6 ms·

Digital Privacy at the U.S Border: A New How-To Guide from EFF

145 points by dwaxe 10y ago

grabcocque 10y ago
"Your response to this dilemma may vary according to your risk assessment. However, all travelers should stay calm and respectful, should not lie to border agents or physically obstruct them, and should plan for this dilemma ahead of time. Try to document or politely ask for the names, badge numbers, and agencies of the government officers you interact with." I don't mean to be churlish but this advice is pretty weak sauce. I mean, I understand why they don't want necessarily want to admit the truth, that if you're a foreign national and you don't comply things will get nasty and you'll almost certainly be deported. However, that sadly seems to be the truth of Trump's TSA, and if the truth stinks, don't sugar coat it.
- df3 10y ago
  I think the best advice in the guide is what not to do. Be polite and most importantly, don't lie. Many people may not know that even an innocuous lie to a border agent is a federal crime.
- moonka 10y ago
  It does call it out in the guide. >Border agents cannot deny a U.S. citizen admission to the country. However, if a foreign visitor declines, an agent may deny them entry. If a lawful permanent resident declines, agents may raise complicated questions about their continued status as a resident.
  - grabcocque 10y ago
    I see that, but it still doesn't fundamentally address what you should do. 1) comply - possibly incriminating yourself, endangering your security and anyone you have contact with or 2) refuse, get arrested, harassed, deported and probably placed on some kind of watch list as a known troublemaker Which should you choose?
    - moonka 10y ago
      I'm not sure there's a third choice currently.
      - infinite8s 10y ago
        Don't travel to the US seems to be the only 3rd option.
        tremon 10y ago
        Also don't fly through US airspace, don't do stopovers in Canada either (because the larger Canadian airports have US officers).
        schoen 10y ago
        If you're talking about the preclearance facilities in the Canadian airports, they only inspect people who are departing on flights to the U.S.
    - schoen 10y ago
      A big point of the guide is that different people will want to choose differently between these two bad options.
    - tdb7893 10y ago
      If you want to go to America you have to comply. If you are stupid enough to have incriminating information on devices you are carrying across the border then you obviously refuse. The choice is just whether that privacy is more important than getting into America to you.
    - PeterisP 10y ago
      They do explicitly address that - as you yourself quoted above, travelers "... should plan for this dilemma ahead of time", i.e. depending on their personal situation, before the trip they should either be prepared to comply (ensuring beforehand that no incriminating information is accessible and full compliance, if needed, won't endanger themselves or others) or be prepared to refuse and face the consequences; if they believe that they are likely to be inspected for some reasons (the vast majority of travelers are not) then this includes making plans on how to mitigate the effects of not getting across the border.
- tdb7893 10y ago
  Of course not complying with border security as a foreigner will get you deported, I don't understand how you would expect anything else. I don't think foreigners who have refused directives from border security have ever gotten in, regardless of presidential administration.
- schoen 10y ago
  > the truth of Trump's TSA, The agency that people are dealing with in this case is CBP, not TSA. TSA has no border search authority. We put out the first version of this guide in 2011. So far we don't know for sure if border searches have gotten more prevalent or more intrusive under the Trump administration. It's very possible, but may not be clear from statistics for about a year. They've definitely been getting more press and public attention.
df3 10y ago
For US citizens, encrypting your device, backing up with cloud storage, and accepting that your device may be seized if you don't provide passwords at the border sounds like the most usable (albeit imperfect) solution. I'm not too concerned about my personal data at the moment. I interact with many non-citizens on a regular basis, and I am concerned that a misinterpreted Facebook message or email could land them in hot water. It's not just ourselves we're protecting, but also our friends, family and colleagues.
- defen 10y ago
  At this point, spending $200 to get a burner laptop and dumb phone for international travel sounds like a really good investment - it doesn't seem to be worth the risk of taking your own hardware. Do you want TSA imaging your laptop (after you've unlocked it for them so they won't confiscate it) and putting whatever secret keys and embarrassing / private info is on there, into their own system, forever?
  - df3 10y ago
    I travel frequently enough internationally that I need to bring my devices with me. If ICE (not TSA) asked me to log into my computer or phone, I would say no and accept the risk that they confiscate my encrypted devices. The likelihood of ICE asking me to log into my devices and confiscating them is quite low. The inconvenience of using burner devices is quite high. This of course assumes that the government is unwilling or unable to defeat your encryption.
    - schoen 10y ago
      Although ICE does have border search authority, the people who will normally perform border searches (and possibly ask you to unlock your device) are neither TSA nor ICE, but rather CBP! They're the people who staff the front-line immigration and customs checkpoints in the ports and perform the interviews there.
