Released by Department of Home Affairs

under the Freedom of Information Act 1982

 OFFICIAL: Sensitive

Table of Contents
1. Purpose 3
2. Scope 3
3. Procedural Instruction 3
3.1. Introduction 3
3.2. Legislative authority 3
3.2.1. Examining Devices 4
3.2.2. Questioning 4
3.2.3. Copying Data 4
3.3. Equipment 5
3.4. Training 6
3.5. Examination 6
3.6. Detention or Seizure of Devices 6
3.7. Record Keeping 7
3.8. Referral to Digital Forensics 7
4. Accountability and Responsibility 7
4.1. Statement of Expectation 8
4.1.1. Directions 8
4.1.2. Policy, Guidelines and Recommendations 9
4.1.3. Exercise of Legislative Pow ers and Function 9
4.1.3. What happens if this Pr ocedural Instruction is not follow ed? 9
5. Version Control 9
Attachment A – Definitions 11
Attachment B – Assurance and Control Matrix 12

under the Freedom of Information Act 1982

1.1. Powers and Obligations 12 Released by Department of Home Affairs
1.2. Controls and Assurance 13
Attachment C – Consultation 15
1.1. Internal Consultation 15

OFFICIAL: Sensitive
Digital Device Examination Page 2 of 15
 OFFICIAL: Sensitive

1. Purpose
The Australian Border Force (the ABF) is the operational enforcement arm of the Department of Home Affairs
(the Department). Through the exercise of certain statutory powers, Border Force Officers (BFOs) may
examine electronic devices in different operational domains.

The ABF ensures that BFOs are appropriately trained, equipped and operationally capable to perform
effectively across operational domains, including the manual examination of electronic devices.

The powers of BFOs to conduct examinations are mainly found in the Customs Act 1901 (the Customs Act),
the Migration Act 1958 (the Migration Act) and the Maritime Powers Act 2013 (the Maritime Powers Act).

This Procedural Instruction provides an outline of the Digital Device Examination capability used by the
Australian Border Force (ABF) in support of its border protection function. The document describes the
standards and governance framework for the capability.

2. Scope
This Procedural Instruction provides guidance on the examination of electronic devices by BFO’s utilising the
dedicated Digital Device Examination (DDE) hardware and software.
Only mobile devices and removable data storage devices are to be examined using the DDE capability.
This document provides general guidance only and is not intended to summarise or replicate all applicable
legislative requirements. As a result, it must be read as subject to any applicable laws. It should also be read
in conjunction with the Electronic Device Examination Policy Statement (BE-6168).

3. Procedural Instruction
3.1. Introduction

under the Freedom of Information Act 1982

The ABF examines electronic devices through its electronic device examination capability framework. This
Released by Department of Home Affairs
includes the ABF’s ability to examine electronic devices through its DDE capability, through referral for more
specialised examination by Digital Forensics Investigators (DFI’s) or a third party or by manual examination.
The examination of electronic devices may:
• Potentially compromise electronic evidence, affecting its admissibility
• Risk overlooking relevant evidential material
• Hinder the successful outcome of the Department of Home Affairs (the Department)
objectives and/or decisions
• Result in failure to bring an investigation to an appropriate conclusion
• Cause damage to equipment or data resulting in civil claims against the Department and
• Risk damage to the ABF’s organisational reputation.
Compliance with the ABF’s electronic device examination capability framework limits these risks.

OFFICIAL: Sensitive
Digital Device Examination Page 3 of 15
 OFFICIAL: Sensitive

3.2. Legislative Authority

3.2.1. Examining Devices
The relevant statutory frameworks empower Officers to conduct examinations for prescribed purposes.
Officers should be aware of the possibility that when they conduct an examination for one purpose, they may
uncover material that is relevant to other purposes - and that this may enliven other statutory powers and
obligations. Officers may examine devices subject to Customs control using section 186 of the Customs Act
1901 (the Customs Act).
In certain circumstances Officers may examine electronic devices using section 252 of the Migration Act
1958 (the Migration Act).
In the marine environment Officers examine devices using section 63 of the Maritime Powers Act 2013 (the
Maritime Powers Act). Officers must ensure that powers permitted under the Maritime Powers Act are
exercised only in accordance with Part 2 of the Maritime Powers Act.
Given the operational flexibility of the section 186 Customs Act power and the limitations of the section 252
Migration Act power, it is the ABF’s position that examination of electronic devices using the DDE will be
undertaken utilising the section 186 Customs Act power as the primary statutory authority, except in marine
environments. The use of other statutory powers is available to Officers following a section 186 examination.
The examination of electronic devices resulting from warrant activity and any subsequent action must comply
with the respective search warrant legislative authority.
Statutory authority allows the use of photographs being taken and in, limited circumstances, video recording
of the manual examination of electronic devices. This can only occur if it constitutes examination of the
goods under section 186 of the Customs Act.

3.2.2. Questioning
BFO’s may question people regarding the contents of their electronic devices under:
• section 195 of the Customs Act
• section 192 of the Migration Act, and
• section 57 of the Maritime Powers Act.

under the Freedom of Information Act 1982

Note that the above powers are limited and querying the contents of a device or requesting a passcode, PINReleased by Department of Home Affairs
or PUK need to align with the specified circumstances in which the powers can be used, If questioning does
not come within these powers, BFOs must not suggest that people are compelled to respond.

3.2.3. Copying Data

“Copy” ” is not defined in either the Customs Act, Migration Act or the Maritime Powers Act. For the purposes
of this instruction, “copy” means to make a similar or identical version or to reproduce a document. It is
considered that a device constitutes a document for the purposes of the Customs Act, Migration Act or the
Maritime Powers Act. It is also considered that the use of a photograph or video record (if applicable) is a
method of taking a copy.
An Officer may make a copy of electronic records or documents subject to customs control, or an extract
may be taken:
• By photocopying the document or a part of the document, or

• By photographing the document or a part of the document (this does not include a video recording),
or
• By electronically scanning the document or a part of the document, or

OFFICIAL: Sensitive
Digital Device Examination Page 4 of 15
 OFFICIAL: Sensitive
• By making an electronic copy of information contained in the document or a part of the document, or
• By making a written copy of information contained in the document or a part of the document,
observed during the examination of electronic device.
BFO’s can copy electronic records or documents from electronic devices using section 252 of the Migration
Act, subject to certain circumstances. This includes the photographing and video recording of information
displayed on a device and the creation of written records of data observed during the examination of
electronic devices.
In the marine environment, BFO’s may copy electronic records or documents from electronic devices using
section 65 of the Maritime Powers Act. Officers must ensure that powers permitted under the Maritime
Powers Act are exercised only in accordance with Part 2 of the Maritime Powers Act.
An extraction or acquisition of a mobile device undertaken for purposes of an examination, is not a copy
for the purposes of the relevant statute. Only when the conditions for the copy are met and a copy is made to
another storage medium that a COPY is said to exist.
BFO’s must understand that, 186A powers may only arise once an examination undertaken as part of
section 186 Customs Act has been conducted, and as a result of that examination, an Officer is satisfied that
the conditions in paragraph 186A(1)(b) have been met – a copy is then made to a separate storage
medium. If a copy is made without s186A being complied with, the copy will be unlawful.
BFO’s are to comply with the Department’s procedures to meet the requirements and obligations under the
Privacy Act 1988 (the Privacy Act) when making copies of any document/s.

