9 ms·
Border Search of Electronic Devices – CBP Directive [pdf]
- troydavis 9y agoSection 5.1 (page 4) describes new rules for US CBP searches: “Officers may not intentionally use the device to access information that is solely stored remotely. Officers will either request that the traveler disable connnectivity to any remote network…”
- zmmmmm 9y agoIt's like an advertisement for Chromebooks ...
- brndnmtthws 9y agoSo it sounds like a workaround is to avoid storing any data locally on the device. I wonder how effective that would be in practice. It might raise some suspicion if you unlocked your phone and they discovered you were logged out of everything, and there was nothing on the phone.
- jsjohnst 9y ago> It might raise some suspicion if you unlocked your phone and they discovered you were logged out of everything, and there was nothing on the phone. There are countries[0] I travel to where that’s exactly what they find, essentially a freshly wiped phone. Hasn’t raised suspicion yet. [0] it’s also how I travel to certain security conferences. Buy a used/refurbished device before, use for duration of event, sell immediately after.
- mysterypie 9y ago> sell [device] immediately after I've heard people say that if their laptop or phone were searched out of their sight by border officials, they'd sell it afterward. But is it ethical? I think this meat might be contaminated; I'm not going to risk eating it, so I'll sell it.
- jsjohnst 9y ago> But is it ethical? Oh, the e-word! The word that has an entirely different meaning to every person you ask and more often than not, when it’s drug out in an Internet debate it turns into a pseudo-Gotwin’s Law alternative. I’ll spin is back to you to prove the point. Is it ethical the work environment that the device you are using to reply to me with was built in? Is it ethical that it was built with environmentally unfriendly materials and practices? Is it ethical that the electricity to power your device (and this site and the internet in between) is not 100% renewable? Is it ethical that you have advantages in life that many of the billions of people in the world have? If you really want to have a discussion on ethics, I’m happy to entertain it, but this doesn’t seem to be the time or place for it.
- carapace 9y agoYou're doing it, do you think it's ethical? If so, why? (I actually don't care, but your response was ridiculous and I noticed you avoided answering.)
- dang 9y agoWould you please stop posting uncivil and/or unsubstantive comments to HN? You've done this a fair bit, and it violates the spirit of this site, as described at https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html. Your comment would be fine with just the first sentence.
- carapace 9y agoDang, I respect you and the work you do here, and I really value the HN site. I never set out to post uncivil and/or unsubstantive comments, and when I do I usually delete them or at least add an edit or reply to soften them. And if somebody calls me out on something I check myself, and apologise if I think I messed up. I started to write a whole long thing defending my previous posts but I stopped myself. I did add up all the points from my most recent 10 comments, the total is 17. I'm having a bad run at average 1.7 points. So, yes, you're absolutely right, and I'll try to do better. (There was one exception to my policy that happened recently, where I snarked at some person who was complaining about how hard it is for white men to speak their truth in silicon valley, from an account with a racial pejorative for username. My comment got flagged. Rightly so.) I consider myself a hacker, I hope I'm a net benefit to the community, and I'd really like to see HN stay high quality. I did reread both the guidelines and the welcome page you linked and I am "on-board". But, ... Just kidding, no "but". Sorry for the noise dude, I'll try to do better.
- coldcode 9y agoWe really need a definitive SCOTUS ruling that searches of electronic devices violate the Constitution but if course we will never get that far. The intent of border searches originally was to identify goods being brought into the country to avoid paying duties or fees or being brought in illegally. Searching an electronic device is more akin to demanding to see what words are on a piece of paper you have in your pocket. Obviously the reason to search electronic devices is for political purposes like finding terrorists or illegal porn which is not what the Constitution is talking about.
- meri_dian 9y agoExcept finding terrorists isn't a "political purpose" it's a matter of life and death.
- krapp 9y agoIt is a political purpose, because "terrorist" is a politically charged definition whose application changes with the political climate.
