Needing to protect your data from customs searches is now a thing...

[julianhigginson]

Interesting article on the realities of what can happen to personal (and business) data these days.

So far it's one documented case in the US, but this could just as easily be China, India, or any place I've been with a bunch of commercial in confidence information and my own personal device with all my own personal stuff on it.

https://medium.freecodecamp.com/ill-never-bring-my-phone-on-an-international-flight-again-neither-should-you-e9289cde0e5f#.5kcdz9qu6

For Android phones, a full ADB bootloader unlock/lock wipe, then setup a new google account before getting on the plane looks like the minimum necessary precaution before making trip through customs now.

A laptop would be a bigger problem. If you couldn't just not take one, you'd need a brand new traveller machine, which has had no accounts logged in (well, the same new google account would be OK I guess..) and no files or programs except bare minimum required for the trip, copied in via LAN or USB.

And you would be putting it all straight into e-waste for recycling after a customs incident like that.

I wonder how many corporations who operate in the US are implementing rules about this sort of thing right now? Automated cloning of work email accounts minus secret/confidential discussions for the purposes of having real data in devices without also having to risk anything critical.

[skylinrcr01]

Interesting article on the realities of what can happen to personal (and business) data these days.

So far it's one documented case in the US, but this could just as easily be China, India, or any place I've been with a bunch of commercial in confidence information and my own personal device with all my own personal stuff on it.

https://medium.freecodecamp.com/ill-never-bring-my-phone-on-an-international-flight-again-neither-should-you-e9289cde0e5f#.5kcdz9qu6

For Android phones, a full ADB bootloader unlock/lock wipe, then setup a new google account before getting on the plane looks like the minimum necessary precaution before making trip through customs now.

A laptop would be a bigger problem. If you couldn't just not take one, you'd need a brand new traveller machine, which has had no accounts logged in (well, the same new google account would be OK I guess..) and no files or programs except bare minimum required for the trip, copied in via LAN or USB.

And you would be putting it all straight into e-waste for recycling after a customs incident like that.

I wonder how many corporations who operate in the US are implementing rules about this sort of thing right now? Automated cloning of work email accounts minus secret/confidential discussions for the purposes of having real data in devices without also having to risk anything critical.

You could also just swap hard drives, and run a thin build of linux on your existing laptop, kind of a pain, but a lot better than having 2 separate computers.

[HAL-42b]

Anyone who has the power to decrypt the data by definition also has the ability to plant any 'evidence' they like. If they want to find child porn on your phone they can, and you can't do anything about it.

 

[julianhigginson]

That was my first thought RE the computer, but my laptop is expensive as it's a high powered Lenovo built for doing heavy CAD work. So while the risk of incident is currently very low, the cost of an incident would be high.

I guess for me in my current situation, personally, as long as this doesn't become a regular thing, I could swap out the drive in my personal time, and install a brand new windows, and copy files, and on average, be better off than if I had bought a new low power traveller computer.

But where I've travelled with a work computer, paying me or IT to have to swap out the drive, reinstall windows, blah blah blah, it's going to add up to the point where a cheap burner is likely cheaper in the first place.

[EEVblog]

I guess if you had a fast enough pipe on both sides you could encrypt the drive, upload somewhere, travel with a blank hard drive, and reload once there?
PITA I know...

[julianhigginson]

Anyone who has the power to decrypt the data by definition also has the ability to plant any 'evidence' they like. If they want to find child porn on your phone they can, and you can't do anything about it.

Not so worried about obviously planted child porn... That situation would obviously be terrible for someone who experienced it, but it's not something that can happen very often to be statistically significant without someone realising that certain people always get busted with the same kinds of files in the same place by the same investigators...

I'm much more worried about a coming world of industrial scale harvesting of computer and phone data that then gets handed out to every gimp with a government employee number (or worse!) and the ways this can then be abused as it's completely unprotected when used the way law enforcement eventually wants access to it.

See the current push for the scale at which all Australian telecomunications metadata is now wanted to be used, when on rollout of the metadata retention system, they originally said it was only for *worst of the worst* criminal investigations at the highest level, now maybe it's going to be OK for people running civil cases against other people to have access to the other people's historical location and communication records.

[EEVblog]

If this happened to me and I was stopped at the US border and asked to hand over my passwords, I'd just head back home. Screw that.

[julianhigginson]

I guess if you had a fast enough pipe on both sides you could encrypt the drive, upload somewhere, travel with a blank hard drive, and reload once there?
PITA I know...

Definitely possible! I mean that's basically what you'd do with your android or apple phone... flush everything off it, have the dummy account on there, then when you get to where you are going, sign back in with the real accounts and boom - it's all back there (That might be problematic in china if you use google though! - do they still block some google IPs?)

And depending on what work materials you have to take over, it's definitely going to be best if you can cloud/server it and not take a physical copy at all.

I also guess for things like manufacturing handover, or presentations for meet and greet with new possible suppliers, it's often quite possible to just ditch a computer completely and just travel with the minimum files in an encrypted zip file on a couple of dvds for redundancy. they could demand the passwords to those zip files and take the data but then you're no worse off than if you had the PC compromised, and you don't have a computer with the possibility of malware at every level, from the peripheral controllers up... :-)

[julianhigginson]

If this happened to me and I was stopped at the US border and asked to hand over my passwords, I'd just head back home. Screw that.