3.3. Equipment
The examination of devices using the DDE capability must only occur using approved equipment. This
equipment is verified and maintained to ensure it delivers a consistent examination outcome. No
unauthorised equipment is to be connected to the deployed examination computer system.
Specialised software applications on dedicated computer systems are deployed to enable trained and
authorised officers to examine mobile devices and removable storage media in support of their operational
duties. The requisite training is outlined below at 3.4
This suite of approved equipment includes:

under the Freedom of Information Act 1982

• A dedicated laptop or workstation utilising a customised Standard Operating Environment Released by Department of Home Affairs
(SOE)
• A software application package for the examination of mobile devices and removable
storage media, and
• A range of software tools for the examination of removable storage media, comprising
software :
o To scan files for the presence of skin tone of a person and key words of interest. As
an automated tool, it can reduce the time needed to examine devices and media
when compared to manual techniques, while increasing the likelihood of detecting
material of interest.
o To recover deleted material not accessible by the Windows operating system and
regular software applications.
o To preview data and acquire data (evidence) in a forensically sound manner by
creating copies of data without making changes to the original evidence.
o A selection of media players able to play a range of video file types.

OFFICIAL: Sensitive
Digital Device Examination Page 5 of 15
 OFFICIAL: Sensitive
The computer systems, laptop or workstation have write blocking software installed to prevent any changes
to the data on the device and ensure the integrity of the examination product.

3.4. Training
Only Officers who have been assessed as competent under the approved DDE training may examine
electronic devices or copy electronic records or documents using the DDE capability. Any BFO with a
genuine need-to-know may review acquired, extracted or copied electronic records or documents in the
course of their duties.

3.5. Examination
Consistent with the Policy Statement - Electronic Device Examination (BE-6168), the ABF utilises an
escalation approach to examine electronic devices. This usually results in devices being examined by the
DDE capability before any other examination capability is considered. In some instances another
examination approach is conducted first, usually because:
• The DDE capability is not available, either because the hardware and software is not available,
or because no trained and authorised officers are available, or
• The electronic device cannot be examined by the DDE capability.
Keeping in mind that an Officer may arrange for another BFO or other person having the necessary
experience to do whatever is reasonably necessary to permit the examination of the goods concerned –
subsection 186(2) of the Customs Act.
In instances where an officer or work area decides to use another examination approach when the DDE
capability could be used the officer or work area must;
• Record the reason for non-compliance with the Policy Statement - Electronic Device
Examination (BE-6168), and
• Conduct the other examination consistent with the requirements of the relevant Procedural
Instruction.
Once taken for examination, Officers must not return electronic devices until the examination is complete.

under the Freedom of Information Act 1982

Regardless of the intended examination method the owner of the electronic device must not be allowed to
Released by Department of Home Affairs
interact with the device from the time the Officer has decided to examine the device to the time the Officer
has completed their examination and, if necessary, copied data from the device.
For detailed instructions for the examination of electronic devices see Standard Operating Procedure – Use
of Digital Device Examination to examine electronic devices (BE-6197).
If it is decided that a copy of data or document/s is to be made, following a DDE examination, the electronic
device must not be returned to the owner until the copy has been made.
For detailed instructions for the copying of electronic records or documents see Standard Operating
Procedure – Digital Device Examination – Copying, transfer and storage of data (BE-6198).

3.6. Detention or Seizure of Devices

Once an electronic device is taken for examination, officers must not return the device until the examination
is complete. If an electronic device is held pending examination the officer must also hold all accompanying
equipment, such as cables, power supplies, cases, etc. and must consider detaining any accompanying
computer system. If devices are detained without accompanying equipment, the ability to comprehensively
examine the device may be compromised.

OFFICIAL: Sensitive
Digital Device Examination Page 6 of 15
 OFFICIAL: Sensitive
If an electronic device held pending examination is locked by a PIN/passcode/PUK and the
PIN/passcode/PUK is known, it must accompany the device. If an Apple mobile device is detained and the
PIN/password/PUK is unknown then the officer must also consider detaining any accompanying computer. It
may be possible to examine a locked Apple mobile device using an associated computer however this
examination must only be undertaken by Digital Forensics.
Any electronic device found to contain goods subject to seizure under a statutory power, such as section
203B of the Customs Act, must be dealt with and handled in accordance with current seizure and evidence
handling procedures. (Refer to Procedural Instruction BE-2882 – Evidence Handling)
These electronic devices must be handled to ensure evidential integrity is maintained. This handling must be
at a minimum as follows:
• Mobile devices are to be isolated from a network connection that is, put into aeroplane/airplane/flight
mode and SIM card removed.
• Computer systems are to be powered off, for example, laptop computers are to have their batteries
removed, if possible, rather than shutdown.
• No interaction with the device is to occur after seizure unless approved.

3.7. Record Keeping

It is critical that officers make contemporaneous notes in a form that enables them to account for continuity
of the electronic devices seized and any copies made, compile reports, statements, conduct interviews and,
if required, be used as evidence in court. Contemporaneous notes are to be made in an officer’s official
notebook and on an approved examination form.
All examinations by the DDE capability is to be recorded on an approved Digital Device Examination Form
and in Baggage Action General Statistics (BAGS), where available. If BAGS is not available the examination
is to be recorded in an Electronic Device Examination Register (see Supporting Material – Electronic Device
Examination Forms (BE-6199). There is to be a separate examination form for every device examined (note:
components of a device can be included on the same form, for example mobile device handset, SIM card,
removable storage card etc).
Any copy made of data or document/s resulting from a DDE examination is to be recorded on the
examination form. These details must include, but are not limited to, the name of the officer who made the

under the Freedom of Information Act 1982

copy, the date the copy is made, the name of the copied data, the statutory power exercised to make the
Released by Department of Home Affairs
copy, the reasons for making the copy and the transfer of any copied data and detained or seized goods. All
copies made must also be recorded in the examination register.
This record keeping is in addition to currently existing local and national arrangements, such as in s. 47E(d)
.

