21 ms·
New DHS policy on demands for passwords to travelers’ electronic devices
- chrisper 9y agohttps://webcache.googleusercontent.com/search?q=cache:wNbL8wBpo0YJ:https://papersplease.org/wp/2018/01/05/new-dhs-policy-on-demands-for-passwords-to-travelers-electronic-devices/+&cd=1&hl=en&ct=clnk&gl=ch https://webcache.googleusercontent.com/search?q=cache:wNbL8w...
- eganist 9y agoHmm can this be filed as an insurance claim if they keep the device?
- fyfy18 9y agoMost travel insurance policies have an exclusion for this, something along the lines of the following (taken from an AXA UK policy): Your policy does not cover you for any claim directly or indirectly resulting from any of the following: ... 8) Confiscation or destruction of property by any customs, government or other authority of any country
- djfm 9y agoAlso, commenters to this thread won't be let through.
- deleted 9y ago[deleted]
- tehlike 9y agoThis should serve as a reminder to everyone to donate/support EFF and ACLU, as two of the very few organizations that watches for our rights. It is also a reminder that as we get more numb to issues like this, it gets worse. It is probably time to call your representatives and raise your voice.
- iovrthoughtthis 9y agoDoesn't matter how much you push the button at the crossing it shows the green light when it was programmed to, regardless of you. If you want to cross you either need to wait until the appropriate time as dictated or you need to risk your well being and cross the road.
- will_hughes 9y agoWrong thread? Also, it may be true where you are, but it's not universally true. I know the cycle and timing of the lights near my home, and I keep getting frustrated by people who don't press the button and now I need to press it, and wait an extra cycle.
- saguro 9y agoBecause calling paid-for representatives has such a strong record of success over the last decade of human rights erosion. Talking to your representative is roughly as useful in curbing these things, as doing nothing at all. What's the real solution?
- JumpCrisscross 9y ago> Talking to your representative is roughly as useful in curbing these things, as doing nothing at all Have you ever called your representatives?
- saguro 9y agowww.google.com/search?q=i+contacted+my+representative+site%3Areddit.com Knock yourself out. Spoiler alert: almost everyone reports getting a cookie-cutter email or scripted response about why the rep will stay the course. They clearly have an established strategy of how to handle the 'contact your rep' crowd and channel their efforts to /dev/null.
- JumpCrisscross 9y ago
- SheinhardtWigCo 9y agoIs this the United States of America or Nazi Germany circa 1930? Anyone with malicious or criminal intent can simply not carry data that implicates them over the border, so just what is the point of this?
- dang 9y agoWould you please not post ideological rants to HN, regardless of how correct the underlying position? Doing that is against the site guidelines, and we'd appreciate it if you'd read those and take the spirit of this site to heart: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.
- SheinhardtWigCo 9y agoThanks for the reminder. I edited my comment.
- rtpg 9y agoHave there been any court rulings that limit searches at the border at all? Are there any lines at all upon which we can rely on? Even a tiny exception to the "4th ammendment exception" might allow for crafting safer transit.
- IronBacon 9y agoI think the borders are technically not US soil so they are covered by a different set of rules/authorities. I could be wrong, not an US citizen, I seldom cross borders, feel free to correct me... ^__^;
- GCU-Empiricist 9y agoYour right entry into the border is held as a plenipotentiary setting by SCOTUS, meaning the laws don't apply until you admitted into the border.
- jsoc815 9y agoNot to my knowledge. One is subject to search within 100 miles of the border, not just at the border. You might want to search around Arstechnica for some of their past stories on this issue. They've been writing about this for years.
- b6 9y agoAbsolutely not. Having lived outside the US for two years (so far), I halfway expect to encounter suspicion when I return. I absolutely will not stand for this. I will not cooperate and I will resist as much as possible, short of violence.
- cinquemb 9y agoI'm in the same position, but I suspect it will get much worse than this as it has since the start of The Global War On Terror™. Time to go long Leidos Holdings, Booz Allen Hamilton, CSRA, SAIC, CACI International, end etc?
- tallanvor 9y agoAs someone who has been living overseas for over 11 years, I can honestly say that US border control and TSA have the most unprofessional and disrespectful employees I've encountered in my travels. It's unlikely they'll ask to check your electronics unless they suspect you've been someplace like Syria, Iraq, etc., but nevertheless they'll look for any reason at all to question you as if you're a criminal. If foreign visitors get treated even half as poorly as I've been treated, and I'm sure they do, it's an embarrassment. I wish more Americans traveled overseas because if they experienced the difference between how we treat people vs how others do, they'd be properly outraged. I stopped bothering even being polite to them after getting repeatedly questioned about my travels when I trying to get back home before my mother died. I'll be the first to admit that I often have trouble showing empathy, but these people make me look like a saint.
