UNITED STATES of America, Plaintiff-Appellant, v. Howard Wesley COTTERMAN, Defendant-Appellee, 709 F.3d 952

Opinion by Judge McKEOWN; Partial Concurrence and Partial Dissent by Judge CALLAHAN; Dissent by Judge MILAN D. SMITH, JR. OPINION McKEOWN, Circuit Judge: Every day more than a million people cross American borders, from the physical borders with Mexico and Canada to functional borders at airports such as Los Angeles (LAX), Honolulu (HNL), New York (JFK, LGA), and Chicago (ORD, MDW). As denizens of a digital world, they carry with them laptop computers, iPhones, iPads, iPods, Kindles, Nooks, Surfaces, tablets, Blackberries, cell phones, digital cameras, and more.

These devices often contain private and sensitive information ranging from personal, financial, and medical data to corporate trade secrets. And, in the case of Howard Cotterman, child pornography. Agents seized Cotterman’s laptop at the U.S.-Mexico border in response to an alert based in part on a fifteen-year-old conviction for child molestation. The initial search at the border turned up no incriminating material. Only after Cotterman’s laptop was shipped almost 170 miles away and subjected to a comprehensive forensic examination were images of child pornography discovered.

This watershed case implicates both the scope of the narrow border search exception to the Fourth Amendment’s warrant requirement and privacy rights in commonly used electronic devices. The question we confront “is what limits there are upon this power of technology to shrink the realm of guaranteed privacy.” Kyllo v. United States, 533 U.S. 27, 34, 121 S.Ct. 2038, 150 L.Ed.2d 94 (2001). More specifically, we consider the reasonableness of a computer search that began as a cursory review at the border but transformed into a forensic examination of Cottermaris hard drive.

Computer forensic examination is a powerful tool capable of unlocking password-protected files, restoring deleted material, and retrieving images viewed on web sites. But while technology may have changed the expectation of privacy to some degree, it has not eviscerated it, and certainly not with respect to the gigabytes of data regularly maintained as private and confidential on digital devices. Our Founders were indeed prescient in specifically incorporating “papers” within the Fourth Amendment’s guarantee of “[t]he right of the people to be secure in their persons, houses, papers, and effects.” U.S.

Const, amend. IV. The papers we create and maintain not only in physical but also in digital form reflect our most private thoughts and activities. Although courts have long recognized that border searches constitute a “historically recognized exception to the Fourth Amendment’s general principle that a warrant be obtained,” United States v. Ramsey, 431 U.S. 606, 621, 97 S.Ct. 1972, 52 L.Ed.2d 617 (1977), reasonableness remains the touchstone for a warrant-less search. Even at the border, we have rejected an “anything goes” approach. See United States v. Seljan, 547 F.3d 993, 1000 (9th Cir.2008) (en banc).

Mindful of the heavy burden on law enforcement to protect our borders juxtaposed with individual privacy interests in data on portable digital devices, we conclude that, under the circumstances here, reasonable suspicion was required for the forensic examination of Cottermaris laptop. Because border agents had such a reasonable suspicion, we reverse the district court’s order granting Cottermaris motion to suppress the evidence of child pornography obtained from his laptop. I.

Factual Background and Procedural History Howard Cotterman and his wife were driving home to the United States from a vacation in Mexico on Friday morning, April 6, 2007, when they reached the Lukeville, Arizona, Port of Entry. During primary inspection by a border agent, the Treasury Enforcement Communication System (“TECS”) returned a hit for Cotterman.

The TECS hit indicated that Cotterman was a sex offender — he had a 1992 conviction for two counts of use of a minor in sexual conduct, two counts of lewd and lascivious conduct upon a child, and three counts of child molestation — and that he was potentially involved in child sex tourism. Because of the hit, Cotterman and his wife were referred to secondary inspection, where they were instructed to exit their vehicle and leave all their belongings in the car.

The border agents called the contact person listed in the TECS entry and, following that conversation, believed the hit to reflect Cottermaris involvement “in some type of child pornography.” The agents searched the vehicle and retrieved two laptop computers and three digital cameras. Officer Antonio Alvarado inspected the electronic devices and found what appeared to be family and other personal photos, along with several password-protected files.

Border agents contacted Group Supervisor Craig Brisbine at the Immigration and Customs Enforcement (“ICE”) office in Sells, Arizona, and informed him about Cotterman’s entry and the fact that he was a sex offender potentially involved in child sex tourism. The Sells Duty Agent, Mina Riley, also spoke with Officer Alvarado and then contacted the ICE Pacific Field Intelligence Unit, the office listed on the TECS hit, to get more information.

That unit informed Riley that the alert was part of Operation Angel Watch, which was aimed at combating child sex tourism by identifying registered sex offenders in California, particularly those who travel frequently outside the United States. She was advised to review any media equipment, such as computers, cameras, or other electronic devices, for potential evidence of child pornography. Riley then spoke again to Alvarado, who told her that he had been able to review some of the photographs on the Cottermans’ computers but had encountered password-protected files that he was unable to access.

Agents Brisbine and Riley departed Sells for Lukeville at about 1:30 p.m. and decided en route to detain the Cottermans’ laptops for forensic examination. Upon their arrival, they gave Cotterman and his wife Miranda warnings and interviewed them separately. The interviews revealed nothing incriminating. During the interview, Cotterman offered to help the agents access his computer.

