5 ms·

Theres another case, though. Some people have no choice but to be "difficult". Consider, for example, a lawyer from an international firm travelling with compan

Theres another case, though. Some people have no choice but to be "difficult". Consider, for example, a lawyer from an international firm travelling with company devices, which have on them privileged information that can under no circumstances be disclosed. These kinds of people have no choice but to be "difficult".

letsgetphysITal 9y ago
Those people don't carry that data with them, if they're competent or have competent IT staff. They have already configured VPNs with 2FA, burner laptops and mobile devices, or simply mail the devices via registered post to the hotel and have them picked up there. Device moving through the mail system don't get seen by the border grunts.
- actionowl 9y ago
  > Those people don't carry that data with them You've made a great point here. What criminal is also going to carry their incriminating data with them? This isn't an effective policy. What problem does it actually solve?
  - ben_w 9y ago
    Most people, I think, don’t follow strict digital security/hygiene policies, nor understand them. That includes me, even though I try to be good. (I will not give specific details because two of my three memorable errors are currently covered by NDAs, and the third is personal).
    - jstanley 9y ago
      Right, but they don't need to investigate most people. They need to investigate people who are motivated enough to... well, I'm not sure what. Cross borders while possessing illegal data? But anyway, the people who are motivated enough to do it can easily circumvent it. The only people harmed are innocents.
      - ben_w 9y ago
        “Need” for what end? If there is political will to be “tough on crime”, or to reduce immigration and get away with it by saying you’re really only being tough on crime, you can probably find something on anyone simply because laws are too broad. Likewise if you care about performing economic espionage, you don’t need to worry that you’re mostly getting low-hanging fruit. These are checks you can perform on everyone, after all.
  - tinus_hn 9y ago
    Many effective police strategies are based on criminals doing stupid things. If criminals were smart most of them would just make a honest living.
alkonaut 9y ago
> These kinds of people have no choice but to be "difficult" Then they don't get in. Things like company secrets or client-lawyer confidentiality just doesn't apply here. You have a choice to give all that up and enter, or just return. The solution as others pointed out is not to travel with the data, but that's just cumbersome. You can always just use whatever cloud service you want, and delete the local copies, downloading the encrypted info again when you have entered the country.
- NoGravitas 9y ago
  They may well ask for your passwords to the common cloud services; they already ask for your social media passwords.
  - alkonaut 9y ago
    Luckily most places have 2FA so giving them the password to Facebook or Gmail is "only" equivalent to logging in so they can look around then and there. They can't look around once you have passed the border, and they can't sabotage you by setting a new password unless they keep your device or actually change the 2FA settings. I think that's pretty rare. I honestly don't think they need/use/keep passwords after I pass through. They may want to look in rare cases, but I actually think it's more of a "control question". If you don't have a normal set of social media accounts you are not normal or you are hiding something. If you aren't willing to show it, you are hiding something. What you are hiding doesn't matter. They use it as a "tell" to see if you need to be investigated further. These questions have always existed. They ask you what your business is entering the country etc, but they are as interested in whether you are sweating as they are in what you respond. Same here. They don't need to see your family photos they need to see you give up your privacy like a "normal person"
  - zbentley 9y ago
    A process that I've heard some financial people developing (highly secret/proprietary/potentially valuable) software use when traveling is: 1. Store confidential data on company servers or a secure/trusted/audited cloud service. 2. Protect that data with two factor authentication, ideally with an ephemeral/rotating factor. 3. Incorporate a duress code into one of the auth factors (e.g. "add one to the google authenticator result when logging in or you get fake data/get permanently locked out until you human-authenticate to regain access"), ideally both. This is far from perfect, but reasonably secure and not terribly inconvenient in practice. Additional layers of protection can be added to the duress process, like defaulting to under-duress behavior until a certain timeframe (i.e. you're being searched at the airport and not during your appointment time slot), or when from an unrecognized network location. Like all duress-code-based responses, it is vulnerable to humanity (e.g. torture/intimidation).
sseveran 9y ago
When I worked for a large company and had to cross an international border that was considered risky (e.g. China) we were issued a special phone and laptop just for that trip. They were wiped after each use. If one was especially paranoid it doesn't seem unreasonable to destroy the devices after use. This way we could consent to search because the devices were blank. It's highly inconvenient and I hope the US doesn't turn into a high risk border.

