safeguards, and the effect on the lawyer's ability to represent clients). The committee identifies measures that may satisfy the duty, such as not carrying confidential information across the border at all, using a "burner" device, removing or securely deleting files, signing out of cloud services, or using secure remote access and encryption. It notes that a lawyer should not carry confidential information except where there is a professional need, and should not carry highly sensitive information except where the need is compelling.

At the border, the committee concludes that Rule 1.6(b)(6) (disclosure to comply with other law or court order) can permit compliance with a border agent's lawful-authority demand, but only to the extent "reasonably necessary." That means the lawyer must first make reasonable efforts to prevent disclosure: informing the agent that the device or files contain privileged or confidential materials, requesting that they not be searched or copied, asking to speak to a superior officer, and carrying attorney identification to support the privilege claim. The opinion observes that it would be an unreasonable burden to require a lawyer to forgo reentry or be taken into custody to litigate the lawfulness of a search, so a lawyer who has made reasonable efforts may ultimately comply. Finally, if confidential information is disclosed during a search, Rule 1.4 requires the lawyer to inform affected clients of what occurred and the extent of the exposure.

In practice

Under this opinion, the duty to protect client confidences at the border is framed as a "reasonable efforts" standard rather than a checklist. The opinion holds that, under the New York rules as they stood at the time, a lawyer must evaluate the risk of carrying confidential information across the border and consider what safeguards to use, with the necessary precautions scaling to the sensitivity of the information and the likelihood of a search. At the border, the opinion holds that compliance with an agent's demand is permissible under Rule 1.6(b)(6) only after the lawyer takes reasonable steps to assert privilege and narrow the search, for example by notifying the agent of privileged contents and asking to speak to a supervisor. The opinion also holds that disclosure triggers a Rule 1.4 duty to notify the affected clients afterward.

Common questions

Q: Do I have to wipe my phone before flying back into the United States?

A: Not necessarily. The opinion sets a reasonableness standard, not a fixed rule. It identifies options ranging from carrying no confidential data or using a burner device to securely deleting files, signing out of cloud services, and using encryption or secure remote access. What is "reasonable" depends on the sensitivity of the information, the risk of a search, and the cost and difficulty of safeguards.

Q: Can I refuse a border agent's demand to unlock my device because it holds privileged material?

A: The opinion says Rule 1.6(b)(6) can permit compliance with a lawful-authority demand, but only after reasonable efforts to prevent or limit disclosure: telling the agent the materials are privileged or confidential, asking that they not be searched or copied, and requesting a superior officer. It concludes a lawyer who has made those efforts may ultimately comply rather than forgo reentry or face custody.

Q: What should I bring to support a privilege claim at the border?

A: The opinion suggests carrying attorney identification (such as a court-issued ID or at least a business card) and being familiar with, and possibly carrying, the relevant customs agency's policies on searches of privileged information.

Q: If my device is searched or seized, do I have to tell my clients?

A: Yes. The opinion holds that under Rule 1.4 the lawyer must notify affected clients of the search or seizure and the extent to which their confidential information may have been reviewed or seized, so they can decide how to respond.

Background and rules framework

The opinion interprets New York Rule of Professional Conduct 1.6 (confidentiality of information; Model Rule 1.6), including Rule 1.6(c)'s reasonable-efforts duty (added January 1, 2017) and the Rule 1.6(b)(6) exception for disclosure to comply with other law or a court order. It reads those duties together with Rule 1.1 (competence; Model Rule 1.1) and Rule 1.4 (communication; Model Rule 1.4). The committee draws on ABA Formal Ops. 477R, 11-459, and 99-413 and several NYSBA opinions for the proposition that the duty of competence includes taking reasonable protective measures for electronically stored and transmitted client information.

Citations and references

Rules of Professional Conduct:

• Model Rule 1.6 / NY RPC 1.6 (confidentiality; reasonable efforts under 1.6(c); 1.6(b)(6) other-law exception)
• Model Rule 1.1 / NY RPC 1.1 (competence)
• Model Rule 1.4 / NY RPC 1.4 (communication)

Cases:

• Riley v. California, 134 S. Ct. 2473 (2014), scope of information stored on and accessible via cell phones
• United States v. Cotterman, 709 F.3d 952 (9th Cir. 2013), reasonable suspicion for forensic border searches
• Abidor v. Napolitano, No. 10-cv-04059 (E.D.N.Y. 2013), challenge to border detention of devices

Other opinions cited:

• ABA Formal Op. 477R (2017): securing communication of protected client information
• ABA Formal Op. 11-459 (2011): duty to protect confidentiality of electronic communications
• NYSBA Ethics Op. 842 (2010): reasonable care for online storage of client data
• NYCBA Formal Op. 2017-2 (2017): unauthorized disclosure of client confidences

See also

• ABA Formal Op. 477R: Securing the communication of client information
• NYC Bar Ethics Op. 2024-3: Ethical obligations after a cybersecurity incident
• NYC Bar Ethics Op. 2019-3: Use of inadvertently transmitted information
• ABA Formal Op. 482: Ethical obligations related to disasters

Source

• Landing page: https://www.nycbar.org/reports/formal-opinion-2017-5-an-attorneys-ethical-duties-regarding-u-s-border-searches-of-electronic-devices-containing-clients-confidential-information/
• Original PDF: https://www.nycbar.org/wp-content/uploads/2023/05/2017-5_Border_Search_Opinion_PROETHICS_7.24.17.pdf