Yes, but that decision could be hard to explain to your CEO if the business was depending on you going somewhere to do something..

Also it's particularly hard to manage if the country doing this is meant to be your home, like it was with this NASA guy..
:-)

[james_s]

Passwords for what? I don't even have a facebook account, so they can ask for the password to that until they're blue in the face and I can't give it to them. Clear the logins and browser history and how are they going to know what to look for? I have at least 10 email addresses, which one are they going to check? I'm no fan of the whole cloud fad but this is one situation where storing my data elsewhere may actually have advantages. Of course I don't personally have anything on my laptop or phone that the border patrol would have any interest in but I'd still rather not have them poking around. If I have to travel internationally I'll bring a laptop that has only what I need for the trip on it. My personal phone doesn't have roaming anyway so I pick up a $20 prepaid phone when I reach my destination.

[EEVblog]

Also it's particularly hard to manage if the country doing this is meant to be your home, like it was with this NASA guy..

In that case you refuse point blank.
They cannot refuse citizens entry into their own country.
They can detain you of course for some time under some ridiculous law, but not indefinitely. You just have to be willing to wait them out.
They will eventually either have to charge you with a crime and arrest you, or let you go.
And not giving up your passwords when asked is not a crime, only refusing a court order becomes crime, and even that is of course contestable.

[DimitriP]

Statistically insignificant.

What is significant is that NASA doesn't seem to have a protocol in place  so that its people know how to handle situations such as this.

But it makes a great article that everyone will click on and get outraged and share and tweet, and link and folllow  etc etc etc ...it's what keeps the internet going...unfortunatelly.

[EEVblog]

What is significant is that NASA doesn't seem to have a protocol in place  so that its people know how to handle situations such as this.

I bet they do now.

But it makes a great article that everyone will click on and get outraged and share and tweet, and link and folllow  etc etc etc ...it's what keeps the internet going...unfortunatelly.

It's fun to play "what if".

[Halcyon]

Standard encryption on Android and Apple handsets are enough provided you use a strong password (at the moment). A 4-digit PIN offers little protection against brute force attacks.

And not giving up your passwords when asked is not a crime, only refusing a court order becomes crime, and even that is of course contestable.

To clarify, a court can order you to give up your password or anything to unlock/disable encryption under certain circumstances. As you mentioned, refusal or not doing so is a further crime. Any Police officer (Constable) in Australia can apply to a magistrate for such an order.

Code: [Select]

CRIMES ACT 1914 - SECT 3LA

Person with knowledge of a computer or a computer system to assist access etc.
             (1)  A constable may apply to a magistrate for an order requiring a specified person to provide any information or assistance that is reasonable and necessary to allow a constable to do one or more of the following:

                     (a)  access data held in, or accessible from, a computer or data storage device that:

                              (i)  is on warrant premises; or

                             (ii)  has been moved under subsection 3K(2) and is at a place for examination or processing; or

                            (iii)  has been seized under this Division;

                     (b)  copy data held in, or accessible from, a computer, or data storage device, described in paragraph (a) to another data storage device;

                     (c)  convert into documentary form or another form intelligible to a constable:

                              (i)  data held in, or accessible from, a computer, or data storage device, described in paragraph (a); or

                             (ii)  data held in a data storage device to which the data was copied as described in paragraph (b); or

                            (iii)  data held in a data storage device removed from warrant premises under subsection 3L(1A).

             (2)  The magistrate may grant the order if the magistrate is satisfied that:

                     (a)  there are reasonable grounds for suspecting that evidential material is held in, or is accessible from, the computer or data storage device; and

                     (b)  the specified person is:

                              (i)  reasonably suspected of having committed the offence stated in the relevant warrant; or

                             (ii)  the owner or lessee of the computer or device; or

                            (iii)  an employee of the owner or lessee of the computer or device; or

                            (iv)  a person engaged under a contract for services by the owner or lessee of the computer or device; or

                             (v)  a person who uses or has used the computer or device; or

                            (vi)  a person who is or was a system administrator for the system including the computer or device; and

                     (c)  the specified person has relevant knowledge of:

                              (i)  the computer or device or a computer network of which the computer or device forms or formed a part; or

                             (ii)  measures applied to protect data held in, or accessible from, the computer or device.

             (3)  If:

                     (a)  the computer or data storage device that is the subject of the order is seized under this Division; and

                     (b)  the order was granted on the basis of an application made before the seizure;

the order does not have effect on or after the seizure.

Note:          An application for another order under this section relating to the computer or data storage device may be made after the seizure.

             (4)  If the computer or data storage device is not on warrant premises, the order must:

                     (a)  specify the period within which the person must provide the information or assistance; and

                     (b)  specify the place at which the person must provide the information or assistance; and

                     (c)  specify the conditions (if any) determined by the magistrate as the conditions to which the requirement on the person to provide the information or assistance is subject.

             (5)  A person commits an offence if the person fails to comply with the order.

Penalty for contravention of this subsection:        Imprisonment for 2 years.



[MarkS]

They can detain you of course for some time under some ridiculous law, but not indefinitely. You just have to be willing to wait them out.

ROTFL! Oh wait... You're serious.

[mtdoc]

As long as you keep your self away from social movements or anything political or the espionage shit, and be a quiet businessman or engineer, I see no reason why you should be afraid of it.

Yes. Of course. Just be good, obedient (and quiet) slaves worker bees.

