Needing to protect your data from customs searches is now a thing...

[Delta]

This story does seem a bit dubious though.....

http://www.snopes.com/jpl-scientist-cbp-phone/

[langwadt]

I do think that going through phones and asking for passwords and such should require probable cause and a warrant though.

It does. That doesn't stop them from asking in a very intimidating way and tricking you into thinking they have the authority to demand it. They rely on people caving in.

https://en.wikipedia.org/wiki/Border_search_exception

[EEVblog]

I do think that going through phones and asking for passwords and such should require probable cause and a warrant though.

It does. That doesn't stop them from asking in a very intimidating way and tricking you into thinking they have the authority to demand it. They rely on people caving in.

https://en.wikipedia.org/wiki/Border_search_exception

And in particular:
https://en.wikipedia.org/wiki/Border_search_exception#Electronic_materials
They might have the ability to search your laptop hard drive, but it seems there is no right to force to disclose passwords. So if it's encrypted, that is their problem.
And given that most things are online these days and don't actually reside on your computer, it seems those things don't fall under this exception.
i.e. if they ask for your password so that they can access files stored remotely that are not on your computer you are carrying with you.
That's like being asked to provide the combination to your safe at home.

[lem_ix]

As usual, such measures are only good at harassing regular citizens. Terrorists don't declare their ideals at customs

[mc172]

Why doesn't some bright spark come up with an app whereby you could tell them a specific but incorrect password or PIN code to type in, triggering deletion of all of the decryption codes? Far better than the you have 10 attempts before the data is erased. They're not going to buy that on attempt nine.

[G7PSK]

Just use an old Nokia phone, customs can do whatever they like, no information other than phone numbers.

[SingedFingers]

Just use an old Nokia phone, customs can do whatever they like, no information other than phone numbers.

You laugh but we're issued Nokia 106's as company phones for exactly that reason.

[langwadt]

I do think that going through phones and asking for passwords and such should require probable cause and a warrant though.

It does. That doesn't stop them from asking in a very intimidating way and tricking you into thinking they have the authority to demand it. They rely on people caving in.

https://en.wikipedia.org/wiki/Border_search_exception

And in particular:
https://en.wikipedia.org/wiki/Border_search_exception#Electronic_materials
They might have the ability to search your laptop hard drive, but it seems there is no right to force to disclose passwords. So if it's encrypted, that is their problem.
And given that most things are online these days and don't actually reside on your computer, it seems those things don't fall under this exception.
i.e. if they ask for your password so that they can access files stored remotely that are not on your computer you are carrying with you.
That's like being asked to provide the combination to your safe at home.

more like trying to cross a border with a locked safe and refusing to open it up, I'd have to have diplomat passport to do that 

[CJay]

I don't think a big country's government will be interested in your business secret.
As long as you keep your self away from social movements or anything political or the espionage shit, and be a quiet businessman or engineer, I see no reason why you should be afraid of it.

Depends how big your business is and who your clients are.

As for staying non political, we've a right to become involved with any legitimate political movement or party without fear of oppression or intimidation so that very much sounds like state sponsored intimidation?

I want my government to know when I'm pissed off at their actions and I will not give up the right to protest actions I disagree with, even if that protest is as seemingly innocuous as a vote.

[CatalinaWOW]

This overt snooping may be new, but covert snooping by most first world countries along with up and comers has been going on for 25 or more years.  In response to this some companies have had policies requiring sterile phones and computers for international travel for two decades.  The days of "Gentlemen don't read others mail" are long gone if they ever existed. 

It is a personal decision whether you care about this, but if you have anything that you don't care to share with a third party don't take it with you when you travel.  It doesn't matter whether it is the design of the next generation of the iPhone or embarrassing pictures of you with small animals.  Since that makes some kinds of business next to impossible you are left with some difficult trade offs.  What quality of encryption do you need?  What is the minimum data set required to execute the purpose of the trip.  Should you partition data for transmission by different paths and re-assembly at the destination?  Can you partition the business to keep eliminate the need for travel by the sensitive parts?  Can you execute your business plan faster than someone else can exploit it?  And so on through a long list of possibilities.

[Monkeh]

And not giving up your passwords when asked is not a crime

It is in the UK.

[RGB255_0_0]

Catalina is on the money - thinclients and remote office are solutions to the problem. It's the way companies are moving, not just from espionage, but from theft or loss of equipment. Exchange users can have their phones remotely wiped, but in the case of being stopped at the border, whether you are allowed to make a phone call is improbable.

 In that case never holding any data on the devices themselves is secure practice for the aforementioned.