letsgetphysITal 9y ago

Those people don't carry that data with them, if they're competent or have competent IT staff. They have already configured VPNs with 2FA, burner laptops and mobile devices, or simply mail the devices via registered post to the hotel and have them picked up there. Device moving through the mail system don't get seen by the border grunts.

actionowl 9y ago
> Those people don't carry that data with them You've made a great point here. What criminal is also going to carry their incriminating data with them? This isn't an effective policy. What problem does it actually solve?
- ben_w 9y ago
  Most people, I think, don’t follow strict digital security/hygiene policies, nor understand them. That includes me, even though I try to be good. (I will not give specific details because two of my three memorable errors are currently covered by NDAs, and the third is personal).
  - jstanley 9y ago
    Right, but they don't need to investigate most people. They need to investigate people who are motivated enough to... well, I'm not sure what. Cross borders while possessing illegal data? But anyway, the people who are motivated enough to do it can easily circumvent it. The only people harmed are innocents.
    - ben_w 9y ago
      “Need” for what end? If there is political will to be “tough on crime”, or to reduce immigration and get away with it by saying you’re really only being tough on crime, you can probably find something on anyone simply because laws are too broad. Likewise if you care about performing economic espionage, you don’t need to worry that you’re mostly getting low-hanging fruit. These are checks you can perform on everyone, after all.
- tinus_hn 9y ago
  Many effective police strategies are based on criminals doing stupid things. If criminals were smart most of them would just make a honest living.

alkonaut 9y ago

> These kinds of people have no choice but to be "difficult" Then they don't get in. Things like company secrets or client-lawyer confidentiality just doesn't apply here. You have a choice to give all that up and enter, or just return. The solution as others pointed out is not to travel with the data, but that's just cumbersome. You can always just use whatever cloud service you want, and delete the local copies, downloading the encrypted info again when you have entered the country.

NoGravitas 9y ago
They may well ask for your passwords to the common cloud services; they already ask for your social media passwords.
- alkonaut 9y ago
  Luckily most places have 2FA so giving them the password to Facebook or Gmail is "only" equivalent to logging in so they can look around then and there. They can't look around once you have passed the border, and they can't sabotage you by setting a new password unless they keep your device or actually change the 2FA settings. I think that's pretty rare. I honestly don't think they need/use/keep passwords after I pass through. They may want to look in rare cases, but I actually think it's more of a "control question". If you don't have a normal set of social media accounts you are not normal or you are hiding something. If you aren't willing to show it, you are hiding something. What you are hiding doesn't matter. They use it as a "tell" to see if you need to be investigated further. These questions have always existed. They ask you what your business is entering the country etc, but they are as interested in whether you are sweating as they are in what you respond. Same here. They don't need to see your family photos they need to see you give up your privacy like a "normal person"
- zbentley 9y ago
  A process that I've heard some financial people developing (highly secret/proprietary/potentially valuable) software use when traveling is: 1. Store confidential data on company servers or a secure/trusted/audited cloud service. 2. Protect that data with two factor authentication, ideally with an ephemeral/rotating factor. 3. Incorporate a duress code into one of the auth factors (e.g. "add one to the google authenticator result when logging in or you get fake data/get permanently locked out until you human-authenticate to regain access"), ideally both. This is far from perfect, but reasonably secure and not terribly inconvenient in practice. Additional layers of protection can be added to the duress process, like defaulting to under-duress behavior until a certain timeframe (i.e. you're being searched at the airport and not during your appointment time slot), or when from an unrecognized network location. Like all duress-code-based responses, it is vulnerable to humanity (e.g. torture/intimidation).

sseveran 9y ago

When I worked for a large company and had to cross an international border that was considered risky (e.g. China) we were issued a special phone and laptop just for that trip. They were wiped after each use. If one was especially paranoid it doesn't seem unreasonable to destroy the devices after use. This way we could consent to search because the devices were blank. It's highly inconvenient and I hope the US doesn't turn into a high risk border.