3.8. Referral to Digital Forensics

Devices may be examined by Digital Forensics and/or an external agency in circumstances that include:
• Electronic devices that cannot be examined by the DDE capability in the first instance and
require further examination
• Technical issues with the examination resulting in incomplete examinations
• A more detailed or alternative examination of an electronic device is required
When electronic devices are referred to Digital Forensics or a third party for examination the referral must be
consistent with the Standard Operating Procedure – Digital Forensic Task Requests (BE-2205).

OFFICIAL: Sensitive
Digital Device Examination Page 7 of 15
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
 OFFICIAL: Sensitive

Attachment C – Consultation
1.1. Internal Consultation
• Tactical Capability Branch, Close Support Command
• Operational Capability Branch, Major Capability Division
• Traveller Operations Policy, Strategic Border Command
• Traveller Management, Port Operations Command
• Cyber Security Branch
• Information and Communications Technology
• Integrity and Professional Standards
• Privacy and Information Disclosure Section
• PPCF Section
• Legal Group

under the Freedom of Information Act 1982

Released by Department of Home Affairs

OFFICIAL: Sensitive
Digital Device Examination Page 15 of 15
Released by Department of Home Affairs
under the Freedom of Information Act 1982
 OFFICIAL: Sensitive

Table of Contents
1. Purpose 3
2. Scope 3
3. Procedural Instruction 3
3.1. Introduction 3
3.2. Legislative authority 4
3.2.1. Examining Devices 4
3.2.2. Questioning 4
3.2.3. Copying Data 4
3.3. Risks 5
3.4 Data Preservation and Acquisition 6
3.5. Examination 6
3.6. Detention or Seizure of Devices 6
3.7. Record Keeping 7
3.8. Training 8
3.9. Digital Device Examination Capability 8
3.10. Referral to Digital Forensics 8
4. Accountability and Responsibility 9
4.1. Statement of Expectation 9
4.1.1. Directions 9
4.1.2. Policy, Guidelines and Recommendations 10
4.1.3. Exercise of Legislative Pow ers and Function 10
4.1.3. What happens if this Pr ocedural Instruction is not follow ed? 10
5. Version Control 10
Attachment A – Definitions 12

under the Freedom of Information Act 1982

Released by Department of Home Affairs
Attachment B – Assurance and Control Matrix 14
1.1. Powers and Obligations 14
1.2. Controls and Assurance 15
Attachment C – Consultation 16
1.1. Internal Consultation 16
Attachment D – Manual Examination of Electronic Device Risk Events 17
Attachment E – Manual Device Examination Process 18
1.1 Mobile Device Examination Procedure 18
1.2 Other Electronic Device Ex amination Procedures 20

Manual Examination of Electronic Devices OFFICIAL: Sensitive Page 2 of 20

 OFFICIAL: Sensitive

1. Purpose
The Australian Border Force (the ABF) is the operational enforcement arm of the Department of Home Affairs
(the Department). Through the exercise of certain statutory powers, Border Force Officers (BFOs) may
examine electronic devices in different operational domains.

The ABF ensures that BFOs are appropriately trained, equipped and operationally capable to perform
effectively across operational domains, including the manual examination of electronic devices.

The powers of BFOs to conduct examinations are mainly found in the Customs Act 1901 (the Customs Act),
the Migration Act 1958 (the Migration Act) and the Maritime Powers Act 2013 (the Maritime Powers Act).

This Procedural Instruction provides an outline of the procedures used by ABF to examine electronic devices
manually without the use of dedicated or specialised equipment. The Procedural Instruction describes the
standards and governance framework for this capability.

2. Scope
This Procedural Instruction provides guidance on when and how electronic devices may be examined
manually without the use of dedicated or specialised equipment using ABF statutory powers. However, this
document provides general guidance only and is not intended to summarise or replicate all applicable
legislative requirements. As a result, it must be read as subject to any applicable laws. It should also be read
in conjunction with the Electronic Device Examination Policy Statement (BE- 6168).

3. Procedural Instruction
3.1. Introduction
The ABF examines electronic devices through its electronic device examination capability framework. This
includes the ABF’s ability to examine electronic devices through its DDE capability through referral for more
specialised examination by Digital Forensics Investigators (DFI’s) or a third party or by manual examination.

under the Freedom of Information Act 1982

Released by Department of Home Affairs
Devices must only be examined manually in circumstances that include:
• Examination by a Digital Forensic Investigator.
• Following an unsuccessful examination of a mobile device using the Digital Device Examination
(DDE) capability and where an assessment has determined that the DDE capability or Digital
Forensics is unable to examine the device.
• In limited exceptional circumstances when the use of the DDE capability or Digital Forensics is either
unavailable or impractical for the examination and all the associated risks have been carefully taken
into consideration.
Prior to examining a device manually, the examining officer must consider the risks which are outlined in
Section 3.3, and must also consider the following:
• The legal authority for the examination, including any legislated time limitations.
• The purpose of the examination.
• Whether the device can be examined by other examination capabilities.

Manual Examination of Electronic Devices OFFICIAL: Sensitive Page 3 of 20

 OFFICIAL: Sensitive

• The operational environment the examination is occurring in. If the device belongs to a traveller the
officer should consider whether the device should be retained for examination so that the traveller is
not unnecessarily delayed. The examination length and comprehensiveness must be determined by
the operational need, not by external factors such as departing flights.

3.2. Legislative authority

3.2.1. Examining Devices
The relevant statutory frameworks empower Officers to conduct examinations for prescribed purposes.
Officers should be aware of the possibility that when they conduct an examination for one purpose, they may
uncover material that is relevant to other purposes - and that this may enliven other statutory powers and
obligations. Officers may examine devices subject to Customs control using section 186 of the Customs Act
1901 (the Customs Act).
BFO’s can examine devices subject to customs control using section 186 of the Customs Act. Pursuant to
sections 198 and 199A of the Customs Act, officers can apply for search warrants to search for and seize
evidential material (as defined in the Customs Act).
In certain circumstances BFOs can examine electronic devices using section 252 of the Migration Act.
Pursuant to section 487ZC of the Migration Act, BFOs may apply for search warrants to search for and seize
evidential material (as defined in the Migration Act).
In the marine environment BFO’s generally examine devices using section 63 of the Maritime Powers Act
2013 (the Maritime Powers Act). Officers must ensure that powers permitted under the Maritime Powers Act
are exercised only in accordance with Part 2 of that Act.
Given the operational flexibility of the Customs Act power and the limitations of the Migration Act powers, it is
the ABF’s position that the manual examination of electronic devices at the border will be undertaken utilising
the Customs Act power (section 186) as the primary statutory authority, except in marine environments. The
use of other statutory powers is available to officers following a section 186 Customs Act examination.
The examination of electronic devices resulting from search warrant activity and any subsequent action must
comply with the respective search warrant legislative authority.
Statutory authority allows the use of photographs being taken and, in limited circumstances, video recording

under the Freedom of Information Act 1982

of the manual examination of electronic devices. This can only occur if it constitutes examination of the Released by Department of Home Affairs
goods under section 186 of the Customs Act.