- laaph 9y agoI was suspected of going to Syria, and they did not search my electronics (or anything) at all. It wasn't until after all sorts of questioning that they searched me, and they didn't tell me the reasons for their questions until they were done either. Oddly enough, I had a raspberry pi with me (with no case or packaging), and I thought I'd get accused of making bombs like the girl at Logan airport. However, the kid searching my luggage said "cool, a raspberry pi! What projects do you do with it?"
- 9y ago
- dang 9y agoThe submitted title broke the site guidelines by editorializing. Accounts that do this eventually lose submission privileges on HN, so please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and don't do this.
- tunareter 9y agoFor those who aren't US citizens, the advice in that article is absolutely terrible. Refuse to cooperate and you'll be on the next flight to whatever CBP deem is your home, and good luck ever getting an ESTA or Visa in future.
- rimliu 9y ago> and good luck ever getting an ESTA or Visa in future Would you want one after this anyway?
- tunareter 9y agoMaybe your employer has offices there. Maybe you have relatives there. Maybe you have clients there. Or conferences, or other professional events. Maybe you are even resident there.
- dbbk 9y agoMaybe you just want to go to Disneyland.
- letsgetphysITal 9y agoWhether Disney World is worth paying for with your dignity and privacy is a decision each person must make. Further, Disney now harvest biometrics for their ticketing. Noooooooope.
- sokoloff 9y agoDisney has an opt-out process for the fingerprint scan. (I'm not saying that to excuse their default stance, which I do find uncomfortable.)
- xxs 9y agoEven the Museum of Natural History in New York is a good attraction. There is no need to consider the US horrid or anything alike based on the ridiculous border policy.
- jimnotgym 9y agoI don't know if it worries my American chums, but I won't visit the USA. As a foreign tourist bringing money into your economy I feel there is a very real risk to my privacy and increasingly my person. I am beginning to favour goods and services from EU where human rights still mean something. Perhaps it doesn't matter to you how the US is perceived overseas, perhaps you don't want my money. Perhaps you don't mind being poorer. To me it has become the land of the police-state and the home of the Trump-Chumps.
- deleted 9y ago[deleted]
- nicolas_t 9y agoI sometimes have to go to the US for business purposes but from now on will only do so with a wiped computer with just enough installed to look like a normal user's data.
- MentallyRetired 9y agowait, so you're actually a spy? What kind of user are you if not a normal one?
- cjslep 9y agoI feel sorry for the bloke whose legitimate password is thisisjustadecoypasswordthatwillblowupthebombibroughtloljk
- snowpanda 9y agoThis is, of course, very upsetting for the obvious reasons. However, there's a second aspect to this that is (IMO) equally infuriating. Which is that even when the Supreme Court rules on something, which (credit where credit is due) has always done its best in making rulings as clear as possible for future similar cases, that politicians (of any party really) will still find a way around it. In 1868 (Crandall v. Nevada) the Supreme court ruled that: "a state cannot inhibit people from leaving the state by taxing them." Sure, maybe the word "tax" can be up for debate (although IMO taking someone's personal information is a tax). But if you look at point 8 at this link: https://supreme.justia.com/cases/federal/us/73/35/ https://supreme.justia.com/cases/federal/us/73/35/ It states that during the ruling, The Supreme Court ruled that: "8. The citizens of the United States have the correlative right to approach the great departments of the government, the ports of entry through which commerce is conducted, and the various federal offices in the states." The "tax" inhibit this right. It is now 2018 (150 years later) and we have simply replaced the word "tax" with a different obstacle, which functions in the same way: inhibiting the freedom of movement for those who don't (or can't) comply.
- tzahola 9y agouse truecrypt
- snag 9y ago> use truecrypt be coerced to give away your truecrypt password.
- DaiPlusPlus 9y agoTruecrypt has deniable encryption and duress passwords.
- 794CD01 9y agoWhether something is deniable is not a matter of software features, but your acting skill.
- cryptonector 9y agoNo such thing. CBP aren't stupid. If they see you have something like Truecrypt installed, then they will assume you have "deniable" stuff stored and will demand to see it. And if you don't actually have it? Too bad for you. Cryptography cannot help you defeat a government's rubber host cryptanalysis.
- tzahola 9y agoYou haven’t used Truecrypt, have you?
- MentallyRetired 9y agohttps://xkcd.com/538/ https://xkcd.com/538/
- ilaksh 9y agoExcept they don't have to drug or hit you. They just "confiscate" it if you don't tell them your password. The last time I went to the airport, I was really tired and it was apparent I hadn't slept. I guess being exhausted and ugly made me suspicious. They way they interrogated me like a criminal and forced me to provide personal details made me seriously consider emigrating.