Remember:

“If you want to keep a secret, you must also hide it from yourself.”

[james_s]

As long as you keep your self away from social movements or anything political or the espionage shit, and be a quiet businessman or engineer, I see no reason why you should be afraid of it.

Yes. Of course. Just be good, obedient (and quiet) slaves worker bees.

Remember:

“If you want to keep a secret, you must also hide it from yourself.”

You can do whatever you want, but keeping a low profile is a good way not to arouse suspicion and will save a lot of hassle. I've never really had any trouble with law enforcement or border patrol, doesn't mean I always agree with what they do but I'm just polite and cooperative, though I don't volunteer any information they don't ask for. The less reason I give them to dig any deeper, the less I have to exercise my legal rights. Be aware of what they're looking for and try not to fit the profile, there *are* people out there with bad intentions and weeding them out without impacting the innocent is not a trivial task. I do think that going through phones and asking for passwords and such should require probable cause and a warrant though.

[JPortici]

But it makes a great article that everyone will click on and get outraged and share and tweet, and link and folllow  etc etc etc ...it's what keeps the internet going...unfortunatelly.

medium dot com. i know what you mean.

[EEVblog]

I do think that going through phones and asking for passwords and such should require probable cause and a warrant though.

It does. That doesn't stop them from asking in a very intimidating way and tricking you into thinking they have the authority to demand it. They rely on people caving in.

[SingedFingers]

For ref this is a problem in the sector I work in (financial).

We carry dumb machines as terminals and our desktops are entirely hosted inside Amazon AWS.

We only carry dumbphones on company business.

[RGB255_0_0]

As long as you keep your self away from social movements or anything political or the espionage shit, and be a quiet businessman or engineer, I see no reason why you should be afraid of it.

Yes. Of course. Just be good, obedient (and quiet) slaves worker bees.

Remember:

“If you want to keep a secret, you must also hide it from yourself.”

You can do whatever you want, but keeping a low profile is a good way not to arouse suspicion and will save a lot of hassle. I've never really had any trouble with law enforcement or border patrol, doesn't mean I always agree with what they do but I'm just polite and cooperative, though I don't volunteer any information they don't ask for. The less reason I give them to dig any deeper, the less I have to exercise my legal rights. Be aware of what they're looking for and try not to fit the profile, there *are* people out there with bad intentions and weeding them out without impacting the innocent is not a trivial task. I do think that going through phones and asking for passwords and such should require probable cause and a warrant though.

Hard to not fit into the profile if you're not white.

Even a school teacher was denied entry to the US because he was Muslim.

I wouldn't give an employer my password to social media and neither the governments of the countries I visit.

[Delta]

See the current push for the scale at which all Australian telecomunications metadata is now wanted to be used, when on rollout of the metadata retention system, they originally said it was only for *worst of the worst* criminal investigations at the highest level, now maybe it's going to be OK for people running civil cases against other people to have access to the other people's historical location and communication records.

That is the big worry, the constant creep of how such surveillance / information gathering laws and systems can be used.

Here in the UK we have more CCTV cameras per head of population than anywhere else (AFAIK), all done on the pretence of public safety, crime prevention, etc. And to be fair, a lot of criminals have been convicted based on CCTV evidence, but then councils got access to the cameras and started using them to dish out parking tickets.

Even if things are introduced with genuine good intentions, if it can be abused, it WILL be.

[Ampera]

I hate this shit. Leave us the heck alone, you're not stopping any terrorists at the airport by scanning their phones.

How about a full encryption of everything, but you don't know the key? If you encrypt it and store something like a bitlocker key with family via secure email, then you can retrieve the key once you get there and decrypt everything.

Or maybe a red herring installation? Install a second copy of windows, hide the other behind bitlocker or another version of partition encryption, and when asked for something like this, give them the password for the red herring installation. Hide the other partition as best you can, and put some dummy fake accounts and red herring applications on the installation to keep them happy.

You could also do the extreme and send the encrypted device or hard drive overseas by airmail (TAKE BACKUP FIRST). If it's really critical you can use something like 2-3 day shipping. Could cost a bit, but so does traveling in general.

[Halcyon]

I hate this shit. Leave us the heck alone, you're not stopping any terrorists at the airport by scanning their phones.

How about a full encryption of everything, but you don't know the key? If you encrypt it and store something like a bitlocker key with family via secure email, then you can retrieve the key once you get there and decrypt everything.

Or maybe a red herring installation? Install a second copy of windows, hide the other behind bitlocker or another version of partition encryption, and when asked for something like this, give them the password for the red herring installation. Hide the other partition as best you can, and put some dummy fake accounts and red herring applications on the installation to keep them happy.

You could also do the extreme and send the encrypted device or hard drive overseas by airmail (TAKE BACKUP FIRST). If it's really critical you can use something like 2-3 day shipping. Could cost a bit, but so does traveling in general.

TwoOfFive; With all due respect, law enforcement, customs, national security etc... etc... aren't interested in you unless you've come under notice for something before.

As for "not stopping any terrorists at the airport", that couldn't be further from the truth. Most of it isn't reported to the public so you wouldn't have any idea. There have been several instances in this country where plots have been foiled and those are just the ones I know about. There is much more at play. Police and National Security agencies are doing a pretty good job at keeping you safe if you live in the US, UK, AU, NZ...