The agents declined the offer out of concern that Cotterman might be able to delete files surreptitiously or that the laptop might be “booby trapped.” The agents allowed the Cottermans to leave the border crossing around 6 p.m., but retained the Cottermans’ laptops and a digital camera. Agent Brisbine drove almost 170 miles from Lukeville to the ICE office in Tucson, Arizona, where he delivered both laptops and one of the three digital cameras to ICE Senior Special Agent & Computer Forensic Examiner John Owen. Agent Owen began his examination on Saturday, the following day.

He used a forensic program to copy the hard drives of the electronic devices. He determined that the digital camera did not contain any contraband and released the camera that day to the Cottermans, who had traveled to Tucson from Lukeville and planned to stay there a few days. Agent Owen then used forensic software that often must run for several hours to examine copies of the laptop hard drives. He began his personal examination of the laptops on Sunday. That evening, Agent Owen found seventy-five images of child pornography within the unallocated space of Cotterman’s laptop.

Agent Owen contacted the Cottermans on Sunday evening and told them he would need Howard Cotterman’s assistance to access password-protected files he found on Cotterman’s laptop. Cotterman agreed to provide the assistance the following day, but never showed up. When Agent Brisbine called again to request Cotterman’s help in accessing the password-protected files, Cotterman responded that the computer had multiple users and that he would need to check with individuals at the company from which he had retired in order to get the passwords.

The agents had no further contact with Cotterman, who boarded a flight to Mexico from Tucson the next day, April 9, and then flew onward to Sydney, Australia. On April 11, Agent Owen finally managed to open twenty-three password-protected files on Cotterman’s laptop. The files revealed approximately 378 images of child pornography. The vast majority of the images were of the same girl, approximately 7-10 years of age, taken over a two-to three-year period. In many of the images, Cotterman was sexually molesting the child.

Over the next few months, Agent Owen discovered hundreds more pornographic images, stories, and videos depicting children. A grand jury indicted Cotterman for a host of offenses related to child pornography. Cotterman moved to suppress the evidence gathered from his laptop and the fruits of that evidence. The magistrate judge filed a Report and Recommendation finding that the forensic examination was an “extended border search” that required reasonable suspicion.

He found that the TECS hit and the existence of password-protected files on Cotterman’s laptop were suspicious, but concluded that those facts did not suffice to give rise to reasonable suspicion of criminal activity. The district judge adopted the Report and Recommendation and granted Cotterman’s motion to suppress.

In its interlocutory appeal of that order, the government characterized the issue as follows: “Whether the authority to search a laptop computer without reasonable suspicion at a border point of entry permits law enforcement to take it to another location to be forensically examined, when it has remained in the continuous custody of the government.” A divided panel of this court answered that question in the affirmative and reversed. United States v. Cotterman, 637 F.3d 1068 (9th Cir.2011).

The panel concluded that reasonable suspicion was not required for the search and that “[t]he district court erred in suppressing the evidence lawfully obtained under border search authority.” Id. at 1084. In dissent, Judge Betty B. Fletcher wrote that “officers must have some level of particularized suspicion in order to conduct a seizure and search like the one at issue here.” Id. (B. Fletcher, J., dissenting). By a vote of a majority of nonrecused active judges, rehearing en banc was ordered. 673 F.3d 1206 (9th Cir.2012).

Following en banc oral argument, we requested supplemental briefing on the issue of whether reasonable suspicion existed at the time of the search. II. Waiver The government argued below that the forensic examination was part of a routine border search not requiring heightened suspicion and, alternatively, that reasonable suspicion justified the search.

Before the district court, the government maintained “the facts of this case clearly establish that there was reasonable suspicion.” However, having failed to obtain a favorable ruling on that ground, the government did not challenge on appeal the conclusion that there was no reasonable suspicion. Rather, it sought a broad ruling that no suspicion of any kind was required. Cotterman thus argued in his answering brief that the government had waived the issue — an assertion that the government did not address in its reply brief.

Cotterman contends that the government has abandoned and conceded the issue of reasonable suspicion and that this court may not address that issue. We disagree. We review de novo the ultimate question of whether a warrantless search was reasonable under the Fourth Amendment. United States v. Johnson, 256 F.3d 895, 905 (9th Cir.2001) (en banc). Our review necessarily encompasses a determination as to the applicable standard: no suspicion, reasonable suspicion or probable cause.

That the government may hope for the lowest standard does not alter our de novo review, particularly when the issue was fully briefed and argued below. Further, we may consider an issue that has not been adequately raised on appeal if such a failure will not prejudice the opposing party. United States v. Ullah, 976 F.2d 509, 514 (9th Cir.1992). Where, as here, we “called for and received supplemental briefs by both parties,” Alcaraz v. INS, 384 F.3d 1150, 1161 (9th Cir.2004), the government’s failure to address the issue does not prejudice Cotterman. See also United States v.

Resendiz-Ponce, 549 U.S. 102, 103-04, 127 S.Ct. 782, 166 L.Ed.2d 591 (2007). III. The Border Search The broad contours of the scope of searches at our international borders are rooted in “the long-standing right of the sovereign to protect itself by stopping and examining persons and property crossing into this country.” Ramsey, 431 U.S. at 616, 97 S.Ct. 1972. Thus, border searches form “a narrow exception to the Fourth Amendment prohibition against warrantless searches without probable cause.” Seljan, 547 F.3d at 999 (internal quotation marks and citation omitted).