- teraflop 9y ago> “What is the password to this device?” is a verbal collection of information, which is prohibited by the Paperwork Reduction Act (PRA) unless it has been approved in advance by the Office of Management and Budget (OMB), a “control number” has been assigned by OMB, and individuals from whom information is to be collected are given notice of this. I find this extremely implausible. If it were true, wouldn't it also imply that customs and immigration officers aren't allowed to ask any questions that don't appear on the customs form? I thought it was generally accepted that they had a wide latitude to conduct an interview and use the results to determine admissibility. The Paperwork Reduction Act is primarily designed to regulate exactly what it sounds like -- standardized forms for data collection. It specifically excludes "A request for facts or opinions addressed to a single person". (https://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&rgn=div5&view=text&node=5:3.0.2.3.9&idno=5#se5.3.1320_13 https://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&rgn=div5&view=t...)
- JoshTriplett 9y agoI'm not an expert in the applicability of that law, but if they're systematically asking people for passwords, that's not necessarily "addressed to a single person".
- freeone3000 9y agoPaperwork Reduction Act is an attempt to reduce paperwork. Customs and immigration questions are not paperwork, despite how systematic they are. Consider if they have an OMB number for "Citizenship? Duration of stay? Purpose of visit?", the questions nearly every traveller gets asked. They don't. Of course they don't. They don't need one.
- UncleEntity 9y agoFrom the bottom of the Customs Declaration form: PAPERWORK REDUCTION ACT STATEMENT: An agency may not conduct or sponsor an information collection and a person is not required to respond to this information unless it displays a current valid OMB control number.
- 9y ago
- ezoe 9y agoNo US visit for me then.
- kqr 9y agoIs it an option to just feign ignorance and claim not to know the password? Sure, they might confiscate it but I guess then you'll have to find a cheap alternative to restore your backups to until/if you get it back.
- tomalpha 9y agoIt wouldn't be too hard to assume they'd simply take that as a refusal (which it actually is). You might try to say that you've got some corporate policy going with your employer where someone else knows the password and you don't I suppose. I suspect that answer wouldn't go down well either though.
- rando444 9y agoWhy bother feigning ignorance? If you don't want them to have it, and you're willing to deal with the hassle, tell them that you won't give it to them. More people standing up and saying no is one of the few things that might actually make a difference.
- kqr 9y agoPlausible deniability in case of consequences for not revealing password.
- robinwassen 9y agoI think a cheaper alternative is to only allow access to non-sensitive information when initially logging into the device, then hide any substantial information behind another layer. Don't think the average customs officer has time or skills to dig out files containing encrypted volumes on your device.
- zbentley 9y agoThe average customs officer will not do that. But they will potentially take an image of the hard drive (possibly by removing it and connecting it to an imaging computer) and store it, after which people/programs with both the time and skills can find your hidden data.
- benevol 9y ago"In other words, CBP is now claiming the authority to confiscate your cellphones, laptops, memory cards, and any other electronic devices if you won’t tell CBP your passwords, and to retain the passwords you give them as well as the contents of those devices. Yes, this applies to U.S. citizens and permanent residents as well as visitors." That is just insane and unacceptable.
- _jal 9y agoPeople need to push back. I know there's risk, but if you take this shit, they just keep pushing. I will be traveling with throwaway, obviously tailored devices with insulting passwords, lock-screens and documents and a huge pile of encrypted chaff. Let them document me as a troublemaker. Better, let them document hundreds of thousands of us as troublemakers. CBP and ICE have been drifting towards authoritarian-shitheaddom for a long time and really needs a serious pruning/lobotomy. It won't stop until there's noise about it.
- throwUsVisitor 9y agoI'm happy to say that I do everything to make Border Control life miserable. I have big clients in US and while I generate for them big profits, I cannot accept payments due to my ethics. So I complained to legal divisions of my clients and asked to funnel money there. Every time I cross US border I refuse to show any data and insist on contact with my lawyers. And by my lawyers I always have big co legal divisions in mind. At average I spend 6 hours per border entry but I feel good about myself. I believe that Border Services still had worse that day.
- Teichopsia 9y agoIs this only for people entering the country or does it also apply to those in transit?
- gingericha 9y agoIt's my understanding that a lot of US airports don't have an international-only terminal where people in transit wouldn't have to first go through customs & immigration. Quick google search brought me here: https://www.tripadvisor.com/ShowTopic-g1-i10702-k10297825-Do_I_Need_A_Visa_For_A_Connecting_Flight_Through_The_US-Air_Travel.html https://www.tripadvisor.com/ShowTopic-g1-i10702-k10297825-Do...