3.2.2. Questioning
BFO’s can question people at the border regarding the contents of their electronic devices, including to
identify a passcode, PUK or PIN to unlock an electronic device, under:
• section 195 of the Customs Act
• section 192 of the Migration Act, and
• section 57 of the Maritime Powers Act.
Note that the above powers are limited and querying the contents of a device or requesting a passcode, PIN
or PUK need to align with the specified circumstances in which the powers can be used, If questioning does
not come within these powers, BFOs must not suggest that people are compelled to respond.

3.2.3. Copying Data

“Copy” is not defined in either the Customs Act, Migration Act or the Maritime Powers Act. For the purposes
of this instruction, “copy” means to make a similar or identical version of or to reproduce a document. It is

Manual Examination of Electronic Devices OFFICIAL: Sensitive Page 4 of 20

 OFFICIAL: Sensitive

considered that a device constitutes a document for the purposes of the Customs Act, Migration Act or the
Maritime Powers Act. It is also considered that the use of a photograph or video (if applicable) is a method
for making a copy.
An Officer may make a copy of electronic records or documents subject to customs control, or an extract
may be taken:
• By photocopying the document or a part of the document, or
• By photographing the document or a part of the document (this does not include a video recording),
or
• By electronically scanning the document or a part of the document, or
• By making an electronic copy of information contained in the document or a part of the document, or
• By making a written copy of information contained in the document or a part of the document,
observed during the examination of electronic device.
BFO’s can copy electronic records or documents from electronic devices using section 252 of the Migration
Act, subject to certain circumstances. This includes the photographing and video recording of information
displayed on a device and the creation of written records of data observed during the examination of
electronic devices.
In the marine environment, BFO’s may copy electronic records or documents from electronic devices using
section 65 of the Maritime Powers Act. Officers must ensure that powers permitted under the Maritime
Powers Act are exercised only in accordance with Part 2 of the Maritime Powers Act.
BFO’s must understand that, 186A powers may only arise once an examination undertaken as part of
section 186 Customs Act has been conducted, and as a result of that examination, an Officer is satisfied that
the conditions in paragraph 186A(1)(b) have been met – a copy is then able to be made. If a copy is made
without s186A being complied with, the copy will be unlawful.
BFO’s are to comply with the Department’s procedures to meet the requirements and obligations under the
Privacy Act 1988 (the Privacy Act) when making copies of any document/s.

3.3. Risks

under the Freedom of Information Act 1982

The manual examination of electronic devices exposes the ABF to some unique risks not present with other Released by Department of Home Affairs
examination approaches. Manual Examination of electronic devices must not be undertaken by untrained
officers as such actions can pose serious risks such as:
• An incomplete examination of all of the data on the device and overlooking of relevant evidential
material
• Affecting the evidential integrity of the stored data and rendering documents or electronic records
inadmissible in court
• Potentially compromising electronic evidence through inadvertent action with the device
• Hindering the successful outcome of the Department’s objectives and/or decisions
• Causing damage to equipment or data resulting in civil claims and litigation against the Department
• Resulting in a failure to bring an investigation to an appropriate conclusion
• Complicating any further examination of the device
• To the health and wellbeing of BFO’s, through such things as viewing of objectionable material; and
• Damage to the ABF’s organisational reputation

Manual Examination of Electronic Devices OFFICIAL: Sensitive Page 5 of 20

 OFFICIAL: Sensitive

Compliance with the ABF’s electronic device examination framework mitigates these risks. The examination
framework requires an escalation of examination capabilities utilising DDE and/or Digital Forensics,
depending on the circumstances. It is considered that operational activity at the border will involve DDE as
the primary capability and post border activity will involve Digital Forensics.
Devices must only be manually examined subject to the consideration and acceptance of the risks as
outlined in a standard risk assessment undertaken and recorded by the respective operational command,
with reference, but not limited, to the Manual Examination of Electronic Device Risk Events outlined in
Attachment D.
Officers encountering devices that they do not know how to operate, are not confident in operating or
experience difficulty in examining must consider having these devices examined by Digital Forensics.
The officer deciding to conduct a manual examination must record their reasons for doing so, including the
consideration, mitigation and acceptance of the manual examination risks. This is further outlined in 3.7
Record Keeping.

3.4 Data Preservation and Acquisition

All examinations of electronic devices must be undertaken to ensure the integrity of electronic evidence is
maintained to the highest level possible.
Ensure appropriate steps are taken to secure electronic devices and electronic records:
• Mobile devices, at the border, must be isolated from the mobile communications network (such as by
aeroplane/airplane/flight mode turned on, SIM card removed, faraday bag and/or WIFI and Bluetooth
disconnected) prior to any examination
• An examination using the primary examination capability (DDE or Digital Forensics) must be
attempted before a manual examination is considered
• Should there be any indication of third party encryption software being installed or encryption being
part of the operating system (e.g. encrypted volume) or anti-forensics techniques being installed such
as destructive devices and data wiping software, the device must be examined by Digital Forensics
• If the device needs to be powered-down, consider whether it will be possible to unlock the device once
power is restored

under the Freedom of Information Act 1982

The owner of the electronic device must not be allowed to physically interact with the device from the time
Released by Department of Home Affairs
the officer has decided to examine the device to the time the officer has completed their examination. An
owner may assist the officer in locating records but must not physically interact with the device during the
examination.

3.5. Examination
The ABF utilises an escalation approach to examine electronic devices, this is consistent with the Policy
Statement - Electronic Device Examination (BE-6168). This usually results in devices being examined by the
Digital Device Examination capability however in some circumstances, a manual examination of the device
is required. Instances which may require a manual examination may be, but not limited to;
• The DDE capability is not available, either because the hardware and software is not available or
because no trained and authorised officers are available, or
• The electronic device cannot be examined by the DDE capability.