Because “[t]he Government’s interest in preventing the entry of unwanted persons and effects is at its zenith at the international border,” United States v. Flores-Montano, 541 U.S. 149, 152, 124 S.Ct. 1582, 158 L.Ed.2d 311 (2004), border searches are generally deemed “reasonable simply by virtue of the fact that they occur at the border.” Ramsey, 431 U.S. at 616, 97 S.Ct. 1972. This does not mean, however, that at the border “anything goes.” Sel-jan, 547 F.3d at 1000. Even at the border, individual privacy rights are not abandoned but “[bjalanced against the sovereign’s interests.” United States v.

Montoya de Hernandez, 473 U.S. 531, 539, 105 S.Ct. 3304, 87 L.Ed.2d 381 (1985). That balance “is qualitatively different ... than in the interior” and is “sti'uck much more favorably to the Government.” Id. at 538, 540, 105 S.Ct. 3304. Nonetheless, the touchstone of the Fourth Amendment analysis remains reasonableness. Id. at 538, 105 S.Ct. 3304. The reasonableness of a search or seizure depends on the totality of the circumstances, including the scope and duration of the deprivation. See United States v. Jacobsen, 466 U.S. 109, 124, 104 S.Ct. 1652, 80 L.Ed.2d 85 (1984); see also United States v.

Duncan, 693 F.2d 971, 977 (9th Cir.1982). In view of these principles, the legitimacy of the initial search of Cotterman’s electronic devices at the border is not in doubt. Officer Alvarado turned on the devices and opened and viewed image files while the Cottermans waited to enter the country. It was, in principle, akin to the search in Seljan, where we concluded that a suspicionless cursory scan of a package in international transit was not unreasonable. 547 F.3d at 1004. Similarly, we have approved a quick look and unintrusive search of laptops. United States v.

Arnold, 533 F.3d 1003, 1009 (9th Cir.2008) (holding border search reasonable where “CBP officers simply ‘had [traveler] boot [the laptop] up, and looked at what [he] had inside.’ ”) (second alteration in original). Had the search of Cotterman’s laptop ended with Officer Alvarado, we would be inclined to conclude it was reasonable even without particularized suspicion. See id. But the search here transformed into something far different. The difficult question we confront is the reasonableness, without a warrant, of the forensic examination that comprehensively analyzed the hard drive of the computer. A.

The Forensic Examination Was Not An Extended Border Search Cotterman urges us to treat the examination as an extended border search that requires particularized suspicion. Although the semantic moniker “extended border search” may at first blush seem applicable here, our jurisprudence does not support such a claim. We have “define[d] an extended border search as any search away from the border where entry is not apparent, but where the dual requirements of reasonable certainty of a recent border crossing and reasonable suspicion of criminal activity are satisfied.” United States v.

Guzman-Padilla, 573 F.3d 865, 878-79 (9th Cir.2009) (internal quotation marks and citations omitted). The key feature of an extended border search is that an individual can be assumed to have cleared the border and thus regained an expectation of privacy in accompanying belongings. See-United States v.

Abbouchi, 502 F.3d 850, 855 (9th Cir.2007) (“Because the delayed nature of an extended border search ... necessarily entails a greater level of intrusion on legitimate expectations of privacy than an ordinary border search, the government must justify an extended border search with reasonable suspicion that the search may uncover contraband or evidence of criminal activity.”) (internal quotation marks omitted) (emphasis added). Cotterman’s case is different. Cotter-man was stopped and searched at the border.

Although he was allowed to depart the border inspection station after the initial search, some of his belongings, including his laptop, were not. The follow-on forensic examination was not an “extended border search.” A border search of a computer is not transformed into an extended border search simply because the device is transported and examined beyond the border. To be sure, our case law has not always articulated the “extended border search” doctrine with optimal clarity.

But the confusion has come in distinguishing between facts describing a functional border search and those describing an extended border search, not in defining the standard for a search at the border. See, e.g., United States v. Cardona, 769 F.2d 625, 628 (9th Cir.1985) (“We have recently recognized the difficulty of making sharp distinctions between searches at the functional equivalent of the border and extended border searches.”). The “functional equivalent” doctrine effectively extends the border search doctrine to all ports of entry, including airports. See Almeida-Sanchez v.

United States, 413 U.S. 266, 273, 93 S.Ct. 2535, 37 L.Ed.2d 596 (1973). A routine customs search at the “functional equivalent” of the border is “analyzed as a border search” and requires neither probable cause nor reasonable suspicion. Seljan, 547 F.3d at 999. This case involves a search initiated at the actual border and does not encounter any of the difficulties surrounding identification of a “functional” border.

As to the extended border search doctrine, we believe it is best confined to cases in which, after an apparent border crossing or functional entry, an attenuation in the time or the location of conducting a search reflects that the subject has regained an expectation of privacy. In his dissent, Judge Smith advocates applying the extended border search doctrine because the forensic examination occurred 170 miles from the border and days after Cotterman’s entry.

Moving the laptop to a specialized lab at a distant location might highlight that the search undertaken there was an extensive one, but it is not the dispositive factor here. Because Cotterman never regained possession of his laptop, the fact that the forensic examination occurred away from the border, in Tucson, did not heighten the interference with his privacy. Time and distance become relevant to determining whether there is an adequate nexus to a recent border crossing only after the subject or items searched have entered.

See Villasenor, 608 F.3d at 471 (explaining that reasonableness of extended border search depends on “whether the totality of the surrounding circumstances, including the time and distance elapsed” establish that items to be searched have recently entered the country) (internal quotation marks omitted). Cotterman’s computer never cleared customs so entry was never effected. In short, the extended border search doctrine does not fit the search here. B.