- meri_dian 9y agoThe definition of 'criminal' changes over time too but that doesn't prevent us from prosecuting those who we determine to be criminals today. Regardless of how the subtleties of politics shift over time, someone who enters a country seeking to kill and destroy should not be a allowed inside regardless of what they're called.
- CaptSpify 9y agoThe percentage of 'terrorists' we are talking about is so small, it's hardly worth considering. It's a waste of everyone's time, and privacy to spend looking through anyone's phone at an airport
- QAPereo 9y agoThe major crimes we still recognize haven’t changed since humans started scratching on clay tablets. Murder, theft, rape, assault/battery, etc. Who was counted as a person and who the manner of gaining justice has changed, but not the crimes. https://en.m.wikipedia.org/wiki/Code_of_Hammurabi https://en.m.wikipedia.org/wiki/Code_of_Hammurabi
- provost 9y agoSection 5.3 pertains to requesting passcodes, and that an Officer may ask you for the passcode (I don't see anything about individuals being obligated -- though see 5.3.4, which could be interpreted by "legal remedies"). However, section 5.3.3 says: > If an officer is unable to complete an inspection of an electronic device because it is protected by a passcode or encryption, the Officer may, in accordance with section 5.4 below, detain the device pending a determination as to its admissibility, exclusion, or other disposition. Section 5.4 elaborates further. Also, I found 5.1.2 interesting: > Officers may not intentionally use the device to access information that is solely stored remotely. To avoid retrieving or accessing information stored remotely and not otherwise present on the device, Officers will either request that the traveler disable connectivity to any network (e.g. by placing the device in airplane mode), or, where warranted by national security, law enforcement, officer safety, or other operational considerations, Officers will themselves disable network connectivity.
- oliv__ 9y agoGot the message? Better store everything in the back-doored cloud! Much less of a hassle to compromise
- dmichulke 9y ago> Officers may not intentionally use the device to access information that is solely stored remotely. Probably until some court rules that a client making the information seem local to facilitate access is legally equivalent to having that information local (and hence not under protection of 5.1.2). Most likely followed later by some other ruling that a browser can be considered such a client.
- lambertsimnel 9y agoDoesn't 5.1.2 mean that the device would be without network access throughout the search (regardless of what information is meant to be protected as stored remotely)?
- mr_spothawk 9y ago> that is solely stored remotely. "blockchain" "blockchain" "blockchain"
- baxtr 9y agoThe number of searches has increased quite a bit from 2016 to 2017 https://www.cbp.gov/newsroom/national-media-release/cbp-releases-updated-border-search-electronic-device-directive-and https://www.cbp.gov/newsroom/national-media-release/cbp-rele...
- aerodog 9y agoSo what do we do if the CBP asks us to hand our devices over? Is there any way we can tell them to fly a kite?
- jsjohnst 9y agoAre you a US Citizen? Are you willing to temporarily (temporarily in this case is not implying a short duration, btw) lose your device? Are you able to waste time (as in hours or unlikely but possibly days) at CBP defending your rights without negative repercussions (as in missed flights, possibly missed work, missed family obligations, etc)? If the answer is yes to all, then sure, politely refuse and stand your ground until you get your way. I try to make sure I can answer all yes when I travel, but the last one isn’t always possible.
- qrbLPHiKpiux 9y agoThe best way is not to travel with anything that is not needed. Use cloud services and a disposable OS. The best way to play their (CBP) game is not to play. Don’t have anything available for them.
- username223 9y agoThis seems like a no-brainer. If you don't want CBP digging through your data, it's not hard to backup and wipe your phone before a trip. Or just buy a cheap burner for travel purposes.
- nabeards 9y agoIs there any way to quickly wipe and restore a full macOS? or other OS for that matter? As someone who travels, well, all the time, it seems a massive amount of overhead at the moment. If everything is in the cloud, that means I have to be sure to have fast, reliable internet at my destination (which is definitely not always the case). And any way I can think of to securely travel with a copy of my data is just the same problem: the CBP can request I unlock the other device. Ideally, we just wouldn't be able to be compelled to unlock our data, without the high probability of being forced to hand over the device because of our refusal. How is this not a violation of the Fourth Amendment? It's frustrating in the least.
