6 ms·

US Border Officers Don’t Always Delete Collected Traveler Data

133 points by toufiqbarhamov 8y ago

rue 8y ago
Completely by accident. There was never any intent to mine that information, no sir.
- isp 8y ago
  Not wittingly.
  - ggggtez 8y ago
    Perhaps, but perhaps not. If you've followed the news since 2001, you'll find that improper deletion of data is a theme that goes back a long time to the point where you should really question whether it's really an accident or the result of purposeful lack-of-enforcement of policy.
    - towelr34dy 8y ago
      I believe a factor in this is the incentives at play based on a mentality. The incentives are that if data is deleted, the person doing it can be in trouble for destroying it. The probability of getting in trouble for not deleting is low. This is based off of a mentality of: If we need the data and delete it, we (the gov) will have less power. If we don't delete it and need it, we will have more. I believe the flaw in this reasoning is not considering a 3rd possibility: We don't delete it, don't need it, but it falls into other (even less scrupulous hands) that can use it and gain power.
    - deogeo 8y ago
      I believe that was a reference to James Clapper's perjury: https://abcnews.go.com/US/americas-top-spy-james-clapper-made-mistake-lie/story?id=37003608 https://abcnews.go.com/US/americas-top-spy-james-clapper-mad...
      - ggggtez 8y ago
        One of many things, yes. Also, see any news story circa 2013 and the Edward Snowden leaks. In more recent and relevant histoy, the border security program is fairly well established to have been rolled out half-baked with the intention of making it a semi-legal limbo for all involved. So the idea that they are playing loose with the rules on purpose based on recommendations from the top seems warranted.
pleasecalllater 8y ago
What a surprise, right?
- leibwiht 8y ago
  I am absolutely SHOCKED, I did not expect this in a million years. Why would I ever have any reason to believe the government isn't telling me the truth? And, as a law-abiding citizen, I can't imagine what they'd even want with it anyway. This must have been an honest mistake.
  - pleasecalllater 8y ago
    I think we should tell them that we are really sorry about all that. We should buy them flowers.
Zak 8y ago
The authority to conduct such searches should simply be removed. Border searches are nominally for the purpose of preventing the importation of something that's illegal to import, but it's trivial to transfer information that's illegal to import (e.g. child pornography) over the internet instead.
- laken 8y ago
  Border searches are nominally for the purpose of preventing the importation of something that's illegal to import _You_ can be illegal to import if you don't have authorization to work/visit/marry/etc. with your visa. Generally, that's what these phone searches are for -- if they think you're lying about the reason why you're visiting, they will search your phone's messages quite often. You see it all the time on the US CBP television program (can be found on Netflix).
  - dawnerd 8y ago
    Suggested that show on here as well. The Canada and Australia variants are also a good watch.
  - Zak 8y ago
    That's at least more realistically connected to a legitimate government purpose. It seems hugely invasive to be doing without a court order though.
    - pjc50 8y ago
      Lots of people seem to believe that non-nationals aren't owed due process, rights, or even access to their own children.
      - labster 8y ago
        Lots of people seem to believe that non-nationals having children is the fundamental problem. We should all strive to ignore these people.
  - 8y ago
mtnGoat 8y ago
neither do the people that work at most of the cell phone stores(verizon, spring, etc)... i knew a couple guys that worked at them and they all were in cahoots to steal private photos from female owned cameras. and then shared them in a massive repo. this is why i dont let anyone touch my tech.
- jabberthemutt 8y ago
  Please blow that whistle loud and clear.
  - mtnGoat 8y ago
    one was/is a multi-state regional manager. these companies don't want this stuff to make the light of day, so even if you reported it, they would bury it. And I have no faith in law enforcement to do anything about it, they are not tech savvy enough to know where to begin. screwed up world. keep your privacy game tight!
    - gjs278 8y ago
      uh huh. I don't believe you. it would be trivial to name the company right now. and the police are not stupid, it would be exceedingly easy to investigate this.
      - bradknowles 8y ago
        Sorry, but I have to ask — why would they care?
      - mtnGoat 8y ago
        clearly you don't understand the incompetence of small town law enforcement, nor their gross lack of technical abilities and resources.
    - justinclift 8y ago
      Isn't there some kind of reward for whistleblowers in the US? eg % of the fines or something?
Drdrdrq 8y ago
As someone who has "nothing to hide", the prospect of such search is why I don't consider travelling to USA a possibility. Or at least not with my phone / laptop.
manicdee 8y ago
I’d be more surprised if anyone in customs/border security actually deleted the collected data. Deleting collected data would imply that they were competent and procedures were being followed, or that procedures exist.
BLKNSLVR 8y ago
There's unlikely to be any real control put on this, so assuming that this is "a new normal" we need to work out how best to deal with it. I found a couple of articles which cover some precautions but aren't quite "paranoid enough" (warning: both of these articles showed me full-paged ads): https://www.computerworld.com/article/3209648/android/the-paranoid-android-travelers-data-protection-checklist.html https://www.computerworld.com/article/3209648/android/the-pa... https://www.wired.com/2017/02/guide-getting-past-customs-digital-privacy-intact/ https://www.wired.com/2017/02/guide-getting-past-customs-dig... We need a nice, clean, to-the-point github readme style list. Off the top of my head: - Backup contents of device to two places, confirm both, delete it all from device - Record all personal accounts on the phone, make sure the login/email/passwords are known, then remove them all - Factory reset the device (if asked about why it's "blank", say that you bought it recently, specifically for the trip. Work out some reasonable excuse) - Create a throwaway account, set that up as the only account on the phone - Encrypt the device - Don't use biometric unlocks - Use a relatively simple passcode that isn't related to any of the ones you may regularly use (unless you already have a regularly used "burner" passcode) - Remove your local / home sim card before going through customs (if asked, you're planning to buy one that's local to the country you're visiting) - Any data that you may need to get back on to your phone once you're through customs should be made available somewhere online and accessible via credentials you can either remember or have stored elsewhere. Possibly through a chain of dependence such as remember the credentials to download the VPN config, then access further documents / details via the VPN. I fundamentally treat phones and laptops as disposable devices so that, if they're lost or stolen there should be minimal life impact. If they're the only store of photos of your kids precious milestones, then you're doing it wrong (you're also probably not someone suspicious, but in that case you shouldn't be subjected to government departments stealing said photos).
- justinclift 8y ago
  Perhaps "don't use your real phone" when traveling to the US? There's no telling what kind of APT's may be installed now or at a future date, so thinking a phone wipe of any kind will do the trick sounds risky. APT's are apparently commonly used with China, so doubt the US would be any different.
- 8y ago