Forensic Examination At The Border Requires Reasonable Suspicion It is the comprehensive and intrusive nature of a forensic examination — not the location of the examination — that is the key factor triggering the requirement of reasonable suspicion here. See Cotterman, 637 F.3d at 1086-87 n. 6 (B. Fletcher, J., dissenting) (recognizing that “[a] computer search in a forensic lab will always be equivalent to an identical search at the border. The duration of a computer search is not controlled by where the search is conducted.

The duration of a computer search is controlled by what one is looking for and how one goes about searching for it.”) (emphasis in original). The search would have been every bit as intrusive had Agent Owen traveled to the border with his forensic equipment. Indeed, Agent Owen had a laptop with forensic software that he could have used to conduct an examination at the port of entry itself, although he testified it would have been a more time-consuming effort.

To carry out the examination of Cotter-man’s laptop, Agent Owen used computer forensic software to copy the hard drive and then analyze it in its entirety, including data that ostensibly had been deleted. This painstaking analysis is akin to reading a diary line by line looking for mention of criminal activity — plus looking at everything the writer may have erased. Notwithstanding a traveler’s diminished expectation of privacy at the border, the search is still measured against the Fourth Amendment’s reasonableness requirement, which considers the nature and scope of the search.

Significantly, the Supreme Court has recognized that the “dignity and privacy interests of the person being searched” at the border will on occasion demand “some level of suspicion in the case of highly intrusive searches of the person.” Flores-Montano, 541 U.S. at 152, 124 S.Ct. 1582. Likewise, the Court has explained that “some searches of property are so destructive,” “particularly offensive,” or overly intrusive in the manner in which they are carried out as to require particularized suspicion. Id. at 152, 154 n. 2, 155-56, 124 S.Ct. 1582; Montoya de Hernandez, 473 U.S. at 541, 105 S.Ct. 3304.

The Court has never defined the precise dimensions of a reasonable border search, instead pointing to the necessity of a case-by-case analysis. As we have emphasized, “[r]easonableness, when used in the context of a border search, is incapable of comprehensive definition or of mechanical application.” Duncan, 693 F.2d at 977 (internal quotation marks and citation omitted).

Over the past 30-plus years, the Supreme Court has dealt with a handful of border cases in which it reaffirmed the border search exception while, at the same time, leaving open the question of when a “particularly offensive” search might fail the reasonableness test. The trail begins with United States v. Ramsey, where the Court reserved judgment on this question: “We do not decide whether, and under what circumstances, a border search might be deemed ‘unreasonable’ because of the particularly offensive manner in which it is carried out.” 431 U.S. at 618 n. 13, 97 S.Ct. 1972.

Of note, the Court cited two cases, albeit non-border cases, as examples: Kremen v. United States, 353 U.S. 346, 347-48, 77 S.Ct. 828, 1 L.Ed.2d 876 (1957) (holding unconstitutional an exhaustive warrantless search of a cabin and seizure of its entire contents that were moved 200 miles away for examination) and Go-Bart Importing Co. v. United States, 282 U.S. 344, 358, 51 S.Ct. 153, 75 L.Ed. 374 (1931) (condemning as “lawless invasion of the premises and a general exploratory search” a warrantless “unlimited search, ransacking the desk, safe, filing cases and other parts of [an] office”).

Less than ten years later, in 1985, the Court observed that it had “not previously decided what level of suspicion would justify a seizure of an incoming traveler for purposes other than a routine border search” and then went on to hold in the context of an alimentary canal search that reasonable suspicion was required for “the detention of a traveler at the border, beyond the scope of a routine customs search and inspection.” Montoya de Hernandez, 473 U.S. at 540-41, 105 S.Ct. 3304.

The Court’s reference to “routine border search” was parsed in a later case, FloresMontano, where the Court explained that “the reasons that might support a requirement of some level of suspicion in the case of highly intrusive searches of the person — dignity and privacy interests of the person being searched — simply do not carry over to vehicles,” and, more specifically, to the gas tank of a car. 541 U.S. at 152, 124 S.Ct. 1582. Accordingly, the Court rejected a privacy claim vis-a-vis an automobile gas tank. We are now presented with a case directly implicating substantial personal privacy interests.

The private information individuals store on digital devices — their personal “papers” in the words of the Constitution — stands in stark contrast to the generic and impersonal contents of a gas tank. See, e.g., United States v. Jones, — U.S. -, 132 S.Ct. 945, 957, 181 L.Ed.2d 911 (2012) (Sotomayor, J., concurring) (expressing “doubt that people would accept without complaint the warrantless disclosure to the Government of a list of every Web site they had visited in the last week, or month, or year”).

We rest our analysis on the reasonableness of this search, paying particular heed to the nature of the electronic devices and the attendant expectation of privacy. The amount of private information carried by international travelers was traditionally circumscribed by the size of the traveler’s luggage or automobile. That is no longer the case. Electronic devices are capable of storing warehouses full of information. The average 400-gigabyte laptop hard drive can store over 200 million pages — the equivalent of five floors of a typical academic library. See Orín S.

Kerr, Searches and Seizures in a Digital World, 119 Harv. L.Rev. 531, 542 (2005) (explaining that an 80 GB hard drive is equivalent to 40 million pages or one floor of an academic library); see also Lexis-Nexis, How Many Pages in a Gigabyte?, http://www.lexisnexis.com/applied discoveryflawhbrary/whitePapers/ADI_ FS_PagesInAGigabyte.pdf. Even a car full of packed suitcases with sensitive documents cannot hold a candle to the sheer, and ever-increasing, capacity of digital storage. The nature of the contents of electronic devices differs from that of luggage as well.