- gsnedders 9y agoNo airport does; you are required to clear the US border to connect. There's not such thing as a transit passenger in the US.
- tunareter 9y agoWell, actually... There are. LHR-LAX-AKL requires all passengers to get off but those not terminating in LAX stay in a transit area (although there's still an immigration check). And IAH supports international transit for bags, but you as a person still need to immigrate the normal way.
- collyw 9y agoThe US is the only country that I have passed though where they feel the need to poke around with your baggage that is in transit. (Its on my list of "shithole" countries).
- Teichopsia 9y agoI understand that one needs to go through customs & immigration, even if one is only in transit. But the idea that one needs to hand over one's "diary" is beyond me.
- Cort3z 9y agoChromebooks will be flying off the shelves after this. They are only allowed to view content on the device itself, not access any cloud-stored data.
- rando444 9y agothe device still has a cache... plus unlocking a device with your google account and then handing it over to a border guard is the last thing I would want to do.
- dmitrygr 9y agoWhy? DefinitelynotfakedmitrygrLOL@gmail.com password: fucktheDHS Log in works. Chromebook shows apps. Emails. Etc.
- netsharc 9y agoI remember reading a traveller's guide to the Soviet Union, and talking about precautions you need to take while using your camera. It was written for the 1980s, I wonder if people back then would've thought, that 40 years later...
- DaiPlusPlus 9y agoWhat kind of precautions did they recommend?
- davidgh 9y agoI’m not sure of the guide referenced, but I traveled in Russia extensively not long after the fall of the Soviet Union. Based on the advice we received, don’t do stuff like take pictures of government facilities, bridges, airports, etc. Don’t attempt to be discreet in your photo taking when you do take photos - hold your camera in plain view as to not appear you’re attempting to hide your activities. Don’t take pictures of things that might have the possibility to show the country negatively such as a dilapidated buildings, street beggars, etc. Also, not directly related but be incredibly careful around military installations, and be aware that many strategic military installations are not clearly identified with signs (if you’re walking in a forest and hit a chain link fence don’t climb it). Stuff like that.
- alkonaut 9y agoUnfortunately the recommended behavior is to be "difficult". Trying to somehow state your own rights, demand that officers perform searches in accordance with law etc. - which is "being difficult". If you are on your way to a great holiday, important meeting etc, you aren't going to risk it. Because anyone "being difficult" will be detained or rejected. So I'll just fold and give them my password. And they know this. The only time I'd even hesitate to trade my precious time for my integrity is if I actually had something to hide, unfortunately. Which just reinforces their assumption that anyone not immediately unlocking their device to let them read your business docs or see your kid photos - must be hiding something.
- tomalpha 9y agoThis. Being "difficult" might be an option for US citizens, but if you're a visitor you're really only going to have a choice between cooperating and being refused entry. If you're refused entry you'll have a much harder job returning.
- gcb0 9y agothat's what they want you to belive. and it saddens me that they are achieving their goals. as an immigrant, I have always opted out of the scanner with undocumented effectiveness and undocumented health effects with no consequences other than a pat down.
- tomalpha 9y agoI (think I) get the point you're making and I broadly agree, but in the immigration case (on the way in to the country, rather than the way out) it's more than what they want you to believe: it's what they can and do enforce. For good or ill. And there's very little that you can do about it other than decide to not travel to the USA. This link[0] is admittedly an advert for legal services, but there are a couple of interesting snippets in there such as: > ... if you have been refused entry into the United States at any point in the past, even for an expired passport, the previous denial is reasoning enough for future denial. IANAL but my understanding is that for non-residents there's no legal obligation to admit you outside of maybe some of the international refugee conventions (which are unlikely to apply). The law is deliberately discretionary. A refusal to admit can be based purely on "suspicion". You can imagine a CBP officer finding you suspicious (rightly or wrongly) because you refuse to hand over your passwords even if they don't have a legal right to force you to hand them over. They can simply offer you a choice of handing them over or going home. To be clear: I'm not advocating for this state of affairs, but it does appear to be the case. [0] https://www.visaplace.com/blog-immigration-law/denied-entry-to-the-us/denied-entry-airport/ https://www.visaplace.com/blog-immigration-law/denied-entry-...
- dukeflukem 9y agoWhat about don't bring any tech at all. Keep it all on the cloud encrypted.
- paulie_a 9y agoGreat. I am planning a trip to Cuba in the near future and now my costs include a burner phone
- userbinator 9y agoGood thing https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/Deniable_encryption exists.
- xxs 9y agoWhat would likely happen: detained at the border regardless your claims, send back on the next flight, denied Visa next time.