    - PeterisP 10y ago
      This assumes that you are a USA citizen; for non-citizens the risk is not accepting the risk of confiscating the devices but removing their current (and possibly future) ability to travel to and through USA, which is a major risk if one travels frequently.
walterbell 10y ago
What not to do: https://medium.com/@thegrugq/stop-fabricating-travel-security-advice-35259bf0e869 https://medium.com/@thegrugq/stop-fabricating-travel-securit...
- ar15saveslives 10y ago
  tl;dr: "Don't even try to protect you personal data".
- lacampbell 10y ago
  Stuff like this is making me feel that I am never going to the US on my own dime. If I'm going to be turned away for reset devices, no devices or not giving my passwords to online accounts - then I give up.
- fuzzybeard 10y ago
  I feel like the author left out a giant caveat: there's a difference between going through CBP as a US citizen and as a non-citizen. Non-citizens can be bounced back home whereas, as I understand it, they HAVE to allow a US citizen back into the states if he has a valid passport and isn't violating any laws.
  - hackuser 10y ago
    The EFF guides cover these questions; click the link.
  - URSpider94 10y ago
    They have to re-admit you if you are a citizen, but in the mean time, they can search your belongings, seize your devices, detain you for an arbitrary period of time without a phone call, and interrogate you. Oh, and add you to a watch list so you are detained every time you enter the country. In addition, there IS a law on the books that says that you must give reasonable assistance to CBP in conducting a search, or be subject to a fine and jail time. CBP construes this to mean that you must give them the encryption passwords to your devices. EFF and others disagree, but the matter has never been decided in court, in part because CBP drops the cases if they are challenged.
lemming 10y ago
The U.S. government reported a five-fold increase in the number of electronic media searches at the border in a single year, from 4,764 in 2015 to 23,877 in 2016. It's worth pointing out that this isn't all Trump related, things have been heading in this direction for a while now. Trump has made the border crossing into the Stanford Prison Experiment, though.
mido22 10y ago
(as a Non-american), what I am sensing is, either bend over for the inspection or buzz off and leave your things behind, guess I ll just never visit NYC, anyway Paris is better for vacations :P
- tutanchamun 10y ago
  I always wanted to see the Grand Canyon, Yellowstone, Yosemite and the many other beautiful national parks, as well as the citys. But with the stuff that's happened against visitors since 2001 I probably will never visit the united states ever and stay in europe.
  - pawadu 10y ago
    OT: Although I personally would rather visit one of the big national parks in Africa. But since that seems a bit dangerous right now, could you recommend some interesting national parks in EU-land?
    - mido22 10y ago
      come to Sweden, we got lots :)
- BugsJustFindMe 10y ago
  As an american living in Paris, I actually think that NYC would be better for vacations. Of course if you really want better for vacations, you go to the american southwest not the northeastern megalopolis.
  - mido22 10y ago
    you are missing the point, NYC is not worth the humiliation I might suffer
grkvlt 10y ago
Would it help to just take e.g. a kindle with a few best sellers on my international flight, and keep my uncharged/wiped/whatever devices in hold baggage? I seem to recall in the US you go through passport control _before_ retrieving your checked bags, right? Although, I also remember having them searched at JFK last year, maybe at the customs enforcement point after baggage reclaim? So, maybe not 100% foolproof, depends at what point these searches by ICE are happening?
- Sir_Substance 10y ago
  Depends on what level of security you want, I guess. The US has a known history of successfully modifying circuitry of devices mid-transit to monitor them[1]. I prefer to keep my electronic devices on me when I fly, but more because I've seen the way baggage handlers throw bags around. [1]https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
  - grkvlt 10y ago
    And, what level of threat you perceive to be relevant. For myself, I am not worried about the NSA, TSA or ICE inserting custom hardware into my devices while they are in transit...
- benmarks 10y ago
  The risk of your gear being stolen from your bag is likely higher.
- kyboren 10y ago
  No. You will pick up your checked baggage before being diverted to a search area at the exit, where openly Trump-supporting CBP officers will, after violating the Hatch act, treat you like shit, ridicule and attempt to humiliate you, rummage through your stuff, and intentionally leave it all a mess for you to repack. While it's unofficial CBP policy to harass in any way possible--the more petty the better--citizens who refuse to answer questions, I have not yet experienced a device search, so this is just speculation; CBP might just get your checked bag(s) and demand your assistance while you're in the main secondary detention area.
gunnyguy121 10y ago
could I just separate my hard drive from my laptop? could they confiscate one or the other? could they put them together?
- southbridge 10y ago
  Underrated post
pawadu 10y ago
What does HN readers think about this statement? "Depending on your priorities, a Chromebook can make a particularly good travel laptop when traveling somewhere with decent Internet access. ... Chromebooks minimize the data stored on the device itself and are particularly easy to clear or reset."

