4 ms·

This article seems like it’s written to be deliberately confusing. If I understand it correctly, the TSA is not forcing anyone to unlock devices. They take the

This article seems like it’s written to be deliberately confusing. If I understand it correctly, the TSA is not forcing anyone to unlock devices. They take the devices away for some period, but if they’re securely locked, TSA won’t be able to get anything from them. However, the article drops border searches which do require an unlock right into the middle of the article, then goes on to say that they have no specific examples of TSA doing the same thing. This implies that they have reason to believe it’s happening, but as far as I can see there’s no justification for that. The big question is: what are they doing with these things? If it’s some fancy explosives sniffing (like they already do to my contact lens solution) then it’s nothing interesting. If it’s an electronic search if unsecured devices, that’s bad. If it’s an attempt to force travelers to unlock secured devices, that’s horrible. The article seems to want to portray it as the last one, while only giving evidence for one of the first two.

FireBeyond 9y ago
> If I understand it correctly, the TSA is not forcing anyone to unlock devices. I'm sure they also don't shrug their shoulders and say "Locked? Oh well.". Varying degrees of coercion, threat, implicit or otherwise, relying on passenger ignorance to their rights. I wonder how many have unlocked it at their request too, which is specifically different from "forced".
- mikeash 9y ago
  What makes you so sure of that? I’ve had them swab electronics for explosives before and they never even try to turn the things on. I’m pretty sure I’ve had them ask me once or twice to prove that a laptop was real by turning it on, and they never asked for it to be unlocked. That’s my whole point: this article appears to be written to make you assume that a lot more is going on than they actually describe.
  - dordoka 9y ago
    I have been always asked to turn my devices on after a search for explosives (and whatever other substances they look for). They do that "to be sure you don't only carry the structure of the device to hide stuff inside". This happens in european flights.
  - bradstewart 9y ago
    This. I've had TSA request "a personal device, like a phone or laptop" twice at the Austin airport. The first time, I (pretty defensively) refused and started asking why they needed it. Turns out I had been randomly selected for an explosives swab, and they wanted to test my devices rather than my person. Both times the test was performed with the devices powered off, and with me present.
- komali2 9y ago
  >coercion, threat This is what bothers me the most about TSA and Border Agents stamping on rights - there's the implicit "we're going to waste at least 1,300$ of your money by forcing you to take another flight and rebook hotels." I get so stressed about it I show up at least 3 hours early for any flight, sometimes even 4 for international.
syshum 9y ago
>>They take the devices away for some period, but if they’re securely locked, TSA won’t be able to get anything from them. You have no way of knowing that, or if they are doing anything to the hardware, cloning the SIM, adding tracking, or simply cloning the flash for possible evaluation later Further it should be considered unconstitutional for them to even take it for 1 second. > If it’s some fancy explosives sniffing (like they already do to my contact lens solution) then it’s nothing interesting. I would find it interesting and "bad", they should not need to remove the device from your view to do explosive sniffing. It is very troubling to me how much invasion of and infringement on a persons liberties the average person is willing to accept in the name of Security Theater
- mikeash 9y ago
  I trust the crypto used by my devices. Searching electronics for explosives isn’t security theater. That’s a real threat vector and an effective counter to that threat.
  - oldandtired 9y ago
    It is theatre if it is applied randomly. It is not if all devices are tested equally. The same goes for testing of people. Unless all are tested, random checks are just about useless, since there will be a pattern to the selection of people for "random" testing.
    - mikeash 9y ago
      If the screening is being rendered ineffective by bad profiling, then it’s the profiling that’s theater, not the screening being profiled for.
      - oldandtired 9y ago
        If you are relying on "profiling" as a precursor to screening then you have made all of it theatre. You either screen everyone or screen no-one. To "randomly" choose someone to screen by the use of "profiling" makes nobody "safe", you may as well not screen anyone.
reaperducer 9y ago
> They take the devices away for some period, but if they’re securely locked, TSA won’t be able to get anything from them. It is well documented that there is no cell phone that cannot be unlocked. And once it's unlocked, who knows what the real goal is. On the surface, one suspects that it's to examine its contents. But other possibilities include sideloading spyware, or even targeted viruses. Some random NGO secretary may not be the actual target, but could be the vector that allows a program to spread to one or more other targets within or without the organization. I liked it better when this was the sort of thing that people on shortwave radio with tinfoil hats would rant about. Now it's almost weekly headlines in the NY Times, Guardian, WSJ, etc...
- mikeash 9y ago
  I’m not aware of anything better than brute force attacks for any vaguely recent iPhone.
  - mrobins 9y ago
    To my knowledge this hasn’t been either verified or disproven, and no methods disclosed, but apparently CellBrite claims to be able to unlock iOS 11. http://iphone.appleinsider.com/articles/18/02/26/cellebrite-advertises-its-ability-to-unlock-devices-running-ios-11-including-the-iphone-x-to-government-agencies http://iphone.appleinsider.com/articles/18/02/26/cellebrite-...
    - mikeash 9y ago
      When that was discussed on HN, the consensus seemed to be that Cellebrite had found a way to allow brute forcing passcodes, but that they would be ineffective against a good password.
- throwaway613834 9y ago
  > It is well documented that there is no cell phone that cannot be unlocked. Citation needed?