rue 8y ago

Completely by accident. There was never any intent to mine that information, no sir.

isp 8y ago
Not wittingly.
- ggggtez 8y ago
  Perhaps, but perhaps not. If you've followed the news since 2001, you'll find that improper deletion of data is a theme that goes back a long time to the point where you should really question whether it's really an accident or the result of purposeful lack-of-enforcement of policy.
  - towelr34dy 8y ago
    I believe a factor in this is the incentives at play based on a mentality. The incentives are that if data is deleted, the person doing it can be in trouble for destroying it. The probability of getting in trouble for not deleting is low. This is based off of a mentality of: If we need the data and delete it, we (the gov) will have less power. If we don't delete it and need it, we will have more. I believe the flaw in this reasoning is not considering a 3rd possibility: We don't delete it, don't need it, but it falls into other (even less scrupulous hands) that can use it and gain power.
  - deogeo 8y ago
    I believe that was a reference to James Clapper's perjury: https://abcnews.go.com/US/americas-top-spy-james-clapper-made-mistake-lie/story?id=37003608 https://abcnews.go.com/US/americas-top-spy-james-clapper-mad...
    - ggggtez 8y ago
      One of many things, yes. Also, see any news story circa 2013 and the Edward Snowden leaks. In more recent and relevant histoy, the border security program is fairly well established to have been rolled out half-baked with the intention of making it a semi-legal limbo for all involved. So the idea that they are playing loose with the rules on purpose based on recommendations from the top seems warranted.

pleasecalllater 8y ago

What a surprise, right?

leibwiht 8y ago
I am absolutely SHOCKED, I did not expect this in a million years. Why would I ever have any reason to believe the government isn't telling me the truth? And, as a law-abiding citizen, I can't imagine what they'd even want with it anyway. This must have been an honest mistake.
- pleasecalllater 8y ago
  I think we should tell them that we are really sorry about all that. We should buy them flowers.