[tszaboo]

So searching your phone is a bigger scare for people, than cavity search.
And some think, the US does not have acess to all the information you need? Sure have my phone. There is no password on it, swipe up, like this, and have fun. Read my SMSes, and my contact list, that is what is interesting for you, isnt it. Everything else in on my gmail account, you have that already. I even upload all my photos to the cloud,  I hope you checked that I'm not burning your precious flag, and I dont behead people. I have nothing to hide.

[Delta]

This story does seem a bit dubious though.....

http://www.snopes.com/jpl-scientist-cbp-phone/

[langwadt]

I do think that going through phones and asking for passwords and such should require probable cause and a warrant though.

It does. That doesn't stop them from asking in a very intimidating way and tricking you into thinking they have the authority to demand it. They rely on people caving in.

https://en.wikipedia.org/wiki/Border_search_exception

[EEVblog]

I do think that going through phones and asking for passwords and such should require probable cause and a warrant though.

It does. That doesn't stop them from asking in a very intimidating way and tricking you into thinking they have the authority to demand it. They rely on people caving in.

https://en.wikipedia.org/wiki/Border_search_exception

And in particular:
https://en.wikipedia.org/wiki/Border_search_exception#Electronic_materials
They might have the ability to search your laptop hard drive, but it seems there is no right to force to disclose passwords. So if it's encrypted, that is their problem.
And given that most things are online these days and don't actually reside on your computer, it seems those things don't fall under this exception.
i.e. if they ask for your password so that they can access files stored remotely that are not on your computer you are carrying with you.
That's like being asked to provide the combination to your safe at home.

[lem_ix]

As usual, such measures are only good at harassing regular citizens. Terrorists don't declare their ideals at customs

[mc172]

Why doesn't some bright spark come up with an app whereby you could tell them a specific but incorrect password or PIN code to type in, triggering deletion of all of the decryption codes? Far better than the you have 10 attempts before the data is erased. They're not going to buy that on attempt nine.

[G7PSK]

Just use an old Nokia phone, customs can do whatever they like, no information other than phone numbers.

[SingedFingers]

Just use an old Nokia phone, customs can do whatever they like, no information other than phone numbers.

You laugh but we're issued Nokia 106's as company phones for exactly that reason.

[langwadt]

I do think that going through phones and asking for passwords and such should require probable cause and a warrant though.

It does. That doesn't stop them from asking in a very intimidating way and tricking you into thinking they have the authority to demand it. They rely on people caving in.

https://en.wikipedia.org/wiki/Border_search_exception

And in particular:
https://en.wikipedia.org/wiki/Border_search_exception#Electronic_materials
They might have the ability to search your laptop hard drive, but it seems there is no right to force to disclose passwords. So if it's encrypted, that is their problem.
And given that most things are online these days and don't actually reside on your computer, it seems those things don't fall under this exception.
i.e. if they ask for your password so that they can access files stored remotely that are not on your computer you are carrying with you.
That's like being asked to provide the combination to your safe at home.

more like trying to cross a border with a locked safe and refusing to open it up, I'd have to have diplomat passport to do that 

[CJay]

I don't think a big country's government will be interested in your business secret.
As long as you keep your self away from social movements or anything political or the espionage shit, and be a quiet businessman or engineer, I see no reason why you should be afraid of it.

Depends how big your business is and who your clients are.

As for staying non political, we've a right to become involved with any legitimate political movement or party without fear of oppression or intimidation so that very much sounds like state sponsored intimidation?

I want my government to know when I'm pissed off at their actions and I will not give up the right to protest actions I disagree with, even if that protest is as seemingly innocuous as a vote.

[CatalinaWOW]

This overt snooping may be new, but covert snooping by most first world countries along with up and comers has been going on for 25 or more years.  In response to this some companies have had policies requiring sterile phones and computers for international travel for two decades.  The days of "Gentlemen don't read others mail" are long gone if they ever existed. 

It is a personal decision whether you care about this, but if you have anything that you don't care to share with a third party don't take it with you when you travel.  It doesn't matter whether it is the design of the next generation of the iPhone or embarrassing pictures of you with small animals.  Since that makes some kinds of business next to impossible you are left with some difficult trade offs.  What quality of encryption do you need?  What is the minimum data set required to execute the purpose of the trip.  Should you partition data for transmission by different paths and re-assembly at the destination?  Can you partition the business to keep eliminate the need for travel by the sensitive parts?  Can you execute your business plan faster than someone else can exploit it?  And so on through a long list of possibilities.

[Monkeh]

And not giving up your passwords when asked is not a crime

It is in the UK.

[RGB255_0_0]

Catalina is on the money - thinclients and remote office are solutions to the problem. It's the way companies are moving, not just from espionage, but from theft or loss of equipment. Exchange users can have their phones remotely wiped, but in the case of being stopped at the border, whether you are allowed to make a phone call is improbable.

 In that case never holding any data on the devices themselves is secure practice for the aforementioned.

[G7PSK]

Intercepting mail has been going on since Elizabethan days here in the UK at least and probably the rest of Europe. Tapping telegraph lines since they were invented, The US got into the first world war partly if not largely due to the fact that all German transatlantic telegrams had to route through the UK and so were listened to.

[rstofer]

Buy a cell phone at the destination and leave it behind - destroyed...
Run the laptop off a bootable Linux CD with data elsewhere.  No hard drive installed...
I don't do social media other than a couple of forums.