145 points by dwaxe 10y ago

"Your response to this dilemma may vary according to your risk assessment. However, all travelers should stay calm and respectful, should not lie to border agents or physically obstruct them, and should plan for this dilemma ahead of time. Try to document or politely ask for the names, badge numbers, and agencies of the government officers you interact with." I don't mean to be churlish but this advice is pretty weak sauce. I mean, I understand why they don't want necessarily want to admit the truth, that if you're a foreign national and you don't comply things will get nasty and you'll almost certainly be deported. However, that sadly seems to be the truth of Trump's TSA, and if the truth stinks, don't sugar coat it.

df3 10y ago
I think the best advice in the guide is what not to do. Be polite and most importantly, don't lie. Many people may not know that even an innocuous lie to a border agent is a federal crime.
moonka 10y ago
It does call it out in the guide. >Border agents cannot deny a U.S. citizen admission to the country. However, if a foreign visitor declines, an agent may deny them entry. If a lawful permanent resident declines, agents may raise complicated questions about their continued status as a resident.
- grabcocque 10y ago
  I see that, but it still doesn't fundamentally address what you should do. 1) comply - possibly incriminating yourself, endangering your security and anyone you have contact with or 2) refuse, get arrested, harassed, deported and probably placed on some kind of watch list as a known troublemaker Which should you choose?
  - moonka 10y ago
    I'm not sure there's a third choice currently.
    - infinite8s 10y ago
      Don't travel to the US seems to be the only 3rd option.
      - tremon 10y ago
        Also don't fly through US airspace, don't do stopovers in Canada either (because the larger Canadian airports have US officers).
        schoen 10y ago
        If you're talking about the preclearance facilities in the Canadian airports, they only inspect people who are departing on flights to the U.S.
  - schoen 10y ago
    A big point of the guide is that different people will want to choose differently between these two bad options.
  - tdb7893 10y ago
    If you want to go to America you have to comply. If you are stupid enough to have incriminating information on devices you are carrying across the border then you obviously refuse. The choice is just whether that privacy is more important than getting into America to you.
  - PeterisP 10y ago
    They do explicitly address that - as you yourself quoted above, travelers "... should plan for this dilemma ahead of time", i.e. depending on their personal situation, before the trip they should either be prepared to comply (ensuring beforehand that no incriminating information is accessible and full compliance, if needed, won't endanger themselves or others) or be prepared to refuse and face the consequences; if they believe that they are likely to be inspected for some reasons (the vast majority of travelers are not) then this includes making plans on how to mitigate the effects of not getting across the border.
tdb7893 10y ago
Of course not complying with border security as a foreigner will get you deported, I don't understand how you would expect anything else. I don't think foreigners who have refused directives from border security have ever gotten in, regardless of presidential administration.
schoen 10y ago
> the truth of Trump's TSA, The agency that people are dealing with in this case is CBP, not TSA. TSA has no border search authority. We put out the first version of this guide in 2011. So far we don't know for sure if border searches have gotten more prevalent or more intrusive under the Trump administration. It's very possible, but may not be clear from statistics for about a year. They've definitely been getting more press and public attention.

df3 10y ago

For US citizens, encrypting your device, backing up with cloud storage, and accepting that your device may be seized if you don't provide passwords at the border sounds like the most usable (albeit imperfect) solution. I'm not too concerned about my personal data at the moment. I interact with many non-citizens on a regular basis, and I am concerned that a misinterpreted Facebook message or email could land them in hot water. It's not just ourselves we're protecting, but also our friends, family and colleagues.

defen 10y ago
At this point, spending $200 to get a burner laptop and dumb phone for international travel sounds like a really good investment - it doesn't seem to be worth the risk of taking your own hardware. Do you want TSA imaging your laptop (after you've unlocked it for them so they won't confiscate it) and putting whatever secret keys and embarrassing / private info is on there, into their own system, forever?
- df3 10y ago
  I travel frequently enough internationally that I need to bring my devices with me. If ICE (not TSA) asked me to log into my computer or phone, I would say no and accept the risk that they confiscate my encrypted devices. The likelihood of ICE asking me to log into my devices and confiscating them is quite low. The inconvenience of using burner devices is quite high. This of course assumes that the government is unwilling or unable to defeat your encryption.
  - schoen 10y ago
    Although ICE does have border search authority, the people who will normally perform border searches (and possibly ask you to unlock your device) are neither TSA nor ICE, but rather CBP! They're the people who staff the front-line immigration and customs checkpoints in the ports and perform the interviews there.
  - PeterisP 10y ago
    This assumes that you are a USA citizen; for non-citizens the risk is not accepting the risk of confiscating the devices but removing their current (and possibly future) ability to travel to and through USA, which is a major risk if one travels frequently.