- clarkevans 9y agoLet's not see this as simply a national policy issue. It's a global problem where peoples lose control to the levers of their governments. Sometimes, it's about a population that is deliberately misguided by propaganda. Often, it's a problem with the concentration of wealth and transnational entities who escape any reasonable form of governance. The solutions to this won't be found by ostracizing any nation's citizens, but, to join in solidarity to solve the economic and governance issues that are at its core. Cooperative structures could offer an approach to these problems. Cooperatives are a way for a group of people to collectively own shared resources and make decisions about them democratically. Importantly, they are not governmental (i.e., they lack force of the police/military) yet can use the same legal environment that for-profit corporations enjoy. Cooperatives fall in the middle of the political spectrum: to liberals, they are about economic self-determinism; to conservatives, they are about smaller government and corporations. Cooperatives could be used to peel away economic activities from unaccountable entities. As leaders and doers, we should start thinking about what activities we perform should be governmental, which should be proprietary (privately controlled) and which should be cooperative yet economically participatory. For example, regional water systems are often operated as cooperatives rather than for-profit entities or as a department in a municipal government. This distributes economic and political power. We could build upon this organizational pattern in other industries. We need more tools, research, and investment into how cooperatives could help us form global democratic networks that are small, distributed, financially sustainable, and accountable. We need global, bottom-up, fractal governance and economic markets that distribute political and financial power.
- mkarliner 9y agoIt would seem to me the answer is to factory reset your phone before travel and reinstate it after landing. However, the UK is not much better, given recent legislation. Until the average voter gets concerned enough about this to make it an election issue, our lives will be more and more constrained.
- DougWebb 9y agoI wouldn't recommend this. You want your device to look innocuous and normal. Nobody carries around an unused phone, so having one would be a red flag. Your phone will be examined for hidden partitions, and you'll be detained for further scrutiny.
- NoGravitas 9y agoIt might make sense to have two images that you can switch between with TWRP or similar. One that is whatever you normally use, and one that is aggressively normal - factory reset, then add a secondary Google account, social media apps (with secondary accounts, maybe, depending), and casual games.
- Terretta 9y agoIn iCloud ecosystem, create a family, with a child account AppleID. Do a full backup. Wipe the phone, log in with child account. You can now redownload a few key apps needed for the trip, as well as some normal apps: weather, TripIt/Uber/CityMapper, games, etc. Because it’s a family account, all the re-downloads are free. Share essential data (that you don’t mind being taken) from your own account to this account the way you would to another family member. Use the iCloud “Family” calendar for your trip planning (useful anyway to share travel plans with partner etc), or subscribe this account to e.g. your TripIt/TripCase calendar. Invite this child account as a family member for your smart home etc., using child (parental controlled) config where available so it’s not an admin. Use secure Shared Notes from Apple Notes or Evernote to bridge travel lists. Subscribe to a shared iCloud Photos album so you can seamlessly post photos taken with this account back to your primary account (and that album will only contain photos you intend to be visible on this persona). Load in your business’s main contact info, your personal contact card with your business email and number, and then contacts for airlines, car rentals, hotels, and customer support numbers you use. If traveling with a partner, load their contact in as well, also using work info. Include a contact record for the ‘emergency contact’ you already disclosed on other forms (airline, customs). If the device is lost, searched, etc., revoke this child from everything you’d shared to it from. If you need access to more while traveling, look into 1Password’s travel mode, and share a travel-safe vault from yourself to yourself: https://blog.agilebits.com/2017/05/18/introducing-travel-mode-protect-your-data-when-crossing-borders/ https://blog.agilebits.com/2017/05/18/introducing-travel-mod... When you are set up as you like, backup to iCloud. In the future, you can restore from this backup. Caveat: On the parent ID, avoid applications that mark their data to exclude from iCloud backups unless they sync themselves to the cloud and auto-restore the data when restoring that Apple ID to a new device. For such apps, you will have to manually recreate their data, or use legacy iTunes wired backup and restore which defeats the purpose if you wish to restore at your trip destination. A common example might be Google Authenticator. Pro-Tip: Restoring very large numbers of apps, as well as iCloud data such as files and photos, can take a very long time OTA. On a home Mac, set up iCloud Content Caching with a sufficient size to cache all apps, documents, and photo data, to radically improve restore times: https://support.apple.com/en-gb/guide/mac-help/about-content-caching-mchleaf1e61d https://support.apple.com/en-gb/guide/mac-help/about-content... This will speed up app restore for the child account as well, though that shouldn’t be an issue as you’ll maintain a very small number of apps. The device will be useful from home to destination, and info (notes, photos, etc.) on the go can be shared back to the parent. Depending on length of trip, you can restore to your primary ID at destination and then flip again for the trip home. The device will be normal.