Laptop computers, iPads and the like are simultaneously offices and personal diaries. They contain the most intimate details of our lives: financial records, confidential business documents, medical records and private emails. This type of material implicates the Fourth Amendment’s specific guarantee of the people’s right to be secure in their “papers.” U.S. Const, amend. IV.

The express listing of papers “reflects the Founders’ deep concern with safeguarding the privacy of thoughts and ideas — what we might call freedom of conscience — from invasion by the government.” Seljan, 547 F.3d at 1014 (Kozinski, C.J., dissenting); see also New York v. P.J. Video, Inc., 475 U.S. 868, 873, 106 S.Ct. 1610, 89 L.Ed.2d 871 (1986). These records are expected to be kept private and this expectation is “one that society is prepared to recognize as ‘reasonable.’ ” Katz v. United States, 389 U.S. 347, 361, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967) (Harlan, J., concurring).

Electronic devices often retain sensitive and confidential information far beyond the perceived point of erasure, notably in the form of browsing histories and records of deleted files. This quality makes it impractical, if not impossible, for individuals to make meaningful decisions regarding what digital content to expose to the scrutiny that accompanies international travel. A person’s digital life ought not be hijacked simply by crossing a border. When packing traditional luggage, one is accustomed to deciding what papers to take and what to leave behind.

When carrying a laptop, tablet or other device, however, removing files unnecessary to an impending trip is an impractical solution given the volume and often intermingled nature of the files. It is also a time-consuming task that may not even effectively erase the files. The present case illustrates this unique aspect of electronic data. Agents found incriminating files in the unallocated space of Cotterman’s laptop, the space where the computer stores files that the user ostensibly deleted and maintains other “deleted” files retrieved from web sites the user has visited.

Notwithstanding the attempted erasure of material or the transient nature of a visit to a web site, computer forensic examination was able to restore the files. It is as if a search of a person’s suitcase could reveal not only what the bag contained on the current trip, but everything it had ever carried. With the ubiquity of cloud computing, the government’s reach into private data becomes even more problematic. In the “cloud,” a user’s data, including the same kind of highly sensitive data one would have in “papers” at home, is held on remote servers rather than on the device itself.

The digital device is a conduit to retrieving information from the cloud, akin to the key to a safe deposit box. Notably, although the virtual “safe deposit box” does not itself cross the border, it may appear as a seamless part of the digital device when presented at the border. With access to the cloud through forensic examination, a traveler’s cache is just a click away from the government.

As Justice Scalia wrote, “It would be foolish to contend that the degree of privacy secured to citizens by the Fourth Amendment has been entirely unaffected by the advance of technology.” Kyllo, 533 U.S. at 33-34, 121 S.Ct. 2038. Technology has the dual and conflicting capability to decrease privacy and augment the expectation of privacy. While the thermal imaging device in Kyllo threatened to expose the hour at which “the lady of the house” took her daily “sauna and bath,” id. at 38, 121 S.Ct. 2038, digital devices allow us to carry the very papers we once stored at home. The point is technology matters.

The Department of Homeland Security has acknowledged as much in the context of international travelers: Where someone may not feel that the inspection of a briefcase would raise significant privacy concerns because the volume of information to be searched is not great, that same person may feel that a search of their laptop increases the possibility of privacy risks due to the vast amount of information potentially available on electronic devices.

DHS, Privacy Impact Assessment for the Border Searches of Electronic Devices 2 (Aug. 25, 2009), available at http://www. dhs.gov/xhbrary/assets/privacy/privacy_ pia_cbp_Laptop.pdf. This is not to say that simply because electronic devices house sensitive, private information they are off limits at the border. The relevant inquiry, as always, is one of reasonableness. But that reasonableness determination must account for differences in property. See Samson v.

California, 547 U.S. 843, 848, 126 S.Ct. 2193, 165 L.Ed.2d 250 (2006) (“Under our general Fourth Amendment approach, we examine the totality of the circumstances to determine whether a search is reasonable_”) (internal quotation marks, citation, and alterations omitted) (emphasis added). Unlike searches involving a reassembled gas tank, FloresMontano, 541 U.S. at 150, 124 S.Ct. 1582, or small hole in the bed of a pickup truck, United States v.

Chaudhry, 424 F.3d 1051, 1054 (9th Cir.2005), which have minimal or no impact beyond the search itself — and little implication for an individual’s dignity and privacy interests — the exposure of confidential and personal information has permanence. It cannot be undone. Accordingly, the uniquely sensitive nature of data on electronic devices carries with it a significant expectation of privacy and thus renders an exhaustive exploratory search more intrusive than with other forms of property.

After their initial search at the border, customs agents made copies of the hard drives and performed forensic evaluations of the computers that took days to turn up contraband. It was essentially a computer strip search. An exhaustive forensic search of a copied laptop hard drive intrudes upon privacy and dignity interests to a far greater degree than a cursory search at the border. It is little comfort to assume that the government — for now— does not have the time or resources to seize and search the millions of devices that accompany the millions of travelers who cross our borders.

It is the potential unfettered dragnet effect that is troublesome. We recognize the important security concerns that prevail at the border. The government’s authority to protect the nation from contraband is well established and may be “heightened” by “national cris[e]s,” such as the smuggling of illicit narcotics, Montoya de Hernandez, 473 U.S. at 538, 105 S.Ct. 3304, the current threat of international terrorism and future threats yet to take shape. But even in the face of heightened concerns, we must account for the Fourth Amendments rights of travelers. Id. at 539, 105 S.Ct. 3304.