walterbell 10y ago

What not to do: https://medium.com/@thegrugq/stop-fabricating-travel-security-advice-35259bf0e869 https://medium.com/@thegrugq/stop-fabricating-travel-securit...

ar15saveslives 10y ago
tl;dr: "Don't even try to protect you personal data".
lacampbell 10y ago
Stuff like this is making me feel that I am never going to the US on my own dime. If I'm going to be turned away for reset devices, no devices or not giving my passwords to online accounts - then I give up.
fuzzybeard 10y ago
I feel like the author left out a giant caveat: there's a difference between going through CBP as a US citizen and as a non-citizen. Non-citizens can be bounced back home whereas, as I understand it, they HAVE to allow a US citizen back into the states if he has a valid passport and isn't violating any laws.
- hackuser 10y ago
  The EFF guides cover these questions; click the link.
- URSpider94 10y ago
  They have to re-admit you if you are a citizen, but in the mean time, they can search your belongings, seize your devices, detain you for an arbitrary period of time without a phone call, and interrogate you. Oh, and add you to a watch list so you are detained every time you enter the country. In addition, there IS a law on the books that says that you must give reasonable assistance to CBP in conducting a search, or be subject to a fine and jail time. CBP construes this to mean that you must give them the encryption passwords to your devices. EFF and others disagree, but the matter has never been decided in court, in part because CBP drops the cases if they are challenged.

lemming 10y ago

The U.S. government reported a five-fold increase in the number of electronic media searches at the border in a single year, from 4,764 in 2015 to 23,877 in 2016. It's worth pointing out that this isn't all Trump related, things have been heading in this direction for a while now. Trump has made the border crossing into the Stanford Prison Experiment, though.

mido22 10y ago

(as a Non-american), what I am sensing is, either bend over for the inspection or buzz off and leave your things behind, guess I ll just never visit NYC, anyway Paris is better for vacations :P

tutanchamun 10y ago
I always wanted to see the Grand Canyon, Yellowstone, Yosemite and the many other beautiful national parks, as well as the citys. But with the stuff that's happened against visitors since 2001 I probably will never visit the united states ever and stay in europe.
- pawadu 10y ago
  OT: Although I personally would rather visit one of the big national parks in Africa. But since that seems a bit dangerous right now, could you recommend some interesting national parks in EU-land?
  - mido22 10y ago
    come to Sweden, we got lots :)
BugsJustFindMe 10y ago
As an american living in Paris, I actually think that NYC would be better for vacations. Of course if you really want better for vacations, you go to the american southwest not the northeastern megalopolis.
- mido22 10y ago
  you are missing the point, NYC is not worth the humiliation I might suffer

grkvlt 10y ago

Would it help to just take e.g. a kindle with a few best sellers on my international flight, and keep my uncharged/wiped/whatever devices in hold baggage? I seem to recall in the US you go through passport control _before_ retrieving your checked bags, right? Although, I also remember having them searched at JFK last year, maybe at the customs enforcement point after baggage reclaim? So, maybe not 100% foolproof, depends at what point these searches by ICE are happening?

Sir_Substance 10y ago
Depends on what level of security you want, I guess. The US has a known history of successfully modifying circuitry of devices mid-transit to monitor them[1]. I prefer to keep my electronic devices on me when I fly, but more because I've seen the way baggage handlers throw bags around. [1]https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
- grkvlt 10y ago
  And, what level of threat you perceive to be relevant. For myself, I am not worried about the NSA, TSA or ICE inserting custom hardware into my devices while they are in transit...
benmarks 10y ago
The risk of your gear being stolen from your bag is likely higher.
kyboren 10y ago
No. You will pick up your checked baggage before being diverted to a search area at the exit, where openly Trump-supporting CBP officers will, after violating the Hatch act, treat you like shit, ridicule and attempt to humiliate you, rummage through your stuff, and intentionally leave it all a mess for you to repack. While it's unofficial CBP policy to harass in any way possible--the more petty the better--citizens who refuse to answer questions, I have not yet experienced a device search, so this is just speculation; CBP might just get your checked bag(s) and demand your assistance while you're in the main secondary detention area.

gunnyguy121 10y ago

could I just separate my hard drive from my laptop? could they confiscate one or the other? could they put them together?

southbridge 10y ago
Underrated post

pawadu 10y ago

What does HN readers think about this statement? "Depending on your priorities, a Chromebook can make a particularly good travel laptop when traveling somewhere with decent Internet access. ... Chromebooks minimize the data stored on the device itself and are particularly easy to clear or reset."