- chx 9y agoAfter the arrest of Marcus Hutchins I have already resolved not to set foot in the USA (unless badly necessary for business :/ ). It is surprising how little international outrage that arrest sparked: if the reasoning of the USA in this case were solid then international travel would halt. You would need to review everything you've done online (the last few years at least but possibly ever) and compare it to the laws of the country you are entering. If the USA believes Hutchins committed a crime according to US laws then they should ask the UK to arrest and extradite him. Let me emphasize: it doesn't matter, at all, what Hutchins have done. And this was not the first time this was done: Sklyarov was arrested for violating the DMCA while outside the USA as well. That case was one of the primary reasons I excluded the USA as my immigration target and landed in Canada instead (back in 2006 I was in a position where I could choose). This policy just makes my resolve stronger.
- zeveb 9y ago> You would need to review everything you've done online (the last few years at least but possibly ever) and compare it to the laws of the country you are entering. Yes, that's what you must do any time you enter a country. Any country is free to arrest you for past violations of its laws when it has the physical ability to do so. Once you're physically present in a country, it no longer needs to demand your extradition: you've extradited yourself.
- chx 9y agoHere's a hypothetical: the country I was born in has a statute where the distribution of a sickle-hammer or the nazi swastika sign (and similar signs, listed in the law) is a minor offense, to be punished with a short jail sentence. Now the hypothetical: You land there, the border officer asks for your phone, browses through your Facebook posts and sees a Soviet joke you made (he doesn't understand it) but sees the icon you put besides. You spend the next sixty days behind bars. Are you OK with this?
- Thiez 9y agoIn general people expect the laws of a country to apply to them only while are actually inside that country. In the UK you have to drive on the left side of the road, would you expect to be arrested on arrival for having driven on the right side of the road while in another country? Being refused entry is understandable, but being arrested? Isn't a country's jurisdiction supposed to be restricted to its borders?
- crispyambulance 9y agoIt seems to me that few people are talking about what actually happens to phones/laptops when they're unlocked by a password given by the passenger. There's a HUGE difference between... A) A derpy mall-cop DHS agent casually browsing through your laptop/phone for a minute or two, looking at emails, pictures etc. B) The contents of hard-drive/flash/phone being copied to a government server, stored in perpetuity, and subject to n-th degree content searches forever. A is just annoying, B is vastly more concerning.
- eximius 9y agoAnd you don't know, can't know which it is since they can remove the device from your presence. So you have to assume the latter.
- crispyambulance 9y agoYeah, I would make that assumption if they confiscated the device and said "we'll send it back to you whenever." But why do I feel that "derpy DHS agent browses computer for a few minutes" is far, far more likely in a scenario where the device is taken to a back room? Is it really impossible to know anything about what is done with devices in the back room?
- eximius 9y agoLet's say they had your device for 15 minutes. Thats enough to disassemble and copy a bunch of data and reassemble. Unless you have whole drive encryption they only need to copy the user folders (typically). Or your machine might have been in a queue and only looked at for 2 minutes. Or they might have not looked at it at all. Now pick a few different timeframes and you tell me how hard it is to know?
- cryptonector 9y ago15m seems like too little unless the traveler is a high-priority target. CBP is often crushed.
- ttul 9y agoBasically, don’t carry data with you. Leave it all in the cloud. You can’t be compelled to provide the password for a service which contains data that is not on the device.
- jccc 9y agoReally? For how long? https://www.theguardian.com/technology/2016/jun/28/us-customs-border-protection-social-media-accounts-facebook-twitter https://www.theguardian.com/technology/2016/jun/28/us-custom... http://www.businessinsider.com/john-kelly-travel-ban-social-media-password-2017-2 http://www.businessinsider.com/john-kelly-travel-ban-social-... https://privacysos.org/blog/social-media-privacy-at-the-border/ https://privacysos.org/blog/social-media-privacy-at-the-bord... https://www.eff.org/deeplinks/2017/01/fear-materialized-border-agents-demand-social-media-data-americans https://www.eff.org/deeplinks/2017/01/fear-materialized-bord...
- danesparza 9y agoThis is a terrible idea.