The effort to interdict child pornography is also a legitimate one. But legitimate concerns about child pornography do not justify unfettered crime-fighting searches or an unregulated assault on citizens’ private information. Reasonable suspicion is a modest, workable standard that is already applied in the extended border search, Terry stop, and other contexts. Its application to the forensic examination here will not impede law enforcement’s ability to monitor and secure our borders or to conduct appropriate searches of electronic devices.

Nor does applying this standard impede the deterrent effect of suspicionless searches, which the dissent contends is critical to thwarting savvy terrorists and other criminals. Dissent at 985. The Supreme Court has never endorsed the proposition that the goal of deterring illegal contraband at the border suffices to justify any manner of intrusive search. Rather, reasonableness remains the touchstone and the Court has expressed support for the deterrence value of suspicionless searches of a routine nature, such as vehicle checkpoints near the border. See United States v.

Martinez-Fuerte, 428 U.S. 543, 556, 96 S.Ct. 3074, 49 L.Ed.2d 1116 (1976) (“We note here only the substantiality of the public interest in the practice of routine stops for inquiry at permanent checkpoints, a practice which the Government identifies as the most important of the traffic-checking operations.”) (emphasis added). In practical terms, suspicionless searches of the type approved in Arnold will continue; border officials will conduct further, forensic examinations where their suspicions are aroused by what they find or by other factors.

Reasonable suspicion leaves ample room for agents to draw on their expertise and experience to pick up on subtle cues that criminal activity may be afoot. See United States v. Tiong, 224 F.3d 1136, 1140 (9th Cir.2000). We have confidence in the ability of law enforcement to distinguish a review of computer files from a forensic examination. We do not share the alarm expressed by the concurrence and the dissent that the standard we announce will prove unmanageable or give border agents a “Sophie’s choice” between thorough searches and Bivens actions. Concurrence at 977-78; Dissent at 986.

Determining whether reasonable suspicion is required does not necessitate a “complex legal determination[ ]” to be made on a “moment-by-moment basis.” Dissent at 984. Rather, it requires that officers make a commonsense differentiation between a manual review of files on an electronic device and application of computer software to analyze a hard drive, and utilize the latter only when they possess a “particularized and objective basis for suspecting the person stopped of criminal activity.” Tiong, 224 F.3d at 1140 (internal quotation marks omitted).

International travelers certainly expect that their property will be searched at the border. What they do not expect is that, absent some particularized suspicion, agents will mine every last piece of data on their devices or deprive them of their most personal property for days (or perhaps weeks or even months, depending on how long the search takes). United States v. Ramos-Saenz, 36 F.3d 59, 61 n. 3 (9th Cir.1994) (“Intrusiveness includes both the extent of a search as well as the degree of indignity that may accompany a search.”).

Such a thorough and detailed search of the most intimate details of one’s life is a substantial intrusion upon personal privacy and dignity. We therefore hold that the forensic examination of Cotterman’s computer required a showing of reasonable suspicion, a modest requirement in light of the Fourth Amendment. IV. Reasonable Suspicion Reasonable suspicion is defined as “a particularized and objective basis for suspecting the particular person stopped of criminal activity.” United States v. Cortez, 449 U.S. 411, 417-18, 101 S.Ct. 690, 66 L.Ed.2d 621 (1981).

This assessment is to be made in light of “the totality of the circumstances.” Id. at 417, 101 S.Ct. 690. “[E]ven when factors considered in isolation from each other are susceptible to an innocent explanation, they may collectively amount to a reasonable suspicion.” United States v. Berber-Tinoco, 510 F.3d 1083, 1087 (9th Cir.2007). We review reasonable suspicion determinations de novo, reviewing findings of historical fact for clear error and giving “due weight to inferences drawn from those facts by resident judges and local law enforcement officers.” Ornelas v.

United States, 517 U.S. 690, 699, 116 S.Ct. 1657, 134 L.Ed.2d 911 (1996). In the district court and in supplemental briefing, the government argued that the border agents had reasonable suspicion to conduct the initial search and the forensic examination of Cotterman’s computer. We agree. The objective facts reflect that both the agents at the border and the agents who arrived later from Sells based their decision to search Cotterman’s belongings on the TECS hit.

Officer Alvarado was told by those in charge of administering the TECS database that he should search Cotterman’s property because the TECS hit indicated “that [Cotterman] appeared to [have] been involved in some type of child pornography.” Agent Riley also looked up Cotterman’s criminal record and understood that he had a prior conviction for child pornography. As it turned out, Cot-terman’s previous conviction was not for pornography, but for child molestation. Nonetheless, the agents’ understanding of the objective facts, albeit mistaken, is the baseline for determining reasonable suspicion. See Liberal v.

Estrada, 632 F.3d 1064, 1077 (9th Cir.2011) (“Even if an officer makes a mistake of fact, that mistake ‘will not render a stop illegal, if the objective facts known to the officer gave rise to a reasonable suspicion that criminal activity was afoot.’ ” (quoting United States v. Mariscal, 285 F.3d 1127, 1131 (9th Cir.2002))).

By itself, Cotterman’s 1992 conviction for child molestation does not support reasonable suspicion to conduct an extensive forensic search of his electronic devices. “Although a prior criminal history cannot alone establish reasonable suspicion ... it is permissible to consider such a fact as part of the total calculus of information in th[at] determination[ ].” Burrell v. McIlroy, 464 F.3d 853, 858 n. 3 (9th Cir.2006).