OTOH, I don't travel any more and there's no way I will ever go through that nonsense at the airport.  If I can't drive, I won't go.  That's the nice part about being retired.  I don't have to travel!

[JPortici]

And not giving up your passwords when asked is not a crime

It is in the UK.

really? that's disgusting

[fubar.gr]

For Android phones, a full ADB bootloader unlock/lock wipe, then setup a new google account before getting on the plane looks like the minimum necessary precaution before making trip through customs now.

I don't think this is going to work. Traveling abroad with a "blank" smartphone will raise even more suspicions.

[RGB255_0_0]

For Android phones, a full ADB bootloader unlock/lock wipe, then setup a new google account before getting on the plane looks like the minimum necessary precaution before making trip through customs now.

I don't think this is going to work. Traveling abroad with a "blank" smartphone will raise even more suspicions.

Some films, Family Guy, Arrested Development and some games on there and your mum's phone number and I doubt they'd be that suspicious.

[CatalinaWOW]

Catalina is on the money - thinclients and remote office are solutions to the problem. It's the way companies are moving, not just from espionage, but from theft or loss of equipment. Exchange users can have their phones remotely wiped, but in the case of being stopped at the border, whether you are allowed to make a phone call is improbable.

 In that case never holding any data on the devices themselves is secure practice for the aforementioned.

They aren't solutions, they just change the nature of the exploits.  If your data has value, someone will chase it.  It is all just a multiway trade between how valuable your data is, and how much effort you are willing to make to keep it yours alone and how much effort someone else is willing to make to get it. 

There is also an unfortunate backwards trapdoor function involved.  If there is data somewhere that is very valuable someone will expend very large resources to exploit it.  Having done that, the incremental effort to get data protected in the same way is likely to be small.  So your data may come under sophisticated attack even though it isn't very valuable.

If I were protecting data I would look very hard at one time pads, though there are several difficulties with this type of system.

[MarkS]

I do think that going through phones and asking for passwords and such should require probable cause and a warrant though.

It does. That doesn't stop them from asking in a very intimidating way and tricking you into thinking they have the authority to demand it. They rely on people caving in.

Actually, in the United States, due to a recent boneheaded Supreme Court ruling, it does not.

[GreyWoolfe]

Because my company works with governmental agencies here and abroad, those who travel internationally must have a clean laptop and cell phone for travel.  I'm a lowly field tech so no international travel for me.  Personally, I would have asked, loudly, for my company supplied lawyer.  No one is getting access to my company phone, tablet or laptop.  Hold me as long as you want, that will just add to my overtime.

[rfeecs]

In the US, there is the 5th Amendment right to not incriminate yourself that should protect you even from a warrant to give up your password.

Although it has been argued over:
https://en.wikipedia.org/wiki/Key_disclosure_law#United_States

[james_s]

The one time I traveled internationally for work, the US border patrol agent at the airport actually said "Welcome home", I was floored. Usually when I go to Canada I drive, and when returning I'm greeted by a group of surly military looking men who glare at me suspiciously while the others use flashlights to peer through the windows of my car. I've joked before that we need a sign at the border that says "Welcome to America. Fuck you."

While not related to the border, I've found that the trick to dealing with TSA at the airports is to be super nice and polite to them. They are not police officers, they are more or less ordinary people who have been given an official looking uniform and badge and some (poor) training. Almost everybody hates them and treats them like crap. When you are nice to them it catches them off guard and most of the time they have waved me through with few issues. That's all security theater, numerous times I've gotten through and then realized I had a pocket knife or other banned object in my carry on.

[julianhigginson]

Blueskull,

It's not about me personally being "worth hacking" I have no delusions of my own importance on the world stage.

The problem is when it's done as a matter of course, and then access to all the data is slopped around any government agencies that think they might want to use it, then all  the captured data becomes a massive target for all sorts of other groups of people. It becomes something that is worth stealing for many reasons. Soon enough someone will stick in a big straw and slurp it all up.

In a  business/work related angle, sure the NSA and border protection don't care if I've designed a widget with x,y,z features.
But when criminal orgs eventually get their hands on all the captured data, you can bet a competitor can pay someone to search for anything related to my customer's name, find all my docs and the captured data, and then get all the trade secrets they want. This is particularly a problem for me, as I have non disclosure agreements in my contracts, and so having my data harvested by incompetently managed government programs can put me in breach of contract...

Or how about I annoy someone in my day to day life, so they go to this black market data harvester and pay to get any information on me that can be found. then they go through all my emails, receipts, bank details, and use that to attack me?
 
Or how about I'm a married christian family man who happens to have a gay lover on the side (seems to be a pretty common thing, eh?) and I organise to meet him by emails a few times and we talk about our relationship and our feelings for each other? the government wouldn't care (well, not till president pence kicks into high gear)  but when the data ends up in other hands it can be mined to expose huge groups of people like this to extreme blackmail. And depending on what kind of job someone like this has, those results could be massive.

Or how about by some miracle the huge pile of insanely valuable information never gets hacked, but one day the government decides to search all emails and web history for any kind of "flags" and then puts people on a blacklist or prison, depending on what they might have spoken about or someone might have looked at on one of their devices?

Or how about the data capture process doesn't just capture data, but opens up a big back door in your device which never gets shut, and then lets someone who knows what to trawl for go into devices and grab all that data from anyone in future and build up their own database in parallel?