Zak 8y ago

The authority to conduct such searches should simply be removed. Border searches are nominally for the purpose of preventing the importation of something that's illegal to import, but it's trivial to transfer information that's illegal to import (e.g. child pornography) over the internet instead.

laken 8y ago
Border searches are nominally for the purpose of preventing the importation of something that's illegal to import _You_ can be illegal to import if you don't have authorization to work/visit/marry/etc. with your visa. Generally, that's what these phone searches are for -- if they think you're lying about the reason why you're visiting, they will search your phone's messages quite often. You see it all the time on the US CBP television program (can be found on Netflix).
- dawnerd 8y ago
  Suggested that show on here as well. The Canada and Australia variants are also a good watch.
- Zak 8y ago
  That's at least more realistically connected to a legitimate government purpose. It seems hugely invasive to be doing without a court order though.
  - pjc50 8y ago
    Lots of people seem to believe that non-nationals aren't owed due process, rights, or even access to their own children.
    - labster 8y ago
      Lots of people seem to believe that non-nationals having children is the fundamental problem. We should all strive to ignore these people.
- 8y ago

mtnGoat 8y ago

neither do the people that work at most of the cell phone stores(verizon, spring, etc)... i knew a couple guys that worked at them and they all were in cahoots to steal private photos from female owned cameras. and then shared them in a massive repo. this is why i dont let anyone touch my tech.

jabberthemutt 8y ago
Please blow that whistle loud and clear.
- mtnGoat 8y ago
  one was/is a multi-state regional manager. these companies don't want this stuff to make the light of day, so even if you reported it, they would bury it. And I have no faith in law enforcement to do anything about it, they are not tech savvy enough to know where to begin. screwed up world. keep your privacy game tight!
  - gjs278 8y ago
    uh huh. I don't believe you. it would be trivial to name the company right now. and the police are not stupid, it would be exceedingly easy to investigate this.
    - bradknowles 8y ago
      Sorry, but I have to ask — why would they care?
    - mtnGoat 8y ago
      clearly you don't understand the incompetence of small town law enforcement, nor their gross lack of technical abilities and resources.
  - justinclift 8y ago
    Isn't there some kind of reward for whistleblowers in the US? eg % of the fines or something?

Drdrdrq 8y ago

As someone who has "nothing to hide", the prospect of such search is why I don't consider travelling to USA a possibility. Or at least not with my phone / laptop.

manicdee 8y ago

I’d be more surprised if anyone in customs/border security actually deleted the collected data. Deleting collected data would imply that they were competent and procedures were being followed, or that procedures exist.

BLKNSLVR 8y ago

There's unlikely to be any real control put on this, so assuming that this is "a new normal" we need to work out how best to deal with it. I found a couple of articles which cover some precautions but aren't quite "paranoid enough" (warning: both of these articles showed me full-paged ads): https://www.computerworld.com/article/3209648/android/the-paranoid-android-travelers-data-protection-checklist.html https://www.computerworld.com/article/3209648/android/the-pa... https://www.wired.com/2017/02/guide-getting-past-customs-digital-privacy-intact/ https://www.wired.com/2017/02/guide-getting-past-customs-dig... We need a nice, clean, to-the-point github readme style list. Off the top of my head: - Backup contents of device to two places, confirm both, delete it all from device - Record all personal accounts on the phone, make sure the login/email/passwords are known, then remove them all - Factory reset the device (if asked about why it's "blank", say that you bought it recently, specifically for the trip. Work out some reasonable excuse) - Create a throwaway account, set that up as the only account on the phone - Encrypt the device - Don't use biometric unlocks - Use a relatively simple passcode that isn't related to any of the ones you may regularly use (unless you already have a regularly used "burner" passcode) - Remove your local / home sim card before going through customs (if asked, you're planning to buy one that's local to the country you're visiting) - Any data that you may need to get back on to your phone once you're through customs should be made available somewhere online and accessible via credentials you can either remember or have stored elsewhere. Possibly through a chain of dependence such as remember the credentials to download the VPN config, then access further documents / details via the VPN. I fundamentally treat phones and laptops as disposable devices so that, if they're lost or stolen there should be minimal life impact. If they're the only store of photos of your kids precious milestones, then you're doing it wrong (you're also probably not someone suspicious, but in that case you shouldn't be subjected to government departments stealing said photos).

justinclift 8y ago
Perhaps "don't use your real phone" when traveling to the US? There's no telling what kind of APT's may be installed now or at a future date, so thinking a phone wipe of any kind will do the trick sounds risky. APT's are apparently commonly used with China, so doubt the US would be any different.
8y ago