- cypherpunks01 9y agoChrome is the only OS that makes this ridiculously easy, I think..
- gcb0 9y agoonly because chromeos is so crippled. this is like suggesting a kids toy in the shape of a power tool is easier to repair than a proper power tool. while true, you can't do the same tasks with the kids toy.
- grecy 9y agoWhile I have never had a major problem, it certainly raises a LOT of eyebrows when I say I don't have a phone. Most Officers simply don't believe me, and quite a few embassies had no idea how they would issue me a visa without a phone number on the application form.
- natch 9y agoNever is there any mention that by accessing the device of person A, the officer may be violating the rights of all people (say persons B, C, and D) who have shared information in confidence with person A. This includes getting access to my family photos. I don’t want an officer, who self selected by applying for a job that he knows will give him access to family photos, to get access to my family photos, because what kind of person applies to that job?
- b4lancesh33t 9y agoThere is not generally a right to confidentiality of information you share with a third party. There are a few exceptions (spouses, doctors, lawyers, among others). If party A shares information with party B outside one of these protected relationships, then I guess A's rights will not be violated if their information is discovered in party B's possession, whether or not party B shares that information voluntarily. (All subject to the search of B's information being constitutional.)
- datenwolf 9y agoThat really depends on the jurisdiction. For example in Germany it is illegal to share pictures of persons not being yourself without the other party's agreement. Google Translate does a decent enough job on the German Wikipedia entry: https://translate.googleusercontent.com/translate_c?depth=1&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=de&sp=nmt4&tl=en&u=https://de.wikipedia.org/wiki/Recht_am_eigenen_Bild_(Deutschland)&usg=ALkJrhiC80DjHDXQOU5_czR98VrQL8tlkQ https://translate.googleusercontent.com/translate_c?depth=1&...
- loeg 9y agoThe article in discussion is the US CBP, so the jurisdiction is pretty clearly the US and not Germany.
- paulie_a 9y agoDo you believe those stupid disclaimers at the bottom of emails hold any water? Same principle here.
- OliverJones 9y agoAre there any devices offering a silent panic passcode? It would be convenient for travelers if "123456" unlocked the device and "987654" erased local information and unlocked the device. That way a properly backed up device could be carried across a border with risk only of inconvenience, not of data loss. (The passcodes I showed are my passcodes. :-) Nobody else use them, OK?)
- robbiet480 9y agoIANAL but previously when I have heard that question the common response is "this can later be considered intentional destruction of evidence and/or obstructing justice and can also be used as grounds for further detention because you must have something to hide" EDIT: Also a commenter below reminded me that not obeying any order given to you by CBP/law enforcement is a direct violation of previously agreed to rules of the trusted traveler programs (Global Entry/TSA Pre, maybe even CLEAR?) which would cause you to be removed from any/all of those programs.
- mindslight 9y agoIf you are opting into these "programs", you are already part of the problem.
- ilkan 9y agoWith the opt-in... 30mins to cross a border. Without it.. slowdowns, flagging, questioning, etc... could be 6 hours. If one is travelling for business, opting out is not realistic.
- mindslight 9y agoWe all sell out every day; might as well be on the winning team!
- krrrh 9y agoNot what you're looking for, but it's worth knowing that since iOS 11, there is a panic sequence that disables TouchID at least. This applicable in non-border LE interactions where a citizen can be compelled to touch the device, but not to give up their passcode (IANAL, this might be out of date, as precedents change). https://www.macrumors.com/how-to/emergency-sos-iphone-ios-11/ https://www.macrumors.com/how-to/emergency-sos-iphone-ios-11...