Right now companies like google and apple already hold most of this kind of information, and generally, they have been mostly good at protecting it because their business relies on that. They do provide info to specific agencies on specific accounts when requested, but generally government doesn't hold that much data on everyone's business...  Government is full of incompetents who have nothing to lose over the breach of a dataset like this. And so it is way more likely to be breached on a massive scale than google or apple.

[julianhigginson]

Think of it another way, the TSA naked scanner. The scanner used nowadays have built in CV algorithm, so no critical images are ever stored. The algorithm only shows processed image with only marks on where should the officers search. That's a good way to both satisfy the government's requirement of screening prohibited articles, and not leaking critical privacy.

The point is, government should have the power to inspect your phones, however they also must have a mechanism to protect your personal information, such as all "seems to be not harmful" information must be deleted from their computer immediately after investigation, or they simply don't copy data from your phone unless they see actual tangible risks.

Google is doing the same thing. They collect user data, but they neither leak it, nor keep the data in a way that can be used to trace you. So does Amazon. Together these two companies can control all my money and information, but I have nothing to fear. Unless they intentionally want to screw up billion of their users, otherwise I see no threat. If one day I become Chinese top rich, maybe I will care about this, But not now.

I hate government's superpower as everyone else does, but the point is, the government does this not just for fun. They're not a phone club or a readers' club, and they're not attracted by your phones. There must be a safety/security reason behind this.

Think of it another way - until enough situations were published, where the full vision naked scanner was seen as being abused, and people got mad about it, and things suddenly managed to get changed, the naked scanner was EXACTLY what it says on the tin.

The naked scanner was what the people doing the work wanted and used, despite anyone else's expectations of basic personal privacy under their clothes.  Without people sticking their noses in and going "hey this sucks, stop it" the naked scanner and its equivalents is exactly what you get.

My point is, where is any discussion right now, about what happens to the contents of peoples devices that might get harvested? there is no discussion. that means there's no protection, no collapsing to relevant information on specific points of knowledge. just wholesale data retention. Data storage is so cheap now and machine learning is so powerful. Nobody who wants to control populations could resist keeping it all. And the problem with that is eventually they're also not going to be able to control it.

[Cubdriver]

The point is, government should have the power to inspect your phones, however they also must have a mechanism to protect your personal information, such as all "seems to be not harmful" information must be deleted from their computer immediately after investigation, or they simply don't copy data from your phone unless they see actual tangible risks.

Google is doing the same thing. They collect user data, but they neither leak it, nor keep the data in a way that can be used to trace you. So does Amazon. Together these two companies can control all my money and information, but I have nothing to fear. Unless they intentionally want to screw up billion of their users, otherwise I see no threat. If one day I become Chinese top rich, maybe I will care about this, But not now.

I hate government's superpower as everyone else does, but the point is, the government does this not just for fun. They're not a phone club or a readers' club, and they're not attracted by your phones. There must be a safety/security reason behind this.

No, without probable cause and a warrant, the government should ABSOLUTELY NOT have the power to inspect my phone.  Simply put, without a good reason for suspicion, it's none of their damned business what's on my phone.  Returning from a trip overseas is not probable cause.  Google and Amazon may be doing the same thing, but I am not required to use either of them, and they are not capable of detaining me against my will and/or imprisoning me in order to extract information.  The government is.

If there's a safety/security reason for it, then it should be possible to get a warrant.

-Pat

[aargee]

I have an old(er) iPhone 5. You could just keep feeding them the wrong PIN, with a totally confused look on your face, until the phone locks itself?

If anything, it will make it interesting.

[Rutherfordium]

I've noticed those stupid Border Security shows on TV always seem to go through people's phones to see what they've been saying to the people they're supposedly visiting.  It is very creepy and intrusive, and really spurns a desire for open borders to me.

[MarkS]

No, without probable cause and a warrant, the government should ABSOLUTELY NOT have the power to inspect my phone.  Simply put, without a good reason for suspicion, it's none of their damned business what's on my phone.  Returning from a trip overseas is not probable cause.  Google and Amazon may be doing the same thing, but I am not required to use either of them, and they are not capable of detaining me against my will and/or imprisoning me in order to extract information.  The government is.

If there's a safety/security reason for it, then it should be possible to get a warrant.

-Pat

It was originally intended to catch child predators that went on "sex tours" in third world countries. However, that is really irrelevant these days. It is too easy to upload your data to the cloud or dark net and wipe your device. However, once a law is implemented it is next to impossible to get it repealed, especially when "security" is involved.

[mtdoc]

Governments have the right to protect their borders and to prevent smuggling in of illicit drugs, certain agricultural products, banned weapons, etc.  The extension of this right to electronic devices was ostensibly done to prevent importation of child pornography. But, at least now, that is an unjustified argument since of course no child pornographer would do attempt that - not when they can anonymously transfer files on the internet or mail digital media.

Governments should not ever have the right to examine a person's private thoughts and lets face it - our phones, tablets and laptops are now just extensions of our brains. 

Governments should not have the right to examine our communications with others without probable cause.  With probable cause and search warrant issued by a court then yes - I have no problem in those limited cases, allowing the government to examine what is on a persons electronic device.

That is not what is happening here. 

[CJay]

Google is doing the same thing. They collect user data, but they neither leak it, nor keep the data in a way that can be used to trace you. So does Amazon. Together these two companies can control all my money and information, but I have nothing to fear. Unless they intentionally want to screw up billion of their users, otherwise I see no threat. If one day I become Chinese top rich, maybe I will care about this, But not now.