[G7PSK]

Intercepting mail has been going on since Elizabethan days here in the UK at least and probably the rest of Europe. Tapping telegraph lines since they were invented, The US got into the first world war partly if not largely due to the fact that all German transatlantic telegrams had to route through the UK and so were listened to.

[rstofer]

Buy a cell phone at the destination and leave it behind - destroyed...
Run the laptop off a bootable Linux CD with data elsewhere.  No hard drive installed...
I don't do social media other than a couple of forums.

OTOH, I don't travel any more and there's no way I will ever go through that nonsense at the airport.  If I can't drive, I won't go.  That's the nice part about being retired.  I don't have to travel!

[JPortici]

And not giving up your passwords when asked is not a crime

It is in the UK.

really? that's disgusting

[fubar.gr]

For Android phones, a full ADB bootloader unlock/lock wipe, then setup a new google account before getting on the plane looks like the minimum necessary precaution before making trip through customs now.

I don't think this is going to work. Traveling abroad with a "blank" smartphone will raise even more suspicions.

[RGB255_0_0]

For Android phones, a full ADB bootloader unlock/lock wipe, then setup a new google account before getting on the plane looks like the minimum necessary precaution before making trip through customs now.

I don't think this is going to work. Traveling abroad with a "blank" smartphone will raise even more suspicions.

Some films, Family Guy, Arrested Development and some games on there and your mum's phone number and I doubt they'd be that suspicious.

[CatalinaWOW]

Catalina is on the money - thinclients and remote office are solutions to the problem. It's the way companies are moving, not just from espionage, but from theft or loss of equipment. Exchange users can have their phones remotely wiped, but in the case of being stopped at the border, whether you are allowed to make a phone call is improbable.

 In that case never holding any data on the devices themselves is secure practice for the aforementioned.

They aren't solutions, they just change the nature of the exploits.  If your data has value, someone will chase it.  It is all just a multiway trade between how valuable your data is, and how much effort you are willing to make to keep it yours alone and how much effort someone else is willing to make to get it. 

There is also an unfortunate backwards trapdoor function involved.  If there is data somewhere that is very valuable someone will expend very large resources to exploit it.  Having done that, the incremental effort to get data protected in the same way is likely to be small.  So your data may come under sophisticated attack even though it isn't very valuable.

If I were protecting data I would look very hard at one time pads, though there are several difficulties with this type of system.

[MarkS]

I do think that going through phones and asking for passwords and such should require probable cause and a warrant though.

It does. That doesn't stop them from asking in a very intimidating way and tricking you into thinking they have the authority to demand it. They rely on people caving in.

Actually, in the United States, due to a recent boneheaded Supreme Court ruling, it does not.

[GreyWoolfe]

Because my company works with governmental agencies here and abroad, those who travel internationally must have a clean laptop and cell phone for travel.  I'm a lowly field tech so no international travel for me.  Personally, I would have asked, loudly, for my company supplied lawyer.  No one is getting access to my company phone, tablet or laptop.  Hold me as long as you want, that will just add to my overtime.

[rfeecs]

In the US, there is the 5th Amendment right to not incriminate yourself that should protect you even from a warrant to give up your password.

Although it has been argued over:
https://en.wikipedia.org/wiki/Key_disclosure_law#United_States

[james_s]

The one time I traveled internationally for work, the US border patrol agent at the airport actually said "Welcome home", I was floored. Usually when I go to Canada I drive, and when returning I'm greeted by a group of surly military looking men who glare at me suspiciously while the others use flashlights to peer through the windows of my car. I've joked before that we need a sign at the border that says "Welcome to America. Fuck you."

While not related to the border, I've found that the trick to dealing with TSA at the airports is to be super nice and polite to them. They are not police officers, they are more or less ordinary people who have been given an official looking uniform and badge and some (poor) training. Almost everybody hates them and treats them like crap. When you are nice to them it catches them off guard and most of the time they have waved me through with few issues. That's all security theater, numerous times I've gotten through and then realized I had a pocket knife or other banned object in my carry on.

[julianhigginson]

Blueskull,

It's not about me personally being "worth hacking" I have no delusions of my own importance on the world stage.

The problem is when it's done as a matter of course, and then access to all the data is slopped around any government agencies that think they might want to use it, then all  the captured data becomes a massive target for all sorts of other groups of people. It becomes something that is worth stealing for many reasons. Soon enough someone will stick in a big straw and slurp it all up.

In a  business/work related angle, sure the NSA and border protection don't care if I've designed a widget with x,y,z features.
But when criminal orgs eventually get their hands on all the captured data, you can bet a competitor can pay someone to search for anything related to my customer's name, find all my docs and the captured data, and then get all the trade secrets they want. This is particularly a problem for me, as I have non disclosure agreements in my contracts, and so having my data harvested by incompetently managed government programs can put me in breach of contract...