Manual Examination of Electronic Devices OFFICIAL: Sensitive Page 6 of 20

 OFFICIAL: Sensitive

Bearing in mind that one officer may arrange for another BFO, or other person having the necessary
experience, to do whatever is reasonably necessary to permit the examination of the goods concerned –
subsection 186(2) of the Customs Act.
The manual examination process to be followed is at Attachment E.
An electronic device subject to manual examination must not be connected to the Department’s network.
This includes the charging of any device through a USB/other port connection.
A number of factors may affect the conduct of a manual examination. It is preferable to conduct the
examination in a place where noise is minimal and where the likelihood of interruption by persons who are
not involved with the examination is minimised. The use of a camera stand or tripod will assist in eliminating
blurred photographs.
Conduct research (e.g. user manuals, websites, examination tool device guides) for the mobile device to be
examined.
Ensure that any equipment used to record an examination has:
• adequate battery charge
• sufficient free memory capacity
• correct time and date settings
It should be noted that any photographs taken during a manual device examination of documents could
constitute a copy of those documents or evidential material. Officers should be aware of the statutory
requirements regarding the copying of documents during the course of any manual device examination.
If any prohibited material is located during the manual examination the examination is to cease
immediately and the electronic device must be referred to Digital Forensics for further examination.
In instances where an officer, or work area, decides to use another examination approach when the DDE
capability could otherwise be used, the officer or work area must;
• Record the reason for non-compliance with the Policy Statement - Electronic Device
Examination (BE-6168), and
• Conduct the other examination consistent with the requirements of the relevant Procedural
Instruction.

under the Freedom of Information Act 1982

Regardless of the intended examination method, the owner of the electronic device must not be allowed to Released by Department of Home Affairs
interact with the device from the time the Officer has decided to examine the device to the time the Officer
has completed their examination and, if necessary, copied data from the device.
For detailed instructions for the examination of electronic devices see Attachment E of this document.
If it is decided that a copy of data or document/s is to be made, following a manual examination, the
electronic device must not be returned to the owner until the copy has been made and the repercussions of
returning the device might have to continuity of evidence.

3.6. Detention or Seizure of Devices

Once an electronic device is taken for examination, officers must not return the device until the examination
is complete. If an electronic device is held pending examination the officer must also hold all accompanying
equipment, such as cables, power supplies, cases, etc. and must consider detaining any accompanying
computer system. If devices are detained without accompanying equipment, the ability to comprehensively
examine the device may be compromised.
If an electronic device held pending examination is locked by a PIN/passcode/PUK and the
PIN/passcode/PUK is known, it must accompany the device. If an Apple mobile device is detained and the

Manual Examination of Electronic Devices OFFICIAL: Sensitive Page 7 of 20

 OFFICIAL: Sensitive

PIN/password/PUK is unknown then the officer must also consider detaining any accompanying computer. It
may be possible to examine a locked Apple mobile device using an associated computer however this
examination must only be undertaken by Digital Forensics.
Any electronic device found to contain goods subject to seizure under a statutory power, such as section
203B of the Customs Act, must be dealt with and handled in accordance with current seizure and evidence
handling procedures. (Refer to Procedural Instruction BE-2882 – Evidence Handling)
These electronic devices must be handled to ensure evidential integrity is maintained. This handling must be
at a minimum as follows:
• Mobile devices are to be isolated from a network connection that is, put into aeroplane/airplane/flight
mode and SIM card removed.
• Computer systems are to be powered off, for example, laptop computers are to have their batteries
removed, if possible, rather than shutdown.
• No interaction with the device is to occur after seizure unless approved.

3.7. Record Keeping

It is critical that officers make contemporaneous notes in a form that enables them to compile reports,
statements, conduct interviews and, if required, be used as evidence in court. Contemporaneous notes are
to be made in an officer’s official notebook and on an approved examination form.
All manual examinations of any electronic device ARE to be recorded on an approved Manual Device
Examination Form and in Baggage Action General Statistics (BAGS), where available. If BAGS is not
available the examination is to be recorded in an Electronic Device Examination Register (see Supporting
Material – Electronic Device Examination Forms (BE-6199). There is to be a separate examination form for
every device examined (note: components of a device can be included on the same form, for example
mobile device handset, SIM card, removable storage card).
Manual examinations undertaken by Digital Forensics are to be recorded on an approved Digital Forensics
form and in National Intelligence System/Case Referral and Investigations Management System
(s. 47E(d) ).
Any copy made of data or document/s resulting from a manual device examination is to be recorded on the

under the Freedom of Information Act 1982

Manual Device Examination Form. These details must include, but are not limited to, the name of the copied Released by Department of Home Affairs
data, the statutory power exercised to make the copy, the reasons for making the copy and the transfer of
any copied data and detained or seized goods. All copies made must also be recorded in the Electronic
Device Examination Register.
This record keeping is in addition to currently existing local and national arrangements, such as s. 47E(d) ,
etc.

3.8. Training
Only officers who have been assessed as competent, under the approved Manual Examination of Electronic
Device training, or a Digital Forensic Investigator (DFI) must manually examine devices.

3.9. Digital Device Examination Capability

Due to the risks presented by manual examination, including those risks described at Attachment D, devices
should rarely be examined using the DDE capability following the manual examination of an electronic
device. The DDE capability must not be used if it is assessed that the manual examination risks have not
been adequately managed.

Manual Examination of Electronic Devices OFFICIAL: Sensitive Page 8 of 20

Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
 OFFICIAL: Sensitive

Attachment C – Consultation
1.1. Internal Consultation
• Tactical Capability Branch, Close Support Command
• Operational Capability Branch, Major Capability Division
• Traveller Management, Port Operations Command
• Traveller Operations Policy, Strategic Border Command
• Governance Coordination & Standards, Enforcement Command
• Cyber Risk Services Branch
• Information and Communications Technology
• Integrity and Professional Standards
• Privacy and Information Disclosure Section
• PPCF Section
• Legal Group

under the Freedom of Information Act 1982

Released by Department of Home Affairs

Manual Examination of Electronic Devices OFFICIAL: Sensitive Page 16 of 20

Released by Department of Home Affairs
under the Freedom of Information Act 1982
 Attachment E – Manual Device Examination
Process
1.1 Mobile Device Examination Procedure
Mobile devices must be isolated from the mobile communications network (aeroplane/airplane/flight mode
turned on, SIM card removed, faraday bag and/or WIFI and Bluetooth disconnected) prior to any
examination.
s. 47E(d)

under the Freedom of Information Act 1982

Released by Department of Home Affairs

OFFICIAL: Sensitive
 OFFICIAL: Sensitive

s. 47E(d)

under the Freedom of Information Act 1982

Released by Department of Home Affairs

Manual Examination of Electronic Devices OFFICIAL: Sensitive Page 19 of 20

 OFFICIAL: Sensitive
s. 47E(d)

under the Freedom of Information Act 1982

Released by Department of Home Affairs

Manual Examination of Electronic Devices OFFICIAL: Sensitive Page 20 of 20

Released by Department of Home Affairs
under the Freedom of Information Act 1982
 OFFICIAL: Sensitive