So you don't mind data harvesting as long as you have no data worth harvesting but if you did have then you'd be upset.

Unfortunately, if you don't stand up for your rights when they're under threat you'll find they've become incredibly difficult, if not impossible to get back later when you need them.

There are any number of dystopian fantasy novels, films, Anime etc. etc. that are beginning to look more like accurate predictions year on year.

[SingedFingers]

There are any number of dystopian fantasy novels, films, Anime etc. etc. that are beginning to look more like accurate predictions year on year.

Indeed. V for Vendetta is pretty much the way the UK is heading...

[EEVblog]

And not giving up your passwords when asked is not a crime

It is in the UK.

Really?
An officer can simply ask you for your passwords and you will go to jail if you do not give it to them?
Got a reference for that?
Nothing about passwords here:
http://www.theverge.com/2013/7/15/4524208/uk-border-police-seize-download-mobile-phone-data-under-anti-terror-law

[EEVblog]

The point is, government should have the power to inspect your phones

Screw that. Not without a warrant they shouldn't.

I hate government's superpower as everyone else does, but the point is, the government does this not just for fun. They're not a phone club or a readers' club, and they're not attracted by your phones. There must be a safety/security reason behind this.

There isn't. It's security theater, done to "protect you" from the imaginary boogy man you have been taught to fear.

[EEVblog]

I seriously think that if I went to the US again I would just get my phone and laptop couriered to my hotel upon arrival.

[Red Squirrel]

It is ridiculous how much our rights and freedoms are being taken away these days and not much we can do.  What makes matters worse is the fact that most people don't really seem to care, especially older people who don't really use technology much.

This kind of crap is starting to happen in Canada too.  They past a bill called Bill C-51 a few years ago which is like the US patriot act.  It's basically a mass surveillance bill making all the surveillance legal, and also giving them more powers to share info between countries etc.

Definitely would avoid bringing any electronics/data through a border or at an airport. If you have to, use a basic machine with nothing installed.  Download, install and configure VPN client once you're at your destination.  You could maybe carry the certificates on a micro SD card that is shoved in your luggage.

[MarkS]

I seriously think that if I went to the US again I would just get my phone and laptop couriered to my hotel upon arrival.

They would still have to pass through customs.

[tronde]

I hate government's superpower as everyone else does, but the point is, the government does this not just for fun. They're not a phone club or a readers' club, and they're not attracted by your phones. There must be a safety/security reason behind this.

Never underestimate the power of money.

Since you mentioned the body scanner:
https://theintercept.com/2015/05/27/tsa-body-scanner-lobbyist-takes-congressional-job-overseeing-spending-tsa-security/

[Monkeh]

And not giving up your passwords when asked is not a crime

It is in the UK.

Really?
An officer can simply ask you for your passwords and you will go to jail if you do not give it to them?
Got a reference for that?
Nothing about passwords here:
http://www.theverge.com/2013/7/15/4524208/uk-border-police-seize-download-mobile-phone-data-under-anti-terror-law

http://www.legislation.gov.uk/ukpga/2000/23/part/III

53 Failure to comply with a notice.

(1)A person to whom a section 49 notice has been given is guilty of an offence if he knowingly fails, in accordance with the notice, to make the disclosure required by virtue of the giving of the notice.

[CJay]

I seriously think that if I went to the US again I would just get my phone and laptop couriered to my hotel upon arrival.

I doubt I'd trust it ever again, if I really wanted to make sure my stuff was secure I'd be buying a burner laptop and phone on arrival then installing/restoring over a VPN

[mtdoc]

A good summary of the ongoing evolution of the Police state.  Mostly about the US,  but applicable to all other Western countries as well:

The Illusion of Freedom: the Police State Is Alive and Well

    “What happened here was the gradual habituation of the people, little by little, to being governed by surprise; to receiving decisions deliberated in secret; to believing that the situation was so complicated that the government had to act on information which the people could not understand, or so dangerous that, even if the people could understand it, it could not be released because of national security… This separation of government from people, this widening of the gap, took place so gradually and so insensibly, each step disguised (perhaps not even intentionally) as a temporary emergency measure or associated with true patriotic allegiance or with real social purposes. And all the crises and reforms (real reforms, too) so occupied the people that they did not see the slow motion underneath, of the whole process of government growing remoter and remoter.”

    —Historian Milton Mayer, They Thought They Were Free: The Germans, 1933-45

[Delta]

There isn't. It's security theater, done to "protect you" from the imaginary boogy man you have been taught to fear.

You are absolutely correct in that what we see is nothing but security theatre, but to state that the threats we face are imaginary is just ludicrous.

[julianhigginson]

https://www.crikey.com.au/2014/09/04/the-real-threat-of-terrorism-to-australians-by-the-numbers/

imaginary? no. statistically insignificant compared to the resources thrown at them and the rights taken away in defending against them? hell yeah.

[EEVblog]

I seriously think that if I went to the US again I would just get my phone and laptop couriered to my hotel upon arrival.

They would still have to pass through customs.

Which they wouldn't care less about.

[EEVblog]

https://www.crikey.com.au/2014/09/04/the-real-threat-of-terrorism-to-australians-by-the-numbers/

imaginary? no. statistically insignificant compared to the resources thrown at them and the rights taken away in defending against them? hell yeah.