FireBeyond 9y ago

> If I understand it correctly, the TSA is not forcing anyone to unlock devices. I'm sure they also don't shrug their shoulders and say "Locked? Oh well.". Varying degrees of coercion, threat, implicit or otherwise, relying on passenger ignorance to their rights. I wonder how many have unlocked it at their request too, which is specifically different from "forced".

mikeash 9y ago
What makes you so sure of that? I’ve had them swab electronics for explosives before and they never even try to turn the things on. I’m pretty sure I’ve had them ask me once or twice to prove that a laptop was real by turning it on, and they never asked for it to be unlocked. That’s my whole point: this article appears to be written to make you assume that a lot more is going on than they actually describe.
- dordoka 9y ago
  I have been always asked to turn my devices on after a search for explosives (and whatever other substances they look for). They do that "to be sure you don't only carry the structure of the device to hide stuff inside". This happens in european flights.
- bradstewart 9y ago
  This. I've had TSA request "a personal device, like a phone or laptop" twice at the Austin airport. The first time, I (pretty defensively) refused and started asking why they needed it. Turns out I had been randomly selected for an explosives swab, and they wanted to test my devices rather than my person. Both times the test was performed with the devices powered off, and with me present.
komali2 9y ago
>coercion, threat This is what bothers me the most about TSA and Border Agents stamping on rights - there's the implicit "we're going to waste at least 1,300$ of your money by forcing you to take another flight and rebook hotels." I get so stressed about it I show up at least 3 hours early for any flight, sometimes even 4 for international.

syshum 9y ago

>>They take the devices away for some period, but if they’re securely locked, TSA won’t be able to get anything from them. You have no way of knowing that, or if they are doing anything to the hardware, cloning the SIM, adding tracking, or simply cloning the flash for possible evaluation later Further it should be considered unconstitutional for them to even take it for 1 second. > If it’s some fancy explosives sniffing (like they already do to my contact lens solution) then it’s nothing interesting. I would find it interesting and "bad", they should not need to remove the device from your view to do explosive sniffing. It is very troubling to me how much invasion of and infringement on a persons liberties the average person is willing to accept in the name of Security Theater

mikeash 9y ago
I trust the crypto used by my devices. Searching electronics for explosives isn’t security theater. That’s a real threat vector and an effective counter to that threat.
- oldandtired 9y ago
  It is theatre if it is applied randomly. It is not if all devices are tested equally. The same goes for testing of people. Unless all are tested, random checks are just about useless, since there will be a pattern to the selection of people for "random" testing.
  - mikeash 9y ago
    If the screening is being rendered ineffective by bad profiling, then it’s the profiling that’s theater, not the screening being profiled for.
    - oldandtired 9y ago
      If you are relying on "profiling" as a precursor to screening then you have made all of it theatre. You either screen everyone or screen no-one. To "randomly" choose someone to screen by the use of "profiling" makes nobody "safe", you may as well not screen anyone.

reaperducer 9y ago

> They take the devices away for some period, but if they’re securely locked, TSA won’t be able to get anything from them. It is well documented that there is no cell phone that cannot be unlocked. And once it's unlocked, who knows what the real goal is. On the surface, one suspects that it's to examine its contents. But other possibilities include sideloading spyware, or even targeted viruses. Some random NGO secretary may not be the actual target, but could be the vector that allows a program to spread to one or more other targets within or without the organization. I liked it better when this was the sort of thing that people on shortwave radio with tinfoil hats would rant about. Now it's almost weekly headlines in the NY Times, Guardian, WSJ, etc...

mikeash 9y ago
I’m not aware of anything better than brute force attacks for any vaguely recent iPhone.
- mrobins 9y ago
  To my knowledge this hasn’t been either verified or disproven, and no methods disclosed, but apparently CellBrite claims to be able to unlock iOS 11. http://iphone.appleinsider.com/articles/18/02/26/cellebrite-advertises-its-ability-to-unlock-devices-running-ios-11-including-the-iphone-x-to-government-agencies http://iphone.appleinsider.com/articles/18/02/26/cellebrite-...
  - mikeash 9y ago
    When that was discussed on HN, the consensus seemed to be that Cellebrite had found a way to allow brute forcing passcodes, but that they would be ineffective against a good password.
throwaway613834 9y ago
> It is well documented that there is no cell phone that cannot be unlocked. Citation needed?