Table of Contents
1. Purpose 3
2. Scope 3
3. Policy Statement 3
3.1. Background 3
3.2. Examination Philosophy 3
3.3. Capability 4
3.3.1. Digital Device Examination 4
3.3.2. Digital Forensics 4
3.3.3. Referral to external agency 4
3.3.4. Manual Examination 4
3.4. Principles 5
3.4.1. Standard of Examination 5
3.4.2. Consistency of approach 5
3.4.3. Escalation of examination 6
3.5. Workplace Health and Safety 6
4. Accountability and Responsibility 6
5. Version Control 7
Attachment A – Definitions 9
Attachment B – Related Framework Documents 10
Attachment C – References and Legislation 11
Attachment D – Consultation 12
1.1. Internal Consultation 12

under the Freedom of Information Act 1982

Released by Department of Home Affairs

Electronic Device Examination OFFICIAL: Sensitive Page 2 of 12

 OFFICIAL: Sensitive

1. Purpose
The Australian Border Force (ABF) is the operational enforcement arm of the Department of Home Affairs
(the Department). Through the exercise of certain statutory powers, Border Force Officers may examine
electronic devices in different operational domains.
The ABF ensures that Border Force Officers are appropriately trained, equipped and operationally capable to
perform effectively across operational domains, including the examination of electronic devices.
The powers of Border Force Officers to conduct examinations are mainly found in the Customs Act 1901 (the
Customs Act), the Migration Act 1958 (the Migration Act) and the Maritime Powers Act 2013 (the Maritime
Powers Act).

2. Scope
This policy statement provides guidance on when and how electronic devices may be examined using ABF
statutory powers. However, this policy statement provides general guidance only and is not intended to
summarise or replicate all applicable legislative requirements. As a result, it should be read as subject to any
applicable laws.
The ABF’s response to the WHS risks associated with the examination of electronic devices is outside the
scope of this policy framework.

3. Policy Statement
3.1. Background
Border Force Officers may, within the confines of their statutory powers, examine electronic devices to
deliver on the ABF’s mission of protecting Australia’s border and managing the movement of people and
goods across it. Under the relevant legislation, these examinations may occur across both land and marine
operational domains.

under the Freedom of Information Act 1982

The ABF has significant service and enforcement functions, including investigations, compliance and
Released by Department of Home Affairs
enforcement in relation to illicit goods and immigration malpractice. The ABF examines electronic devices to
help it achieve these functions.
This policy statement gives guidance in relation to the examination of electronic devices by Border Force
Officers. The policy statement also sets out the ABF’s approach to ensuring that its officers are supported
through a robust training, governance and capability regime.

3.2. Examination Philosophy

The examination of electronic devices and digital media occurs across all operational domains under a
number of statutory frameworks. The relevant statutory frameworks only empower Officers to conduct
examinations for prescribed purposes. However, when undertaking examinations for a prescribed purpose,
Officers should be aware of the possibility that they may uncover material that may enliven other statutory
powers and obligations. For example, the examination of a device to identify evidence of an importation
offence may uncover data of national security significance.

Electronic Device Examination OFFICIAL: Sensitive Page 3 of 12

 OFFICIAL: Sensitive
There may be a range of examination actions undertaken by an escalating range of work areas and teams.
The escalation of examination activity can lead to an enhanced outcome and officers should remain aware
that the examination of a device by one work area may lead to more detailed examination by other areas as
a normal course of events.

3.3. Capability
In exercising its statutory powers of examination, the ABF employs certain capabilities. The manner in which
these capabilities is used may depend upon the particular statutory power being relied upon to conduct the
examination. The capabilities are:

3.3.1. Digital Device Examination

The Digital Device Examination (DDE) capability is delivered through the use of dedicated
hardware and software to examine mobile devices and removable media in the marine
domain or at the border.
A DDE allows the ABF to examine a limited number of device types in a timely way that
presents limited risk of data compromise or device damage and permits the examination of
deleted, hidden or obscured data when possible.
This capability includes the use of dedicated hardware and software supported by a manual
review of data on an electronic device to ensure a thorough examination of all available
electronic records.

3.3.2. Digital Forensics

A specialist capability for the identification, preservation, acquisition, analysis and reporting
of electronic devices and electronic records.
A Digital Forensics examination allows the ABF to examine a broad range of device types in
a way that presents the least risk of data compromise or device damage and permits the
examination of a wider range of deleted, hidden or obscured data when possible.
This capability also provides a value added component to the interpretation of electronic
devices and electronic records and data to assist ABF operational and organisational goals

under the Freedom of Information Act 1982

and objectives. Released by Department of Home Affairs
The Digital Forensics capability is outlined in Procedural Instruction – Digital Forensics (BE-
2204).

3.3.3. Referral to external agency

A process of referral to a third party, external to the ABF, for the examination of an electronic
device. This should occur once all internal ABF capabilities are exhausted or in instances
where third parties attend ABF locations with their own capability.

3.3.4. Manual Examination

The process involving the manual operation of an electronic device’s controls and/or display
to document data present in the device’s internal memory. This capability activity is
undertaken in isolation and separate to another capability. For example, a manual
examination of an electronic device without the use of the DDE equipment first.
A manual examination risks device or data damage, does not facilitate the examination of an
entire device including the examination of deleted data and risks overlooking hidden or
obscured data.

Electronic Device Examination OFFICIAL: Sensitive Page 4 of 12

 OFFICIAL: Sensitive
For these reasons manual examinations should only be considered under specific
circumstances.

3.4. Principles
3.4.1. Standard of Examination
All examinations of electronic devices should have regard to preserving and maintaining the
evidential integrity of the device and any electronic record as a priority. All electronic device
examinations are conducted such that the examination is for a relevant purpose, and such
that the findings of the examination may be admissible in any jurisdiction. All examinations
should also meet all Departmental obligations with regards to the Privacy Act 1988,the
Australian Privacy Principles (APP), the law and departmental policy.
This standard is required to:
• enable the successful outcome of the Department’s objectives and/or decisions;
• ensure any evidence is lawfully obtained;
• ensure electronic evidence is not compromised, thereby affecting it’s admissibility;
• limit the risk of overlooking relevant electronic records;
• provide a higher likelihood of bringing an investigation to an appropriate conclusion;
• reduce the likelihood of damage to equipment or data resulting in civil claims against
the Department; and
• lower the risk of any action with potential to damage the ABF and Department’s
organisational reputation.

3.4.2. Consistency of approach

The appropriate method of examination, and the considerations relevant to the examination,
may vary depending on the statutory power being used to conduct the examination.
However, so far as the differences between statutory frameworks permit, all examinations of
electronic devices should be approached using the same examination procedures and the

under the Freedom of Information Act 1982

same standard of examination, regardless of operational domain. This ensures that Released by Department of Home Affairs
examinations are more likely to be conducted
• lawfully
• effectively
• efficiently
• impartially
• to a high standard
• without error and
• in a timely manner.