The TECS alert was not based merely on Cotterman’s conviction — the agents were aware that the alert targeted Cotterman because he was a sex offender “who travelled] frequently out of the country” and who was “possibly involved in child sex tourism.” Further, Agent Riley testified that an examination of Cotter-man’s passport confirmed that he had traveled in and out of the country frequently since his conviction in 1992.

In further support of reasonable suspicion, the government asserts that Mexico, from which the Cottermans were returning, is “a country associated with sex tourism.” The ICE field office specifically informed Agent Riley that the alert was part of Operation Angel Watch, which targeted individuals potentially involved in sex tourism and alerted officials to be on the lookout for laptops, cameras and other paraphernalia of child pornography. See 156 Cong. Rec. S9581-03 (daily ed.

Dec. 14, 2010) (describing Operation Angel Watch as a program “helpfing] ICE [to] identify travel patterns of convicted sex offenders who may attempt to exploit children in foreign countries”). Cotterman’s TECS alert, prior child-related conviction, frequent travels, crossing from a country known for sex tourism, and collection of electronic equipment, plus the parameters of the Operation Angel Watch program, taken collectively, gave rise to reasonable suspicion of criminal activity. To these factors, the government adds another — the existence of password-protected files on Cotterman’s computer.

We are reluctant to place much weight on this factor because it is commonplace for business travelers, casual computer users, students and others to password protect their files. Law enforcement “cannot rely solely on factors that would apply to many law-abiding citizens,” Berber-Tinoco, 510 F.3d at 1087, and password protection is ubiquitous. National standards require that users of mobile electronic devices password protect their files.

See generally United States Department of Commerce, Computer Security Division, National Institute of Standards and Technology, Computer Security (2007) (NIST Special Publication 800-111). Computer users are routinely advised — and in some cases, required by employers — to protect their files when traveling overseas.

See, e.g., Michael Price, National Security Watch, 34-MAR Champion 51, 52 (March 2010) (“[T]here is one relatively simple thing attorneys can do [when crossing the border] to protect their privacy and the rights of their clients: password-protect the computer login and any sensitive files or folders.”). Although password protection of files, in isolation, will not give rise to reasonable suspicion, where, as here, there are other indicia of criminal activity, password protection of files may be considered in the totality of the circumstances.

To contribute to reasonable suspicion, encryption or password protection of files must have some relationship to the suspected criminal activity. Here, making illegal files difficult to access makes perfect sense for a suspected holder of child pornography. When combined with the other circumstances, the fact that Officer Alvarado encountered at least one password protected file on Cotterman’s computer contributed to the basis for reasonable suspicion to conduct a forensic examination.

The existence of the password-protected files is also relevant to assessing the reasonableness of the scope and duration of the search of Cotterman’s computer. The search was necessarily protracted because of the password protection that Cotterman employed. After Cotterman failed to provide agents with the passwords to the protected files and fled the country, it took Agent Owen days to override the computer security and open the image files of child pornography.

Although we must take into account factors weighing both in favor and against reasonable suspicion, Cotterman’s innocent explanation does not tip the balance. See Tiong, 224 F.3d at 1140 (recognizing that “innocent possibilities ... do not undermine reasonable suspicion”). The dissent suggests that Cotterman’s offer at the border “to help the agents access his computer” counsels against a finding of reasonable suspicion. Dissent at 993. The agents were appropriately wary of such an offer due to concerns that Cotterman could tamper with the devices.

Nor did the agents’ discovery of vacation photos eliminate the suspicion that Cotterman had engaged in criminal activity while abroad or might be importing child pornography into the country. Because the first examination of Cotterman’s laptop, by Officer Alvarado, turned up nothing incriminating, Cotterman urges that any suspicion prompted by the TECS alert was dispelled by this initial failure.

But the nature of the alert on Cotterman, directing agents to review media and electronic equipment for child pornography, justified conducting the forensic examination despite the failure of the first search to yield any contraband. Collectors of child pornography can hardly be expected to clearly label such files and leave them in readily visible and accessible sections of a computer’s hard drive, particularly when they are traveling through border crossings, where individuals ordinarily anticipate confronting at least a cursory inspection.

Officer Alvarado, who was responsible for conducting the initial search, was specifically looking for photographs as described in the TECS hit but testified that he had only a slightly above-average familiarity with laptops. He could do no more than open a file, look at it and see if he could access it. He testified that “[i]f [he] encountered something that [he] could not access, then [he] would reference it to somebody that may have that ability to look at [it].” That is precisely what occurred here. Officer Alvarado came across password-protected files but, unable to open them, moved on to other files.

Alvarado told Agent Riley about the password protection, and she and Agent Brisbine decided to seize the computers for further examination. The border agents “certainly had more than an inchoate and unparticularized suspicion or hunch” of criminal activity to support their decision to more carefully search for evidence of child pornography. Montoya de Hernandez, 473 U.S. at 542, 105 S.Ct. 3304 (internal quotation marks and citation omitted).

An alert regarding possession of this type of criminal contraband justified obtaining additional resources, here available in Tucson, to properly determine whether illegal files were present. Unlike the dissent, we credit the agents’ observations and experience in acting upon significant myriad factors that support reasonable suspicion. It is not our province to nitpick the factors in isolation but instead to view them in the totality of the circumstances.