Or how about I annoy someone in my day to day life, so they go to this black market data harvester and pay to get any information on me that can be found. then they go through all my emails, receipts, bank details, and use that to attack me?
 
Or how about I'm a married christian family man who happens to have a gay lover on the side (seems to be a pretty common thing, eh?) and I organise to meet him by emails a few times and we talk about our relationship and our feelings for each other? the government wouldn't care (well, not till president pence kicks into high gear)  but when the data ends up in other hands it can be mined to expose huge groups of people like this to extreme blackmail. And depending on what kind of job someone like this has, those results could be massive.

Or how about by some miracle the huge pile of insanely valuable information never gets hacked, but one day the government decides to search all emails and web history for any kind of "flags" and then puts people on a blacklist or prison, depending on what they might have spoken about or someone might have looked at on one of their devices?

Or how about the data capture process doesn't just capture data, but opens up a big back door in your device which never gets shut, and then lets someone who knows what to trawl for go into devices and grab all that data from anyone in future and build up their own database in parallel?

Right now companies like google and apple already hold most of this kind of information, and generally, they have been mostly good at protecting it because their business relies on that. They do provide info to specific agencies on specific accounts when requested, but generally government doesn't hold that much data on everyone's business...  Government is full of incompetents who have nothing to lose over the breach of a dataset like this. And so it is way more likely to be breached on a massive scale than google or apple.

[julianhigginson]

Think of it another way, the TSA naked scanner. The scanner used nowadays have built in CV algorithm, so no critical images are ever stored. The algorithm only shows processed image with only marks on where should the officers search. That's a good way to both satisfy the government's requirement of screening prohibited articles, and not leaking critical privacy.

The point is, government should have the power to inspect your phones, however they also must have a mechanism to protect your personal information, such as all "seems to be not harmful" information must be deleted from their computer immediately after investigation, or they simply don't copy data from your phone unless they see actual tangible risks.

Google is doing the same thing. They collect user data, but they neither leak it, nor keep the data in a way that can be used to trace you. So does Amazon. Together these two companies can control all my money and information, but I have nothing to fear. Unless they intentionally want to screw up billion of their users, otherwise I see no threat. If one day I become Chinese top rich, maybe I will care about this, But not now.

I hate government's superpower as everyone else does, but the point is, the government does this not just for fun. They're not a phone club or a readers' club, and they're not attracted by your phones. There must be a safety/security reason behind this.

Think of it another way - until enough situations were published, where the full vision naked scanner was seen as being abused, and people got mad about it, and things suddenly managed to get changed, the naked scanner was EXACTLY what it says on the tin.

The naked scanner was what the people doing the work wanted and used, despite anyone else's expectations of basic personal privacy under their clothes.  Without people sticking their noses in and going "hey this sucks, stop it" the naked scanner and its equivalents is exactly what you get.

My point is, where is any discussion right now, about what happens to the contents of peoples devices that might get harvested? there is no discussion. that means there's no protection, no collapsing to relevant information on specific points of knowledge. just wholesale data retention. Data storage is so cheap now and machine learning is so powerful. Nobody who wants to control populations could resist keeping it all. And the problem with that is eventually they're also not going to be able to control it.

[Cubdriver]

The point is, government should have the power to inspect your phones, however they also must have a mechanism to protect your personal information, such as all "seems to be not harmful" information must be deleted from their computer immediately after investigation, or they simply don't copy data from your phone unless they see actual tangible risks.

Google is doing the same thing. They collect user data, but they neither leak it, nor keep the data in a way that can be used to trace you. So does Amazon. Together these two companies can control all my money and information, but I have nothing to fear. Unless they intentionally want to screw up billion of their users, otherwise I see no threat. If one day I become Chinese top rich, maybe I will care about this, But not now.

I hate government's superpower as everyone else does, but the point is, the government does this not just for fun. They're not a phone club or a readers' club, and they're not attracted by your phones. There must be a safety/security reason behind this.

No, without probable cause and a warrant, the government should ABSOLUTELY NOT have the power to inspect my phone.  Simply put, without a good reason for suspicion, it's none of their damned business what's on my phone.  Returning from a trip overseas is not probable cause.  Google and Amazon may be doing the same thing, but I am not required to use either of them, and they are not capable of detaining me against my will and/or imprisoning me in order to extract information.  The government is.

If there's a safety/security reason for it, then it should be possible to get a warrant.

-Pat