Electronic Device Examination OFFICIAL: Sensitive Page 5 of 12

Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
 OFFICIAL: Sensitive

Attachment B – Related Framework Documents

Policy Statement
Electronic Devices Examination
BE-6168

Procedural Instruction
Procedural Instruction Procedural Instruction
Procedural Instruction Manual examination of electronic
Digital Device Examination Digital Forensics
Referral to external agency devices
BE-6185 BE-2204 BE-6196

SOP Use of Digital Device

Examination to examine SOP Digital Forensic Task
electronic devices Requests
BE-6197 BE-2205

SOP Digital Device Examination -

SOP Digital Forensic
Copying, transfer and storage of
data Identification Process
BE-6198 BE-5441

SOP Digital Device Examination

SOP Digital Forensic
Hardware maintenance
Preservation Process
BE-6537
BE-5442

Supp Mat Digital Device

Examination - Forms SOP Digital Forensic Acquisition
BE-6199 Process
BE-5443

Supp Mat Digital Device

Examinatino - Governance & SOP Digital Forensic
Quality Checks Examination Process
BE-6538 BE-5444

under the Freedom of Information Act 1982

SOP Digital Forensic Reports and
Statements
BE-5445
Released by Department of Home Affairs

SOP Digital Forensic Evidence

Handling
Be-5446

SOP Digital Forensic

Competency Framework
BE-5146

SOP Digital Forensic Quality

Framework
BE-5440

SOP Digital Forensic

Management Framework
BE-5439

Electronic Device Examination OFFICIAL: Sensitive Page 10 of 12

 OFFICIAL: Sensitive

Attachment C – References and Legislation

• Customs Act 1901
• Migration Act 1958
• Maritime Powers Act 2013
• Crimes Act 1914
• Australian Border Force Act 2015

under the Freedom of Information Act 1982

Released by Department of Home Affairs

Electronic Device Examination OFFICIAL: Sensitive Page 11 of 12

 OFFICIAL: Sensitive

Attachment D – Consultation
1.1. Internal Consultation
The following internal stakeholders were consulted in the development of this Policy Statement:
• Tactical Capability Branch, Close Support Command
• Operational Capability Branch, Major Capability Division
• Operational Policy, Strategic Border Command
• Regional Command ACT/HQ, Port Operations Command
• ABF College, Operational Practices Command
• Technology Operations & Support, ICT Division
• PPCF Section
• Legal Group

under the Freedom of Information Act 1982

Released by Department of Home Affairs

Electronic Device Examination OFFICIAL: Sensitive Page 12 of 12

Released by Department of Home Affairs
under the Freedom of Information Act 1982
 OFFICIAL: Sensitive

Table of Contents
1. Purpose 3
2. Scope 3
3. Standard Operating Procedure 3
3.1 Device Identification 4
3.2 Data Preservation and Acquisition 4
3.3 Examination and Analysis 4
3.3.1. Mobile Device Examination Procedure 4
3.3.2. Removable Data Storage Device Softw are Applications 6
3.3.3. Removable Data Storage Device Examination Procedure 6
3.4. Record Keeping 7
4. Accountability and Responsibilities 8
4.1. Statement of Expectation 9
4.1.1. Directions 9
4.1.2. Policy, Guidelines and Recommendations 9
4.1.3. Exercise of Legislative Pow ers and Function 9
4.1.4. What happens if this SOP is not follow ed? 9
5. Version Control 10
Attachment A – Definitions 11
Attachment B – Assurance and Control Matrix 14
1.1. Powers and Obligations 14
1.2. Controls and Assurance 14
Attachment C – Consultation 16
1.1. Internal Consultation 16
Attachment D – ABF Port Codes 17

under the Freedom of Information Act 1982

Released by Department of Home Affairs

Use of Digital Device Examination to

examine electronic devices OFFICIAL: Sensitive Page 2 of 18
 OFFICIAL: Sensitive

1. Purpose
This Standard Operating Procedure (SOP) must be read in conjunction with Policy Statement – Electronic
Device Examination (BE-6168) and Procedural Instruction – Digital Device Examination (BE-6185) and all
associated SOPs and Supporting Material and applicable legislation.
These procedures will ensure that any activity undertaken meets accepted best practice for Digital Device
Examination (DDE) and any legislative requirements.
DDE activities must only be undertaken by appropriately trained and skilled DDE examining officers using
dedicated tools and rigorous procedures in accordance with legislation and electronic evidence handling
procedures so as to be admissible as evidentiary material in a court of law.
Examination of electronic devices should not be undertaken by unqualified/untrained persons as such
actions can:
• Potentially compromise electronic evidence affecting its admissibility
• Hinder the successful outcome of the Department of Home Affairs (the Department) objectives
• Cause damage to equipment or data resulting in civil claims or litigation against the Department
• Result in failure to bring an investigation to an appropriate conclusion
• Risk damage to the Department’s reputation.
This SOP supports the Department’s ability to demonstrate the reliability of the electronic evidence.

2. Scope
This SOP applies to all examinations of electronic devices by the Australian Border Force (the ABF) utilising
the Digital Device Examination equipment and capability.
Only mobile devices and removable data storage devices are to be examined using the DDE capability.

3. Standard Operating Procedure

under the Freedom of Information Act 1982
Released by Department of Home Affairs
Prior to examining a device the DDE examining officer must consider
• The ABF Statutory powers for the examination, including any legislated time limitations
• The purpose of the examination, including consultation with the client if necessary
• Whether the DDE examining officer possesses the necessary resources and tools to facilitate the
examination, including
o Software
o Hardware
o Cables, and/or
o Device documentation
• The operational environment the examination is occurring in. If the device belongs to a traveller the
officer should consider whether the device should be retained for examination so that the passenger
is not unnecessarily delayed. The examination length and comprehensiveness must be determined
by the operational need, not by external factors such as departing flights.

Use of Digital Device Examination to

examine electronic devices OFFICIAL: Sensitive Page 3 of 18
 OFFICIAL: Sensitive

3.1 Device Identification

DDE Examining officers must only examine mobile devices and removable data storage devices that they
have been trained to examine.
DDE Examining Officers encountering devices that they cannot identify, do not know how to operate or are
experiencing difficulty in examining should consider requesting these devices be examined by Digital
Forensics.