- illirik 9y agoOne thing to note: "This directive governs border searches of electronic devices -- including... at the extended border." The "extended border" extends a hundred miles from what we normally consider the border; the authorization for customs agents to conduct warrantless searches in the Immigration and Naturalization Act allows them "within a reasonable distance from any external boundary of the United States," and the Attorney General defined that distance as a hundred miles. The Supreme Court disagrees (Almeida-Sanchez v. U.S., U.S. v. Martinez-Fuente), and has ruled that border searches can only be done, well, at the border. Under this directive, an importer/exporter headquartered in downtown San Diego would be subject to these searches... a bit scary if the Supreme Court ever overturns its earlier border search decisions.
- ComputerGuru 9y agoYes, it’s indeed over the top. Here’s a map by the ACLU: https://goo.gl/images/HpPYby https://goo.gl/images/HpPYby
- moonka 9y ago"Roughly two-thirds of the United States' population lives within the 100-mile zone."* That's incredibly disturbing. * https://www.aclu.org/other/constitution-100-mile-border-zone https://www.aclu.org/other/constitution-100-mile-border-zone
- mc32 9y agoWhen you drive close to the Canadian and Mexican borders I've gone through those inland checkpoints. I've never seen that practiced along the littorals --never. Has anyone seen a checkpoint along the littorals? Curious.
- RA_Fisher 9y agoNot a checkpoint but I've seen CBP sitting on the Mississippi - Alabama state line multiple times (I10).
- tptacek 9y ago
- yborg 9y agoIgnorant question for those who have had to transit the US border (it has been many years for me) - are these device searches now routine? I.e. do they automatically request access to any locked smartphone, etc?
- paulsutter 9y agoFrom https://www.cbp.gov/newsroom/national-media-release/cbp-releases-updated-border-search-electronic-device-directive-and https://www.cbp.gov/newsroom/national-media-release/cbp-rele...: > In FY17, ... Approximately 0.007 percent of arriving international travelers processed by CBP officers (more than 397 million) had their electronic devices searched I would guess devices are searched at the border for parallel reconstruction (to find information they already know without disclosing details about surveillance)
- tptacek 9y agoYou would guess that based on what evidence? Just first principles, in the sense that if you ran an DOJ and a CBP with what you believe the same objectives as the real DOJ and CBP, that's what you'd do?
- paulsutter 9y agoTwo reasons: (1) There were posts on HN around the time of the Snowden news of border agents presenting private emails, in one instance someone was traveling as a tourist but had email inviting them to perform as a musician (2) In individual stories I read of searched phones, the agent already knew where to look (for example, went directly to an app with discussion arranging paid hookups) We already know that parallel reconstruction is common for surveillance used by law enforcement (DEA, local police using Stingray, etc) so that seems more believable than random spot checks on .007% of people.
- tptacek 9y agoWe know that parallel reconstruction is "common"? Can you back that up with evidence?
- CharlesMerriam2 9y agoTL;DR: Some businesses will forego an option to connect with a US supplier rather than try to send a lawyer through customs.
- whisk3rs 9y agoWhat is the most effective way to encourage our elected representatives to correct this potential for violation of our rights?
- dang 9y agoRelated: https://www.npr.org/sections/thetwo-way/2018/01/05/576139303/u-s-customs-and-border-patrol-sets-new-rules-for-searching-electronic-devices https://www.npr.org/sections/thetwo-way/2018/01/05/576139303... via https://news.ycombinator.com/item?id=16086700 https://news.ycombinator.com/item?id=16086700
- philip1209 9y agoAttorney-client privilege is interesting. What happens if you say that you have emails and voicemails from an attorney?
- rocqua 9y agoAs I read it, they essentially promise not to look at it.
- Havoc 9y agoThey're on to me and my evil attempt to smuggle lolcats into the US
- lurr 9y agoOooh, they referenced both national security and got a "THINK OF THE CHILDREN" in for good measure.
- shiado 9y agoDoes anybody know if there is an equivalent to Hidden Volumes for an OS? It would be pretty cool if you could give a password for your machine that loads up a default OS installation, or maybe some configurable fake user to make things look more 'legit'.