- zbentley 9y agoI posted basically this elsewhere on this thread, but: 1. Make sure it's a cloud service that you trust (i.e. audited, self-hosted and you know what you're doing etc.), since they'll probably keep the data on it forever, regardless of whether you delete it. 2. They will eventually ask for your password for that cloud service and download the data from it. For the truly paranoid (which is increasingly coming to resemble "people who care about security at all", sadly), use a cloud service with a duress code https://en.wikipedia.org/wiki/Duress_code https://en.wikipedia.org/wiki/Duress_code. Returning fake data with a duress response can get you through security quickly if the people searching your data don't identify it as fake. Otherwise, the response of "I just gave a duress response and was permanently locked out until I personally visit the agency holding it in $my_country_of_origin and re-authenticate" may have a slightly higher success rate of getting you through security than refusing to surrender passwords. But then you don't get access to your data until you do that. There's always the "inconvenience" bluff-call option of "after I gave the duress response, I won't have access to my data for a week", but depending on how petty/suspicious the officers are that can be equivalent to asking for a week's detention.
- bogomipz 9y agoSo the DHS in the US began deploying facial recognition scan without any authorization and now they have gone and decided to implement collecting travelers passwords. So the DHS requesting you passwords in order to enter and the DHS collecting your facial scan in order to exit will effectively bookend the experience of visiting the USA. This agency seems to increasingly act with complete autonomy and impunity. The culture there seems to be one of arrogance and disregard. This is evident all the way down to the clowns at the airport who berate and harass regular folks who are just trying to get somewhere.
- FidelCashflow 9y agoWe should resist this by wasting as much time as humanly possible. How about carrying multiple data devices with brute force able encryption for meaningless data? Encrypted linux ISOs, 8051 datasheets, trivial C programs, etc. There's clearly a file structure in place, it's clearly not easily readable, the person who was carrying it will not (or maybe cannot because they genuinely don't know) divulge how to read it. All this just to waste their time and resources dealing with piles of this shit. Anybody remember that USB stick that kills whatever it's plugged into? I could throw 2-3 of those into my luggage and forget about them.
- KKKKkkkk1 9y agoThe US government would love nothing more than you wasting its time. I would argue that mutual time wasting is what it perceives to be its primary function.
- antihero 9y agoThis seems like a good plan if you enjoy sitting in a holding cell for hours or days.
- maxxxxx 9y agoIf you have plenty of time sitting around while they work in your stuff and potentially being denied entry for the next few years you should absolutely do this.
- itissid 9y agoI always thought that immigrants always get the sharper end of the stick and I wondered when has immigration ever been easy without these kind of issues. But this is truly appalling. Two things I know to be true: 1. The current gene pool that will rule this country will be no different from the last and it will impose similar measures on the next pool. 2. What's sad about this is the long term damage done to trust and a raft of the rights of people, all for some short term security. The only thing that can fix this is a return to thinking of consequences on a larger time scale and stop being afraid.
- alerighi 9y agoAnd you still call your country a democracy! If this doesn't change, I will never consider to move or even go on vacation to the USA, I might live in a state that has a lot of problems (Italy), but at least I have the right of privacy, and I can take a plane without having agents searching through my sensitive information on my devices.
- danesparza 9y agoIt's not (nor has it ever been) a democracy. It's a Federal Republic. More info: https://en.wikipedia.org/wiki/United_States https://en.wikipedia.org/wiki/United_States
- welterde 9y agoDemocracy and federal republic are not mutually exclusive (in modern usage anyway). Far from it - being a federal republic is just one of many variants of democracies. The USA - like other countries, such as Germany or Mexico - are both a (representative) democracy and a federal republic.
- soundwave106 9y agoCareful about this. This is one of those policies I can easily see changing at least for US citizens. (Hopefully they adjust the policy for everyone, but I'm less optimistic on this front). The Supreme Court, in Riley vs. California (https://en.wikipedia.org/wiki/Riley_v._California https://en.wikipedia.org/wiki/Riley_v._California), unanimously held that warrantless searching of a cell phone is unconstitutional (violation of the 4th amendment). The ACLU and EFF have filed a case largely on this basis. (https://www.aclu.org/legal-document/alasaad-v-duke-complaint https://www.aclu.org/legal-document/alasaad-v-duke-complaint) My armchair thoughts on this is that it looks like their case is very strong, and the likelihood of this policy being struck down at least for US citizens is pretty high. Wouldn't mind a lawyer opinion, but at first glance I don't see a huge difference between the circumstances of Riley vs. California, and the cases represented here. There are unfortunately people in this nation (as everywhere else) who are authoritarian oriented in nature, but there are also many in this country who push back. For US citizens, the best way to react to this is less Internet outrage, but ensure that one supports the ACLU and EFF, two organizations that have been critical in pushing back against the erosion of the 4th Amendment.
- Zak 9y agoYes, officer, the password is "Orwell1984". Where's the data? What data? The only thing on there is an app called "Secure erase free space". No, you can't have the encryption key to that flash drive there, but I'll surrender it under protest.
- u801e 9y agoI think the only option now until the policy changes is to just carry a phone with no data on it and a laptop without any hard drives/secondary storage (which you boot with a live usb).
