As I understand it, they generally don't just aimlessly scroll through your email/facebook in front of you, then give your device back (although they can, if they feel like it) - they get you to surrender your credentials, then save these in their database; the contents of the accounts will then be downloaded automatically.

Same for devices - they have you unlock the device, then take it away, plug it into a PC/whatever, which sucks down a complete image of the device. Then they give it back, if they feel like it.

Obviously, if they do this with your email & facebook, they're also sucking in all your connections - your social graph: everyone you've ever emailed or has emailed you, everyone you're connected to on facebook.

Thanks for the details? Is it a common procedure? Are they doing that to everyone coming to US?

I think the answers to those are probably: No one really knows, and No, not yet - although they do now (optionally) ask for your facebook/twitter usernames when applying for an ETSA.