3.2 Data Preservation and Acquisition

All examinations of mobile devices and removable data storage devices must be undertaken using DDE
hardware and software to ensure the integrity of data and electronic evidence is maintained to the highest
level possible.
Ensure appropriate steps are taken to secure electronic devices and electronic records, as follows:
• A Digital Device Examination must be attempted before a manual examination is considered
• Mobile devices must be isolated from the mobile communications network (aeroplane/airplane/flight
mode turned on, SIM card removed, faraday bag and/or WIFI and Bluetooth disconnected) prior to any
examination
• SIM cards should be removed and extracted separately
• Removal of the SIM card is only mandatory if the device cannot be isolated from the network by
activating ‘Flight Mode’ on the device itself.
• Write protection must be ensured for any connected removable data storage device
• Consider acquiring data from removable storage separately
• Should there be any indication of third party encryption software being installed or encryption being
part of the operating system (e.g. encrypted volume) or anti-forensics techniques being installed such
as destructive devices and data wiping software, the device must be examined by Digital Forensics.
• If the device needs to be powered-down, consider whether it will be possible to unlock the device once
power is restored. If it is not possible to unlock the device then an examination using DDE equipment
must be attempted.

under the Freedom of Information Act 1982

Released by Department of Home Affairs
3.3 Examination and Analysis
3.3.1. Digital Device Examination Procedure
s. 47E(d)

Use of Digital Device Examination to

examine electronic devices OFFICIAL: Sensitive Page 4 of 18
 OFFICIAL: Sensitive
s. 47E(d)

under the Freedom of Information Act 1982

Released by Department of Home Affairs

Use of Digital Device Examination to

examine electronic devices OFFICIAL: Sensitive Page 5 of 18
 OFFICIAL: Sensitive
o If extracted electronic records are to be seized, copy data to external storage according to
current evidence handling procedures
o If extracted electronic records are to be copied under statutory authority copy data as per
Standard Operating Procedure BE-6198 – Use of Digital Device Examination – Copying,
transfer and storage of data.

3.3.2. Removable Data Storage Device Software Applications

The dedicated DDE computer system (laptop or workstation) is installed with a range of software tools for the
examination of removable data storage devices for its border related functions, including:
• An application which scans files for the presence of skin tone and key words of interest. As an
automated tool, it can reduce the time needed to examine devices and media when compared to
manual techniques, while increasing the likelihood of detecting material of interest.
• An application which can recover deleted material not accessible by the Windows operating system
and regular software applications.
• A data preview and imaging tool used to acquire data (electronic evidence) in a forensically sound
manner by creating copies of data without making changes to the original electronic evidence.
• A selection of media players able to play a range of video file types.
The dedicated DDE computer also has installed write -blocker software to prevent any changes to the data
on the removable data storage device being examined to ensure the integrity of the device.

3.3.3. Removable Data Storage Device Examination Procedure

s. 47E(d)

under the Freedom of Information Act 1982

Released by Department of Home Affairs

Use of Digital Device Examination to

examine electronic devices OFFICIAL: Sensitive Page 6 of 18
 OFFICIAL: Sensitive
s. 47E(d)

• Examine data to determine if prohibited material or relevant information has been located.
• If prohibited material is located, it must be dealt with and handled in accordance with current seizure
and evidence handling procedures.
• If information is located consider the need to copy the electronic record/s as outlined in Standard
Operating Procedure – Digital Device Examination – Copying, transfer and storage of data (BE-
6198).
• If no prohibited material is located or the device is not to be held pending further examination, all
removable data storage devices are to be returned to the owner.
During the examination process consideration must be given to the length of time for the examination with
regard to:
• The risk indicators leading to the decision to examine the device
• The amount of data apparent on the removable data storage device
• The length of time required for the s. 47E(d) applications.

3.4. Record Keeping

It is critical that DDE examining officers make contemporaneous notes in a form that enables them to
compile reports, statements, conduct interviews and, if required, be used as evidence in a Court of Law.
Contemporaneous notes are to be made in a DDE examining officer’s official notebook and on an approved
Digital Device Examination Form.

under the Freedom of Information Act 1982

If a DDE examining officer uses an ABF statutory power in relation to the examination of an electronic
Released by Department of Home Affairs
device, an official record must be made with details of the reasons that led them to form their state of mind
and the statutory power used, such as subparagraph 186A(1)(b)(i) of the Customs Act 1901 (the Customs
Act).
For the purposes of DDE all examinations must be recorded contemporaneously on an approved Digital
Device Examination Form and in Baggage Action General Statistics (BAGS) (where available). This form will
follow the approved form in Supporting Documentation – Electronic Device Examination Forms (BE-6199).
If BAGS is not available the examination is to be recorded in an Electronic Device Examination Register (see
Supporting Material – Electronic Device Examination Forms). A separate Digital Device Examination Form is
to be completed for each individual device.
This record keeping is in addition to all standard national and local record keeping procedures, such as the
s. 47E(d)

Should electronic records be copied under an ABF statutory power, such as section 186A of the Customs
Act, the copied data must be recorded consistently with the recording of mobile device
acquisitions/extractions.
Should the decision be made to hold a device pending examination, a DDE examining officer is required to
issue a Receipt for Goods (such as B390) to the person purporting to be the owner of the device as written

Use of Digital Device Examination to

examine electronic devices OFFICIAL: Sensitive Page 7 of 18
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
Released by Department of Home Affairs
under the Freedom of Information Act 1982
 OFFICIAL: Sensitive

Attachment C – Consultation
1.1. Internal Consultation
• Tactical Capability Branch, Close Support Command
• Operational Capability Branch, Major Capability Division
• Cyber Risk Services Branch
• ICT Division
• Integrity and Professional Standards
• Privacy and Information Disclosure Section
• PPCF Section
• Legal Group

under the Freedom of Information Act 1982

Released by Department of Home Affairs

Use of Digital Device Examination to

examine electronic devices OFFICIAL: Sensitive Page 16 of 18
Released by Department of Home Affairs
under the Freedom of Information Act 1982
 OFFICIAL: Sensitive

PST - Port Stanvac BUS - Busselton CAN - Canberra Airport

THE - Cape Thevenard PCE - Pearce Airport APP - ACT Parcels Post

WAL - Wallaroo WYD - Wyndham OFF - Offshore

ADA - Adelaide Airport PEX - Exmouth

WYA - Whyalla YAM - Yampi Sound

SAP - SA Parcels Post WPP - WA Parcels Post

ALH - Albany SPB - Spring Bay

BME - Broome BWT - Burnie

CVQ - Carnarvon DPO - Devonport

DRB - Derby BEL - Bell Bay

EPR - Esperance HBA - Hobart

FRE - Fremantle LST - Launceston

GET Geraldton NCP - Naracoopa

PHE - Port Hedland PLA - Port Latta

PER - Perth Airport PSY - Port Stanley

CCI - Cocos Island ULV - Ulverstone

under the Freedom of Information Act 1982

CHI - Christmas Island HBT - Hobart Airport
Released by Department of Home Affairs
CCU - Cape Cuvier ASP - Alice Springs

BUY - Bunbury DAR - Darwin

ONS - Onslow GTE - Groote Eylandt

PEH - Perth GOV - Gove

DAM - Dampier AYQ - Ayers Rock

USL - Useless Loop TIN - Tindal

SPP - Port Sampson DAA - Darwin Airport

Use of Digital Device Examination to

examine electronic devices OFFICIAL: Sensitive Page 18 of 18