- edanm 9y agoI understand the anger, and I understand people wanting to protest. But why on earth would most people here feel the need to travel with a wiped, or factory-defaulted device? I mean, if you have something to hide, or sensitive information, sure, I guess. But it's not like they stop and ask for a password from everyone. This probably applies to 1 in thousands, if not tens of thousands of passengers. What on earth do you gain by going through the elaborate precaution of wiping all your devices, for a 1 in 10k chance of someone bothering to look at them, especially when they wouldn't find anything? It is ok to be both angry, even outraged at a policy, but also not let it impact you in a totally crazy way which doesn't make any sense.
- jnagro 9y ago"Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say." - Edward Snowden
- kaybe 9y agoIt's also naive. Most of the things I have to hide are other people's secrets. Closeted people's sexual orientations, secret pregnancies and cheating, porn fetisches.. sure, none of these things are a huge problem (though illegal in some countries..), but they are vulnerabilities of the people that shared them with me, and they are not mine to disclose. Currently that probably means to never even mention these things in combination with anything internet (unless it has strong encryption, maybe). edit: mental health issues, drug use, compromising pictures and situations, ...
- deleted 9y ago[deleted]
- edanm 9y agoI absolutely did not say you shouldn't care about the right to privacy. I said you can care and protest that, while recognizing that you don't necessarily have to go to extreme lengths if you yourself don't need the privacy at this particular moment.
- cryptonector 9y agoIf you are a U.S. person they cannot deny you entry for not giving them your passwords, though they can keep your devices for some time.
- JustSomeNobody 9y agoI think I remember reading that they can still detain you "indefinitely" even if you're a US Citizen. Is that not correct?
- gamblor956 9y agoThey can detain you indefinitely even if you're a US Citizen, but afterwards they will be sending you a rather sizable check to settle the lawsuit you file for getting your civil rights violated. Unless you commit a crime crossing the border (like getting caught with drugs), CBP does not have the authority to detain a US citizen without probable cause. Refusing to provide a password is not probable cause.
- cryptonector 9y agoCorrect. But they can retain your devices and all your stuff.
- ComodoHacker 9y agoAn obvious solution is to upload your data to a cloud service before passing the border and download them later. Will that be declared a contraband soon?
- danjoc 9y agoI trust my country more than I trust Google/iCloud/Dropbox/etc. I'll take my chances.
- ComodoHacker 9y agoWhat you really should trust is strong encryption with keys managed by yourself.
- cosban 9y agoI've been working on an app/program that could be of use for this kind of situation. It's in way to early of a state to be released though. For the sake of giving it a name, we can call it Dead Man's Pass. Effectively, for phones or laptops, you would have your standard password as well as a secondary password. If you use your fingerprint to open your phone, you would be able to register a different print as your secondary print. Using your regular password/fingerprint would unlock the device normally. Using the secondary (dead man's pass) would either wipe the device, or open it to a honeypot state. I think this would be useful for phones and perhaps laptops. If a memory card is confiscated, perhaps it could be encrypted with a program that follows the same concept. Either way, it allows people like DHS to demand a password, and have one given to them while also solving the problem of not wanting to show them private information.
- cryptonector 9y agoMight as well just travel with wiped devices. If you're a U.S. person the worst case scenario is they keep them anyways. BUT! if you're NOT a U.S. person do keep in mind that CBP takes wiped devices (and lack of devices) as suspicious in itself, and may deny you entry.
- cosban 9y agoUnder this concern, perhaps the if being used in "honeypot" mode, it could act as a reverse vault. Rather than setting up what you don't want people to see, you would instead set what you do want them to see. Regardless, implementation details would probably be better for a different topic.
- deleted 9y ago[deleted]
- cryptonector 9y agoWell, yes, CBP will be seeing a lot of what they don't care about (boring stuff), no doubt.
- cryptonector 9y agoI would note that DHS/CBP can't do too much of this. It's very time-consuming even to set aside a passenger and demand their devices and passwords, and CBP has large plane loads to process quickly. So obviously they must only bother with this policy when they think they have reason to -- because you're on some list, or perhaps because someone with the same name as you is on a list (scary!). There are some natural limits to this policy.
- ashildr 9y agoGerman here, in his 40s, earning quite an above average income in IT as does my partner. Double income no kids as they say. We travel a lot, just not to the US anymore.
- vlod 9y agoReminder: pay your yearly contribution to your lawyer. i.e. Write checks to ACLU and EFF. ACLU: https://action.aclu.org/donate-aclu?redirect=donate/join-renew-give https://action.aclu.org/donate-aclu?redirect=donate/join-ren... EFF: https://supporters.eff.org/donate https://supporters.eff.org/donate