For the above reasons, we conclude that the examination of Cotter-man’s electronic devices was supported by reasonable suspicion and that the scope and manner of the search were reasonable under the Fourth Amendment. Cotter-man’s motion to suppress therefore was erroneously granted. REVERSED. . The facts related here are drawn from the record of the evidentiary hearing held before the magistrate judge. . The TECS is an investigative tool of the Department of Homeland Security that keeps track of individuals entering and exiting the country and of individuals involved in or suspected to be involved in crimes. .

The other two cameras were returned to the Cottermans. . "Unallocated space is space on a hard drive that contains deleted data, usually emptied from the operating system's trash or recycle bin folder, that cannot be seen or accessed by the user without the use of forensic software. Such space is available to be written over to store new information.” United States v. Flyer, 633 F.3d 911, 918 (9th Cir.2011). .

Although the Arnold decision expressed its conclusion in broad terms, stating that, “reasonable suspicion is not needed for customs officials to search a laptop or other personal electronic storage devices at the border,” Arnold, 533 F.3d at 1008, the facts do not support such an unbounded holding. As an en banc court, we narrow Arnold to approve only the relatively simple search at issue in that case, not to countenance suspicionless forensic examinations. The dissent's extensive reliance on Arnold is misplaced in the en banc environment. .

This characterization is consistent with how our circuit and others have articulated the doctrine. See, e.g., United States v. Villasenor, 608 F.3d 467, 471-72 (9th Cir.2010); United States v. Yang, 286 F.3d 940, 945-46 (7th Cir.2002); United States v. Hyde, 37 F.3d 116, 120 n. 2 (3d Cir.1994); United States v. Santiago, 837 F.2d 1545, 1548 (11th Cir.1988); United States v. Gaviria, 805 F.2d 1108, 1112 (2d Cir.1986); United States v. Niver, 689 F.2d 520, 526 (5th Cir.1982); United States v. Bilir, 592 F.2d 735, 739-40 (4th Cir.1979). .

The concurrence goes to great lengths to “refute any such notion” that location and duration contributed to our holding reasonable suspicion required here. Concurrence at 974-75. We see no reason for such an exegesis; our opinion is clear on the point that these factors are not at issue. . Agent Owen used a software program called EnCase that exhibited the distinctive features of computer forensic examination.

The program copied, analyzed, and preserved the data stored on the hard drive and gave the examiner access to far more data, including password-protected, hidden or encrypted, and deleted files, than a manual user could access. . We are puzzled by the dissent's speculation about "how many gigabytes of storage [one must] buy to secure the guarantee that reasonable suspicion will be required before one’s devices are searched.’’ Dissent at 987. We discuss the typical storage capacity of electronic devices simply to highlight the features that generally distinguish them from traditional baggage.

Indeed, we do not and need not determine whether Cotterman's laptop possessed unusually large or simply "average” capacity in order to resolve that the forensic examination of it required reasonable suspicion. . The dissent's discussion about Facebook and other platforms where the user voluntarily transmits personal data over the Internet, often oblivious to privacy issues, Dissent at 65-66, is a red herring. Of course, willful disclosure of electronic data, like disclosure of other material, undercuts an individual’s expectation of privacy. But there was no such disclosure here.

Nor does the border search implicate such an affirmative disclosure. . “The term ‘cloud computing’ is based on the industry usage of a cloud as a metaphor for the ethereal internet.... An external cloud platform is storage or software access that is essentially rented from (or outsourced to) a remote public cloud service provider, such as Amazon or Google.... By contrast, an internal or private cloud is a cluster of servers that is networked behind an individual or company's own firewall.” David A.

Couillard, Befogging the Cloud: Applying Fourth Amendment Principles to Evolving Privacy Expectations in Cloud Computing, 93 Minn. L.Rev. 2205, 2216 (2009) (internal citations omitted). . Terry v. Ohio, 392 U.S. 1, 30, 88 S.Ct. 1868, 20 L.Ed.2d 889 (1968). . The greatest obstacle to ferreting out contraband at the border has always been the sheer number of international travelers.

Any contention that national security will be critically hampered by stripping border agents of a critical law enforcement tool — suspicionless forensic examinations of electronics — is undermined by the fact that, as a matter of commonsense and resources, it is only when reasonable suspicion is aroused that such searches typically take place. See, e.g., Chaudhry, 424 F.3d at 1054 (B. Fletcher, J., concurring) ("As a practical matter, border agents are too busy to do extensive searches (removing gas tanks and door panels, boring holes in truck beds) unless they have suspicion.”).

As Judge Callahan acknowledges in her separate opinion, the record suggests that "remote and/or intensive searches of electronic devices crossing the border do not occur all that often.” Concurrence at 978 n. 11. The reference that only a small fraction of travelers at the border have their devices searched simply reinforces our point — our ruling will not place an undue burden on border agents who already rely on a degree of suspicion in referring travelers to secondary inspection. .

It is ironic that the dissent expresses concern that, by factoring in the incidence of crime in particular countries, "thousands of individuals ... will now be forced to reconsider traveling to entire countries ... or will need to leave all their electronic equipment behind, to avoid arousing a 'reasonable' suspicion," Dissent at 78, when, if forensic examination of those travelers’ electronics occurs at the border, the dissent would require no suspicion at all. .

Agent Riley testified that Alvarado told her that he had “encounter[ed] some files that were password protected,” while Agent Alvarado testified that he found one file. . We do not suggest that password protecting an entire device — as opposed to files within a device' — can be a factor supporting a reasonable suspicion determination. Using a password on a device is a basic means of ensuring that the device cannot be accessed by another in the event it is lost or stolen.