Woman sues US Customs over data copied from seized iPhone

An American Muslim citizen is suing the US Customs and Border Protection (CBP) for seizing her iPhone at an airport, keeping it for 130 days, failing to explain why, and refusing to destroy whatever copies of her data that they might have grabbed, including photos of her when she wasn’t wearing a hijab, which she wears as an expression of her Islamic faith.

Rejhane Lazoja, a 39-year-old woman from Staten Island, N.Y., had her phone and its SIM card seized by border patrol agents on 26 February at Newark Liberty International Airport when she returned from a trip to Switzerland.

On Thursday, the Council on American-Islamic Relations (CAIR), a Muslim civil rights group, announced that its New Jersey chapter had filed a case in federal court challenging the CBP’s “warrantless and unconstitutional seizure” of an American citizen’s phone.

Lazoja formally asked a federal judge to force border officials to delete data copied from her iPhone 6S Plus – a legal filing that’s formally known as a Rule 41(g) Motion, or as a Motion to Return Property.

It’s not her physical phone that she wants back. She got that back after 130 days.

Rather, she specifically wants assurances that copies of her data are deleted. As CAIR points out, Rule 41(g) motions are generally used for tangible items, as opposed to easily copied data. But it’s those easily made copies that she wants wiped out: copies that were taken without the CBP explaining its reason for seizure.

One of her attorneys, CAIR’s Albert Fox Cahn, told Ars Technica that the phone was seized, and its data imaged, in spite of her never being charged with a crime:

They provided no justification for why they took the phone. They’ve never accused her of a crime.

Her attorneys have asked the CBP…

…[to] return her Data, to expunge any copies made of the Data, to disclose all third parties who received and/or retain copies, partial or complete, of the Data, and to provide information about the basis for the seizure and retention of the Property.

Lazoja’s motion argues that CBP violated Lazoja’s Fourth Amendment rights not only by seizing the phone, but by the length of time the phone was retained and by any copying of her personal data.

From the suit:

While defendants returned Ms. Lazoja’s cell phone 130 days after it was seized, they refuse to state what they did with her personal data, what third parties her personal data was shared with, and if, let alone when, they will return her data.

To add weight to its argument, CAIR notes that in June, the Supreme Court held, in Carpenter v. United States, that police need to obtain a warrant in order to seize cellphone location data.

The case involved the conviction of Timothy Carpenter, who was sentenced in 2014 to 116 years in jail for robbing six cellular telephone stores. To get him convicted, prosecutors had relied on vast amounts of data collected – without a warrant – from cellphone companies that showed Carpenter’s movements.

Carpenter v. US sought to determine whether that warrantless search violated Carpenter’s Fourth Amendment protection against unreasonable search. In June, the Supreme Court decided that yes, it did.