That's exactly what I'm talking about.
The boogy monster is completely imaginary in relation to how many will get caught by searching phones and computers at customs.
Meanwhile we have to live in a world were our privacy can be taken away on a whim by anyone with a badge.
It should require probable cause and a warrant.

Now, an argument can be made that they could do it to non-citizens entering their country, and those people have the option to either come to that country or not. But to citizens, hell no. If you let this kind of thing slide then you do deserve the totalitarian society you will end up with.

There isn't much I'd go to jail for, but this is one of them. I'd be "that guy" on the 6 o'clock news setting the national precedent case.

[mtdoc]

https://www.crikey.com.au/2014/09/04/the-real-threat-of-terrorism-to-australians-by-the-numbers/

imaginary? no. statistically insignificant compared to the resources thrown at them and the rights taken away in defending against them? hell yeah.

And similar statistics for the US  which has been expending enormous resources:  money, human lives, and other less tangible costs to fight the "war on terror" - a war which only promotes growth of more terrorism and less safety.

The boogy monster is completely imaginary in relation to how many will get caught by searching phones and computers at customs.
Meanwhile we have to live in a world were our privacy can be taken away on a whim by anyone with a badge.

The constant state of fear that is promoted and encouraged serves its purpose for politicians and the MIC...

The real cost of this unachievable goal to ensure complete security is very high.

[MarkS]

Which they wouldn't care less about.

You think they haven't thought of this?

[timb]

There isn't. It's security theater, done to "protect you" from the imaginary boogy man you have been taught to fear.

You are absolutely correct in that what we see is nothing but security theatre, but to state that the threats we face are imaginary is just ludicrous.

The last time I traveled (NC to CA and back), I managed to get a 7" flip blade knife onto the plane. Both ways!

Now, I didn't do it on purpose, but still, I was pretty amazed. (I had given it to my GF the week before to hold in her purse, then forgot about.)

I guess the TSA agents were more concerned about all the random wires, batteries and circuit boards in my backpack, as I got pulled for bag searches both ways, yet they never noticed the knife in her purse.

Yet I still have to take off my shoes and can't carry shampoo. Its ludicrous.

[digsys]

Remember, not that long ago, here in Melbourne, they introduced a law (or tried to?), where they could stop anyone in the streets and demand proof of ID#, fingerprints? etc,
IN CASE they had done something wrong !! All the usual bullshlt "if you've done nothing wrong, you have nothing to worry about" !! Well, it didn't last long :-) Unbefookinlieveable !

[james_s]

The last time I traveled (NC to CA and back), I managed to get a 7" flip blade knife onto the plane. Both ways!

Now, I didn't do it on purpose, but still, I was pretty amazed. (I had given it to my GF the week before to hold in her purse, then forgot about.)

I guess the TSA agents were more concerned about all the random wires, batteries and circuit boards in my backpack, as I got pulled for bag searches both ways, yet they never noticed the knife in her purse.

Yet I still have to take off my shoes and can't carry shampoo. Its ludicrous.

A few years ago I flew back from Bend, OR to Seattle. Now the airport in Bend is a tiny little thing, the sort of place where you wait in a glass walled terminal until your plane pulls up outside and then you line up and walk out onto the tarmac and climb aboard. Security at the time was just the old fashioned metal detector you walk through and an ancient baggage xray machine, none of those fancy body scanners or anything. When I arrived back in Seattle it occurred to me that I was in the secure area of a major airport, having completely bypassed all the fancy security by taking a 40 minute flight from a small town.

One could also get a large amount of liquid or other substance on a plane by simply finding a stash point and having a few dozen people carry the allowed amount through security and deposit it in the arranged location or hand it off to somebody. It's not as if someone planning an attack wouldn't have the resources to do this.

I don't worry about it though, terrorist attacks are exceedingly rare, I'm more likely to die in a plane crash caused by mechanical failure or human error, and far more likely than that to die in my car on the way to the airport. In the US roughly 50,000 people are killed every year in car crashes, that's equivalent to a typical passenger jet going down every single day. It's so common that few even think about it, people fear terrorists but think nothing of having a few drinks and then driving home, or playing with their phone as they barrel down the highway in 4,000 lbs of steel.

[HoracioDos]

I'm always complaining why we can't be a developed and serious country. But when I see these things I'm quite happy living below parallel 35 south.

By the way, there's something strange about this case. In Latin America if you shout and complain a lot you can get away with it.

[mc172]

One could also get a large amount of liquid or other substance on a plane by simply finding a stash point and having a few dozen people carry the allowed amount through security and deposit it in the arranged location or hand it off to somebody. It's not as if someone planning an attack wouldn't have the resources to do this.

This makes me laugh. You can do a lot of damage with 100 ml of certain clear liquids, and some of those liquids are quite easily produced using things available around the house. I obviously do not condone this, however my point is that this whole "restricted volume of any fluid" bollocks is merely a facade.

[MarkS]

This makes me laugh. You can do a lot of damage with 100 ml of certain clear liquids, and some of those liquids are quite easily produced using things available around the house. I obviously do not condone this, however my point is that this whole "restricted volume of any fluid" bollocks is merely a facade.

It's all a facade. It is about the feeling of security, not actual security. No one that knows anything about this truly believes that there is any way to secure transportation against threats, but that is unacceptable to the public. We want security! We DEMAND security! Don't bother us with facts and logic!