In fiscal year 2024, U.S. Customs and Border Protection reported searching 47,047 electronic devices at ports of entry (42,725 basic searches and 4,322 advanced ones) and detaining 2,316 of them, according to the DHS Inspector General’s final audit on the subject, dated September 28, 2026. The auditors found that CBP did not consistently document those searches and did not track what became of the data afterward. CBP’s written reply, which the report reproduces, calls the assertions “extremely misleading.” The report is public, in redacted form, and so is CBP’s reply. They reward being read side by side.
Twelve of Forty, and a Form Called 6059D
Congress, in the Trade Facilitation and Trade Enforcement Act of 2015 (codified at 6 U.S.C. § 211(k)), told CBP to write standard procedures for searching, reviewing, retaining and sharing information from travelers’ devices, and told the Inspector General to audit compliance three times. Those audits arrived in December 2018, September 2021 and September 2026. OIG says it delayed the third on guidance from committee chairmen, and that three government shutdowns slowed publication further.
The third audit reviewed 40 of the electronic media reports that officers file in CBP’s TECS system for each search. Twelve of them, OIG says, were missing information the Directive requires. Four lacked a note that the traveler received a tear sheet, the written notice of a search’s purpose and authority. Two advanced searches lacked evidence of a completed detention form (DHS Form 6051D), three lacked documentation of a detention’s results, and one lacked approval for holding a device beyond five days. Two basic searches lacked device details such as the IMEI number. The Directive assigns duty supervisors to ensure every documentation requirement is met, and OIG attributes the lapses to supervisors not thoroughly reviewing the records.
At San Ysidro, OIG found an advanced search whose record cited only “national security concerns” and offered no facts behind the phrase. CBP answers that under the guidance then in force this is not noncompliance, because derogatory information may be classified or sensitive and can be documented in separate systems.
A caution, since arithmetic tempts. OIG calls its 40 records a judgmental sample, CBP’s reply describes them as drawn from roughly 47,000 searches, and CBP argues that such a sample cannot support broad conclusions. Nobody, this publication included, should multiply twelve-fortieths by 47,047.
The Count Nobody Kept
The statute also says what each audit must report. Two items on the list describe what happens to a device’s contents after the officer is finished with it. One is the number of instances in which information from searched devices was retained, copied, shared or entered into an electronic database. The other is the number of instances in which information went to another federal agency, including whether it produced a prosecution or conviction.
OIG could report neither. CBP, it says, did not track them, had no formal mechanism to do so, and told auditors it lacks the resources. CBP instead reported alternative metrics to Congress, among them information from advanced searches that yielded positive matches for known or suspected terrorist connections.
There is history here. OIG’s 2021 audit found that CBP counted the devices it referred to other agencies (189 in fiscal 2018 and 193 in 2019, with 151 of the latter going to Homeland Security Investigations) but did not track whether referrals led to prosecutions or convictions, and that an Office of Field Operations official saw no benefit in learning the outcomes. The new report recalls that earlier count and says CBP stopped tracking these metrics after it identified “alternative program oversight metrics.” Replacing one measurement with another is a way of conducting oversight, though not one listed among the statute’s five items.
In fairness to CBP, the statute assigns the reporting to the Inspector General, and the 2021 report observed that the law does not explicitly require CBP to track prosecution or conviction data. That audit also treated the retained-or-copied count as equal to total searches, since each search must be documented in TECS. The obligation to report is OIG’s. The records, however, are CBP’s.
Concurrence, Delivered With Reservations
CBP concurred with all three recommendations and gave June 30, 2027 as the estimated completion date for each. It also told the Inspector General that it contests the report’s assertions, called the report’s title sensationalized, and said its own review of the forty records found one not fully compliant, which it puts at 2.5 percent against OIG’s 30.
CBP’s particulars are specific. A tear sheet is recommended but not required, it says, since the Directive requires only that travelers be notified. An IMEI is one of several acceptable device identifiers. One record lacked an attached detention form, and a second had it attached but bore a typo reading “6059D.” OIG replies that it supplied its criteria and examples.
The Directive is another dispute. OIG says the 2018 version was not replaced until Directive 3340-049B was issued on January 1, 2026, though the statute requires review and update every three years. OIG notes CBP reviewed it in 2021 and decided no changes were needed, and in between came guidance documents, including a field guidebook in May 2025. CBP answers that it keeps a continuous review cycle and calls the suggestion that it relied on outdated procedures unsubstantiated.
Then there is access. OIG says CBP denied its request for direct, read-only access to the TECS relational database and delayed access to the module holding the electronic media reports, which kept auditors from running a comprehensive risk analysis. CBP answers that the law requires access but prescribes no format, and that the system holds sensitive and classified information beyond the audit’s scope. OIG replies that CBP “misinterprets the Inspector General Act of 1978” and that static datasets are no substitute for system access. OIG’s own 2021 report states that its auditors obtained direct access to TECS and pulled the records themselves.
CBP also disputes that progress has been stagnant, and OIG states that CBP concurred with and implemented all ten recommendations from the two earlier audits. For context, the 2021 audit found that 79 of the 100 records it reviewed had at least one instance of noncompliance. The samples differ in size and period, and the new report does not set them side by side, so compare with care.
The Report That Answered a Different Question
Recommendation 2 is where the story sits. It asks the CBP Commissioner to work with Congress to clarify or document that CBP’s Fiscal Year 2023 Report to Congress satisfies the statute’s tracking requirements, and to build mechanisms so search statistics can be derived from CBP’s systems. CBP concurred, promising to engage Congress to confirm that its published figures and that report are sufficient. OIG calls the response only partially responsive and the recommendation “open and unresolved,” the only one of the three so classified.
That report, dated November 26, 2024 and signed by Acting Deputy Commissioner Pete R. Flores, was provided to the chairs and ranking members of the House and Senate Homeland Security appropriations subcommittees. It says it responds to language in a House report and joint explanatory statement accompanying the fiscal 2023 appropriations act, and that it aims to be responsive in spirit rather than to follow that language directly. It does not name the Trade Facilitation and Trade Enforcement Act. The statute directs the Inspector General’s audits to the House Committee on Homeland Security and the Senate Committee on Homeland Security and Governmental Affairs.
What it contains is a set of tidy counts (394,569,408 travelers, 12,276,440 secondary inspections, 41,767 device searches, 8,657 of them involving U.S. citizens) and, for each item the appropriators requested, an explanation of why it is not reported. It contains no figures on data retained, copied or shared, and none on prosecutions.
One explanation stands out. Asked how often CBP searched a device at another government entity’s request, or disclosed information from a searched device to one, the report says the information is not collected because “this does not occur as part of BSEDs at POEs,” the report’s abbreviation for border searches of electronic devices at ports of entry. The explanation that follows addresses searches requested by other agencies and does not separately address information going the other way. OIG’s 2021 audit, for its part, states that CBP “sometimes refers travelers’ devices and information obtained from devices” to agencies such as ICE and the FBI. Two official documents, a little over three years apart, describing one agency. Perhaps the reconciliation lives in the definitions.
OIG says it will close Recommendation 2 only when CBP produces documentation from Congress that no additional reporting is required, along with evidence of mechanisms to derive search statistics from CBP’s systems. Until then, the two figures the statute lists remain ones the auditors could not report. Whether the published statistics are enough is, by CBP’s own plan, a question for Congress, and CBP’s estimated completion date is June 30, 2027.
